8c4ea2ea982794ed2e94e482269738e25225588f4925eeefc08fcf26a44bf140

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c4ea2ea982794ed2e94e482269738e25225588f4925eeefc08fcf26a44bf140.exe
Size

78KB
MD5

a45eef28435527801b6494d7d9958a7d
SHA1

12aa46ca76e97a12683b1797c792f823f680db45
SHA256

8c4ea2ea982794ed2e94e482269738e25225588f4925eeefc08fcf26a44bf140
SHA512

1a0bd443276777927ce946a069f26e6a49798f81023dd582ffdbb7f87803c0f366db622df36c3fc85d0808c139f8fc743b6efcd359a2b0ccc861b8b551aad118
SSDEEP

1536:r15yG6sjRYPvUywm2fE5tih6yf5oAnqDM+4yyF:36sdYPvUi8E5tihCuq4cyF

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pggbkagp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmjdjgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlbgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbbkaako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcgbco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhgjblfq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klqcioba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmbfpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hopnqdan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkffog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgmngglp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lingibiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfkbhpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeaikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkoiefmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnccmbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkkojgao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gohhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkoiefmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkdbpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldoaklml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flqimk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdqgmmjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifefimom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkaejf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojoign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liddbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdqgmmjb.exe

Executes dropped EXE 64 IoCs

pid	Process
512	Edbklofb.exe
4776	Ehnglm32.exe
1784	Fohoigfh.exe
5076	Febgea32.exe
1348	Fllpbldb.exe
4896	Fcfhof32.exe
4940	Ffddka32.exe
1288	Flnlhk32.exe
2792	Fakdpb32.exe
2644	Ffgqqaip.exe
1536	Flqimk32.exe
2164	Fckajehi.exe
3884	Ffimfqgm.exe
4924	Fhgjblfq.exe
3916	Fkffog32.exe
4876	Ffkjlp32.exe
4808	Fhjfhl32.exe
2080	Gododflk.exe
4072	Gbbkaako.exe
4004	Gdqgmmjb.exe
3712	Glhonj32.exe
2304	Gkkojgao.exe
5112	Gbdgfa32.exe
1184	Ghopckpi.exe
3500	Gmjlcj32.exe
4256	Gohhpe32.exe
1380	Gcddpdpo.exe
2128	Gfbploob.exe
2192	Gdeqhl32.exe
2364	Gkoiefmj.exe
4968	Gbiaapdf.exe
1656	Gdhmnlcj.exe
4756	Gkaejf32.exe
4148	Gcimkc32.exe
440	Gfgjgo32.exe
2480	Hiefcj32.exe
1752	Hkdbpe32.exe
2264	Hopnqdan.exe
3196	Hbnjmp32.exe
3120	Helfik32.exe
896	Hmcojh32.exe
2812	Hkfoeega.exe
4948	Hbpgbo32.exe
3300	Heocnk32.exe
2496	Hodgkc32.exe
2212	Hfnphn32.exe
1912	Himldi32.exe
1008	Hofdacke.exe
1104	Hbeqmoji.exe
1968	Hmjdjgjo.exe
2336	Hoiafcic.exe
3696	Iefioj32.exe
2400	Icgjmapi.exe
2996	Ifefimom.exe
5012	Iicbehnq.exe
4996	Iejcji32.exe
1984	Iifokh32.exe
1244	Ildkgc32.exe
316	Ibnccmbo.exe
3044	Iemppiab.exe
2224	Ipbdmaah.exe
4268	Ifllil32.exe
4888	Ilidbbgl.exe
3532	Icplcpgo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gkkojgao.exe	Glhonj32.exe
File created	C:\Windows\SysWOW64\Kpjcdn32.exe	Kmkfhc32.exe
File created	C:\Windows\SysWOW64\Lljfpnjg.exe	Likjcbkc.exe
File created	C:\Windows\SysWOW64\Lqnjfo32.dll	Pjmehkqk.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Chagok32.exe
File created	C:\Windows\SysWOW64\Febgea32.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Hmjfkopm.dll	Fhgjblfq.exe
File opened for modification	C:\Windows\SysWOW64\Glhonj32.exe	Gdqgmmjb.exe
File created	C:\Windows\SysWOW64\Mnbcedcn.dll	Ipbdmaah.exe
File created	C:\Windows\SysWOW64\Jmknaell.exe	Jedeph32.exe
File created	C:\Windows\SysWOW64\Lbmhlihl.exe	Llcpoo32.exe
File created	C:\Windows\SysWOW64\Njqmepik.exe	Ndcdmikd.exe
File opened for modification	C:\Windows\SysWOW64\Hkdbpe32.exe	Hiefcj32.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pfhfan32.exe
File opened for modification	C:\Windows\SysWOW64\Qddfkd32.exe	Qmmnjfnl.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Ffgqqaip.exe	Fakdpb32.exe
File created	C:\Windows\SysWOW64\Gohhpe32.exe	Gmjlcj32.exe
File opened for modification	C:\Windows\SysWOW64\Gohhpe32.exe	Gmjlcj32.exe
File created	C:\Windows\SysWOW64\Pohkbc32.dll	Gcimkc32.exe
File created	C:\Windows\SysWOW64\Ligqhc32.exe	Lfhdlh32.exe
File created	C:\Windows\SysWOW64\Nilcjp32.exe	Ngmgne32.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Flfelggh.dll	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Ooajidfn.dll	Jeaikh32.exe
File opened for modification	C:\Windows\SysWOW64\Jlkagbej.exe	Jimekgff.exe
File created	C:\Windows\SysWOW64\Nhgaocmg.dll	Kfckahdj.exe
File opened for modification	C:\Windows\SysWOW64\Oncofm32.exe	Ocnjidkf.exe
File opened for modification	C:\Windows\SysWOW64\Qqfmde32.exe	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Khkaedic.dll	Gkoiefmj.exe
File created	C:\Windows\SysWOW64\Fqqlehck.dll	Helfik32.exe
File opened for modification	C:\Windows\SysWOW64\Mgfqmfde.exe	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Gkoiefmj.exe	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Qghlmgij.dll	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Cnnlaehj.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Benlnbhb.dll	Lfhdlh32.exe
File created	C:\Windows\SysWOW64\Pjeoglgc.exe	Pggbkagp.exe
File created	C:\Windows\SysWOW64\Mbpfgbfp.dll	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Glhonj32.exe	Gdqgmmjb.exe
File created	C:\Windows\SysWOW64\Gmjlcj32.exe	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Ffhoqj32.dll	Kikame32.exe
File created	C:\Windows\SysWOW64\Efjecajf.dll	Kmkfhc32.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Knkffk32.dll	Fakdpb32.exe
File opened for modification	C:\Windows\SysWOW64\Kbfbkj32.exe	Kmijbcpl.exe
File created	C:\Windows\SysWOW64\Kboeke32.dll	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Aglemn32.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Inlekh32.dll	8c4ea2ea982794ed2e94e482269738e25225588f4925eeefc08fcf26a44bf140.exe
File created	C:\Windows\SysWOW64\Flnlhk32.exe	Ffddka32.exe
File opened for modification	C:\Windows\SysWOW64\Jpnchp32.exe	Jlbgha32.exe
File opened for modification	C:\Windows\SysWOW64\Kibgmdcn.exe	Kfckahdj.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Ehnglm32.exe	Edbklofb.exe
File opened for modification	C:\Windows\SysWOW64\Jifhaenk.exe	Jblpek32.exe
File created	C:\Windows\SysWOW64\Gdkkfn32.dll	Lingibiq.exe
File created	C:\Windows\SysWOW64\Pjcbnbmg.dll	Nlaegk32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7596	7508	WerFault.exe	318

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Febgea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jehokgge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfhdlh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liimncmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndcdmikd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npfkgjdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jblpek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbfbkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbhoqj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnjidkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlmllkja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcncpbmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hiefcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffkjlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcddpdpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icgjmapi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jianff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkdbpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jimekgff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlpkba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gododflk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lingibiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mibpda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlampmdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbdgfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klqcioba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Medgncoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ligqhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbdolh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqfdnhfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fllpbldb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhjfhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iicbehnq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmknaell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlcifmbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbiaapdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kibgmdcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odocigqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkaejf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfckahdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlkagbej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nilcjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oolpjdob.dll"	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flnlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oijgnaaa.dll"	Ffimfqgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kemhff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfgjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hopnqdan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbdhjm32.dll"	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgmngglp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nedmmlba.dll"	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lommhphi.dll"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnmacdaj.dll"	Icgjmapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjbedgde.dll"	Jianff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qqfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okokppbk.dll"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knkffk32.dll"	Fakdpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecnpbjmi.dll"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npcoakfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igjnojdk.dll"	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gododflk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpijnqkp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjplc32.dll"	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcinbcgc.dll"	Ifefimom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Donfhp32.dll"	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llgjjnlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcbihpel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmehcnhg.dll"	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fakdpb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 512	840	8c4ea2ea982794ed2e94e482269738e25225588f4925eeefc08fcf26a44bf140.exe	82
PID 840 wrote to memory of 512	840	8c4ea2ea982794ed2e94e482269738e25225588f4925eeefc08fcf26a44bf140.exe	82
PID 840 wrote to memory of 512	840	8c4ea2ea982794ed2e94e482269738e25225588f4925eeefc08fcf26a44bf140.exe	82
PID 512 wrote to memory of 4776	512	Edbklofb.exe	83
PID 512 wrote to memory of 4776	512	Edbklofb.exe	83
PID 512 wrote to memory of 4776	512	Edbklofb.exe	83
PID 4776 wrote to memory of 1784	4776	Ehnglm32.exe	85
PID 4776 wrote to memory of 1784	4776	Ehnglm32.exe	85
PID 4776 wrote to memory of 1784	4776	Ehnglm32.exe	85
PID 1784 wrote to memory of 5076	1784	Fohoigfh.exe	86
PID 1784 wrote to memory of 5076	1784	Fohoigfh.exe	86
PID 1784 wrote to memory of 5076	1784	Fohoigfh.exe	86
PID 5076 wrote to memory of 1348	5076	Febgea32.exe	87
PID 5076 wrote to memory of 1348	5076	Febgea32.exe	87
PID 5076 wrote to memory of 1348	5076	Febgea32.exe	87
PID 1348 wrote to memory of 4896	1348	Fllpbldb.exe	88
PID 1348 wrote to memory of 4896	1348	Fllpbldb.exe	88
PID 1348 wrote to memory of 4896	1348	Fllpbldb.exe	88
PID 4896 wrote to memory of 4940	4896	Fcfhof32.exe	89
PID 4896 wrote to memory of 4940	4896	Fcfhof32.exe	89
PID 4896 wrote to memory of 4940	4896	Fcfhof32.exe	89
PID 4940 wrote to memory of 1288	4940	Ffddka32.exe	90
PID 4940 wrote to memory of 1288	4940	Ffddka32.exe	90
PID 4940 wrote to memory of 1288	4940	Ffddka32.exe	90
PID 1288 wrote to memory of 2792	1288	Flnlhk32.exe	92
PID 1288 wrote to memory of 2792	1288	Flnlhk32.exe	92
PID 1288 wrote to memory of 2792	1288	Flnlhk32.exe	92
PID 2792 wrote to memory of 2644	2792	Fakdpb32.exe	93
PID 2792 wrote to memory of 2644	2792	Fakdpb32.exe	93
PID 2792 wrote to memory of 2644	2792	Fakdpb32.exe	93
PID 2644 wrote to memory of 1536	2644	Ffgqqaip.exe	94
PID 2644 wrote to memory of 1536	2644	Ffgqqaip.exe	94
PID 2644 wrote to memory of 1536	2644	Ffgqqaip.exe	94
PID 1536 wrote to memory of 2164	1536	Flqimk32.exe	95
PID 1536 wrote to memory of 2164	1536	Flqimk32.exe	95
PID 1536 wrote to memory of 2164	1536	Flqimk32.exe	95
PID 2164 wrote to memory of 3884	2164	Fckajehi.exe	96
PID 2164 wrote to memory of 3884	2164	Fckajehi.exe	96
PID 2164 wrote to memory of 3884	2164	Fckajehi.exe	96
PID 3884 wrote to memory of 4924	3884	Ffimfqgm.exe	97
PID 3884 wrote to memory of 4924	3884	Ffimfqgm.exe	97
PID 3884 wrote to memory of 4924	3884	Ffimfqgm.exe	97
PID 4924 wrote to memory of 3916	4924	Fhgjblfq.exe	98
PID 4924 wrote to memory of 3916	4924	Fhgjblfq.exe	98
PID 4924 wrote to memory of 3916	4924	Fhgjblfq.exe	98
PID 3916 wrote to memory of 4876	3916	Fkffog32.exe	99
PID 3916 wrote to memory of 4876	3916	Fkffog32.exe	99
PID 3916 wrote to memory of 4876	3916	Fkffog32.exe	99
PID 4876 wrote to memory of 4808	4876	Ffkjlp32.exe	100
PID 4876 wrote to memory of 4808	4876	Ffkjlp32.exe	100
PID 4876 wrote to memory of 4808	4876	Ffkjlp32.exe	100
PID 4808 wrote to memory of 2080	4808	Fhjfhl32.exe	101
PID 4808 wrote to memory of 2080	4808	Fhjfhl32.exe	101
PID 4808 wrote to memory of 2080	4808	Fhjfhl32.exe	101
PID 2080 wrote to memory of 4072	2080	Gododflk.exe	102
PID 2080 wrote to memory of 4072	2080	Gododflk.exe	102
PID 2080 wrote to memory of 4072	2080	Gododflk.exe	102
PID 4072 wrote to memory of 4004	4072	Gbbkaako.exe	103
PID 4072 wrote to memory of 4004	4072	Gbbkaako.exe	103
PID 4072 wrote to memory of 4004	4072	Gbbkaako.exe	103
PID 4004 wrote to memory of 3712	4004	Gdqgmmjb.exe	104
PID 4004 wrote to memory of 3712	4004	Gdqgmmjb.exe	104
PID 4004 wrote to memory of 3712	4004	Gdqgmmjb.exe	104
PID 3712 wrote to memory of 2304	3712	Glhonj32.exe	105

C:\Users\Admin\AppData\Local\Temp\8c4ea2ea982794ed2e94e482269738e25225588f4925eeefc08fcf26a44bf140.exe
"C:\Users\Admin\AppData\Local\Temp\8c4ea2ea982794ed2e94e482269738e25225588f4925eeefc08fcf26a44bf140.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\Edbklofb.exe
  C:\Windows\system32\Edbklofb.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:512
- - C:\Windows\SysWOW64\Ehnglm32.exe
    C:\Windows\system32\Ehnglm32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\SysWOW64\Fohoigfh.exe
      C:\Windows\system32\Fohoigfh.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1784
    - - C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5076
      - C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3500
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        29⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2192
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2364
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        33⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4756
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4148
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:440
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2264
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        40⤵
        Executes dropped EXE
        
        PID:3196
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        42⤵
        Executes dropped EXE
        
        PID:896
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2812
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        44⤵
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        45⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        46⤵
        Executes dropped EXE
        
        PID:2496
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        47⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        49⤵
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        50⤵
        Executes dropped EXE
        
        PID:1104
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2336
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        53⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2400
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2996
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        57⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1244
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:316
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        61⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2224
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        63⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        65⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2884
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        69⤵
        Modifies registry class
        
        PID:2152
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        70⤵
        Drops file in System32 directory
        
        PID:2568
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2720
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        72⤵
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4508
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        74⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:944
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4760
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4376
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:3212
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2976
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        80⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        81⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1628
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        82⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        83⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        84⤵
        Modifies registry class
        
        PID:868
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        85⤵
        Modifies registry class
        
        PID:628
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        86⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        87⤵
        Drops file in System32 directory
        
        PID:4388
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        88⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3560
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:3524
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        90⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        91⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:436
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        94⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        96⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4804
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        98⤵
        Drops file in System32 directory
        
        PID:1472
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        99⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:5136
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        103⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        105⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5356
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        109⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        112⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        113⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        116⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        117⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        119⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        120⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6004
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        123⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        125⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5232
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        127⤵
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        128⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        131⤵
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        132⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        135⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        136⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        137⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        138⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        139⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        142⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5516
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        144⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        145⤵
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        147⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        150⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        151⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        152⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        153⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        154⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        156⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        157⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        161⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        162⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        163⤵
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        164⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        165⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        167⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        168⤵
        Drops file in System32 directory
        
        PID:6292
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        170⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        171⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6460
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        173⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        174⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        176⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        178⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6756
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6796
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        182⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        183⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        184⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        186⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        187⤵
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        188⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        189⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        190⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        191⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        192⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        193⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        194⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        196⤵
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        197⤵
        Drops file in System32 directory
        
        PID:6724
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6780
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        199⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6920
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        202⤵
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        203⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        204⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        205⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        207⤵
        Drops file in System32 directory
        
        PID:6552
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        208⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        209⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:6900
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        212⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        213⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        214⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        215⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        217⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        218⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        219⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        221⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        222⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        223⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        224⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7048
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        226⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        228⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6828
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:7200
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7332
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        233⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7376
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7420
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        235⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7508 -s 396
        237⤵
        Program crash
        
        PID:7596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7508 -ip 7508
1⤵
PID:7572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Accfbokl.exe

Filesize
78KB

MD5
4957846d1c9705d822cf7dac4b8ce745

SHA1
d116e011bef918be3ae946fc6dc339c3fa99d7ef

SHA256
77a19d817ec30469083f4df4342b0815acf0ac799dbac966038dec32a56f8452

SHA512
1995f5d9d6913a4c93d9f7cdc4ad4d51bc94a146e9c7edd3239bb90a6bbf76265fc35d6d0cf465d8a1ce6ed6c6f8e4d20ccd125e768da51df990f4eacb65c200

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
78KB

MD5
7493711dc5617bf85d39edea84019fd4

SHA1
618deacac8af7dfeff2bcbe658627989f5b86ebb

SHA256
b41c9b167a0f62a03ceb3d0674362943cf331036338f25ff2dc71996d7d33aff

SHA512
a4f3ac83e8deffec8645032d403b8a8f85085b702d29e4fec88eda864bb02e36e1dc87c4692f2628046cf52e6e01cc082d0a8c908c395253ead1170f0617142a

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
78KB

MD5
0d750be979e13402751caa90cf4f8e88

SHA1
dce6b4151fabd4469f28b57786d50d83fc3935a6

SHA256
9dec8e9c72409b2310cc41394c86f599b567788cf0a3593d6de094f80b03e8ab

SHA512
4656a94276b954de24316595ea18306eb6faa580b2ab29089dc082063abf19e2417200ef44e0a4274e6398a9280e8353dadd84d3fcd4b189458a5c4a965c4ca4

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
78KB

MD5
7721828d5c3efc4effe03109d2991ac6

SHA1
3ec614c182a9913bc9dd38fbab87bbbf3934852e

SHA256
7b8d234fcf4da6776977830f96b892c330292d24d1217d1872e175ba70888310

SHA512
5e3966b4ccadbcf4152cb2447b5d8ce3db549c2121349110afa75129b14aebdcf943837896dd324de96754b7b75c71b25eb863c714d3e986501b43ec0e74a352

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
78KB

MD5
816fefe6dda5e8b91183189fdd4a6a67

SHA1
55d9376382938b3588cc68b17f8618bb2fd4f125

SHA256
52c49cfb255fc60f745d3fadfb6dc5e645de8dc55ca45b4dd5d718bb85a0ee96

SHA512
65d4de97e3a4b2b16084b9f37888eedfd0e133a10e8eb0de3bbe15f631ae215db4355ff9a9e21e7030c87f4a0914abe9f932fc7f8da47826f2ee2b1024752a4d

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
78KB

MD5
24135138e004ba29101bad210c73e9c0

SHA1
4875be4cc9f318cacccf102a68456eb77d2aa3f7

SHA256
60fdb5a3b435110e13994f7893cb0e50ab3a31cebb3442f18a746ebc0e4dbf63

SHA512
bc7a86d68aaa65277ac49a1fe6fe19b0020a6cb255ff5d1aa8a6de2ac8bac9902e217702658579d8bdcd78f0fad116ca2233709ee8e2817c4efaf623c8d07f40

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
78KB

MD5
f7a7ed3f4ec4d2b4cdc64281d69da729

SHA1
5bd3f92865c22918cc9c6d31aa837b62ad887210

SHA256
4ae2c6b7aad0db24243150a36368a06c8fa664f48477987dec22f257ac4a4b67

SHA512
be729d75b63fbb130f17ff01edb41e79e4aecff58eafc663627ea2e1ca69b9b8619e6278e469ca90f263f693b8db881ab2cf60b45ec03cba72276791218637a2

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
78KB

MD5
8473652329b9f1ba31779931cac56e34

SHA1
917f4b47654beaec5c2a1bce2a331b1d1dbf5784

SHA256
e3125b014dad2b74febb1caf91e3facf89b04c39039b6dcf58a0f27a7c640dd6

SHA512
4be028b4479c5b7c297e918f639bbc8acc677865674ba88fe18f1c4e50cdaa26db7f3ccdcb1058b67ab71ace4d54afac106cdf4c6d4b59164a8742cb9d57d8d1

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
78KB

MD5
3ea5f0d0b32641945899bb39e168e34c

SHA1
ef19f4cfef4b84932028d2e2328fa6c7df1a2e18

SHA256
9ac839eca983122b9741ea2a9b9e7ee154f08b9c97cd42811245103282b1b835

SHA512
c6541590f5b1adf26e760e45f282b2c66bb03e3811af59f3cb7dd8b8d6bb3506d55270bd903ad8cbb0580e9244c5fde96e7076519c088e056f99563ae71a98f8

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
78KB

MD5
4c882b9adb940628160e879677bfabac

SHA1
7f99cc8f99beac82baf2218e2d77a466f2523cf2

SHA256
d64599c1aa97a096bc5571b7d0c13197c8455f1001a8101203d9b2f31de2cfe1

SHA512
32449fe9ec8201b95c9ffed328da1f0fe6f432935101518244f2eabe7d3c43d92ed60df4f6546c94f73cb77ff408a074d1b37892ac27dc68aeb5196833b21ad1

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
78KB

MD5
992d75d7ca854e556937b2fa8b986fb3

SHA1
5de144ef59af74e657654a1a33fd1502c047fe56

SHA256
b05c80bc230b434c83a2988fe8ca12763d1c5eb70ddee8f8afb0b4b6e7a1c64d

SHA512
8528350f619d082989d16213c5305ddad969f2cae8ac322b046b8dedcf9d2271550db3e52385b218b56bce2543b42bdb59b59d18b9758bb2685399d33cc0b818

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
78KB

MD5
7fe6077cc38d57c7321adc2f26df22d0

SHA1
06cf4e66134c79c7f95649717e4f67a196e9f389

SHA256
fc27602f9b3b593642ec4aa3d0d7604dae580ebd4f7be6d2a60b5547d6d4ca2a

SHA512
131403ada5fcb7a7059e2fc996aa5c46bf16b4d68166894931a5cc6b90f876f434f95c8b0050bf5b80b3adb0eab5e914ea5247c8a6f7f00716999c8cc708baa3

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
78KB

MD5
7181d391fa09d41811aa5915da1592b9

SHA1
063194a7c054796a5a219bb607224f843969d495

SHA256
0b5128bc469937c2e7f78d44c58d7f611637162a48cfa51139a3bc4a1a0a153a

SHA512
4ec0115556d014cae31c22acdd00f45f562d5450b1b9eb1a356340e8b1088062895b5412204c171e349e89d46c8e3222c43f1929c6293a0364757b4f9572fbfc

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
78KB

MD5
5ba6aac8b618e8974f34623cc459f20b

SHA1
d5a90fbe0b7441f52bb18f58482d994207a34625

SHA256
067566e4cd64cd20331956729de5c9d1b9fd9b25de773fdb3fab5b6d39480211

SHA512
9468070b01e9d9438ef2ace3606fecb20798fb3405f1dc94643d316a93fbce7a0742bc3b23672a30d98d952742148a914392b8ab37adbf439fc7831d16e2b706

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
78KB

MD5
991848aa60b37c7955bf582e2a21d957

SHA1
be367f63c3defbdaa3b96a07550cc2070cc79bed

SHA256
975a101d6701f00058b970b8493f7cd418cfd2981234f623e3238348d07285cf

SHA512
a72e22fc1354012c01d2acf8185d1159e59ea02c7833f066612e5c930989fdcf8abe7d85a5fd02d231ef85029bb70c715adb384368746bb2ad5e9e980dc676fd

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
78KB

MD5
52f2eb01bc61ab3fdc1488bb4c1ea397

SHA1
f67d924216defdf6307ab902c857c39603e50600

SHA256
21fe3f05993050175a48fe0d81eb3de0013baf60d55c10eeff410fca58ab8497

SHA512
3e902826ba16c2fb35643b5d586b34f225ca51a2ff8de86b57776d1522f413e5406628fbfb8220b8d3b472460e3d9b6f3d191b21204d2133d8c6de71db01ea0b

Download Submit
C:\Windows\SysWOW64\Edbklofb.exe

Filesize
78KB

MD5
e2d0b0394a3d82db9ea93b789378faf2

SHA1
7caecb3b7251ab3a646d86189bd4d24df94a81a8

SHA256
c1cfcea55219513849d1f7315dfd8519b1d54b3604c71ca104dcdd0ae627443c

SHA512
0fa7eb3966e47b5d0d7df8432b603017612c60d934c064166cb65044887344acbe5c5ed080db1947f41f3745dd71674743f5ade9c022372f96288cbcad10027c

Download Submit
C:\Windows\SysWOW64\Ehnglm32.exe

Filesize
78KB

MD5
6f359906402fb35ee023be4d8502e697

SHA1
102559029bdbbed85f1d79e2b197d1dcb2d0b4c0

SHA256
c4c29e22942643c51176decdc516c4aca0ef77d42cf2da8ea8a0d1362eda3598

SHA512
1b918a1f61b410f82b57bb45dfc567e3c4df52ec29e0b2b4f1a8c2392f26917d86ad56991a812eb1ec9761b949e3705330d128e4550ed79ffd9bc06c961d6202

Download Submit
C:\Windows\SysWOW64\Fakdpb32.exe

Filesize
78KB

MD5
bf3ea7cfbb376f6927f948831697081b

SHA1
741f0af6a514298338326646714a899665a5cc20

SHA256
5e0a80ae56c5aae881a4efe0302b41888df24d9963721d14360390f1aa676b54

SHA512
16bf08cf5b271d9e2f0e272d84569210bb8b9af5f156eedca3b713b87e7c71b3e14c403950faa0102ede9c7938b76113af25488211b6bfdfec6e368bf5a8a3c0

Download Submit
C:\Windows\SysWOW64\Fcfhof32.exe

Filesize
78KB

MD5
1759fa4e32136f0ba66029cfd22bf0fd

SHA1
3636003d4d4f7c5583e41e20b30a2c8b38745c98

SHA256
5420eed3226c6f223e8c9081d70183393a14bf2b18c98611884f3c8f437abfe0

SHA512
271175c167900a2e9c8d7e916d1961d87535c0700805cd5c6d2ac97eaa93da0ef43e076b950e8f6adc954ccc4fd9ecaf7212af10a3e8a77996e735a8655e2159

Download Submit
C:\Windows\SysWOW64\Fckajehi.exe

Filesize
78KB

MD5
0b14f5f0cc16f79cd8415adf5de5eae1

SHA1
1ceb9c3f02190d1bafb4a78f95a0cdb58678ffcc

SHA256
5960cec7a7870ed6c3d6327bed1ded5f0dbf73a3ada818bdcd2386d6e392f513

SHA512
2aaee2350aa56f015b1bb37dbdf5519d4166e797987ee5e316be2a9e745255ae93b76716105a36359858333f6d07bcc5c57e2bb261c5df537db9359a08253440

Download Submit
C:\Windows\SysWOW64\Febgea32.exe

Filesize
78KB

MD5
b680c630556fcb3cb133de041140574e

SHA1
36401ee4faf038620e3eb86d75b360d850571749

SHA256
e4f874ccbc466ab950b22134844dc04b3edb8c58190effdd2cb42a5a36101d2b

SHA512
afcddcf9028e8f6ae304c8be74ddb2f86b99ec3b9ddea6f147b8946dfcfa88218bc45cf3eda4a16bfb44f110a58c19cc9bad764085528f707c7feb5fac53fbec

Download Submit
C:\Windows\SysWOW64\Ffddka32.exe

Filesize
78KB

MD5
9624fa1a98147b4438e5468c56a32c31

SHA1
7c67f5042341c59049c9d5f59008f8551f9f0d6b

SHA256
7aafb88dc42768afdfb9e267c39234249114cae8855cbd7cd8590e1cef37222c

SHA512
858196d522c0b1d05aeed711e2bec4ba7d4df4ccc4267885523b4bea1905c94d4f20abd23e44c25ef15e8bdf143c4b1b20c52fdb8e6e7a2cd4d9097e9d6812ad

Download Submit
C:\Windows\SysWOW64\Ffgqqaip.exe

Filesize
78KB

MD5
523d31b095c42d27180bf7207cb7e70f

SHA1
adad5b8064fb3db8585b0a06e20af14773f23cc0

SHA256
5d2ef81941207b26e82526a8620df5c8a69b5170a231ec942f712b5abd218b39

SHA512
fb8bb3bd12acfd27e0fe8882acbb90421a71234453a8657e27591db1712a5d2cade0e6d1376445c67461945f9121843c404a4c3629192689ea06420b393785f1

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
78KB

MD5
c505dc620be383a55cb46ba46d38a15e

SHA1
f51dcd1715954b454cd9cd7697ea7f7baad91ed2

SHA256
f0640b3d25e7687b3c4568699c0083c06ba676091f7bf0d38b4e0c0f74ec1060

SHA512
6b25ecceb2b0abfe0693ace6d715e78f1c9ba149d17514f183197d0490c6fcd21658deb6fe61b354bc9a7e9a7843279460061c86e22a752f592e7063ef68da9b

Download Submit
C:\Windows\SysWOW64\Ffkjlp32.exe

Filesize
78KB

MD5
197c898467732d236f5a7f96657ff510

SHA1
3a78d02a9a693e1387bafec548484b7c6ac3341a

SHA256
a77085cf79621f91548a43981c3034d8c074d811889505fc3839da870acc17e3

SHA512
7d436c77553f30502e7649a804331a5bfa1e1788c9c5e681dd5b55f80e2897572442cbb8e54ba22a6f1bd5d234f711a9c411ca34410d93d228f3a2058ef173ca

Download Submit
C:\Windows\SysWOW64\Fhgjblfq.exe

Filesize
78KB

MD5
d362381df2ff78b0367d64a2d431c253

SHA1
5b58f430acf97276e3df30ba4f4d2cc1694f244b

SHA256
76dd9a44baa5707a35c02af857317e645fd30f9f3a7878243fa6697591f5cbd6

SHA512
967842bc839da99e0fa2e004c2542bcc25c8a13157862c3686531084bc5f6315561dabc55494086d7774308e5a5874c2771f007f8e4f28070c67a143e272e1ca

Download Submit
C:\Windows\SysWOW64\Fhjfhl32.exe

Filesize
78KB

MD5
c4fb36705097ba7b6dd1025fa4860988

SHA1
8b33a91ffc4bfced257d6c9e6d6c605df4db1b20

SHA256
ed9cc85b3d46eddda1e5823174b30ae3ce9435c1a2c5e991c1ab0b88215b412e

SHA512
efe96a842c3c44597e35c318522199e0ad1e70f4300137bf44eb6978fdc020a557ddbdcd3b4b442f641f6e8848dd945c5c91cd846996a167be129fffdaee5cff

Download Submit
C:\Windows\SysWOW64\Fkffog32.exe

Filesize
78KB

MD5
cffc8ad9e00596258f7c715444acc8d4

SHA1
f7efc5eb55b87e1bdefbe2c4b1262a458b6d78c4

SHA256
7d369160e1e630fd1e414fae8178fdc545a4d976d9467f11e43f6f9014cb6f1c

SHA512
ee896571454d54db21a6b2dcd884cfa8554817787d367c7fbdabe5b4470924a8067c0335e6c5091190f3610e1a430995d5f229b046ef8ec0efc464de64c6e821

Download Submit
C:\Windows\SysWOW64\Fllpbldb.exe

Filesize
78KB

MD5
ab6695a44269c06f71acacf46186859d

SHA1
34b084b166e56c5477c908ccd58e807123a19826

SHA256
9fdd51960e80e062b242c17fab932574e3dba2cb6e187eb37e37a555f9b64191

SHA512
b08685b8aedfd6ab0eef0505e8b2954ffd53add078e5ac242a7d41bd53cc61763186c1cfd75c18ed40de1149298eb8eb3c80f6a4828e96a0790d0bae8b990b1d

Download Submit
C:\Windows\SysWOW64\Flnlhk32.exe

Filesize
78KB

MD5
01778058d7c19e1e15cc7527047d96ed

SHA1
3980c97ea3652d29ebfc661afd9eb23a42473fdd

SHA256
4bcda03009fdd169eb0b7add585258b7fc8329e59e01679cf4efb0ab8585c310

SHA512
851a404a85fdc09e41163e1e38e2ec2618e50fb8727b5837c3c0ebf95683808076e4b4605675bf321071b684e189e9182869ade665acc9e4721b3d8692d04fd7

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
78KB

MD5
a4d63dccdbad5dbe638b760f2b7106c9

SHA1
709982c65ecfc5011a076ae4fda8d35dbc7b882c

SHA256
3b9f142146ad402fd4abb52af55f5675c23050e61a65c3cb3a96ad0329644407

SHA512
9b16d2002d85f5363fee61a8f76a5da5fbbd5ceb2279af182b66023ca797a8ded7f644e917b5ab6ef36109aa3356c3b563a0f14833fc552bdbc1db720a70e5f8

Download Submit
C:\Windows\SysWOW64\Fohoigfh.exe

Filesize
78KB

MD5
b40d40cc8aa7245ae5ef519bad61f280

SHA1
7a8097bc98c72f4342867a5c016c4fce48fe0476

SHA256
d2b53fb6002d5e6c7293aa5cfa98274b4fac77e3891c42beef7dff8531392de3

SHA512
9019515e1c56e2586cf86ef51ec282922ce4ce4dcd6da2217284d6f18d42dca6cafa9d905427b9968e31f2279fad845acad8111d35a1ecdea8ba2cf1776098b3

Download Submit
C:\Windows\SysWOW64\Gbbkaako.exe

Filesize
78KB

MD5
7ec26b504168899bdd944478b5474382

SHA1
cc854075b893f7f548517dae1492508d683eeecf

SHA256
f740702e96f797c228d266a94bd9e2b836c0e1ddc63732cccd9d0789fb61c872

SHA512
3fe9488366464f94d0a5f70a4c68cad48468dc48ee03aaa89cfe0139f74ba926658cdf1ed01d518dc0fd08efda0d4a919b1f83e8a9de5066e288c3b9e9641816

Download Submit
C:\Windows\SysWOW64\Gbdgfa32.exe

Filesize
78KB

MD5
c6bc93e7747f43cf66277de525360f43

SHA1
6674c0b18b46821a32237c1b591e366dc061e8a4

SHA256
95fe9ccaa59e556cec9e4c793b7018498aba7602d907e11a573f26bb2ca8fe0f

SHA512
39a00a54da30d4ed618af394cf5802c772fc4db566f5c1b62d70a2020128265de5cfaa1e8e0ea424a01ac344c178e51695f4347538876fb8823734217d21ebfa

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
78KB

MD5
a2ec6c5342aac5d52c2a7696e313baff

SHA1
4a635b7adfe5b0a1032e1d6d63d9f36c698de527

SHA256
03b2a677477856b403e5d46516076db580e8261d75a3f1120975b0cefc9de720

SHA512
2387e128a4c5ca3b7461655f42a010d6930d359b824ff2c86624b1e76cccedef0c5debf264711f76131d559bd97d12f11d2e42f72bda693c8f90521e1fcedd04

Download Submit
C:\Windows\SysWOW64\Gcddpdpo.exe

Filesize
78KB

MD5
d03f2e2b33a3ea420da33589943b73a1

SHA1
4cdce8a3487382ca085d8254cc56d0fe726fd3d5

SHA256
45b69756470572d6a1500601d4f94bd39ca28e134d619352845435cc6a242377

SHA512
cffd9d7d296c69edb33577d9fc9fcbaeb41549c8497e4a183b8325c9094decc967d9dd236285a0e7f3d1a68fc7ef4892703345c007ccd22c53b7d56a341c9c30

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
78KB

MD5
2873cacdd65fc775ea0572b274b7a1cf

SHA1
ae5a9115f8e96b75ff956ef2284b5f6ce2223cb9

SHA256
3bd19438edb6d69f866eabe18b32375eed69145f535d5b0430728864ca8afe33

SHA512
9c60374e85c884a4dacb6b2388b5b0d487cdecd52260fff4b5c6ad2f532972f7b1061d4bb0385d25bf1a3537012adba6e88e4432a94a4c019e9b22cf8265b1ea

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
78KB

MD5
dcc1612ae3734a9e484db444103d1198

SHA1
b8d75acfb474a60e9443f19b50a1a13468dcd56b

SHA256
8a53346a79478dcd645ecbc1f58df5d24aef03f875f17ef323d263842223a970

SHA512
8503015f8643aeb07764a1bb40b9f5aa9196f38ed89b8ab08e1709173a2aad0eea7e1d721fb51565cc17402913e8121de08ca3c975d3bd61a9359c1a747cfe21

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
78KB

MD5
cf84c9086422ca2cda9e5fcd94bab0cc

SHA1
d0e5135ccbfeee8fb4598ba890da6ee0c752d519

SHA256
eb27905a34341a757f0395d05da5b37cad9b1af0e8b085b445e61751066504d6

SHA512
07eb721ce8220eac74296f7160015e74cc293dbed9194eb8416a376e6e96ad6e70f2f6b8d7cef63a307a8f4cf9d8757cd5721e9fa2c8b5ca3e04515659b3e456

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
78KB

MD5
7712ad7e6c6ca161da76349db8685486

SHA1
eaeeb97562e2527cbfe0f9c9f72c6f7673f96633

SHA256
7c1ee05c922abe9092a1857903c7af3ff3604c169f1ebb7c410adc9f214b077e

SHA512
1d46a11b3c03e06197aa09dd1eab5fb77cfdd002daf2e648a65d18a298231e721e18c57e950cf3e9281bd2734794250e0ec9ea7e06ae2778e435cae55502f839

Download Submit
C:\Windows\SysWOW64\Ghopckpi.exe

Filesize
78KB

MD5
7f3f90d3111e053140ca80a5b2aea55d

SHA1
d891aa53b27fcabc8c43a85cf2f3a1843804c845

SHA256
524cf08fc6109d4e778cbed3fcc4a2b8bcc3cd8a0feb3573672cbc4e1fa6d7c3

SHA512
5dcc422bdf99bbc3d79dc2cf1b64cd7630fbd469e1a239734115490351908d85c1ccc50d2a5c71e464cc5ef3f4e3b374088d0275e7e9da18e0adc74c3a58d0d9

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
78KB

MD5
5cabb97eb0fbceabf82c66b5dacb7ee3

SHA1
e8317adb2d1fed36cfb8fb7650cf876c4a9848b0

SHA256
c2088d86ff47a030f81ed7fc94155fa329da4588c8637d890f04c17ddc1546e6

SHA512
422b1fd308d88edea0fbaaee25c125fd06f019de8a07a2865399736930a11fd613351a3817bd6c564cac907c59acf68a98b809818b9c54daa945aac37df943fd

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
78KB

MD5
a641dcda8638613b60f69bc687995746

SHA1
3e6ab6448e614fc96d387068dbc8d5ef3da3a18f

SHA256
4a33bf2cebf08edad3ef21b263e25e286ee43f8a95bdb7764580fbe6751a61a7

SHA512
a54cf6a4c0a114f3a53295cca501ea11d7ce1fa0a71a7d909d735cdd60c0d6b2641e5ec2be255055be2ce2b327929e9ec6328aec59722739731269bc59dc18e5

Download Submit
C:\Windows\SysWOW64\Glhonj32.exe

Filesize
78KB

MD5
0483f7f6248821b0efd4adc32c8156cb

SHA1
b59672e8b474a9846a0688967e44f7e043038f9f

SHA256
df6a738380b52efd464f76bb00d7152351890d06e3e1d624260e715157fba513

SHA512
9f425ee59ab99bb8e7e2f363f2a41bbeeffb6b512f3d68c5e10c89016bc1b6fb946ce78b98462c9b8e95959fa39a8be89e9e45924fb7ad71c22a0db30e49db90

Download Submit
C:\Windows\SysWOW64\Gmjlcj32.exe

Filesize
78KB

MD5
8e7056348c6135972114dcfb3bcedd80

SHA1
caf706926dd4789ec2bca9be1b75c83ee0e52937

SHA256
71cc43cbbf3ebd59931a7966e0c67b5fe23034e8e47466e15c7dd422edc08146

SHA512
153c4618875c07eef6a2c2ddfc2c3e2752ab42db32da78d317b56a9d64ae74cc25a123fb82c1f09717983e79c00c159d3aa7b345f4a30ab1541b0a6bbbb059c7

Download Submit
C:\Windows\SysWOW64\Gododflk.exe

Filesize
78KB

MD5
4ea1ad87d1a0635ef639070ef4469cdf

SHA1
311b6e2cc517b58fb271b7fac9021fb4f931f636

SHA256
354135487fcf85fce46192cee16dcfdedd97a00d75d25492be47e638cc12b5d6

SHA512
4c377f1c6ccf600519d4478750cbb45e1db354493a69992540f81cef5d8bacf8da90df3ea51599e520c18443d94c8c6adf8a3d711541dde88021f2f6d796ed50

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
78KB

MD5
ecb0c83cfdc072e051966e4ad028eef4

SHA1
d9e65175b541c901e0b5044b2a541d614fee26e6

SHA256
0f9c33a959afb65679121cdbd5506da1c3d63699b3459716de3cbb56a64d04b6

SHA512
09a5af13ae6f5bd5498a59f2959508c7fa3dd07a826de5f0d86619ef28164fd6c5d902c79c60b226b72707b4de4d73d129fa91209c24fa7e371616eca637146e

Download Submit
C:\Windows\SysWOW64\Hbpgbo32.exe

Filesize
78KB

MD5
4a7ae37ce632ff40d54045fa1c61d38f

SHA1
83dc98e268de6f47c73ce502fa697a8ecc2e330d

SHA256
47e60839fcf5bf7f25d839d49ed2546d338103f989dd982a1a1cb340efe452ed

SHA512
cd287b745ffc47a2e1839dfb29e1aae577cf560c7b98c50a57b3f29f3387b6cb94659331e550ff0316d44ec4751ecd585461157b76791848a97df195aa94ed94

Download Submit
C:\Windows\SysWOW64\Hmjdjgjo.exe

Filesize
78KB

MD5
b2e345066a4c6e033e3cecd98eb8b211

SHA1
27516697bb61e1f822477ee94ae614cf10922d1c

SHA256
dd6920370d428670bf01e5338f8f2872eaba9afcb8db455d5cb65292e2582fc0

SHA512
871c512ee126094dd0596d7734d648f0ee3f2785320121bde025fc6702d3dd874bc4ce389c8dc981d3c42ce6e2cb828604a3af88ff53b85327eb50749384e9d2

Download Submit
C:\Windows\SysWOW64\Ipbdmaah.exe

Filesize
78KB

MD5
4a7b7f65e23a0cdf6efe3d885b2c8a2c

SHA1
a7fc19bef33bd40bd97e0ff58eac32576262a987

SHA256
ead261e15ceb383cf6379e2d373a41c86b5c45c0da555904c8d7ced9d82fc8d2

SHA512
70e107e0f31ff534465067f531b1338a49cfd9d10fbc2543efd388ffba1590065a0d0317c176984535d159677ec497b9118aa9765a41b1cd26872c869f2a44e2

Download Submit
C:\Windows\SysWOW64\Jedeph32.exe

Filesize
78KB

MD5
3f23c97c54d433409868e70c537a234b

SHA1
7fda0b5fb985449b1a97c6c19384b78bd2fb8821

SHA256
47091e79b2f2dd3cc71fd61b3063a962bcbbbb219c356aa19df540707d05dd50

SHA512
e13f6397d1d6e68dc938a972d9121cc1d8ea41dac30ebccc2c601439fec629b9d564ffebda28d881cd291f9cb6f8fcaaff7ffbcdd85c6597e14c820b17ad2f03

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
78KB

MD5
165439d7bf316ee3fb30422d23f03ae1

SHA1
46e54c097c1ddaf915f8602efcace9c5d85d6a93

SHA256
2186288fa0ad47186fa698a4b8eb24cb3398495d009b23b1064f42a477df3c67

SHA512
ff86fe47d8b562a0ec92f1aceb8e5be7a803064dd069b00dca587b7305489782b20bf963fd514bed57ab212ba9b7abbc1d5a98d52fd92283c29ea36fd3e32378

Download Submit
C:\Windows\SysWOW64\Kfjhkjle.exe

Filesize
78KB

MD5
4abb14ee88495e83047c69d5e0770996

SHA1
3b8e8562b5e326105b67e03d49e357cb092d7ad3

SHA256
1df9f2ed98982c9454ce75a6c6210bb5a2d1389e2689ba12e9f2db7078679de4

SHA512
d66b061d4845686e41670bb9c62e3e04974b6e8d8ccdebfba0216ce03f16507a70d884c17a9d3e7680021a88686006a492a1a99766b89d6dabda6509663ca6b8

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
78KB

MD5
22b6f1e60645ba5c8c4835694e01764d

SHA1
faa0329b2ec23c50340b29b672143b04162403eb

SHA256
63e37fbeb64a543e2c0ef5762664dca0ec5e78b3d37265f6307c8af8561ec0c7

SHA512
e7e3cd01dec4de3febdd73196b2a6da8382bcdca45bb3b2bc3f4a98573acb4a9194dee4b0d9dfe9282f7858b470720b747be54fd9aab73dca194e5ea1fd87d80

Download Submit
C:\Windows\SysWOW64\Lbdolh32.exe

Filesize
78KB

MD5
be7e5491c2eb42eaec0e915ece68416e

SHA1
d1dc1edb7a6d8bc9805b352d271d1d8a37fc09be

SHA256
faaafb56f27dd9337c9e727479ef6afc469031c73e5242f56cd1b083b71a37c7

SHA512
b9fcdeaf68cd06bd24b2579cc3e5144020b41331c5a1a6ae2baa9ba4a848c25b248b2b440733b2f615012cb45664d6c2f6ebec6d9db1fd9258e74a467878b669

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
78KB

MD5
20118a29ad339da09f75ab083ccf12ac

SHA1
92c9b8b42f402faea51659ebc7fc3ba9f938a463

SHA256
8d804d4f765945303e3838098cc197f9f9f61e3edc62a18f6e8ed8fbbfe04919

SHA512
2f83e3fe7e6217862bb78e693d84dc3b4e70f6a291091c83623b91c104511187e3aa0f062636533ea837da4cb5e353ac1378a7f9e3cf2852ca83d749b3acee3a

Download Submit
C:\Windows\SysWOW64\Llemdo32.exe

Filesize
78KB

MD5
eea3694de5dfe968bbd05a729d5f70a6

SHA1
0b3b81993bc6e63392bf72d89f3898a2a44f4cdc

SHA256
248194b899854a3205b96afa96b8532697bc3f477e55d24a7ea1835b16b0c3dd

SHA512
949423d3a5a047fc6fe7119a6c7446f9fbe7f91856a0edccbd6133ee523d798688dbfdfc3bfe7ec112a8f93df509cb4d93fe71d295c76b72a5f055ac8992f720

Download Submit
C:\Windows\SysWOW64\Mchhggno.exe

Filesize
78KB

MD5
03587c670801f51bde94cc9f56b609a3

SHA1
b37684a50a87df469fdccba1d18cd96d74e4d159

SHA256
787c40210a556665a326d0b2b2a4df669a73b4e251497482d521edaf2e7ff542

SHA512
efc266971e226e07b9f0de421f7386c6a79cbbbb627ce39d99ac9e98da85ffb6f5d5a43a2119d3cf4dc4d4f56244d5a83ca7afc48386462d04d5ed0a86f10f2d

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
78KB

MD5
9ddeaf303d9283dfa221ca764b466b6d

SHA1
f6f655a00b03d7d5d97f3835f7bc7ed52aed2771

SHA256
debe09fa826daf12348054d748e83455fa9a0c483036525ded920962bf548706

SHA512
0c64198ca34cc331138aa3ee78fb1766444ff5ffd819d61c90b518fa8758759e8d9eeef5bb8b9dc5cea3404d23064921dcdf9164d274aec760827a4e61133cf7

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
78KB

MD5
8887c21f0e7267b13efea52110147149

SHA1
765ae4303b22909be0f4425f68efe45d9601f841

SHA256
6db1871878cc5eb765ba5be2a5d93805404ab817c6be102984ce1ee562a17c3c

SHA512
665bfa779bd344aa840c7d6bb33e7bcf684723cbfaed12597b389c2f3f80cc7fa1f2614003f3efbf5f68ee32458d1fd5369d6f452538c12080881b6769f7ae14

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
78KB

MD5
e00aefcb6a7360f49cfa33a6f0e2d51d

SHA1
55f31a74169540ad0b88d9e8ef1f2b6a81c884c4

SHA256
38a270a6fa8069b8893bfb3b8c0114f287c501e9a2658871a6b519824c3cef3b

SHA512
108022fe28c949798334065aa97919d30c5d608a85e6e0093aa1cb2977164fdb515ef19740dddc1415b6c68f339d345ec05134db5f098f97f41ae91d4aef3338

Download Submit
C:\Windows\SysWOW64\Npcoakfp.exe

Filesize
78KB

MD5
953ab7413f1e79176c489abc9d329bf6

SHA1
15ebfb9bed0507e918631b8f7a51b7e1eda7fee5

SHA256
4f8a929689f5ef746c7a3641385d611833bfc5a0f8c04b5b0a5ffefd8b77160b

SHA512
df1038a4bf6d7eb925190527d5235b684603ab2d1f51f9fbadbb643b930f92dc301092940f1cf8cf140785c3e61236a96cdfe9461abe7a70d90eba757439e792

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
78KB

MD5
3f1ced8f04b467097d7e9861df2524ef

SHA1
e2f881c143ea3694bfde82aa3ba40a5de5fddf42

SHA256
875c929cbf432da28036115e25e6aab093ed03a02ba848eb8c40508b27593960

SHA512
dda2f5c8aeee89b876ea7faa58cc26cf6ed7418b143a1a0606744a77c968bbbe0a67d5c91019fed139396e814ac5ac5753346d15e67726784bcb34b32f7611a2

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
78KB

MD5
77939ae93abff9b467bfc43050e13106

SHA1
a59c43d142796c36a40e2517f385f0c601387014

SHA256
a165ee35d8e87a1ddf9f27cf73f5427a98fae9fd1cc1aa105bde16f519e54d6a

SHA512
4fc6e37bb1faf2faec6bc94804f3beab7b7fa5011f27757b6d32521b641cf61e20526472615338ff1af2ccda5bbc0d0e07c8d347e72843701cb2bd5528ef66a1

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
78KB

MD5
57d61d1d2730abdcb9129f8b92eebbec

SHA1
b3f7472aed2b683660fc5e870273824e42db700f

SHA256
875427eef5b6f4a7d1f8578076e8c6dcaacc9cdde370b92c42d0fabceb9a0632

SHA512
a35c09d5c0c92822872182aeaeaf8ea2f8aad041195140983109bd57e01485632d8da680a0c2fc55dd85d586650aba06085e4c2463144cc0a9a41bc4a4c844e7

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
78KB

MD5
4722107cfa3ee74b9ff8a940cff1ab53

SHA1
c6da5f21a3545b573947dbd22fc11bf5bb9d01b2

SHA256
f5242aeed97f00595962de050ad8e138d2b133620e80aea67dc9d63e1a699bdd

SHA512
89b7c0c6136d01caee25af29b34ada4019ff924867903678f683376fa296aadbe01be8db149fc032e2ea9628ac9387943924a50cc1e998d51e0610ad9c1b688e

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
78KB

MD5
7998514d876f8c6e752c04aba7577853

SHA1
6f8394b316822e7b0c8a013a4340820a78bb51a9

SHA256
82d93b31e47633a8f9dc8b1ea0932dd97b0b31e22a70659df2c08692b735d78d

SHA512
56e7eeade459454aa36ce0a8383a9d9811aa9245631bfe65f4eec41f19828c84ad2cecaa0a65d58d36aeb756567b6c1631158562c5a20cff521c2c322f307105

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
78KB

MD5
bcec37bbd2a27e7040e3423a83c5703e

SHA1
58cbacfd76e2f1380ee35aa1b3e4b241b336f356

SHA256
51221b59d62d48ec030349b0e6966eac93b07b72c4e03ca45a741550da025738

SHA512
cc43f4be6b3d91f8c9e8f21374517b866d7d7a2e1b5b105af9611452ed8faa3a948248860951801a012e50dcbd378828b954ed71fdf33b07af80115b0d1309d5

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
78KB

MD5
fe2bf0d82c2add983ebdab86efbb92b5

SHA1
429eb46933505544e14e01be3803b33019911183

SHA256
532704a04b500ca93733c6e31074dd2f6fdbec4759c8e2a3418fe4683e08bfe7

SHA512
0aa6b775186a0ee50aae641f243e6aae6d8531f97c4d6e8c2029d51ea4433bee8171510621f72d6b3cd2bc3d1e2652a66ba47d964735dafc508b77d16b8c5a7b

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
78KB

MD5
f125c276575699905f5f1210d6c25f5a

SHA1
ae6a6259a49bc613b09dcda3f18f5649d0c860be

SHA256
0cf5d0d2eae2d73a04678965234ef3fad933deef67311aa81388d2a7034ab743

SHA512
a7b76816df6add01a1aa93751a4744d0c08d6ab5d07e770964e36647f4a2d390a15f652a1901a36ee0fb5cdbe4a57e9116919642c138e694f9d22916f55116cc

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
78KB

MD5
15ff61390aed642cecfdf44d8eb311cf

SHA1
7cc401bab0992ecb149c7b56ccea3af7311b16c1

SHA256
cb90e3d1dc978dbee5141055390089c588eec364ad53e7499c96b2ede480ce43

SHA512
98825bd93f1089faa809109022c7428244bd0441a2041c1c4e78f327744587cb173bd54312a7223afff92249d504c430616974b4d1f083f056a5469f1aa2ab7f

Download Submit
memory/316-419-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/440-279-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/512-552-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/512-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/628-573-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/840-539-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/840-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/840-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/868-566-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/896-311-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/944-509-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1008-357-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1064-494-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1104-359-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1184-193-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1244-417-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1288-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1348-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1348-579-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1380-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1536-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1628-548-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1656-257-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1752-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1784-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1784-565-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1892-472-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1912-347-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1968-365-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1984-407-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2080-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2128-225-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2152-473-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2164-101-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2192-233-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2212-341-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2224-431-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2264-293-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2304-181-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2336-371-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2364-241-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2400-383-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2480-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2496-335-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2524-584-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2568-483-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2644-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2720-485-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2792-78-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2812-317-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2884-455-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2976-537-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2996-389-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3044-425-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3120-308-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3196-302-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3212-527-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3300-329-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3500-201-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3532-449-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3560-598-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3648-540-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3672-508-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3696-377-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3712-169-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3884-110-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3888-466-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3916-121-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4004-160-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4072-157-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4148-273-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4256-209-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4268-439-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-521-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4388-587-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4508-501-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4752-553-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4756-263-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4760-515-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4776-21-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4808-136-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4876-133-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4884-559-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4888-443-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4896-586-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4896-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4924-117-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4940-593-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4940-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4948-327-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4968-253-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4996-401-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5012-395-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5076-572-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5076-33-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-185-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads