Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/08/2024, 04:17

General

  • Target

    e6afa83abb9c4a45abe9fa5ff3a6319cd9bb194b20c7ca65bb08100bb2566b4d.exe

  • Size

    368KB

  • MD5

    eaf92d7c1e3c89367b50815891fd3808

  • SHA1

    49195545c343f60e29a6e9445048045ac450c2fe

  • SHA256

    e6afa83abb9c4a45abe9fa5ff3a6319cd9bb194b20c7ca65bb08100bb2566b4d

  • SHA512

    17cf9c56639c4f4ecf39b6adb0a0473f61a0544226960df67e648ab623a31f60703d53b30afc5256e13b41fdafa5cdb2306f93530dd4bf02598e5ccabae4c2f9

  • SSDEEP

    6144:gW4w8pMhMjPX6+lTjZXvEQo9dfJBEdKFckUQ/4TIHD4xutM3VOEIuV5t6R+0I/V2:gppMhMrT9XvEhdfJkKSkU3kHyuaRB5tC

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6afa83abb9c4a45abe9fa5ff3a6319cd9bb194b20c7ca65bb08100bb2566b4d.exe
    "C:\Users\Admin\AppData\Local\Temp\e6afa83abb9c4a45abe9fa5ff3a6319cd9bb194b20c7ca65bb08100bb2566b4d.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Windows\SysWOW64\Ihkjno32.exe
      C:\Windows\system32\Ihkjno32.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\SysWOW64\Inebjihf.exe
        C:\Windows\system32\Inebjihf.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Windows\SysWOW64\Iacngdgj.exe
          C:\Windows\system32\Iacngdgj.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1112
          • C:\Windows\SysWOW64\Ihmfco32.exe
            C:\Windows\system32\Ihmfco32.exe
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:4364
            • C:\Windows\SysWOW64\Ilibdmgp.exe
              C:\Windows\system32\Ilibdmgp.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3660
              • C:\Windows\SysWOW64\Iefphb32.exe
                C:\Windows\system32\Iefphb32.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4004
                • C:\Windows\SysWOW64\Ipkdek32.exe
                  C:\Windows\system32\Ipkdek32.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4572
                  • C:\Windows\SysWOW64\Jlbejloe.exe
                    C:\Windows\system32\Jlbejloe.exe
                    9⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:3540
                    • C:\Windows\SysWOW64\Jldbpl32.exe
                      C:\Windows\system32\Jldbpl32.exe
                      10⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3432
                      • C:\Windows\SysWOW64\Jlgoek32.exe
                        C:\Windows\system32\Jlgoek32.exe
                        11⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:3604
                        • C:\Windows\SysWOW64\Jeocna32.exe
                          C:\Windows\system32\Jeocna32.exe
                          12⤵
                          • Adds autorun key to be loaded by Explorer.exe on startup
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:3064
                          • C:\Windows\SysWOW64\Jeapcq32.exe
                            C:\Windows\system32\Jeapcq32.exe
                            13⤵
                            • Adds autorun key to be loaded by Explorer.exe on startup
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3040
                            • C:\Windows\SysWOW64\Jbepme32.exe
                              C:\Windows\system32\Jbepme32.exe
                              14⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:764
                              • C:\Windows\SysWOW64\Kolabf32.exe
                                C:\Windows\system32\Kolabf32.exe
                                15⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Suspicious use of WriteProcessMemory
                                PID:1728
                                • C:\Windows\SysWOW64\Kplmliko.exe
                                  C:\Windows\system32\Kplmliko.exe
                                  16⤵
                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:980
                                  • C:\Windows\SysWOW64\Kidben32.exe
                                    C:\Windows\system32\Kidben32.exe
                                    17⤵
                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:5100
                                    • C:\Windows\SysWOW64\Kekbjo32.exe
                                      C:\Windows\system32\Kekbjo32.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3640
                                      • C:\Windows\SysWOW64\Kabcopmg.exe
                                        C:\Windows\system32\Kabcopmg.exe
                                        19⤵
                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:2180
                                        • C:\Windows\SysWOW64\Kofdhd32.exe
                                          C:\Windows\system32\Kofdhd32.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:3876
                                          • C:\Windows\SysWOW64\Lljdai32.exe
                                            C:\Windows\system32\Lljdai32.exe
                                            21⤵
                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:4900
                                            • C:\Windows\SysWOW64\Lpgmhg32.exe
                                              C:\Windows\system32\Lpgmhg32.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious use of WriteProcessMemory
                                              PID:2404
                                              • C:\Windows\SysWOW64\Lchfib32.exe
                                                C:\Windows\system32\Lchfib32.exe
                                                23⤵
                                                • Executes dropped EXE
                                                PID:5028
                                                • C:\Windows\SysWOW64\Llqjbhdc.exe
                                                  C:\Windows\system32\Llqjbhdc.exe
                                                  24⤵
                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4488
                                                  • C:\Windows\SysWOW64\Lcmodajm.exe
                                                    C:\Windows\system32\Lcmodajm.exe
                                                    25⤵
                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    PID:1912
                                                    • C:\Windows\SysWOW64\Mledmg32.exe
                                                      C:\Windows\system32\Mledmg32.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1068
                                                      • C:\Windows\SysWOW64\Mablfnne.exe
                                                        C:\Windows\system32\Mablfnne.exe
                                                        27⤵
                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Modifies registry class
                                                        PID:3732
                                                        • C:\Windows\SysWOW64\Mpclce32.exe
                                                          C:\Windows\system32\Mpclce32.exe
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          PID:4940
                                                          • C:\Windows\SysWOW64\Mhoahh32.exe
                                                            C:\Windows\system32\Mhoahh32.exe
                                                            29⤵
                                                            • Executes dropped EXE
                                                            PID:1880
                                                            • C:\Windows\SysWOW64\Mbgeqmjp.exe
                                                              C:\Windows\system32\Mbgeqmjp.exe
                                                              30⤵
                                                              • Executes dropped EXE
                                                              PID:3076
                                                              • C:\Windows\SysWOW64\Mqhfoebo.exe
                                                                C:\Windows\system32\Mqhfoebo.exe
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                PID:4508
                                                                • C:\Windows\SysWOW64\Mhckcgpj.exe
                                                                  C:\Windows\system32\Mhckcgpj.exe
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  PID:3044
                                                                  • C:\Windows\SysWOW64\Njbgmjgl.exe
                                                                    C:\Windows\system32\Njbgmjgl.exe
                                                                    33⤵
                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4844
                                                                    • C:\Windows\SysWOW64\Nqmojd32.exe
                                                                      C:\Windows\system32\Nqmojd32.exe
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3760
                                                                      • C:\Windows\SysWOW64\Nckkfp32.exe
                                                                        C:\Windows\system32\Nckkfp32.exe
                                                                        35⤵
                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        PID:3928
                                                                        • C:\Windows\SysWOW64\Nfihbk32.exe
                                                                          C:\Windows\system32\Nfihbk32.exe
                                                                          36⤵
                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          PID:3480
                                                                          • C:\Windows\SysWOW64\Nmcpoedn.exe
                                                                            C:\Windows\system32\Nmcpoedn.exe
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            PID:3620
                                                                            • C:\Windows\SysWOW64\Noblkqca.exe
                                                                              C:\Windows\system32\Noblkqca.exe
                                                                              38⤵
                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              PID:4064
                                                                              • C:\Windows\SysWOW64\Nbphglbe.exe
                                                                                C:\Windows\system32\Nbphglbe.exe
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry class
                                                                                PID:4848
                                                                                • C:\Windows\SysWOW64\Nijqcf32.exe
                                                                                  C:\Windows\system32\Nijqcf32.exe
                                                                                  40⤵
                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2268
                                                                                  • C:\Windows\SysWOW64\Nqaiecjd.exe
                                                                                    C:\Windows\system32\Nqaiecjd.exe
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5068
                                                                                    • C:\Windows\SysWOW64\Ncpeaoih.exe
                                                                                      C:\Windows\system32\Ncpeaoih.exe
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1464
                                                                                      • C:\Windows\SysWOW64\Nmhijd32.exe
                                                                                        C:\Windows\system32\Nmhijd32.exe
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry class
                                                                                        PID:1176
                                                                                        • C:\Windows\SysWOW64\Nofefp32.exe
                                                                                          C:\Windows\system32\Nofefp32.exe
                                                                                          44⤵
                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          PID:4384
                                                                                          • C:\Windows\SysWOW64\Nbebbk32.exe
                                                                                            C:\Windows\system32\Nbebbk32.exe
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3840
                                                                                            • C:\Windows\SysWOW64\Njljch32.exe
                                                                                              C:\Windows\system32\Njljch32.exe
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1872
                                                                                              • C:\Windows\SysWOW64\Nqfbpb32.exe
                                                                                                C:\Windows\system32\Nqfbpb32.exe
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3096
                                                                                                • C:\Windows\SysWOW64\Ocdnln32.exe
                                                                                                  C:\Windows\system32\Ocdnln32.exe
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1264
                                                                                                  • C:\Windows\SysWOW64\Obgohklm.exe
                                                                                                    C:\Windows\system32\Obgohklm.exe
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies registry class
                                                                                                    PID:3144
                                                                                                    • C:\Windows\SysWOW64\Oiagde32.exe
                                                                                                      C:\Windows\system32\Oiagde32.exe
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Modifies registry class
                                                                                                      PID:948
                                                                                                      • C:\Windows\SysWOW64\Oqhoeb32.exe
                                                                                                        C:\Windows\system32\Oqhoeb32.exe
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in System32 directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Modifies registry class
                                                                                                        PID:5076
                                                                                                        • C:\Windows\SysWOW64\Ookoaokf.exe
                                                                                                          C:\Windows\system32\Ookoaokf.exe
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Modifies registry class
                                                                                                          PID:3776
                                                                                                          • C:\Windows\SysWOW64\Ofegni32.exe
                                                                                                            C:\Windows\system32\Ofegni32.exe
                                                                                                            53⤵
                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                            • Executes dropped EXE
                                                                                                            PID:3780
                                                                                                            • C:\Windows\SysWOW64\Oiccje32.exe
                                                                                                              C:\Windows\system32\Oiccje32.exe
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:784
                                                                                                              • C:\Windows\SysWOW64\Oqklkbbi.exe
                                                                                                                C:\Windows\system32\Oqklkbbi.exe
                                                                                                                55⤵
                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                • Executes dropped EXE
                                                                                                                • Modifies registry class
                                                                                                                PID:2576
                                                                                                                • C:\Windows\SysWOW64\Oblhcj32.exe
                                                                                                                  C:\Windows\system32\Oblhcj32.exe
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in System32 directory
                                                                                                                  PID:876
                                                                                                                  • C:\Windows\SysWOW64\Oifppdpd.exe
                                                                                                                    C:\Windows\system32\Oifppdpd.exe
                                                                                                                    57⤵
                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Modifies registry class
                                                                                                                    PID:4516
                                                                                                                    • C:\Windows\SysWOW64\Oqmhqapg.exe
                                                                                                                      C:\Windows\system32\Oqmhqapg.exe
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Modifies registry class
                                                                                                                      PID:2340
                                                                                                                      • C:\Windows\SysWOW64\Ockdmmoj.exe
                                                                                                                        C:\Windows\system32\Ockdmmoj.exe
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5004
                                                                                                                        • C:\Windows\SysWOW64\Opbean32.exe
                                                                                                                          C:\Windows\system32\Opbean32.exe
                                                                                                                          60⤵
                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Modifies registry class
                                                                                                                          PID:2544
                                                                                                                          • C:\Windows\SysWOW64\Ocnabm32.exe
                                                                                                                            C:\Windows\system32\Ocnabm32.exe
                                                                                                                            61⤵
                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in System32 directory
                                                                                                                            PID:3028
                                                                                                                            • C:\Windows\SysWOW64\Ojhiogdd.exe
                                                                                                                              C:\Windows\system32\Ojhiogdd.exe
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Modifies registry class
                                                                                                                              PID:4560
                                                                                                                              • C:\Windows\SysWOW64\Ppdbgncl.exe
                                                                                                                                C:\Windows\system32\Ppdbgncl.exe
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Modifies registry class
                                                                                                                                PID:3368
                                                                                                                                • C:\Windows\SysWOW64\Pfojdh32.exe
                                                                                                                                  C:\Windows\system32\Pfojdh32.exe
                                                                                                                                  64⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  PID:2560
                                                                                                                                  • C:\Windows\SysWOW64\Pimfpc32.exe
                                                                                                                                    C:\Windows\system32\Pimfpc32.exe
                                                                                                                                    65⤵
                                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    PID:1852
                                                                                                                                    • C:\Windows\SysWOW64\Ppgomnai.exe
                                                                                                                                      C:\Windows\system32\Ppgomnai.exe
                                                                                                                                      66⤵
                                                                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:4868
                                                                                                                                      • C:\Windows\SysWOW64\Pfagighf.exe
                                                                                                                                        C:\Windows\system32\Pfagighf.exe
                                                                                                                                        67⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2296
                                                                                                                                        • C:\Windows\SysWOW64\Piocecgj.exe
                                                                                                                                          C:\Windows\system32\Piocecgj.exe
                                                                                                                                          68⤵
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4016
                                                                                                                                          • C:\Windows\SysWOW64\Pafkgphl.exe
                                                                                                                                            C:\Windows\system32\Pafkgphl.exe
                                                                                                                                            69⤵
                                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1896
                                                                                                                                            • C:\Windows\SysWOW64\Pfccogfc.exe
                                                                                                                                              C:\Windows\system32\Pfccogfc.exe
                                                                                                                                              70⤵
                                                                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                              PID:748
                                                                                                                                              • C:\Windows\SysWOW64\Pjoppf32.exe
                                                                                                                                                C:\Windows\system32\Pjoppf32.exe
                                                                                                                                                71⤵
                                                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2980
                                                                                                                                                • C:\Windows\SysWOW64\Pplhhm32.exe
                                                                                                                                                  C:\Windows\system32\Pplhhm32.exe
                                                                                                                                                  72⤵
                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:1328
                                                                                                                                                  • C:\Windows\SysWOW64\Pjaleemj.exe
                                                                                                                                                    C:\Windows\system32\Pjaleemj.exe
                                                                                                                                                    73⤵
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:5132
                                                                                                                                                    • C:\Windows\SysWOW64\Pidlqb32.exe
                                                                                                                                                      C:\Windows\system32\Pidlqb32.exe
                                                                                                                                                      74⤵
                                                                                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                      PID:5172
                                                                                                                                                      • C:\Windows\SysWOW64\Pakdbp32.exe
                                                                                                                                                        C:\Windows\system32\Pakdbp32.exe
                                                                                                                                                        75⤵
                                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:5216
                                                                                                                                                        • C:\Windows\SysWOW64\Ppnenlka.exe
                                                                                                                                                          C:\Windows\system32\Ppnenlka.exe
                                                                                                                                                          76⤵
                                                                                                                                                            PID:5260
                                                                                                                                                            • C:\Windows\SysWOW64\Pfhmjf32.exe
                                                                                                                                                              C:\Windows\system32\Pfhmjf32.exe
                                                                                                                                                              77⤵
                                                                                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:5332
                                                                                                                                                              • C:\Windows\SysWOW64\Pmbegqjk.exe
                                                                                                                                                                C:\Windows\system32\Pmbegqjk.exe
                                                                                                                                                                78⤵
                                                                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:5372
                                                                                                                                                                • C:\Windows\SysWOW64\Qppaclio.exe
                                                                                                                                                                  C:\Windows\system32\Qppaclio.exe
                                                                                                                                                                  79⤵
                                                                                                                                                                    PID:5412
                                                                                                                                                                    • C:\Windows\SysWOW64\Qbonoghb.exe
                                                                                                                                                                      C:\Windows\system32\Qbonoghb.exe
                                                                                                                                                                      80⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:5448
                                                                                                                                                                      • C:\Windows\SysWOW64\Qfjjpf32.exe
                                                                                                                                                                        C:\Windows\system32\Qfjjpf32.exe
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:5492
                                                                                                                                                                        • C:\Windows\SysWOW64\Qiiflaoo.exe
                                                                                                                                                                          C:\Windows\system32\Qiiflaoo.exe
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          PID:5532
                                                                                                                                                                          • C:\Windows\SysWOW64\Qbajeg32.exe
                                                                                                                                                                            C:\Windows\system32\Qbajeg32.exe
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                            PID:5608
                                                                                                                                                                            • C:\Windows\SysWOW64\Qjhbfd32.exe
                                                                                                                                                                              C:\Windows\system32\Qjhbfd32.exe
                                                                                                                                                                              84⤵
                                                                                                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                              PID:5648
                                                                                                                                                                              • C:\Windows\SysWOW64\Amfobp32.exe
                                                                                                                                                                                C:\Windows\system32\Amfobp32.exe
                                                                                                                                                                                85⤵
                                                                                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                PID:5704
                                                                                                                                                                                • C:\Windows\SysWOW64\Apeknk32.exe
                                                                                                                                                                                  C:\Windows\system32\Apeknk32.exe
                                                                                                                                                                                  86⤵
                                                                                                                                                                                    PID:5744
                                                                                                                                                                                    • C:\Windows\SysWOW64\Afockelf.exe
                                                                                                                                                                                      C:\Windows\system32\Afockelf.exe
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5796
                                                                                                                                                                                      • C:\Windows\SysWOW64\Aadghn32.exe
                                                                                                                                                                                        C:\Windows\system32\Aadghn32.exe
                                                                                                                                                                                        88⤵
                                                                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:5840
                                                                                                                                                                                        • C:\Windows\SysWOW64\Abfdpfaj.exe
                                                                                                                                                                                          C:\Windows\system32\Abfdpfaj.exe
                                                                                                                                                                                          89⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:5880
                                                                                                                                                                                          • C:\Windows\SysWOW64\Ajmladbl.exe
                                                                                                                                                                                            C:\Windows\system32\Ajmladbl.exe
                                                                                                                                                                                            90⤵
                                                                                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5928
                                                                                                                                                                                            • C:\Windows\SysWOW64\Apjdikqd.exe
                                                                                                                                                                                              C:\Windows\system32\Apjdikqd.exe
                                                                                                                                                                                              91⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5968
                                                                                                                                                                                              • C:\Windows\SysWOW64\Abhqefpg.exe
                                                                                                                                                                                                C:\Windows\system32\Abhqefpg.exe
                                                                                                                                                                                                92⤵
                                                                                                                                                                                                  PID:6016
                                                                                                                                                                                                  • C:\Windows\SysWOW64\Ajohfcpj.exe
                                                                                                                                                                                                    C:\Windows\system32\Ajohfcpj.exe
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                      • C:\Windows\SysWOW64\Aibibp32.exe
                                                                                                                                                                                                        C:\Windows\system32\Aibibp32.exe
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                        • C:\Windows\SysWOW64\Aaiqcnhg.exe
                                                                                                                                                                                                          C:\Windows\system32\Aaiqcnhg.exe
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          PID:5128
                                                                                                                                                                                                          • C:\Windows\SysWOW64\Abjmkf32.exe
                                                                                                                                                                                                            C:\Windows\system32\Abjmkf32.exe
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                            PID:5180
                                                                                                                                                                                                            • C:\Windows\SysWOW64\Ajaelc32.exe
                                                                                                                                                                                                              C:\Windows\system32\Ajaelc32.exe
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5196
                                                                                                                                                                                                              • C:\Windows\SysWOW64\Ampaho32.exe
                                                                                                                                                                                                                C:\Windows\system32\Ampaho32.exe
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:5404
                                                                                                                                                                                                                • C:\Windows\SysWOW64\Apnndj32.exe
                                                                                                                                                                                                                  C:\Windows\system32\Apnndj32.exe
                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                    PID:5456
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Abmjqe32.exe
                                                                                                                                                                                                                      C:\Windows\system32\Abmjqe32.exe
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Ajdbac32.exe
                                                                                                                                                                                                                        C:\Windows\system32\Ajdbac32.exe
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Bmbnnn32.exe
                                                                                                                                                                                                                          C:\Windows\system32\Bmbnnn32.exe
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:5736
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Bboffejp.exe
                                                                                                                                                                                                                            C:\Windows\system32\Bboffejp.exe
                                                                                                                                                                                                                            103⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5772
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Biiobo32.exe
                                                                                                                                                                                                                              C:\Windows\system32\Biiobo32.exe
                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Bbaclegm.exe
                                                                                                                                                                                                                                C:\Windows\system32\Bbaclegm.exe
                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Bjhkmbho.exe
                                                                                                                                                                                                                                  C:\Windows\system32\Bjhkmbho.exe
                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  PID:6000
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Bmggingc.exe
                                                                                                                                                                                                                                    C:\Windows\system32\Bmggingc.exe
                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Bdapehop.exe
                                                                                                                                                                                                                                      C:\Windows\system32\Bdapehop.exe
                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                        PID:3048
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Bfolacnc.exe
                                                                                                                                                                                                                                          C:\Windows\system32\Bfolacnc.exe
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          PID:5276
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Binhnomg.exe
                                                                                                                                                                                                                                            C:\Windows\system32\Binhnomg.exe
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                              PID:5360
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Bphqji32.exe
                                                                                                                                                                                                                                                C:\Windows\system32\Bphqji32.exe
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:5524
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Bfaigclq.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\Bfaigclq.exe
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:5692
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Bipecnkd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\Bipecnkd.exe
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:5816
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Bagmdllg.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\Bagmdllg.exe
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5916
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Bdeiqgkj.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\Bdeiqgkj.exe
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                        PID:5984
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Ckpamabg.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\Ckpamabg.exe
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:6140
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Cmnnimak.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\Cmnnimak.exe
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                              PID:5200
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\Cdhffg32.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\Cdhffg32.exe
                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                PID:5520
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Cienon32.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\Cienon32.exe
                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                  PID:5712
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Calfpk32.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\Calfpk32.exe
                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Ccmcgcmp.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\Ccmcgcmp.exe
                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                      PID:6044
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Cigkdmel.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\Cigkdmel.exe
                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                        PID:5224
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Cmbgdl32.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\Cmbgdl32.exe
                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5632
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Cdmoafdb.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\Cdmoafdb.exe
                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:5832
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Ckggnp32.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\Ckggnp32.exe
                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                PID:5160
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Caqpkjcl.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\Caqpkjcl.exe
                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:5656
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Ccblbb32.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\Ccblbb32.exe
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:6104
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Ckidcpjl.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\Ckidcpjl.exe
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                      PID:5912
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\Cpfmlghd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\Cpfmlghd.exe
                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:3748
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\Dgpeha32.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\Dgpeha32.exe
                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:1168
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Dgbanq32.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\Dgbanq32.exe
                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:4272
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Diqnjl32.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\Diqnjl32.exe
                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:1664
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 428
                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:1632
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4420,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
                        1⤵
                          PID:5184
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1664 -ip 1664
                          1⤵
                            PID:1008

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\SysWOW64\Bboffejp.exe

                            Filesize

                            368KB

                            MD5

                            fb4b48670206c957a4dd5fb80e5c065b

                            SHA1

                            e6ab475c87fd13ee1ef84688209c8f62e74bb24e

                            SHA256

                            534134f9d27cff087cdab8ea9909dcbe75ada2da2aa80711d1f3f3f6077b1f8c

                            SHA512

                            ca31319aee28bae1b192830f0f3768c4c8c13240be387d727b7b936bc61631541049edab10569c0fdae9e8533c7e72ea72c174048b0c7a17ab33041721f4b8ca

                          • C:\Windows\SysWOW64\Biiobo32.exe

                            Filesize

                            368KB

                            MD5

                            c7433e4b73b68650d944bed00a6e0796

                            SHA1

                            562bb54a1b093677423f41e3ac27dcd7d3f56c11

                            SHA256

                            9a8d296930de8930eb564f2c12c448797cfaeabbc3494449ea27c96695416667

                            SHA512

                            a13ee27b1569cab776457371fda495ad9902ff727dd7931fdf90f5cd76a1d7511067cf94cd5ec07ddac4bcc73d86be8a7ddeb89dd930a9a6ea0f39a9289cd59f

                          • C:\Windows\SysWOW64\Cdhffg32.exe

                            Filesize

                            368KB

                            MD5

                            2dda96512daecfb07b660592fe65cf50

                            SHA1

                            4e073626b8ddd534cbd4865c3b275a778b313af5

                            SHA256

                            74e3ba9657828d5bbaf7f54d307d3c544a9f7e6bb3bc27e3e9d8d3005ad3b955

                            SHA512

                            cde8dd4bf9ae63b033d6d5d668c85f344493b8c61f0b707340f6b0b2b1d1d3db9706547f831f2940e9b8822f447ff5da765d7f138b85c66213bc2460db6bb63a

                          • C:\Windows\SysWOW64\Cmbgdl32.exe

                            Filesize

                            368KB

                            MD5

                            056d263808762fed6258ab3d98979f0f

                            SHA1

                            e3668a877d00b79c293cf0fd3172328d5f37ef39

                            SHA256

                            01a9249b19e851e1d90293f2f70c05399e338741a4fcf0046d224a4c1193e275

                            SHA512

                            662705410558120c284bf1ae60dfa5098c3f7a79266b09c4d4977655957e29e85840881e3e7053219ca31bd90a8ac58b4f505bd2a0a13292ed63ebf6cbaa2958

                          • C:\Windows\SysWOW64\Deocpk32.dll

                            Filesize

                            7KB

                            MD5

                            c5b81c3ce1543ed6bbe66cdb6e807ee3

                            SHA1

                            94b8925e23b27fb9330ff8518b116ba4eb5a9513

                            SHA256

                            8c2c298fa5282476a022e5ebfb01fa75d510edc008d709f051d356385ee1e6ed

                            SHA512

                            1b193ab47b37a51aa16fe6c6e064348a9f8eb10ecbe55e3c80248e99c3794ad5bf09f2c6702c580e03e88a8f260feeffb443cb24d390b5b31a6e8b8a287fdbc4

                          • C:\Windows\SysWOW64\Dgpeha32.exe

                            Filesize

                            368KB

                            MD5

                            3c46e3b200c815f54dae2fd050b5688b

                            SHA1

                            b20685a09923603c473b3671f8346d802fc43499

                            SHA256

                            36bdb882227d90b5e2b78d38364b0028bd3b7c4f1bb084159ec96de93f3a5f14

                            SHA512

                            67beb7780ff5a1b35a2b7df503a57aec88b34827ec74f99161a77d39e449ba0332aeb2a6c6a57be525409fc635d05849443f93968afe8592b70e1aa44615ae06

                          • C:\Windows\SysWOW64\Iacngdgj.exe

                            Filesize

                            368KB

                            MD5

                            377a227b6d22fcf359c8e8f948de07a0

                            SHA1

                            b615183c478e78fd7b764ca48e1aeb7ec37a2628

                            SHA256

                            45ebe2234aff49d910424bd16580a79e7a14b41b3566f2fb7efece1b0d1551e5

                            SHA512

                            56359bd995ae4a3332be090050bb99095d1abe86c3f607a9b25d1215c1194e01cd4e52b5723400574437c640f783603fcec31d44d08d1df7e7b97033c7b4bf8a

                          • C:\Windows\SysWOW64\Iefphb32.exe

                            Filesize

                            368KB

                            MD5

                            f57581d69c69d2c2207f312df8a0ca5d

                            SHA1

                            9590bca721799976380a47b209240c30c07184a0

                            SHA256

                            d89ef141e7f16b83afadc8442c1e8070861a9dc131ca8cd94df005e039cd07f6

                            SHA512

                            a923e4a55f5cef1fd090f6e0c0d8e463d3c5f6eac2c30c3792269f4aaf903db9f97345988d5fc3e657c4f38132ad40f8938bf9a22d0d38ac9412de13522272e2

                          • C:\Windows\SysWOW64\Ihkjno32.exe

                            Filesize

                            368KB

                            MD5

                            cf721817494b26b6f11a776b41d1f266

                            SHA1

                            abfe26eaa43aa3dbced18b5044e6759c5e40b443

                            SHA256

                            86b0491a049c73eb9a8b77b1e3425aeb2f42f4cb9a8970ea65a78b57ba70d1b8

                            SHA512

                            ff2e954f30509fdad04c9657c7df2c19cc80c43741db5100861a6e7811d4778072b0e43a2013ebeb0c27a18367b70c34cd9c17d02848930d368ce4a8b0aba192

                          • C:\Windows\SysWOW64\Ihmfco32.exe

                            Filesize

                            368KB

                            MD5

                            5453bc77c06d30fd5f0911be8d24ddf2

                            SHA1

                            5f65da49bb4986e9d0b6d41112d9abb15230fc2f

                            SHA256

                            72ec716948ac9722ac204641fac67ed8e4d151e02909c2db46a9c7e4f7dcc348

                            SHA512

                            041b8400989ba0d1ce6b976172ddb5f6090c2bbeae01f329a5e57729d141e8ffb53628f531c07f80204668575b34c27202c84c93ee377eaa3877e6ab0738070c

                          • C:\Windows\SysWOW64\Ilibdmgp.exe

                            Filesize

                            368KB

                            MD5

                            eb9e84e300045b093af93a2fd1112ed4

                            SHA1

                            389d3d3074a1686835dba219bae3ac83dcde3d26

                            SHA256

                            eb7c39ddb2c7aa700284384b75ecf1f62a91b1513cd087a508b23ec8a779231b

                            SHA512

                            ae01f614d15c45e0916d5c29aa4efe106b3d0d52b7f8cd73b3e16817d1e8d5b1a8ab15bd5f2606e8e47b069f93065979eb64c075881a43522aa23e67f3274986

                          • C:\Windows\SysWOW64\Inebjihf.exe

                            Filesize

                            368KB

                            MD5

                            3365e9559ff0f91ca5015d7a32a3caa0

                            SHA1

                            820ce8ff52cc3d3147f9bf418836deaca23a4a40

                            SHA256

                            c94ae7ae0788256fd717847ffba07fe810ad54a8003e2e5a1585c1cab6d5f432

                            SHA512

                            4caaee99234220f995ae5a0142f0764f5fdb2439b4086a3c99620cb1989c63b76be5c781acdb392586f7e0530f0d2b4a4dbae6ff0632bced52de5d47c3e315b4

                          • C:\Windows\SysWOW64\Ipkdek32.exe

                            Filesize

                            368KB

                            MD5

                            8819dfe2d52aa993f50aa1a830c0eb78

                            SHA1

                            810566fc82353e63d2543395fb66d687f099a70b

                            SHA256

                            92714d2eb5cb31b3ef899c9b8101e62cea0b2d1ce8cd8f0b2ff15b0d41d1413d

                            SHA512

                            413235a9b0edc47d507de101781b36e0f69aef2eab6ee674f6f8e819abc69cf936572c298ebe5c39ffad3fb70fd2a02d52d340f9f0cf14c42c872fd336f09809

                          • C:\Windows\SysWOW64\Jbepme32.exe

                            Filesize

                            368KB

                            MD5

                            473827ccf2b691e4c87ade21323e5c98

                            SHA1

                            1d344040fb4bd874675bf1fb9909db3fc03daa95

                            SHA256

                            aa1d7e9f01383dc30256a0c3d465774698727561c6300aa7d759ea7ea81ccc7f

                            SHA512

                            1eaced4b1ce76f4816c7e1b42d47b88a6f0a7084b737cf82fb289392f4c3fc2c7e897d9ef301651b09571da8813e464a5bb9188be63afe838f6b721e7056afeb

                          • C:\Windows\SysWOW64\Jeapcq32.exe

                            Filesize

                            368KB

                            MD5

                            f133d1e2a96bb99a538d06fc6677e14b

                            SHA1

                            c32dda0cad69ffacde411447c5b3a38fad3d6a3d

                            SHA256

                            7b747d65b6f7588cb64d8c2cdf448e16292fbe67ca16f32c5b66797affa29e3a

                            SHA512

                            80af0667cb20524ab612af06e0106341e88ae1e422ca6e15d62779f1140a2ba6ed2eddba30943eb4603c21ad19e190675108c8ac9464b87cacc28efc486a9206

                          • C:\Windows\SysWOW64\Jeocna32.exe

                            Filesize

                            368KB

                            MD5

                            0215ccaaf8ec3504df8223c382fd8dcb

                            SHA1

                            aa1b7b13aac133588e3ff8e46e68d889521b7f3f

                            SHA256

                            f839bf9107d69d57bf2240b1380f43c0bf9972efe706159b6cad8eb2cdd33bf7

                            SHA512

                            994e2eb302035305408fc02fb50061ca5314ca38f53a5193c35e2bb77c3bd82fb24769b608097bed67bc5e51f7a85ece127de138211985837ffb8bd2fbcb5331

                          • C:\Windows\SysWOW64\Jlbejloe.exe

                            Filesize

                            368KB

                            MD5

                            715cc5e52cda96b86ab01460fc35b513

                            SHA1

                            4e3fede09e9b19f74f88f6d6b2e2e8efd8e43a66

                            SHA256

                            5e20f096bf70ed523d6b81869f8744d955329250b6b1b19c7175825e7ada0b6c

                            SHA512

                            ca81ac7eba60eba656c1a382f0cd1402b401ba2b22da11410f25fdc2fc033da6503ba066ca974bcde8202dbc02c5f37e8ffd8c712686cc8ef009801a06da3ca3

                          • C:\Windows\SysWOW64\Jlbejloe.exe

                            Filesize

                            368KB

                            MD5

                            580fb97a63d3d0a4a89248e0464644cc

                            SHA1

                            323a84ff99ed3e141fca4fc1897440e857dec9be

                            SHA256

                            dc23072a4aa78b43fee0b54ad373fd3224f92bea406c851f60243c7c8a8fcdaf

                            SHA512

                            c01d57cc57031daa75ea84aafcc0909e66ca5d8a6a0b3fe9fc2645044264829079807591d112d587d2256972360d6d4f8ab7898f87560ec4bdedbbe3af1936a3

                          • C:\Windows\SysWOW64\Jldbpl32.exe

                            Filesize

                            368KB

                            MD5

                            ec75378f2a13ab61937b85d02fb28735

                            SHA1

                            f16794bf31125b9267ab45cdb7814fee7ed7e1b1

                            SHA256

                            fe0c0822ec167a6644edda04ab869012b14c5abd567cb45249f7c34daaebe179

                            SHA512

                            c34c2ef17720945225109a685a5681a6fb758731711e07201e530b6c6ca45e9d9e8450dc06d1a7f742e5d3d53418c3c939dc4e7f2da62a30d62bf27d8a691322

                          • C:\Windows\SysWOW64\Jlgoek32.exe

                            Filesize

                            368KB

                            MD5

                            c5c54091dd10c9907eb74d71cb46b48a

                            SHA1

                            ab34bd98980a25c3b90a56decf3b850f6b5e67ca

                            SHA256

                            801b1a253baca833946a47ac8f0143ae02412648cc10d298c998e905c5e47fac

                            SHA512

                            038a305a82aac9ac1c42dd546f32f7e7ef7db7f2f34d389e0d8c91eabe7d49e81ed014b36ff5dedad995e631bf51b255202c07882c36878813e08de2b5d96169

                          • C:\Windows\SysWOW64\Kabcopmg.exe

                            Filesize

                            368KB

                            MD5

                            7f96d76f7b62a967648c8b61025dbd58

                            SHA1

                            c2a90d0f08a7b0504dcdc8b79399001ca9a739be

                            SHA256

                            95fe4e09b73c0be9b40412928e69dc68ca14e6145a9591d09149262a61257fa4

                            SHA512

                            dc9a47ee956b4b5a5d192574d27a90b71c991deaf26ee8e61e8a8a9bdf88df96d7bbd1f281b2a80279fbd3eb937ee7d1f6a9756c5fe147e821dabce3d159fb40

                          • C:\Windows\SysWOW64\Kekbjo32.exe

                            Filesize

                            368KB

                            MD5

                            9b56ccef5314245bb4c07c8713215533

                            SHA1

                            3e31ac9cf58d8d01bc1c8f660fb9c6a233dd419e

                            SHA256

                            49365211c783e4b27d731f6577f95271c344c1d59cb6dfa4a76e5903a261ae68

                            SHA512

                            8d5e62f98a6e067c3179ac01a26ab6f34f06dc9fdb50cc6cf2f7c3d967b027a9c88a28a95719c54861a63a19bc708925b5cf197bc13d9eec4c321dd829414c71

                          • C:\Windows\SysWOW64\Kidben32.exe

                            Filesize

                            368KB

                            MD5

                            718e0236ee38bce9e5705c7cc2a48b6c

                            SHA1

                            1e0a682bb52fa4bbb1aa62d6ebdb3784ded1251c

                            SHA256

                            074225882ee5bf7b3a944dd56b05157a25bffdc04450c322f125d7eb77b8dc90

                            SHA512

                            ab4b046be7d8dc4b4f45bb58aed780f731799a3ee610e35ba214d4d91d7f39c35920445e1cd9ec22044d0d32ee71d446e0652ca7ad8adb999c1f1c9c6638ea0b

                          • C:\Windows\SysWOW64\Kofdhd32.exe

                            Filesize

                            368KB

                            MD5

                            f4a0bb4d25f13ab3ce4a72577398bcf9

                            SHA1

                            3eeb2413dceacb35d248c1fb44cb3bd8d53f54ca

                            SHA256

                            8542b0c099d3f8ffefbb937db5565cbd8ad33e0fe9764c7703d1a9c313fe63ea

                            SHA512

                            3bd06ee280bb82d185f2e0466772621808f90b8d5b4d52e89868f04c30c84f3330eca18973ee80ffe2244cb9921ec5ba28ef44592fa6d3be6a25725cfdbb828a

                          • C:\Windows\SysWOW64\Kolabf32.exe

                            Filesize

                            368KB

                            MD5

                            e1cb832609e27777054bade545c21369

                            SHA1

                            3855bbddae037c5fbf5f18d9fc90e96454c21b25

                            SHA256

                            3fbce105804c609c9d6cc6270b24ae4510a3c0a30c4df2ca6e95a7b3561a5dbe

                            SHA512

                            25f7fc4fc8fb6a0e90c679e7ec5d2bff440651574a77eb246f1df0e958bd0bddd91251c6d7e16c44582b1cd2e01a43e52012774797a1a7355fd2302a42dcd53a

                          • C:\Windows\SysWOW64\Kplmliko.exe

                            Filesize

                            368KB

                            MD5

                            c31f5bbb974d0ff0bd346311a62d0cb9

                            SHA1

                            22e748c7562670a67ada08a5441d88686ec1a66e

                            SHA256

                            5a6863e6b2b68d096e601611d73008895a2a2a06e542c058cec981acd9a6a77d

                            SHA512

                            704a1d69d8944667627d5ce3290fa646e45e5e8a24353e27ff2db07e243d3c9a43bd3a395bbdd9719f005dc5a0283ccd665fbe2118ccdbcc948d2d9da62094e0

                          • C:\Windows\SysWOW64\Lchfib32.exe

                            Filesize

                            368KB

                            MD5

                            a48e9f5686a9bdc4733de3a203f80708

                            SHA1

                            0d60ad4024829c7fe04e1ba9be49ba582925576d

                            SHA256

                            2b15ae42fdeca7b365804bef6e1618a6094536fa1472fb00cca3c667c5a02860

                            SHA512

                            87f4be00f631c41b2b2e0e1a99594b1f1702cfaa87c6bbf419b72d2bc7a0214cbfa5a35b849e0644928e2d9f6a00ea8c2d373bc99cfc980a4c78529d27aef686

                          • C:\Windows\SysWOW64\Lcmodajm.exe

                            Filesize

                            368KB

                            MD5

                            8f0b0409be1403c6194c1790c5987342

                            SHA1

                            32532ce7ddf48d4e9b0438facc27c50af17c9749

                            SHA256

                            ae9e7a9759def99af9ca73f0f5f26204cceebaf31e9b83ccc0c9071e0c7483e7

                            SHA512

                            adb62fb41df77a6ebc2c4226fbc22d37a87fe170d5e3c443e075723dfbecf3733c62178110abb40e7db4a1ca9bc0047f757499878cd7400e5a192cd63457f3ee

                          • C:\Windows\SysWOW64\Lljdai32.exe

                            Filesize

                            368KB

                            MD5

                            bac1bad2b8cd0843ed3134f8df3758bf

                            SHA1

                            c7a9c9eeff867e61de97ddec6253d4652cd00f46

                            SHA256

                            d4118bec993963352874f31f2e960e34c97cc9621c9b010b5bb9f2eb230aa840

                            SHA512

                            b35c972bc41cf2ab234bb703269174e5625450684ba564d6e8d52550bcd5208aef62d117607f5cdaf111cb387caf711b47738d754dad84e6bbca252bd4d599e5

                          • C:\Windows\SysWOW64\Llqjbhdc.exe

                            Filesize

                            368KB

                            MD5

                            cd1aebd908eab8d24e61519baa11cb92

                            SHA1

                            a546f6698e6910e404daf4f6db3879a3bf5092e1

                            SHA256

                            b8f7d0055f89305128b5e28c926aabb40fa4a43c20d25a6efb640a9339a75c24

                            SHA512

                            342c067ecc5f5d172ec48df2c85392c71badabb8960684c87f6a4af3d9c896e95301c944f78e3dcc6c71344471d5a61208c4dc77e295e8a2207d9107e3074187

                          • C:\Windows\SysWOW64\Lpgmhg32.exe

                            Filesize

                            368KB

                            MD5

                            398aded4fba5a2062a0063cad5b27150

                            SHA1

                            35b3a628238076c5a8c09cb211e1d587b27579ac

                            SHA256

                            3b405e3dee23f98ffc24963113237dc18fc3002f474474adb23125e3a0fbc039

                            SHA512

                            868b51e6ebb012db260b1eebca56145c10f256d14af73d15945105d3b7300257bc8a81645c1edef6bede6accb2ad954e8025f0f0f57735431487dc09cba7d6ab

                          • C:\Windows\SysWOW64\Mablfnne.exe

                            Filesize

                            368KB

                            MD5

                            b6c498c2727047206e95c5346e28e28a

                            SHA1

                            93df542ab5f2167333cd5231c820623ef8190a9c

                            SHA256

                            4513235a16fb2c9c66fe3543d383ed035dcfd9ca514baa6fa1b4ca33912d0b0e

                            SHA512

                            f2303d4e65236e46f48a7a5a8c62b1dfc4a8a1dd4f3d7080d2aeedf03231f324b45be702dfd0cb9bcde7a5def7ad15832e25b902a497df19e42f52e7afb6e95b

                          • C:\Windows\SysWOW64\Mbgeqmjp.exe

                            Filesize

                            368KB

                            MD5

                            70221df8a9ab7bdc85de4246037d4913

                            SHA1

                            6571a5db7dffb34720376f664ae7467a9c2d1ded

                            SHA256

                            c2e0543fc9a56f1f6c5f98f0774f13d2adafc910ce6fb66abd1e9e007cc75180

                            SHA512

                            eae86e00d14903af40f6102a7308c7d70e334b834fd21b620a669184edee2261e6ab13d859554d8eca5a05d8c4948bdfcbcf0eda33c0365fdb0856d7e4408ef4

                          • C:\Windows\SysWOW64\Mhckcgpj.exe

                            Filesize

                            368KB

                            MD5

                            19d42798ad3e32335ed7b4f5058777bb

                            SHA1

                            85a1eb9e908fc1014c54a446b292ac63363bc562

                            SHA256

                            4c657d282b8497766ce5c89f5e054f819a00553030605c022ff57b6d6642b0b4

                            SHA512

                            5e4fa3052694e3c719ce5f377138121b6fa7cbec830156e923f204d022371623f6212c3a940e1b7ad735298411d50695e80bb43781a3d7ac5f6623ffba013ceb

                          • C:\Windows\SysWOW64\Mhckcgpj.exe

                            Filesize

                            368KB

                            MD5

                            da4de7f7076276dd35346a6c2f58b49d

                            SHA1

                            7481adb9c6bdacc5a7e23e84d033a86c5c5ddb0f

                            SHA256

                            ea338e405511be54a19b0696e823edc27ae7eef48df6be66dbb19218b00b9f24

                            SHA512

                            3bdceb260b3e09a185d07854eb468e52d0ce99bcc1c005451dfa549607a1b54e3a6c81bed27b1c0eb5dcbcab5ac0bcd0ebb1e4a8cdd0b6ed43d9553b58506c41

                          • C:\Windows\SysWOW64\Mhoahh32.exe

                            Filesize

                            368KB

                            MD5

                            918c2959ca2e8ca537187adf35dc8eaa

                            SHA1

                            23d763952e6cd795fbff338ef68d193caf7710c6

                            SHA256

                            c7e4d2a918aa5b8806d43a56fb9d47a609b2c9147c997b611cf9a5e288718587

                            SHA512

                            4cdcec908fab4aab6c1207d0c75ada40c4cd9b7902d203704e1a70edae2bd58734cb723c6fb5710255cd2368139121e0705f432db6eaaac688902fce02c657ca

                          • C:\Windows\SysWOW64\Mledmg32.exe

                            Filesize

                            368KB

                            MD5

                            7918f5180f76bba06cadf8da04440ff6

                            SHA1

                            f6a5a51911b92d45bf8d892c464ae36bdb080161

                            SHA256

                            c0a9b6d7559fbe4c7f7e0a37ae1e5eb9508b5aa5090ecd9e02b4bbc21b963bec

                            SHA512

                            39abd0b90f1c0d95b9f1aa9790c12f05e6dd5abef1a82b39dc27d61688fca6cebb0fc1ffd082b1563e76caf788ac40225391f111503c651c01e125c237e146d5

                          • C:\Windows\SysWOW64\Mpclce32.exe

                            Filesize

                            368KB

                            MD5

                            b07c303c22a9a2fbdaddfa26eb1dcb65

                            SHA1

                            b740926a8cc763a04bfd1e00663e860c3ac9f604

                            SHA256

                            598db8230e7e4039e4ab4bff693e556a03e82c713859dceaeb5f79a1d9e65838

                            SHA512

                            2e819b4fed78f9ea7e1450b08cf9a23b4f1f35135a8fda2c2f1f209778005f7ddddcc91bf9f8349d41fccdeded4ad6edfd82e9ce816d5897b5def81a1160abfe

                          • C:\Windows\SysWOW64\Mqhfoebo.exe

                            Filesize

                            368KB

                            MD5

                            b4f67fb2df76f292419d795888219c88

                            SHA1

                            15dedd9493b7e92a67cf2dbdc302316696bd1b50

                            SHA256

                            e390ddfad8a02689341fff9ec55c7af5b567a7261430da8025812df6cf999bf8

                            SHA512

                            f34ea6c4d245a65cd7ca1dbbc30b46f8815489a8e60887dad1670d07cbfcdff47bb45340aa0222a62982908ff7c0b57bfae3fab0d7d2978d3f0955323b0cb792

                          • C:\Windows\SysWOW64\Ncpeaoih.exe

                            Filesize

                            368KB

                            MD5

                            27f08024eaddfc6f0371b9ec021b173d

                            SHA1

                            48e091a4a8ee73b649f561f9891d12594844ab9c

                            SHA256

                            ec3b759663104567d1a6d675d944ff2d5e8d297032025cc57f3b2c65676e9c60

                            SHA512

                            e10064c5b734c06c20d33d5ebc53bd370321d996c2a963811fafc2378393982bcb297c3cf1305b803f518c475d074bbd4d08e510a7d06db53d71f2bfab069e3a

                          • C:\Windows\SysWOW64\Njbgmjgl.exe

                            Filesize

                            368KB

                            MD5

                            412e73b8d264b5cee36876285fe910b4

                            SHA1

                            6b31fdcf26413aaa5774a40f6617e9806386ca90

                            SHA256

                            17640dfa0a89ae484b77d74fdaa1ce5cbf3d606f74f6ef54714cd1bf1b72eccf

                            SHA512

                            47b62d973d7ebfab427732a83315332ae492926805a7c0f595481d62d3ab898e8280acf2255628b6a9dfe28d79fb851382975725160e38946db1e80065beb9f0

                          • C:\Windows\SysWOW64\Oqklkbbi.exe

                            Filesize

                            368KB

                            MD5

                            76d4775a0859c382d23c44803ab3e704

                            SHA1

                            e01bef7d65a6499cd1d78c1947683324e7de2940

                            SHA256

                            b8afe0d261350ffe0b6b534b7ad8889608644dc55742c69149a92cfe59a4d8f9

                            SHA512

                            93e8812d38121dad8677019b368f2bedcfb0112597c579d7d5ae4ec3d734cc4a8491eed5bdc693f7e7d9a7da42d2d5d0ac2f45847fb4ef116a664efa4b2bf129

                          • C:\Windows\SysWOW64\Pfojdh32.exe

                            Filesize

                            368KB

                            MD5

                            95c81e49103a72837293f7518f8a7f85

                            SHA1

                            5745ed77e0e5981d10fe4b59bf8c211e063f174a

                            SHA256

                            065e6114923283d54854f210cd825cb8353d831ea85354dd2fd4b7731e452e7c

                            SHA512

                            556f064c5ac09c2589b1982a061855c2524e2f4554998da53c75e3bae6018b3c93029379f642eb320082a76545c4dde64867fd53eb94f30e28d44cfbe2a7f0a4

                          • memory/624-0-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/624-543-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/748-482-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/764-104-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/784-386-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/876-394-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/948-358-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/980-120-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1068-199-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1112-29-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1176-318-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1264-350-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1328-485-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1464-314-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1708-20-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1728-111-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1852-448-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1872-334-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1880-223-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1896-472-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/1912-192-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2180-144-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2268-302-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2296-460-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2340-406-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2404-167-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2544-422-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2560-442-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2568-546-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2568-12-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2576-392-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/2980-484-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3028-428-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3040-96-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3044-248-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3064-87-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3076-231-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3096-344-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3144-357-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3368-436-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3432-71-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3480-274-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3540-64-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3540-593-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3604-79-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3620-284-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3640-135-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3660-572-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3660-40-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3732-207-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3760-264-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3776-370-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3780-380-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3840-328-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3876-151-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/3928-272-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4004-47-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4004-579-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4016-466-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4064-286-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4364-32-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4364-569-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4384-322-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4488-183-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4508-239-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4516-403-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4560-430-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4572-586-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4572-56-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4844-261-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4848-292-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4868-454-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4900-159-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/4940-216-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5004-412-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5028-176-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5068-304-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5076-368-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5100-127-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5132-495-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5172-497-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5216-507-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5260-509-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5332-515-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5372-525-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5412-531-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5448-537-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5492-545-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5532-547-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5608-558-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5648-560-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5704-571-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5744-573-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5796-580-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5840-591-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB

                          • memory/5880-594-0x0000000000400000-0x0000000000434000-memory.dmp

                            Filesize

                            208KB