76fdd8189abd771c074fc6d6939884730103c1389d8880bac6d305e801c5f7d4

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2024 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76fdd8189abd771c074fc6d6939884730103c1389d8880bac6d305e801c5f7d4.exe
Size

387KB
MD5

6c63bf43d811f65e655164b03844a183
SHA1

6de9ddb73e2e4248a94903233fa087025cace6c4
SHA256

76fdd8189abd771c074fc6d6939884730103c1389d8880bac6d305e801c5f7d4
SHA512

7826912c227203f54231b05ba05a89ee0bcac732ff194bcfc2755ec7fd808f0b02feec07ba6c3e59e2d9fa67328eca1e4c9bf6e8a61c518bb7de83b68c4f72d4
SSDEEP

6144:S1vB5pjMchCIOEgHixuqjwszeXmpzKPJG9EeIMT:qAHiPjoPJG9EeIW

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glkmmefl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmhocd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgjljpkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhnlkfpp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggpbjkpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hncmmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpanan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqojclne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hglipp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbdjchgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppopjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oplfkeob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilibdmgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djhpgofm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbeapmll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkmdecbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afghneoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kiphjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obqanjdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmbfbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfagighf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niniei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpelhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obqanjdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbhgoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocmconhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkafmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpfbcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfcqpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jngbjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llnnmhfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oocddono.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oihagaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajaelc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhakoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iojbpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfnoqc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fofilp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhifomdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbkfbcpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knippe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhoipb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgfapd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohgoaehe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icnklbmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlikkkhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kqdaadln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdhbmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiknlagg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akccap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddgplado.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eopbnbhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnnbqnjn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhfppabl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifdonfka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpnjah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlbejloe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bboffejp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmpqfq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnmdme32.exe

Executes dropped EXE 64 IoCs

pid	Process
432	Mgkjhe32.exe
464	Nphhmj32.exe
3108	Pflplnlg.exe
3088	Pgllfp32.exe
1604	Anmjcieo.exe
2024	Aeiofcji.exe
3536	Bfabnjjp.exe
3836	Bganhm32.exe
3868	Bjddphlq.exe
2876	Cjinkg32.exe
5020	Cnnlaehj.exe
2548	Dmcibama.exe
3464	Dfnjafap.exe
1072	Eajeon32.exe
3640	Eopbnbhd.exe
3304	Edpgli32.exe
2284	Fddqghpd.exe
4220	Fhbimf32.exe
3880	Famjkl32.exe
4292	Gekcaj32.exe
364	Gadqlkep.exe
5004	Gfbibikg.exe
696	Hakgmjoh.exe
4356	Hkckeo32.exe
5044	Hgjljpkm.exe
3696	Hglipp32.exe
2248	Hhlejcpm.exe
2080	Hbdjchgn.exe
4608	Iohjlmeg.exe
904	Ifdonfka.exe
1184	Idjlpc32.exe
3656	Jeqbpb32.exe
2328	Jiaglp32.exe
1836	Jghabl32.exe
4004	Kihnmohm.exe
4148	Kpdboimg.exe
5064	Knippe32.exe
4216	Kfcdfbqo.exe
4028	Lpneegel.exe
2356	Lbnngbbn.exe
4548	Llipehgk.exe
1768	Mfaqhp32.exe
4584	Mhdjehhj.exe
4448	Mlbbkfoq.exe
2984	Nlglfe32.exe
3036	Nhnlkfpp.exe
2640	Niniei32.exe
4404	Nhbfff32.exe
2012	Nheble32.exe
4624	Ohgoaehe.exe
1056	Ocmconhk.exe
1416	Oocddono.exe
4108	Opemca32.exe
1592	Pgbbek32.exe
1656	Pfgogh32.exe
1908	Ppopjp32.exe
3020	Pflibgil.exe
5068	Qfpbmfdf.exe
3980	Qhakoa32.exe
4928	Ajqgidij.exe
3500	Afghneoo.exe
4884	Aihaoqlp.exe
3440	Aqaffn32.exe
3444	Biogppeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pfgogh32.exe	Pgbbek32.exe
File opened for modification	C:\Windows\SysWOW64\Ekjded32.exe	Dglkoeio.exe
File created	C:\Windows\SysWOW64\Ilccmqen.dll	Famjkl32.exe
File opened for modification	C:\Windows\SysWOW64\Hhlejcpm.exe	Hglipp32.exe
File opened for modification	C:\Windows\SysWOW64\Edeeci32.exe	Ekjded32.exe
File created	C:\Windows\SysWOW64\Iocmhlca.dll	Bboffejp.exe
File created	C:\Windows\SysWOW64\Jdedak32.exe	Jhndljll.exe
File opened for modification	C:\Windows\SysWOW64\Bjicdmmd.exe	Aleckinj.exe
File opened for modification	C:\Windows\SysWOW64\Kmdlffhj.exe	Kdigadjo.exe
File created	C:\Windows\SysWOW64\Ockdmmoj.exe	Ojcpdg32.exe
File created	C:\Windows\SysWOW64\Elfahb32.dll	Dalofi32.exe
File opened for modification	C:\Windows\SysWOW64\Dmdonkgc.exe	Dmbbhkjf.exe
File created	C:\Windows\SysWOW64\Dpgeee32.exe	Djhpgofm.exe
File created	C:\Windows\SysWOW64\Oondonie.dll	Ekjded32.exe
File opened for modification	C:\Windows\SysWOW64\Mhckcgpj.exe	Mjnnbk32.exe
File created	C:\Windows\SysWOW64\Pfagighf.exe	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Ikfbpdlg.dll	Dknnoofg.exe
File created	C:\Windows\SysWOW64\Fkcpql32.exe	Enopghee.exe
File opened for modification	C:\Windows\SysWOW64\Knbbep32.exe	Jnpfop32.exe
File created	C:\Windows\SysWOW64\Fmpqfq32.exe	Fmndpq32.exe
File opened for modification	C:\Windows\SysWOW64\Olfghg32.exe	Omegjomb.exe
File opened for modification	C:\Windows\SysWOW64\Hffken32.exe	Hfcnpn32.exe
File created	C:\Windows\SysWOW64\Ablmdkdf.dll	Kiphjo32.exe
File opened for modification	C:\Windows\SysWOW64\Ddhomdje.exe	Dgdncplk.exe
File created	C:\Windows\SysWOW64\Oifeab32.exe	Olbdhn32.exe
File created	C:\Windows\SysWOW64\Ljalni32.dll	Bopocbcq.exe
File created	C:\Windows\SysWOW64\Jjafok32.exe	Jjoiil32.exe
File created	C:\Windows\SysWOW64\Ejljgqdp.dll	Jjafok32.exe
File created	C:\Windows\SysWOW64\Eeeaodnk.dll	Lhqefjpo.exe
File opened for modification	C:\Windows\SysWOW64\Pbhgoh32.exe	Pfagighf.exe
File opened for modification	C:\Windows\SysWOW64\Qhakoa32.exe	Qfpbmfdf.exe
File created	C:\Windows\SysWOW64\Fdkpma32.exe	Fpmggb32.exe
File opened for modification	C:\Windows\SysWOW64\Bcddcbab.exe	Boflmdkk.exe
File created	C:\Windows\SysWOW64\Fpejlmcf.exe	Elgaeolp.exe
File created	C:\Windows\SysWOW64\Hlcjhkdp.exe	Hgfapd32.exe
File created	C:\Windows\SysWOW64\Kgnbdh32.exe	Kjjbjd32.exe
File opened for modification	C:\Windows\SysWOW64\Hhimhobl.exe	Hnphoj32.exe
File opened for modification	C:\Windows\SysWOW64\Egnajocq.exe	Ekgqennl.exe
File opened for modification	C:\Windows\SysWOW64\Cfcqpa32.exe	Cjmpkqqj.exe
File created	C:\Windows\SysWOW64\Oihagaji.exe	Oifeab32.exe
File opened for modification	C:\Windows\SysWOW64\Hblkjo32.exe	Hffken32.exe
File opened for modification	C:\Windows\SysWOW64\Kjpijpdg.exe	Kageaj32.exe
File created	C:\Windows\SysWOW64\Pjjfgb32.dll	Boflmdkk.exe
File created	C:\Windows\SysWOW64\Gcobmi32.dll	Fhbimf32.exe
File created	C:\Windows\SysWOW64\Cbeapmll.exe	Cfnqklgh.exe
File opened for modification	C:\Windows\SysWOW64\Fmikeaap.exe	Fpejlmcf.exe
File created	C:\Windows\SysWOW64\Lkalplel.exe	Lddgmbpb.exe
File opened for modification	C:\Windows\SysWOW64\Bnoknihb.exe	Bnmoijje.exe
File created	C:\Windows\SysWOW64\Eanmnefk.dll	Llodgnja.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Ckamjcad.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Kmkdjo32.dll	Nqmfdj32.exe
File created	C:\Windows\SysWOW64\Apjfbb32.dll	Llnnmhfe.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Cdpcal32.exe
File created	C:\Windows\SysWOW64\Glhimp32.exe	Gbpedjnb.exe
File created	C:\Windows\SysWOW64\Pbhgoh32.exe	Pfagighf.exe
File created	C:\Windows\SysWOW64\Fgqgfl32.exe	Fcbnpnme.exe
File opened for modification	C:\Windows\SysWOW64\Cjmpkqqj.exe	Cabomkll.exe
File created	C:\Windows\SysWOW64\Ggpbjkpl.exe	Gpcmga32.exe
File created	C:\Windows\SysWOW64\Edhjghdk.dll	Cnahdi32.exe
File opened for modification	C:\Windows\SysWOW64\Eecphp32.exe	Dbbffdlq.exe
File created	C:\Windows\SysWOW64\Gemkelcd.exe	Gfhndpol.exe
File opened for modification	C:\Windows\SysWOW64\Ilqoobdd.exe	Ibhkfm32.exe
File created	C:\Windows\SysWOW64\Nnafno32.exe	Nqmfdj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5904	6176	WerFault.exe	528

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bopocbcq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngjbaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddnfmqng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpimlfke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmmlla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmphaaln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhbimf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpcmga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihkjno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpgeee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffqhcq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljhnlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbgcih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkalplel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqbliicp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jghabl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opeiadfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnpofnhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfbibikg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opemca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfpell32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajaelc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggepalof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eifhdd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bohbhmfm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jngbjd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfcdfbqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eopbnbhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpanan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epndknin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifmqfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiphjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpfcdojl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iqklon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhdjehhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cofnik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcifkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmbbhkjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieidhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjnffjkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmpqfq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jllokajf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iohjlmeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpneegel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnphoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmhand32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kglmio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfgcakon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qebhhp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgflcifg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edopabqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olbdhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnifekmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njiegl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dikihe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idjlpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hncmmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icknfcol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fofilp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifomll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfkkqmiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbkfbcpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmcjpl32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnflfgji.dll"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmidnm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faikapbo.dll"	Alqjpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eifhdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fpimlfke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bojlop32.dll"	Gkmdecbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chlcgfff.dll"	Oanfen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqojclne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edaaccbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjmgbm32.dll"	Gclafmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egcpgp32.dll"	Mjnnbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kljibbol.dll"	Bcddcbab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjofoqdn.dll"	Hblkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfcjqc32.dll"	Komhll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glhimp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blqhpg32.dll"	Ngqagcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifffn32.dll"	Hnphoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajhapb32.dll"	Mhckcgpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbhildae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppopjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpcmga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icnklbmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdbnjdfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekjded32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	76fdd8189abd771c074fc6d6939884730103c1389d8880bac6d305e801c5f7d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idieem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acfhad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmdlffhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmlbhekk.dll"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohmnmmb.dll"	Aaldccip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfkkqmiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egbejk32.dll"	Hgjljpkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idjlpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oikmnf32.dll"	Fmikeaap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkmdecbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfibjl32.dll"	Gaebef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Famjkl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqaffn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbeojn32.dll"	Icnklbmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpimlfke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjafok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfmmaj32.dll"	Gpelhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncqlkemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hglipp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhlejcpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pflibgil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdffhl32.dll"	Ccnncgmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkcpql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpneegel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klkkgm32.dll"	Idieem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcpojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miongake.dll"	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bihice32.dll"	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obqanjdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjicdmmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjhhfnd.dll"	Bnmoijje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmcjpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qjiipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pafpga32.dll"	Qclmck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgnbdh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 432	3636	76fdd8189abd771c074fc6d6939884730103c1389d8880bac6d305e801c5f7d4.exe	87
PID 3636 wrote to memory of 432	3636	76fdd8189abd771c074fc6d6939884730103c1389d8880bac6d305e801c5f7d4.exe	87
PID 3636 wrote to memory of 432	3636	76fdd8189abd771c074fc6d6939884730103c1389d8880bac6d305e801c5f7d4.exe	87
PID 432 wrote to memory of 464	432	Mgkjhe32.exe	88
PID 432 wrote to memory of 464	432	Mgkjhe32.exe	88
PID 432 wrote to memory of 464	432	Mgkjhe32.exe	88
PID 464 wrote to memory of 3108	464	Nphhmj32.exe	89
PID 464 wrote to memory of 3108	464	Nphhmj32.exe	89
PID 464 wrote to memory of 3108	464	Nphhmj32.exe	89
PID 3108 wrote to memory of 3088	3108	Pflplnlg.exe	90
PID 3108 wrote to memory of 3088	3108	Pflplnlg.exe	90
PID 3108 wrote to memory of 3088	3108	Pflplnlg.exe	90
PID 3088 wrote to memory of 1604	3088	Pgllfp32.exe	91
PID 3088 wrote to memory of 1604	3088	Pgllfp32.exe	91
PID 3088 wrote to memory of 1604	3088	Pgllfp32.exe	91
PID 1604 wrote to memory of 2024	1604	Anmjcieo.exe	92
PID 1604 wrote to memory of 2024	1604	Anmjcieo.exe	92
PID 1604 wrote to memory of 2024	1604	Anmjcieo.exe	92
PID 2024 wrote to memory of 3536	2024	Aeiofcji.exe	93
PID 2024 wrote to memory of 3536	2024	Aeiofcji.exe	93
PID 2024 wrote to memory of 3536	2024	Aeiofcji.exe	93
PID 3536 wrote to memory of 3836	3536	Bfabnjjp.exe	94
PID 3536 wrote to memory of 3836	3536	Bfabnjjp.exe	94
PID 3536 wrote to memory of 3836	3536	Bfabnjjp.exe	94
PID 3836 wrote to memory of 3868	3836	Bganhm32.exe	95
PID 3836 wrote to memory of 3868	3836	Bganhm32.exe	95
PID 3836 wrote to memory of 3868	3836	Bganhm32.exe	95
PID 3868 wrote to memory of 2876	3868	Bjddphlq.exe	96
PID 3868 wrote to memory of 2876	3868	Bjddphlq.exe	96
PID 3868 wrote to memory of 2876	3868	Bjddphlq.exe	96
PID 2876 wrote to memory of 5020	2876	Cjinkg32.exe	97
PID 2876 wrote to memory of 5020	2876	Cjinkg32.exe	97
PID 2876 wrote to memory of 5020	2876	Cjinkg32.exe	97
PID 5020 wrote to memory of 2548	5020	Cnnlaehj.exe	98
PID 5020 wrote to memory of 2548	5020	Cnnlaehj.exe	98
PID 5020 wrote to memory of 2548	5020	Cnnlaehj.exe	98
PID 2548 wrote to memory of 3464	2548	Dmcibama.exe	99
PID 2548 wrote to memory of 3464	2548	Dmcibama.exe	99
PID 2548 wrote to memory of 3464	2548	Dmcibama.exe	99
PID 3464 wrote to memory of 1072	3464	Dfnjafap.exe	100
PID 3464 wrote to memory of 1072	3464	Dfnjafap.exe	100
PID 3464 wrote to memory of 1072	3464	Dfnjafap.exe	100
PID 1072 wrote to memory of 3640	1072	Eajeon32.exe	101
PID 1072 wrote to memory of 3640	1072	Eajeon32.exe	101
PID 1072 wrote to memory of 3640	1072	Eajeon32.exe	101
PID 3640 wrote to memory of 3304	3640	Eopbnbhd.exe	102
PID 3640 wrote to memory of 3304	3640	Eopbnbhd.exe	102
PID 3640 wrote to memory of 3304	3640	Eopbnbhd.exe	102
PID 3304 wrote to memory of 2284	3304	Edpgli32.exe	103
PID 3304 wrote to memory of 2284	3304	Edpgli32.exe	103
PID 3304 wrote to memory of 2284	3304	Edpgli32.exe	103
PID 2284 wrote to memory of 4220	2284	Fddqghpd.exe	104
PID 2284 wrote to memory of 4220	2284	Fddqghpd.exe	104
PID 2284 wrote to memory of 4220	2284	Fddqghpd.exe	104
PID 4220 wrote to memory of 3880	4220	Fhbimf32.exe	105
PID 4220 wrote to memory of 3880	4220	Fhbimf32.exe	105
PID 4220 wrote to memory of 3880	4220	Fhbimf32.exe	105
PID 3880 wrote to memory of 4292	3880	Famjkl32.exe	106
PID 3880 wrote to memory of 4292	3880	Famjkl32.exe	106
PID 3880 wrote to memory of 4292	3880	Famjkl32.exe	106
PID 4292 wrote to memory of 364	4292	Gekcaj32.exe	107
PID 4292 wrote to memory of 364	4292	Gekcaj32.exe	107
PID 4292 wrote to memory of 364	4292	Gekcaj32.exe	107
PID 364 wrote to memory of 5004	364	Gadqlkep.exe	364

C:\Users\Admin\AppData\Local\Temp\76fdd8189abd771c074fc6d6939884730103c1389d8880bac6d305e801c5f7d4.exe
"C:\Users\Admin\AppData\Local\Temp\76fdd8189abd771c074fc6d6939884730103c1389d8880bac6d305e801c5f7d4.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\Mgkjhe32.exe
  C:\Windows\system32\Mgkjhe32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\Nphhmj32.exe
    C:\Windows\system32\Nphhmj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\SysWOW64\Pflplnlg.exe
      C:\Windows\system32\Pflplnlg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3088
      - C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Edpgli32.exe
        
        C:\Windows\system32\Edpgli32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SysWOW64\Fhbimf32.exe
        
        C:\Windows\system32\Fhbimf32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:364
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        24⤵
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        25⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2248
        
        C:\Windows\SysWOW64\Hbdjchgn.exe
        
        C:\Windows\system32\Hbdjchgn.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2080
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:904
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        33⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        34⤵
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        36⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        37⤵
        Executes dropped EXE
        
        PID:4148
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4216
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4028
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        41⤵
        Executes dropped EXE
        
        PID:2356
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        42⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        43⤵
        Executes dropped EXE
        
        PID:1768
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4584
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        45⤵
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        46⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3036
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2640
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        49⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        50⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4108
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        56⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1908
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5068
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        61⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        63⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3440
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        65⤵
        Executes dropped EXE
        
        PID:3444
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        66⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        67⤵
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        68⤵
        Drops file in System32 directory
        
        PID:5100
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        69⤵
        Drops file in System32 directory
        
        PID:1804
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2588
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        71⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        73⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2252
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        76⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        77⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        78⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        80⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        81⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        82⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        83⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        84⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        87⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        88⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        89⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        91⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        92⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        95⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        96⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        97⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        98⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        99⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        100⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        101⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        102⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        103⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        104⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        106⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5664
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        109⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        110⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        111⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6052
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        113⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        114⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        117⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        118⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        120⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        124⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        125⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        126⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        127⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        128⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        129⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        130⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        131⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        133⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        134⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        135⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        136⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        137⤵
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        138⤵
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        139⤵
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        140⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        142⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        143⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        144⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        145⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6860
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        148⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        149⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        151⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        154⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        155⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        156⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        158⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        159⤵
        Drops file in System32 directory
        
        PID:400
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        160⤵
        Drops file in System32 directory
        
        PID:2936
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        161⤵
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        162⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        165⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        166⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        167⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        168⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        169⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        171⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        173⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1632
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        175⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        176⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        177⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        178⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        179⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        182⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        183⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        184⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        185⤵
        Drops file in System32 directory
        
        PID:928
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        186⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        187⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        188⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        189⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1460
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        192⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        193⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        195⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        196⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        197⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        198⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        199⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        200⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        201⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        203⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        204⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:7344
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        206⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        207⤵
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        208⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        209⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        210⤵
        Modifies registry class
        
        PID:7584
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        211⤵
        Drops file in System32 directory
        
        PID:7624
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        212⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        213⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        214⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        215⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7828
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        217⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        218⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        219⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        220⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        221⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        222⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        223⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7228
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        225⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        226⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        227⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        229⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        230⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        232⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        233⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:7952
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        235⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        236⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1080
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        238⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        239⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:1496
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        241⤵
        Drops file in System32 directory
        
        PID:7500
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        242⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        243⤵
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        244⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        245⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        246⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7852
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        247⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        248⤵
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        249⤵
        System Location Discovery: System Language Discovery
        
        PID:8096
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        250⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        251⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        252⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        253⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        254⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        255⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7732
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        258⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        259⤵
        Drops file in System32 directory
        
        PID:2368
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        260⤵
        Drops file in System32 directory
        
        PID:3640
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        261⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        262⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:752
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        264⤵
        System Location Discovery: System Language Discovery
        
        PID:1324
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7844
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        266⤵
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        267⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:8060
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        269⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        270⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7484
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        272⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        274⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        275⤵
        Modifies registry class
        
        PID:416
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        276⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        278⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2192
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        280⤵
        Drops file in System32 directory
        
        PID:4156
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        281⤵
        Modifies registry class
        
        PID:4348
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        282⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7780
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        284⤵
        Drops file in System32 directory
        
        PID:3000
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        285⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3540
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        287⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5084
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        291⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        292⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        293⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        295⤵
        Drops file in System32 directory
        
        PID:4648
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        296⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        297⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        298⤵
        Modifies registry class
        
        PID:3616
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        299⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        300⤵
        Modifies registry class
        
        PID:1312
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1076
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        302⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        303⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        304⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:964
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        306⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        308⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        309⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2328
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        311⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        312⤵
        Modifies registry class
        
        PID:4220
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        313⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        314⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        315⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        316⤵
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        317⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        318⤵
        Modifies registry class
        
        PID:1908
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        319⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4856
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        321⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        322⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        323⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        324⤵
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        325⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        326⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        327⤵
        Drops file in System32 directory
        
        PID:3188
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        328⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        329⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        330⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        331⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        332⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        333⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        334⤵
        Drops file in System32 directory
        
        PID:3440
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        335⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        336⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        337⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        338⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        339⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        340⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        342⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2776
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        344⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        345⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        346⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        347⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        348⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        349⤵
        Drops file in System32 directory
        
        PID:3980
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        350⤵
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        351⤵
        Modifies registry class
        
        PID:1012
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5476
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        353⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        354⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        355⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        356⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        357⤵
        System Location Discovery: System Language Discovery
        
        PID:8328
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8404
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        359⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        360⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        361⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8624
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8680
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        364⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        365⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8844
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        367⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8944
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        369⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9076
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        371⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        372⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        373⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        374⤵
        Drops file in System32 directory
        
        PID:8240
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8296
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        376⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        377⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        378⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8480
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        379⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        380⤵
        System Location Discovery: System Language Discovery
        
        PID:8604
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        381⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8720
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        382⤵
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        383⤵
        
        PID:688
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        384⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        385⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        386⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        387⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        388⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        389⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        390⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        391⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        392⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        394⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8448
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8484
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        397⤵
        System Location Discovery: System Language Discovery
        
        PID:8548
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        398⤵
        System Location Discovery: System Language Discovery
        
        PID:8632
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        399⤵
        Modifies registry class
        
        PID:8712
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        400⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        401⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        402⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9024
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        404⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9132
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        406⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        407⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        408⤵
        Modifies registry class
        
        PID:8244
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        409⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        411⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        412⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        413⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        414⤵
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        415⤵
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        416⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        417⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        418⤵
        Drops file in System32 directory
        
        PID:8984
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        419⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        420⤵
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        421⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        422⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        423⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        424⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        425⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        426⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8676
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        428⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        429⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        430⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        431⤵
        System Location Discovery: System Language Discovery
        
        PID:7004
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        432⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        433⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 400
        434⤵
        Program crash
        
        PID:5904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6176 -ip 6176
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
387KB

MD5
d725f73ab17862642396f8b40a9b2a51

SHA1
768920e21410998ba3c22cc00d015c5259e9fa21

SHA256
f0f68bd78f82cac54bd10a26ac9f66543a02e75c9934a2857313bf690f23bc55

SHA512
0def9bb314d6c167fb4a1ff0b9d76c28e6a235ea19496618a95b596d41b7c8f76cf790a218c2ecec92926f72e948cd8a1af28997bb60f98e838ebb064ef54de7

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
387KB

MD5
7ae3c8a3d442f65850bcc05d33780de0

SHA1
751ab69227f06b4429ffe7ad3adcb6b0375a0ae0

SHA256
833fa324b3cd0d0630498541de3d050e24dc52fc2ed756ac33e8f186df0d3860

SHA512
07a5e81121450a480f1d65c679fe34a2e78229a3c3e3e44c0d24cefbf75ee247283cbdeb79c1762cbd5dc57d44e5e9201be0457409416cae43aed2a4421b9adf

Download Submit
C:\Windows\SysWOW64\Aqaffn32.exe

Filesize
387KB

MD5
83cf784ab741bfd499070dcd8ff31881

SHA1
16b1db4d721a82cabd6736925a20802bafca873b

SHA256
e791e7727b531445a2ba2a6a71bde54ac5ac17433bb206a76f179072e3aa894a

SHA512
54af4e39f2dfa3bcc6816585009de24024af6682b472bc7f72bf108174c58ad6f38de88038e7725e3d2624ac83d48e8d007e4f506cc5576e65181e7a7d9152d1

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
387KB

MD5
933bc5b713142ed77923fe9d7a43b928

SHA1
666b9f972d8cd11e925ade4df00268b36c952efe

SHA256
b6f43e9f97c8e1e60a1265adf532263fdffc773f436364a2416daaaee7da99e4

SHA512
79910bbe7395d6a147be12c614d6b63afd96bf05fd88a08f4ea452abdc7bf60279f156a21b51d7ad6ed70e25c14980852982e49235fd4849c5dafe25daadc4e9

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
387KB

MD5
f70e45c0bada051addab13f39d6946b8

SHA1
55008f77b74aff82887424b5e7e52607e8191124

SHA256
e801008bc6843ecb907c60c2e422d39a1f380686c5775e66d8c997a745361423

SHA512
78aa21eebad4961dfbaab7d1b27febfa9dc97e909a8744d84b91eec38c6a557d699dac6bfe908f4fc8af92e469e082ba2a797a445ebddbda604fe845c31e72d0

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
387KB

MD5
e6d6a6e43ee21837647be1a1dbc6fe1a

SHA1
07017a8c13dbc34db54b617b081f13726adf852c

SHA256
2a901eaee0d1a728915a24704dbdf2e085c4b3a946b1332935fe848ef6b9f135

SHA512
a4e15db7c14990d3c0216166469b5257a46b12a61595be97d87cab1d207dc09d60243b639a08c3329959543c223d906710173849ff4a4ff0c1da23aa553a2c5d

Download Submit
C:\Windows\SysWOW64\Bnmoijje.exe

Filesize
387KB

MD5
c175db34351371f84896df94ef5ba13a

SHA1
ce65a1c26114d01eba45194f08259edc783093db

SHA256
263fd5965c29f4d04ad02b39a8a926a2d3cddfe0a635ecae5e7fb094318d9299

SHA512
f664434aeec56ce1ce7b257019e80aef7b4573c00c235751c3f50c7ffbc6a211dea238b2c345e3b1aa3466338248fdd059fc637a37f220ec3a5e4e1139f7d930

Download Submit
C:\Windows\SysWOW64\Bpkdjofm.exe

Filesize
387KB

MD5
d8548fe2115f4a99c21ed1931bda23ab

SHA1
affa1d15eb2625badb505a3cdc60b6a2f11cf7b5

SHA256
7dfaf54b8c7f049ae2638cc6b76d6210e251f260444f8b0e3e06418a18f3a92b

SHA512
701e4e7a4c7323c8e2f597645a505df37e7786b7166889e16f617f84595ca63bbd2bff963e92f6b22873bf9cffd54f9d1daa3aff6149edaa043e4b05c4a1476b

Download Submit
C:\Windows\SysWOW64\Cbeapmll.exe

Filesize
387KB

MD5
ed43d6f10f92b151066683dc72d047e7

SHA1
082c55dd543760d22d02363a949f86aa72cef5e4

SHA256
66562990657fbc0d97199ca20e81ff4f733eba57a4417b8cc166e12ca1b57aeb

SHA512
9f9cb8d514df2a1d3c375fa71bd7a25b406ff96fdcaf4b12b4e080ed78c039b502e3b561874d26983ad6950674976118f4143b3feed8dced022cf368148ae41e

Download Submit
C:\Windows\SysWOW64\Cbkfbcpb.exe

Filesize
387KB

MD5
0452a144f2beeaa999d81b578d3868a7

SHA1
ada68049ace29eadcc9322a7dd9a0cc0e637e47a

SHA256
00f8b31b947c19be7eca987c74dc4135b9f44b6274f54df6ec2055022d2db7e3

SHA512
8392d6d13c31c5f089964ad7f0f788f283967bd4469251b6889aba4ea5c9a53ffcbecef1f2223d4c5f60e98358aeb8167a93c99be07c9372253b369f40244b06

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
387KB

MD5
ed92548a751831570170259000f42fb6

SHA1
fbcd0acd86968a65c76a050e01e1e40e5dcbd6cc

SHA256
e3dc0611f5be68586ab0f7d72ca145fa63416f3dd4ed133ccff78efe2900aa4c

SHA512
ef450975588df24995a10c32edfc9f720538b46d4d962cff8f35841f6bf243a0661dd58ed51384a2e955362f2a8bf45626c2d7b2a10381b6fa02da4d89a6b22e

Download Submit
C:\Windows\SysWOW64\Cleegp32.exe

Filesize
387KB

MD5
b8ae5b92a925b4a7cf4ae4a34de5559f

SHA1
34905dd66356dd63f10de403fb34c5d2eb61b9b3

SHA256
ae5bd64e97bce6ed0069f28a0abce6d8ae7d7f387ab9e063fe0a3a14b73d6214

SHA512
c3ec71aa4ba155fbf32abc383117b9656115594679c6f01a4b8ce555738174155eba5960d86908e3df42b76d451ecc7d369f4a524ff3e66d923e7f815dd5c485

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
387KB

MD5
fca9df5233b5dbc757cca91439cd4792

SHA1
a7cb413b2f38c9138cf45f104f651cf2f5ee4f62

SHA256
52aaea7c52640d6700a31b2a9305017cf0fedb04b93ab2ca3a778eeeeb7e933b

SHA512
2e2b56313067b6b7550212b74b51e4670770663b543039fdc27cf0f290316cd5f213f5d448b81f1d6001d863d450bbccbdc65b16ff33934a3785c207467ef5f8

Download Submit
C:\Windows\SysWOW64\Coknoaic.exe

Filesize
387KB

MD5
a9e6d5bdac38191e97bb50d0cc292357

SHA1
b22e387450e15d7e4bba05f20d077ac2a4d0ffee

SHA256
a209c88568571e8ae3766ed5324b64c7e6d3c224cfaea2e6480c2fac2c875f73

SHA512
525573ccae51af12ad8f3a8dd5c0ef0b00540e8ef218b412bf5a4dea244c943c5aefacfb21ee586262e4a24e3a505c5d373efa45ad9e377ea6d1d0229b5ce55b

Download Submit
C:\Windows\SysWOW64\Dalofi32.exe

Filesize
387KB

MD5
8452e7f5fb8568adcfe89134195fde8c

SHA1
93cb2cc4432d5a95cb36b153fa94f27ab7c41b95

SHA256
24094588f2d2d35ae0becf1116448c4e9669c20cd8e02dd6f69dafb61588fb85

SHA512
7e56f4c8f483cd5a7330ac2185cf229fae610c4e76c5e3d0e295e370fa4789287fc94bc0f1a0784c0437870d95bfd06d743b0da87aa443b72e37e844ba4b92f0

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
387KB

MD5
7ad06bf8dc52f576a8b630e8a34b38c4

SHA1
df9593e80509d143f125a871afdf89df15e3e28e

SHA256
503d02c4de6012c5b447c2499e18b6668ff6256b5f2ff888c8f20febd93b2784

SHA512
e8bba7228f042dc6273e163edc0c0fb4682b5f0160450c789564d1e234bd4056aedd9dcc66efcc95a4c89a1ad44ee390aa3115b44f0ef57109959511607b789c

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
387KB

MD5
c0c7624f02c08b581520122f686f410f

SHA1
a267f0d055365b49f2d3b20299e10524c63c676e

SHA256
bbf10cc7cd8a0f48ec124c452a3e24921d290ef7ce6def21104d5541389a8747

SHA512
48a0acf1f302daf9e17d09669be839c6c1491a1419cbc63631c13276792c3fbe74ef3e2e18398253c4f7892ca38d01722ab054f955e9070be45805534727e29d

Download Submit
C:\Windows\SysWOW64\Dglkoeio.exe

Filesize
387KB

MD5
7b2900f9d485b0547c420d7a17c4757d

SHA1
61e92a4c9bbf0d353c53477503f8d57d3c964ace

SHA256
41bf2abb140fe92c201e3cc2ffd1156468b86a0b3193b89484241238d3af78d1

SHA512
83217ad774cf1bae953c7e9c7b4bc42ec54100f2d1e67b3a885c5311d72f8dbff05e818fd9428d1994679912d052cb434c51ac20c0c2f51abd18aab217603a60

Download Submit
C:\Windows\SysWOW64\Dheibpje.exe

Filesize
387KB

MD5
e83155c4601d52b496c5750fb76c8602

SHA1
e6e3d8cd35002af490b1aa599eca7418017e08f1

SHA256
0f131a1ae914509b144b1d6108e839e5106bc275a6761d5efec835cfd6f04f4e

SHA512
7a2165dee2e375c686a34ec1791cc3543c5ab991a6f2cce1dbd2502c77b8ab94aafd9619fc32a9f9fe1395c960ebe22733dc20f942ff81e9ddd97a7756c51c0d

Download Submit
C:\Windows\SysWOW64\Dkdliame.exe

Filesize
387KB

MD5
f023c17e5593df20ece6c50ff5d78acb

SHA1
00554d1e1c9a861d6c569f137bc4ed67906a2bb2

SHA256
b2c8ecc3236ce5dff7b05cdb00060c69d480306c600c1d8237d995107feab4c0

SHA512
5186b0db0e52b0073916d8bc5b0e9ef1bb6c8f23d0dab76577d4ef55a869f08604c446c2a8e0c5c185ce094c094cac730d154d25b2401b5e5290c83ee63fb8a5

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
387KB

MD5
2b252a832cb44b2b7cfd803bf9a1eb91

SHA1
2350aaa1cc7254b455f9c69727c81fcff6432519

SHA256
aea38ec12f89f90ccdf35c32319b945933fdfede285229bff6072b50ff886a9e

SHA512
6318376d7a4fd4850463037f6d784c9621edaa8497563cc844a27b69ca16fa50f62a42993162e89e5662ec7b81c1155aad4d56b9c86d693758bb22cc30e214b7

Download Submit
C:\Windows\SysWOW64\Eajeon32.exe

Filesize
387KB

MD5
3777a71d81ffbeb3e4e5447f589566c9

SHA1
adc43ded0416a96275488a77572890e8f5f20b2b

SHA256
939713d399958bafd44da2b706db5e47039ce5c9d0e308d5f4722a9f3a86aab6

SHA512
5aa3ce10ae0b3ebf47ca2842f73483a85bd6bec16eb1d061e996a24f0dff21f638da2b1866e21b80893ec772b7deaf73ffc02c338e448b022454b0145b6e9cff

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
387KB

MD5
bfe262288246a6f12b950e1d2750ea92

SHA1
de617f9b5e3cc4989150dae68736973a050adcb0

SHA256
b05a5d7f78d6b54cb5af523a8c82ed289c2cfff4242b0e00fa48d0681d3dcece

SHA512
85c2d16d404fd66d4b15779a557acfd58abf38c5e50f1df511178fc6c1c6ff9cb98fea6ebec17ce8959d65700803909e70cd0b97883393b7ca264e268db99619

Download Submit
C:\Windows\SysWOW64\Edpgli32.exe

Filesize
387KB

MD5
964a9c6ec1e97671c262507ab299f2f7

SHA1
85cf0be13bd4926c0eb9d9127e936dd1709df565

SHA256
06ccb8eef8d82a41683e3d97de96cf7f22715b041c2645a1db4b6d9a048b70c3

SHA512
2f3fa31e58537f16daa298f391cf85161c8a14a638587500dde9b058c3466b1712057cce58e9067d56996da7dbf55befc7db9c5828743fb1918c0c595d8669d4

Download Submit
C:\Windows\SysWOW64\Efeihb32.exe

Filesize
387KB

MD5
6dc0b101b107c25a08723b39244405f0

SHA1
66284d42688b2328a26453bd7eea931a86bb4006

SHA256
b0c97533a822e90e9e362ba3f10d2c8ac6c966b8681396c2841eea7e64da5b48

SHA512
8ff3319ade420f460e7916ba65c59e88b5a2e5395361964c18aed2a4510ec4d68f66b51403eafd3fac2692985f29cf643a6a8202fad0e400e86af87e8a5fb3a2

Download Submit
C:\Windows\SysWOW64\Elgaeolp.exe

Filesize
387KB

MD5
e666bed2acdeecd8e939d7c862f18e4f

SHA1
ebc11d48328a8f87cdc20662e75e9a8fb4000845

SHA256
e1e40d7bfef1e54ae35bbabb9714e259018878e6f63289379f250b9f675baa10

SHA512
976ee58a237803f7a8b5b19c33b2be3ae85384543727c2bc2c2db599b56904e750adb81b28583f9e7ddd1f436db5f30c83dd25cc9c73befa2483c1b49d9471e1

Download Submit
C:\Windows\SysWOW64\Eopbnbhd.exe

Filesize
387KB

MD5
4dfac9977fbf95ef893113fc7c7bcc94

SHA1
547861123802af46d6c28157cf416e8630a4789e

SHA256
70bdd419bb010449bbcb1e69fb1869565e358fb645eaa29af938f426b872512d

SHA512
8bb35fe1d80b7a529eb31d39d1e710fed33decadf37e122d18917599b500387998bd14084e1cf91456fa7295b3776a36a8c2977e099a1ff5fde9d6e23a149bc7

Download Submit
C:\Windows\SysWOW64\Famjkl32.exe

Filesize
387KB

MD5
013e569cc747eb96ef3d906d44b8dbd4

SHA1
2f41d5d4a818769b2f64d853f1e2f8dfe00126ac

SHA256
61b719886204d11b570bdd4194fe4ef18021492b586e94e7c01cb904304069df

SHA512
3ee2b3d2d80e4404e6aba00b20719fa4b206115b78ddc5137fe78289470b68759638cc714ba4712bddbb7eb77243c62bf411de5df2fe57a214a8e7e3cab96922

Download Submit
C:\Windows\SysWOW64\Fddqghpd.exe

Filesize
387KB

MD5
f48d5d5d4c806c511d800f870b383910

SHA1
d868e655ab167ac366c8d14fd836dcb75c8fc4a6

SHA256
8c93cec21ed3ff78e2c3664d629270902267ae3ca8692ecdedb38605feab521a

SHA512
c74a95f2949bfba9a651a99aefac3035ca8d7ae3dafd787b4d996531927fad0134d4606452dc06ddaf3e2e22d9a323c8b01132c7c95d35910d196c7033f9c481

Download Submit
C:\Windows\SysWOW64\Fgqgfl32.exe

Filesize
387KB

MD5
9cf3b1f6d4980b7430822e5fd1f8c22b

SHA1
79e6cea589b63dd770be244b2b218848c596155b

SHA256
7badd5e1457e11bd250e8e9147cf62e2abdc712892554bea505ba7ad99e63825

SHA512
ff17b4781f4b5cd969bba6a4ddef2a2b007b6e688abe3c0772aedeab441583d2c098d145e2c7637e7665120af03f353107e5d3e1030a11f5498b07b9fe3ffe62

Download Submit
C:\Windows\SysWOW64\Fhbimf32.exe

Filesize
387KB

MD5
9ab3407136bf24054e63c0d7d8ff406e

SHA1
e5a188b913545836fe839898ed919a23c280a794

SHA256
076e3f7466f0205d8b19d896c0453aab46ecadbbfbbef6b70b953aa36531ba6a

SHA512
9346fc1879e5e058156a0771d68e20689736e55f166585cec7b7d8c98c0894b7a96b4a39e062ccde36f0d30e19f980959fb42af59e8cd2ebba815bc7cd9b9614

Download Submit
C:\Windows\SysWOW64\Fmkgkapm.exe

Filesize
387KB

MD5
46db2c56f0e5aa80b689f6341230e062

SHA1
05b448cfb11fac86546212581c0857405aa3d2fe

SHA256
a9d336cfde85b5a7ec9d091e96277e29d1a3091c39290a6c9152944f40285ce3

SHA512
672ac042e074343d8ca9444a9f029f99ff007d4bc0812bf8cb1c1876207708d12b03c7a45e3168aaeb96b964e47041dc2d9a06549460bd0b343ae9bca7fa9195

Download Submit
C:\Windows\SysWOW64\Fmmmfj32.exe

Filesize
387KB

MD5
78ce4f5119fb320b179036847e4f8062

SHA1
8933a6488b1a370fb0c1c7f082638b6491768724

SHA256
9d81c6db1a640ef17db58d6f5b93d65557ae8694ac049292f101f03bfec5feb0

SHA512
b35bff2340a84627dadfc0b0f0432ab7bcb68dc494979c3095f1c7afc7f0a78d056b691983642fcf2f29451d534065b830275f4daadff330dcbaa19056f92576

Download Submit
C:\Windows\SysWOW64\Fohfbpgi.exe

Filesize
387KB

MD5
993a828a32e9d420f08c42127ec7b197

SHA1
c254b45d85d6a6d510855f973b80e7b0ed18a0e6

SHA256
fcdb43939539cde228c4eb99b519b76aa4087d0899ddb4c0ee0097570209b50b

SHA512
948f6cd0721a55ad6408e77c8df8f21334efa5c8574bb39a7c8a2341cf6c9044d7f7f35176d44568a67512fea8fa39b33fc15a7b97bcba7e5e90ddf6fbf870d6

Download Submit
C:\Windows\SysWOW64\Gadqlkep.exe

Filesize
387KB

MD5
4fa579b7535ae0fcf79522726ebcfdba

SHA1
c3d29fb9f99471b5f5a227a5c9fc4497ac2cfaad

SHA256
09b53bd07dc766a4f368673b8975e80577e74bb56950e04f184d769ac937bea5

SHA512
4a580084c9bce06bc421fa4f0639337629905deaa00072bd782e33ad7b383d8b26e39d1746e6799bb761fd689cabf96356ed05cc5e3529a273c7929da7c67d11

Download Submit
C:\Windows\SysWOW64\Gekcaj32.exe

Filesize
387KB

MD5
9f18f35bec757116f582278a6384d7fa

SHA1
cbb906b27262883b37d0ff77dd56f7e8f53e1e2d

SHA256
7172f9ced650539669b04b3b624020b7adbae09df57e196feba0c1125ff2a8ad

SHA512
977c54a8cf8e306b171a3dfd65e7c84b87ede2657c414da2c35817feb2201f86d8d1b359abc2ce5eb756f863f6351c25d024f25b742a3a781c5fd6bcd5fcf59a

Download Submit
C:\Windows\SysWOW64\Gfbibikg.exe

Filesize
387KB

MD5
faf1d061666e7ecb77ff8239a22f1c9b

SHA1
4613b6f16e8983a84b2bff1386d17cb055638116

SHA256
76340a9847f4f3c68f27282e7e1b51b470b0b70bc6caafd58580138f53d30ce9

SHA512
5ee0fbc40c18445372c96ba8b713edcb02d11b06c9ebfbba996b119f53446af16f0e4c94621cd3ad42758a74b778acbc50b798be61928155016f6fd0120bad57

Download Submit
C:\Windows\SysWOW64\Gkmdecbg.exe

Filesize
387KB

MD5
0ff1a114c601103c12c93d96b1330a87

SHA1
7d371f3daf2494ffb73f62e74580a5d4a97d0ebf

SHA256
bd89c85b1ab4e14e020bf2a24b0248347c700ad7d02199d88fe09b287354ac96

SHA512
40d7551084746ed00aea49f89bccb4688409a4d7cef417f4a1d9c9410b0dbe8b3a08cc9b96cc90e37c02f53ca42e895f744990e725f1423b646568608cc0a396

Download Submit
C:\Windows\SysWOW64\Hakgmjoh.exe

Filesize
387KB

MD5
b5a482a3813ed9fde7e0de9be6edbfb8

SHA1
825c1337a6d052a93a2f0ae8ae5fbd9d66e686c7

SHA256
32b6eb5309f1605a2488ab6c49dbbf578fea1ada6879cfb82d708493fc9cf0d4

SHA512
aa0ac461f47bf321b920dd78344b9b8178c543e4042a20022cea893571f1d1800075cc43360349c3ed317b07da3db4e188e5fce423d3aed44b98dad891ea630c

Download Submit
C:\Windows\SysWOW64\Hbdjchgn.exe

Filesize
387KB

MD5
c82f1e29bd559a1b979629332258431b

SHA1
9748e107bd12c632bd552d459d472c8e9735db79

SHA256
76faff6c313074f15804fd4f1d23c8a132d6e599366291e7008d62338284209b

SHA512
3c120918267be097aa00b81206340ae7f63c51389feeead70b4e6d7f418a5b1404b115adcd46db12bf2d083f14b2e0cf225a2198f1bc059a55d03aba81c4695e

Download Submit
C:\Windows\SysWOW64\Hgjljpkm.exe

Filesize
387KB

MD5
dba3ecd2387f1914a766037d243b7ef5

SHA1
e5b16d06e9557bb25be01472d2ce5e642c54957f

SHA256
6a050b8fef8fe200246c4b6a227797ca8985572ef21f6b68480bef0e1e64fa67

SHA512
f107f9b6add74adb8ce613be5ee3ddf9564aad651c4d4b98bacbbc8940aca64d64b3a382443e0bdf9fa5f303c89f75cb3e593de4ac786b512c93b429115e8247

Download Submit
C:\Windows\SysWOW64\Hglipp32.exe

Filesize
387KB

MD5
9ca9a8b0a421d094e2391b7b551bf3cc

SHA1
323d9580dfe40ef1a42f1fc55237afe0ad5cd3d1

SHA256
efded68889bd36839bf0254bddab66ff7803ae8bfe83505e0214992ff9fa7e33

SHA512
f37287ff014eadccf27e8bc729a10dc0b46b5f8ac37d6d3c2dd680821b4db79a40e86bc7291463c2f13e48a2303743c72347c9147efcbe0d037d404cdb4ccc7a

Download Submit
C:\Windows\SysWOW64\Hhlejcpm.exe

Filesize
387KB

MD5
ca1ea5f7b7ce1c03c99e4a9acdf7e44f

SHA1
a8b7cbcc30cf8091e35ab86aa8dd2f975bc2bdf2

SHA256
bd0e5c28588c14c5d44dcb7faefbb3ba685e4be0f9d11d4ff808558a661867f8

SHA512
06d0f4fad5680e434288ea17c6e5c6bd2d219dab653f36bd610dc078cb0492e0bddb8641aeb3b34642b04a8e2398aaa1b39e1b1abc24ebc650ddb41a4a41e389

Download Submit
C:\Windows\SysWOW64\Hjchaf32.exe

Filesize
387KB

MD5
8f766c1dfdc52a200202dabe9a52ba6b

SHA1
05129696223aefb9b2be12eb6c85e0d9bdac11e7

SHA256
76adf3602e0ba69909778cd894d7c606802534b0454b0c7db4e6d13cf4f32486

SHA512
d17177673b6ed04f36a681c643933ad1c30dab3ec8d2dc8997789d3460ec78098c0b7d332fe46b1a6da7da6ea50592aea720c86611915fd43e0b2e35661c6762

Download Submit
C:\Windows\SysWOW64\Hkckeo32.exe

Filesize
387KB

MD5
346112358788825253437857f695e397

SHA1
59f0cb457e101e529fe08677d2559c3e6e4f5ac2

SHA256
3d40c9cfcd6611e35f7c83746dfaf9633790bb91cb3a62c9bdbc1cff0258fb20

SHA512
78799eda2711139f3539426f70cea0439e1a9a5971d1b769e2ca3085e6035b8618e4e078793cbaa9a44be31b8a8e7747ee68d0e33c89790d29d49fb48ea7a399

Download Submit
C:\Windows\SysWOW64\Hpfcdojl.exe

Filesize
387KB

MD5
deacfdd5c93535f3b99549a58ba17016

SHA1
af5a1d528b14bed14ae059d912c7232787565560

SHA256
0ba3486e3e7c23ec6beb169eb3e53f1e129dd92bc191b7a3bf4fb0c3763f54c5

SHA512
611c5a8fae2766ff21c1e233cae6d40a6dfeba77cef0ed6eb9454c79835bb7b5d6d2eeb8ed4be1dcbc3677b96c179cbfe026ee3dbb5a4b603bd53ed5fbf3b421

Download Submit
C:\Windows\SysWOW64\Idjlpc32.exe

Filesize
387KB

MD5
b30c072eba43a20032b95e11fcb4da36

SHA1
00fe727c9a0fd00569e1281a012eac6b7e4dfafc

SHA256
c8925cfa85dd404f80a7f9f79c3b460247423ca7428614a6d1d6e65b5b985f23

SHA512
1de4bb6fc1c65d26e68c4016b2d118d8cfc376f9213f40dfcdaa742d65b517a2f052dbbf24c06a70a3d77703af22be38b7b968429e7b94e9c6a3025c331eff35

Download Submit
C:\Windows\SysWOW64\Ifdonfka.exe

Filesize
387KB

MD5
9171ed81325cd5b67bd3f9a378d15089

SHA1
48c9103496374c4b73d2a7bce8b158ae6472dc5b

SHA256
5d34f563f43e51ef0cbf420857d943d53fee21cdfc9519b932c33e354a81340f

SHA512
468fb6a40dce2cb9860ad76aa3b1ef9f873f6e916eeff82660d9f1bfd86135e5ff575e25b8642219fdaff19d54a6d2ad7b6bebc233b0b95378482adc1fc6d39d

Download Submit
C:\Windows\SysWOW64\Iohjlmeg.exe

Filesize
387KB

MD5
9351066246947f0c2e1a720b5d49b03f

SHA1
6533fae403f3ecdf2d4952bc11bfe6e73cdf036c

SHA256
565e649987f49a9253bb6069a349da80dc0e144e1196df2e2accad264dca74a2

SHA512
d2efb58f1bd326063b18d5141cb6cab7ea6f2e8bcc832d36226364d3249cb83c5d258aa213ea440c742b899176601834e1738feaac3f32cf8179816e1047ef49

Download Submit
C:\Windows\SysWOW64\Jeqbpb32.exe

Filesize
387KB

MD5
2dde426ec0e497549e495dcc597b4768

SHA1
262eb1cb19b9512c458a90d4c273d230cb3a7848

SHA256
005704ab90d555add0fe1564e29b5867dd67aafe488433aa4f742b8f7d7c7418

SHA512
758942ad73151754dbc7f7775a673c4155824361a43a678d9e35147d997dc93f7bafca1694a6695b460d4520a4cbab45844790fc35c40490213b7dbaac346de3

Download Submit
C:\Windows\SysWOW64\Jngbjd32.exe

Filesize
64KB

MD5
c27afa168b77be4742db507fc3c42c8b

SHA1
a90f620605d1ab085c945ba275df28775144b303

SHA256
f9b68c3b05540d6556af3c5c10a28a69011f90128edd7b133936e627263ef9ce

SHA512
8876522074eefddb6bf925b4d4c4fcfd49617a49d7915fade2033fdf79b5593f64e5db8dfa4fb082133e80782b1038657ce38450f2e60a703ff1028ec6589a06

Download Submit
C:\Windows\SysWOW64\Kgflcifg.exe

Filesize
387KB

MD5
29a22421a9566b1699b5127348151535

SHA1
09827da5acf30d3176046f37930e76c36ea534f7

SHA256
bb7f36af892b6a77070167a24e91d4d03bf80c4349bfc3b099c73258dbe9beb1

SHA512
9a82e40caf1924ef1d91a22bda1a17a467286c1e7296011a8b3de8ef6d3f78c2a7a57f7371d4c2768330b58fb3934c661d2d6666971b0a1915b172ec3fb0a2d7

Download Submit
C:\Windows\SysWOW64\Mfkkqmiq.exe

Filesize
387KB

MD5
a77da2b73bc6a47d4ac1e94e0f12386e

SHA1
36b01b0504f6c0fcbcfa283ceadd06fc7bc9703a

SHA256
9f0bc0ecddb8690c6ce97ca3846955496dc31984cd306887c072e9ee6e429d67

SHA512
3c4cbdc9809d971198bbc56b7c11c8109b97a2c7887cfd73dcd2afde439321a9527b28ed71720043af5a8a3cef64ff670e92af7a2873765f3c8f857100b98529

Download Submit
C:\Windows\SysWOW64\Mgkjhe32.exe

Filesize
387KB

MD5
0805d499db16bb09b38c5ff90455417c

SHA1
b501840e4fa2409d86b5450f973e956b7b52850e

SHA256
555b80d006b34f66b50d26908af66668f92b2b2407dc158dc1ddbdc164e3c6c0

SHA512
bbcbe128c8a14475a6cc41216ab8ef84ef5d49857c0344b8e9ce229f7deb7913331f003ecea4fc35e1cf676c97ecb5cd00d95e63fa64a1565f304fc82a07a452

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
387KB

MD5
3b69ed1897832d7ef4ebd9f81234ff1c

SHA1
89e31a3b3dbab0e30c4de4c7231d1a3ec7d56985

SHA256
8e2b8259caa2c93bcde785bac116532b35dbf65788f832df33520659baef6ad0

SHA512
bd6769e521b2278b6abf222fcd6d4b69d2f483a4346f0348bfdae290d8f8d56cdcd52d72cb8a5c0fe14cf78b86c4d0ba3b2fee4bdffb81982302d1e4ce1fa6cc

Download Submit
C:\Windows\SysWOW64\Ockdmmoj.exe

Filesize
387KB

MD5
c33e0c4c6d90165e49a32e940760ae1c

SHA1
d28f6acc34d9dcf116331a910622f4b128e15213

SHA256
750bd11234f3e09beb175878855d20f6299df6ac518533f0bcf490c96edaca5c

SHA512
370c27995174058cd05418fbaa21f2ffb18d319da903d4e4fcc3e1bb81116de35cfde61c767a6dff56eaba21641f1810bbfacebe93f1c8486327efaa61c7e34d

Download Submit
C:\Windows\SysWOW64\Panhbfep.exe

Filesize
387KB

MD5
dd9d3a33caddb742dc2d402d488169df

SHA1
9d5c9956ec2b78dc8d9ee1732970ece55178fc8c

SHA256
353529a9444aa19c4b3a69a89753abcdedcaff74df0bc98a8f664dd7bb94271f

SHA512
0cb04ec760b2ba9003aa5da8b1758d80bf270bc440e30b5a008c234412bb14020d654124d0927e07b1c2260ea24624ccc3014a93f2b4a932160ff5b9293bdf60

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
387KB

MD5
9a5ceaf2c528d3f0cec6fda23132f50f

SHA1
d2375a65397de5cd0f15e8ee414087a5a7357f13

SHA256
6048f6225025739255076fa150bece4e372405effd5b8d01b317cd8149fdc14d

SHA512
e800a8fcefbd9bd652a8eaad000668e94e81350803769349c19dd2767f7bdfcc8186a37b51d4320ffab3d9fb31a45c09fffb4dc912ede74a6cc2cde1441427c8

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
387KB

MD5
407ecbd1ba376f55e2c029ee4c5509a9

SHA1
e8cf4a2ab903201dd4c3b82e8c952a05a1d67581

SHA256
3380c13b5f7aa09b98bd1804bce77e2424398765217d7e3465bd90847be6f6ab

SHA512
b14e971ce2e0efa050c4e50bf2ec373d2bb05f0280e4179d177d0801edee287f4da984deb23b91085c9a35e413e68ea0671286b5d99a317f8c276b31fa1dd649

Download Submit
memory/364-590-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/364-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/432-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/432-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/464-22-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/696-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/904-245-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1056-373-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1072-117-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-660-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-249-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1340-504-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1416-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1592-391-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1604-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1604-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-402-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1768-318-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1804-489-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-409-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2012-365-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2024-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2024-437-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-229-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2248-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2252-517-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2284-555-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2284-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2328-264-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2344-476-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2356-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2548-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2548-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2588-494-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2612-515-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2640-349-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2876-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2876-475-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-342-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3020-411-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-343-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3088-417-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3088-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3108-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3108-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3304-129-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3304-549-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3440-451-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3444-458-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3464-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3464-513-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3472-527-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3500-438-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3536-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3536-450-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3628-503-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3636-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/3636-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3636-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3640-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3640-536-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3656-258-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3696-227-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3836-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3836-457-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3868-464-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3868-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3880-576-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3880-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3980-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4004-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4028-300-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4108-385-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4148-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4216-294-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4220-563-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4220-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4292-583-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4292-165-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4356-225-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4404-355-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4548-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4584-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4608-238-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4624-367-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4652-465-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4884-444-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4928-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5004-177-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5004-597-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5020-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5020-89-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5044-226-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5064-288-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5068-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5100-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5124-533-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5164-541-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5212-543-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5252-556-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5292-557-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5360-564-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5408-570-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5456-577-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5504-588-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5544-596-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5588-602-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5640-606-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5684-617-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5724-627-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5768-631-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5812-639-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5852-640-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5908-647-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5952-654-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5996-665-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads