c4ce897ab364c2252110e1cdd4d93586387c150f6aba4e35ca7eff2f279bf9dc

Analysis

max time kernel
147s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c4ce897ab364c2252110e1cdd4d93586387c150f6aba4e35ca7eff2f279bf9dc.exe
Size

790KB
MD5

bcb7a8341912e1d65d41c48c78180060
SHA1

833eedb95fa1bdd6d801b7170322ce5da0fbcbdd
SHA256

c4ce897ab364c2252110e1cdd4d93586387c150f6aba4e35ca7eff2f279bf9dc
SHA512

938a6781c6f6dea3744b429d3810a8bef7ee515b8e7ce0ebb1252427451358188d3a8594163cd2c27ba73aa87d5d18fe3b76e5af0339f971bc5fa5da8a882098
SSDEEP

6144:8arisD2iRFM6234lKmwr8SeNpgdyuH1lZfRo0V8JcgE+ezpg1xrloBNTNxaaqk9y:8a2MFB24lA87g7/VycgE81lgxaa79y

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opfcgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppmihfdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aggklnnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Epfgji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jagnidkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npomgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppdpie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpgnlppj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdmbcjgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pldjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aobopp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bonoln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpphka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efnbachd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hncpklnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifhgemcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpqdep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpenppgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Khlfamho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkmochep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmbcjgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhdbpld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bolbfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcgngmkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgacbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mhdeijdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeclpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clnoaafo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nedidian.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boqlanop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcblae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikafql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ihgdopjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oenbenmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dcmqijif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eodjei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iamkbfcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nedidian.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlbhlp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjjgipbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gcblae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofkbia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qmjmhiki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aicjbiok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epfgji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laidebkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pldjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apkfid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpbeefk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecofehiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhnjpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kgdphikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgiich32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjhmdfmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gjnado32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpbpme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iooofjdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npjdlhep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bldlkbni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cplhgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jdekepjc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppdpie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqcgolhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haalggmg.exe

Executes dropped EXE 64 IoCs

pid	Process
4416	Npjdlhep.exe
848	Nffinbjj.exe
3436	Npomgh32.exe
2648	Oelfoo32.exe
1208	Opajlgog.exe
4680	Ondjhd32.exe
5004	Ofkbia32.exe
3344	Oenbenmo.exe
4952	Omejflna.exe
1016	Opcgbgme.exe
1256	Onfgnd32.exe
5036	Obbcnbli.exe
4076	Oeqojnkl.exe
1388	Oilkkm32.exe
704	Oljgghbi.exe
5012	Opfcgg32.exe
4692	Obdpcb32.exe
3380	Ofpldabo.exe
3516	Oeclpn32.exe
4504	Omjdak32.exe
988	Ophpmf32.exe
2572	Obglib32.exe
4312	Ofbhjqpl.exe
64	Oiqdflop.exe
3144	Oloabgnd.exe
2268	Ponmnc32.exe
4444	Pfdeop32.exe
4616	Picakl32.exe
924	Pmomljef.exe
4688	Ppmihfdj.exe
1620	Pbkfdacn.exe
2992	Pejbqmca.exe
2684	Pmajajcd.exe
4080	Pldjmg32.exe
696	Pbnbja32.exe
408	Pelofl32.exe
2504	Pmcggj32.exe
3740	Plfgbfhl.exe
3840	Podcobgp.exe
3336	Peokll32.exe
2980	Pmecmi32.exe
1772	Ppdpie32.exe
3032	Pbblep32.exe
1068	Peahalmj.exe
2848	Qoimja32.exe
3656	Qfpdko32.exe
3544	Qecegkkg.exe
3924	Qmjmhiki.exe
5152	Qpiiddjm.exe
5188	Qolipa32.exe
5224	Qfbaqnbj.exe
5264	Qianmjam.exe
5300	Qmmimh32.exe
5336	Apkfid32.exe
5372	Afenfnpg.exe
5408	Aicjbiok.exe
5444	Albfoeno.exe
5496	Aopbkpmb.exe
5552	Aggklnnd.exe
5592	Amachhea.exe
5632	Appodcde.exe
5668	Aobopp32.exe
5708	Abnkqoci.exe
5744	Aemhmjbl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ondjhd32.exe	Opajlgog.exe
File created	C:\Windows\SysWOW64\Lpogcgoo.dll	Cojohm32.exe
File created	C:\Windows\SysWOW64\Hhnaiaba.exe	Hpgihdbp.exe
File created	C:\Windows\SysWOW64\Qdcddcif.dll	Jghplk32.exe
File opened for modification	C:\Windows\SysWOW64\Nnhdbpld.exe	Nkigedmp.exe
File created	C:\Windows\SysWOW64\Dofdnmgi.dll	Lqanlnmp.exe
File opened for modification	C:\Windows\SysWOW64\Opcgbgme.exe	Omejflna.exe
File opened for modification	C:\Windows\SysWOW64\Obdpcb32.exe	Opfcgg32.exe
File created	C:\Windows\SysWOW64\Ghomci32.dll	Aihcmi32.exe
File opened for modification	C:\Windows\SysWOW64\Bjfpogoe.exe	Bekdnh32.exe
File created	C:\Windows\SysWOW64\Epfgji32.exe	Eqcgolhj.exe
File opened for modification	C:\Windows\SysWOW64\Ihpnoaqo.exe	Iafebg32.exe
File opened for modification	C:\Windows\SysWOW64\Obglib32.exe	Ophpmf32.exe
File created	C:\Windows\SysWOW64\Cjpbeefk.exe	Cfdgdg32.exe
File created	C:\Windows\SysWOW64\Klfgadoa.dll	Gjldno32.exe
File created	C:\Windows\SysWOW64\Hniiqp32.dll	Oloabgnd.exe
File opened for modification	C:\Windows\SysWOW64\Eodjei32.exe	Emeninad.exe
File created	C:\Windows\SysWOW64\Nqniqq32.dll	Gjjgipbk.exe
File created	C:\Windows\SysWOW64\Mdflbk32.exe	Moidjd32.exe
File created	C:\Windows\SysWOW64\Ponmnc32.exe	Oloabgnd.exe
File opened for modification	C:\Windows\SysWOW64\Pelofl32.exe	Pbnbja32.exe
File created	C:\Windows\SysWOW64\Jfgcdohc.dll	Ffeibb32.exe
File created	C:\Windows\SysWOW64\Blkidcfd.exe	Aimmhhgp.exe
File created	C:\Windows\SysWOW64\Pgcaml32.dll	Bekdnh32.exe
File opened for modification	C:\Windows\SysWOW64\Dfmikefg.exe	Dleeap32.exe
File created	C:\Windows\SysWOW64\Bghjkn32.dll	Eodjei32.exe
File opened for modification	C:\Windows\SysWOW64\Lobnje32.exe	Lqanlnmp.exe
File created	C:\Windows\SysWOW64\Ooifdfhb.dll	Mkpepeek.exe
File created	C:\Windows\SysWOW64\Mmokfd32.dll	Pmecmi32.exe
File created	C:\Windows\SysWOW64\Nhnhqqgj.dll	Becnni32.exe
File created	C:\Windows\SysWOW64\Dapmjg32.dll	Bldlkbni.exe
File created	C:\Windows\SysWOW64\Gogdfmef.dll	Cjhmdfmc.exe
File created	C:\Windows\SysWOW64\Idgncbfc.exe	Immfghof.exe
File created	C:\Windows\SysWOW64\Klncib32.dll	Aobopp32.exe
File created	C:\Windows\SysWOW64\Cfdgdg32.exe	Cgafijgg.exe
File created	C:\Windows\SysWOW64\Gjldno32.exe	Gcblae32.exe
File created	C:\Windows\SysWOW64\Ikafql32.exe	Ifekpneg.exe
File created	C:\Windows\SysWOW64\Mholnjhj.exe	Mqhdmm32.exe
File created	C:\Windows\SysWOW64\Nnhdbpld.exe	Nkigedmp.exe
File opened for modification	C:\Windows\SysWOW64\Ofpldabo.exe	Obdpcb32.exe
File created	C:\Windows\SysWOW64\Acceln32.exe	Apdhpb32.exe
File created	C:\Windows\SysWOW64\Kdcgfn32.exe	Kphkfoej.exe
File created	C:\Windows\SysWOW64\Ipbhdbhb.exe	Imdlhgio.exe
File created	C:\Windows\SysWOW64\Kpqdep32.exe	Joohmhfd.exe
File created	C:\Windows\SysWOW64\Pmcggj32.exe	Pelofl32.exe
File created	C:\Windows\SysWOW64\Becnni32.exe	Bgqnblfj.exe
File created	C:\Windows\SysWOW64\Kjecee32.dll	Bgcjgl32.exe
File created	C:\Windows\SysWOW64\Khemgh32.dll	Bpphka32.exe
File opened for modification	C:\Windows\SysWOW64\Cfdgdg32.exe	Cgafijgg.exe
File created	C:\Windows\SysWOW64\Hpgihdbp.exe	Hmhmli32.exe
File created	C:\Windows\SysWOW64\Blnfjc32.exe	Bmkfof32.exe
File created	C:\Windows\SysWOW64\Gbfqfmhg.dll	Cpbeaq32.exe
File created	C:\Windows\SysWOW64\Gfeaipcj.exe	Gahiqieb.exe
File created	C:\Windows\SysWOW64\Ipnoic32.exe	Ikafql32.exe
File created	C:\Windows\SysWOW64\Qmjmhiki.exe	Qecegkkg.exe
File created	C:\Windows\SysWOW64\Mjfeei32.dll	Alimodhf.exe
File created	C:\Windows\SysWOW64\Cndhee32.exe	Cjhmdfmc.exe
File opened for modification	C:\Windows\SysWOW64\Cjkijf32.exe	Cglmnk32.exe
File created	C:\Windows\SysWOW64\Ghncapnd.dll	Fpkpehjp.exe
File opened for modification	C:\Windows\SysWOW64\Blkidcfd.exe	Aimmhhgp.exe
File created	C:\Windows\SysWOW64\Dbbckn32.dll	Ccaamlcc.exe
File opened for modification	C:\Windows\SysWOW64\Hmhmli32.exe	Hjjqpm32.exe
File opened for modification	C:\Windows\SysWOW64\Ldjmgm32.exe	Lnpejc32.exe
File opened for modification	C:\Windows\SysWOW64\Dlbhlp32.exe	Djdlpe32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9064	8504	WerFault.exe	385

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpeafpbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpbeefk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpgihdbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbjmlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oilkkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pejbqmca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmfgpkca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monmedka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkfof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfpogoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndhee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghpdhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnjgqa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obglib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqhfnaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cllbla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjjgipbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmjqkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iafebg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhlmjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Johbmill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aicjbiok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeaahi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnpejc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qecegkkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kngbddhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmoaolii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdcgfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmecmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgojcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nefejiok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiqdflop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bolbfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Colkmleb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knlkocdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apdhpb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bidcig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cglmnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpikap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onfgnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpgeeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjlmemae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Podcobgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfbaqnbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bonoln32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emeninad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeclpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Picakl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plfgbfhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qoimja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dleeap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkmochep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgiich32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbacmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ondjhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmajajcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmbdfkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fajmok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kobechda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofkbia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blkidcfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoanoibj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfeaipcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpjgko32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Enejbqhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqniqq32.dll"	Gjjgipbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Johbmill.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhllepme.dll"	Jagnidkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lqanlnmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pbnbja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jmplceoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kgdphikd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eodjei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fmjgcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ifekpneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heqede32.dll"	Cglmnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fpkpehjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ihgdopjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaeiciho.dll"	Jaiknd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdmbcjgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgjphkno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbeoccf.dll"	Fcdpqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqbdem32.dll"	Mdflbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Afenfnpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Appodcde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpnpe32.dll"	Bmkfof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amopijgh.dll"	Cgafijgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dghmii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kobechda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Alimodhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnhdbpld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cllbla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ghpdhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Khlfamho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lodkoecl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Clnoaafo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngphke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pejbqmca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Blpbpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dcmqijif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jkapgjpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aihcmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbhqklba.dll"	Behgihho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmjqkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghpmfndi.dll"	Ikafql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdflbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfedigkb.dll"	Bcgngmkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gobbgoai.dll"	Bceaan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Efnbachd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idoaaofm.dll"	Ipbhdbhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aobopp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njicdlbj.dll"	Dleeap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fngghpfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abpbkoie.dll"	Fmoaolii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cenjli32.dll"	Johbmill.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acqhfnaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pbblep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cpikap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lqfggm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiliij32.dll"	Mqhdmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aojfac32.dll"	Mbljaoje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hpbpme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfalld32.dll"	Bonoln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmdell32.dll"	Cfajogpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ecofehiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hdkohc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmhngebm.dll"	Nbelhnbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmkfof32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 4416	1332	c4ce897ab364c2252110e1cdd4d93586387c150f6aba4e35ca7eff2f279bf9dc.exe	91
PID 1332 wrote to memory of 4416	1332	c4ce897ab364c2252110e1cdd4d93586387c150f6aba4e35ca7eff2f279bf9dc.exe	91
PID 1332 wrote to memory of 4416	1332	c4ce897ab364c2252110e1cdd4d93586387c150f6aba4e35ca7eff2f279bf9dc.exe	91
PID 4416 wrote to memory of 848	4416	Npjdlhep.exe	92
PID 4416 wrote to memory of 848	4416	Npjdlhep.exe	92
PID 4416 wrote to memory of 848	4416	Npjdlhep.exe	92
PID 848 wrote to memory of 3436	848	Nffinbjj.exe	93
PID 848 wrote to memory of 3436	848	Nffinbjj.exe	93
PID 848 wrote to memory of 3436	848	Nffinbjj.exe	93
PID 3436 wrote to memory of 2648	3436	Npomgh32.exe	95
PID 3436 wrote to memory of 2648	3436	Npomgh32.exe	95
PID 3436 wrote to memory of 2648	3436	Npomgh32.exe	95
PID 2648 wrote to memory of 1208	2648	Oelfoo32.exe	96
PID 2648 wrote to memory of 1208	2648	Oelfoo32.exe	96
PID 2648 wrote to memory of 1208	2648	Oelfoo32.exe	96
PID 1208 wrote to memory of 4680	1208	Opajlgog.exe	97
PID 1208 wrote to memory of 4680	1208	Opajlgog.exe	97
PID 1208 wrote to memory of 4680	1208	Opajlgog.exe	97
PID 4680 wrote to memory of 5004	4680	Ondjhd32.exe	98
PID 4680 wrote to memory of 5004	4680	Ondjhd32.exe	98
PID 4680 wrote to memory of 5004	4680	Ondjhd32.exe	98
PID 5004 wrote to memory of 3344	5004	Ofkbia32.exe	99
PID 5004 wrote to memory of 3344	5004	Ofkbia32.exe	99
PID 5004 wrote to memory of 3344	5004	Ofkbia32.exe	99
PID 3344 wrote to memory of 4952	3344	Oenbenmo.exe	100
PID 3344 wrote to memory of 4952	3344	Oenbenmo.exe	100
PID 3344 wrote to memory of 4952	3344	Oenbenmo.exe	100
PID 4952 wrote to memory of 1016	4952	Omejflna.exe	101
PID 4952 wrote to memory of 1016	4952	Omejflna.exe	101
PID 4952 wrote to memory of 1016	4952	Omejflna.exe	101
PID 1016 wrote to memory of 1256	1016	Opcgbgme.exe	102
PID 1016 wrote to memory of 1256	1016	Opcgbgme.exe	102
PID 1016 wrote to memory of 1256	1016	Opcgbgme.exe	102
PID 1256 wrote to memory of 5036	1256	Onfgnd32.exe	103
PID 1256 wrote to memory of 5036	1256	Onfgnd32.exe	103
PID 1256 wrote to memory of 5036	1256	Onfgnd32.exe	103
PID 5036 wrote to memory of 4076	5036	Obbcnbli.exe	104
PID 5036 wrote to memory of 4076	5036	Obbcnbli.exe	104
PID 5036 wrote to memory of 4076	5036	Obbcnbli.exe	104
PID 4076 wrote to memory of 1388	4076	Oeqojnkl.exe	105
PID 4076 wrote to memory of 1388	4076	Oeqojnkl.exe	105
PID 4076 wrote to memory of 1388	4076	Oeqojnkl.exe	105
PID 1388 wrote to memory of 704	1388	Oilkkm32.exe	106
PID 1388 wrote to memory of 704	1388	Oilkkm32.exe	106
PID 1388 wrote to memory of 704	1388	Oilkkm32.exe	106
PID 704 wrote to memory of 5012	704	Oljgghbi.exe	107
PID 704 wrote to memory of 5012	704	Oljgghbi.exe	107
PID 704 wrote to memory of 5012	704	Oljgghbi.exe	107
PID 5012 wrote to memory of 4692	5012	Opfcgg32.exe	108
PID 5012 wrote to memory of 4692	5012	Opfcgg32.exe	108
PID 5012 wrote to memory of 4692	5012	Opfcgg32.exe	108
PID 4692 wrote to memory of 3380	4692	Obdpcb32.exe	109
PID 4692 wrote to memory of 3380	4692	Obdpcb32.exe	109
PID 4692 wrote to memory of 3380	4692	Obdpcb32.exe	109
PID 3380 wrote to memory of 3516	3380	Ofpldabo.exe	110
PID 3380 wrote to memory of 3516	3380	Ofpldabo.exe	110
PID 3380 wrote to memory of 3516	3380	Ofpldabo.exe	110
PID 3516 wrote to memory of 4504	3516	Oeclpn32.exe	111
PID 3516 wrote to memory of 4504	3516	Oeclpn32.exe	111
PID 3516 wrote to memory of 4504	3516	Oeclpn32.exe	111
PID 4504 wrote to memory of 988	4504	Omjdak32.exe	112
PID 4504 wrote to memory of 988	4504	Omjdak32.exe	112
PID 4504 wrote to memory of 988	4504	Omjdak32.exe	112
PID 988 wrote to memory of 2572	988	Ophpmf32.exe	113

C:\Users\Admin\AppData\Local\Temp\c4ce897ab364c2252110e1cdd4d93586387c150f6aba4e35ca7eff2f279bf9dc.exe
"C:\Users\Admin\AppData\Local\Temp\c4ce897ab364c2252110e1cdd4d93586387c150f6aba4e35ca7eff2f279bf9dc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\Npjdlhep.exe
  C:\Windows\system32\Npjdlhep.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\Nffinbjj.exe
    C:\Windows\system32\Nffinbjj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\SysWOW64\Npomgh32.exe
      C:\Windows\system32\Npomgh32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Windows\SysWOW64\Oelfoo32.exe
        
        C:\Windows\system32\Oelfoo32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2648
      - C:\Windows\SysWOW64\Opajlgog.exe
        
        C:\Windows\system32\Opajlgog.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\SysWOW64\Ondjhd32.exe
        
        C:\Windows\system32\Ondjhd32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Ofkbia32.exe
        
        C:\Windows\system32\Ofkbia32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Oenbenmo.exe
        
        C:\Windows\system32\Oenbenmo.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\SysWOW64\Omejflna.exe
        
        C:\Windows\system32\Omejflna.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\Opcgbgme.exe
        
        C:\Windows\system32\Opcgbgme.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\Onfgnd32.exe
        
        C:\Windows\system32\Onfgnd32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Windows\SysWOW64\Obbcnbli.exe
        
        C:\Windows\system32\Obbcnbli.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Oeqojnkl.exe
        
        C:\Windows\system32\Oeqojnkl.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\Oilkkm32.exe
        
        C:\Windows\system32\Oilkkm32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Oljgghbi.exe
        
        C:\Windows\system32\Oljgghbi.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\SysWOW64\Opfcgg32.exe
        
        C:\Windows\system32\Opfcgg32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Obdpcb32.exe
        
        C:\Windows\system32\Obdpcb32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Ofpldabo.exe
        
        C:\Windows\system32\Ofpldabo.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Oeclpn32.exe
        
        C:\Windows\system32\Oeclpn32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\SysWOW64\Omjdak32.exe
        
        C:\Windows\system32\Omjdak32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Ophpmf32.exe
        
        C:\Windows\system32\Ophpmf32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Obglib32.exe
        
        C:\Windows\system32\Obglib32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2572
        
        C:\Windows\SysWOW64\Ofbhjqpl.exe
        
        C:\Windows\system32\Ofbhjqpl.exe
        24⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Oiqdflop.exe
        
        C:\Windows\system32\Oiqdflop.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:64
        
        C:\Windows\SysWOW64\Oloabgnd.exe
        
        C:\Windows\system32\Oloabgnd.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3144
        
        C:\Windows\SysWOW64\Ponmnc32.exe
        
        C:\Windows\system32\Ponmnc32.exe
        27⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\Pfdeop32.exe
        
        C:\Windows\system32\Pfdeop32.exe
        28⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Picakl32.exe
        
        C:\Windows\system32\Picakl32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Windows\SysWOW64\Pmomljef.exe
        
        C:\Windows\system32\Pmomljef.exe
        30⤵
        Executes dropped EXE
        
        PID:924
        
        C:\Windows\SysWOW64\Ppmihfdj.exe
        
        C:\Windows\system32\Ppmihfdj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Pbkfdacn.exe
        
        C:\Windows\system32\Pbkfdacn.exe
        32⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Pejbqmca.exe
        
        C:\Windows\system32\Pejbqmca.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2992
        
        C:\Windows\SysWOW64\Pmajajcd.exe
        
        C:\Windows\system32\Pmajajcd.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Windows\SysWOW64\Pldjmg32.exe
        
        C:\Windows\system32\Pldjmg32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4080
        
        C:\Windows\SysWOW64\Pbnbja32.exe
        
        C:\Windows\system32\Pbnbja32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:696
        
        C:\Windows\SysWOW64\Pelofl32.exe
        
        C:\Windows\system32\Pelofl32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:408
        
        C:\Windows\SysWOW64\Pmcggj32.exe
        
        C:\Windows\system32\Pmcggj32.exe
        38⤵
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\SysWOW64\Plfgbfhl.exe
        
        C:\Windows\system32\Plfgbfhl.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3740
        
        C:\Windows\SysWOW64\Podcobgp.exe
        
        C:\Windows\system32\Podcobgp.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3840
        
        C:\Windows\SysWOW64\Peokll32.exe
        
        C:\Windows\system32\Peokll32.exe
        41⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Windows\SysWOW64\Pmecmi32.exe
        
        C:\Windows\system32\Pmecmi32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Windows\SysWOW64\Ppdpie32.exe
        
        C:\Windows\system32\Ppdpie32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1772
        
        C:\Windows\SysWOW64\Pbblep32.exe
        
        C:\Windows\system32\Pbblep32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Peahalmj.exe
        
        C:\Windows\system32\Peahalmj.exe
        45⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Qoimja32.exe
        
        C:\Windows\system32\Qoimja32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\Windows\SysWOW64\Qfpdko32.exe
        
        C:\Windows\system32\Qfpdko32.exe
        47⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Qecegkkg.exe
        
        C:\Windows\system32\Qecegkkg.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3544
        
        C:\Windows\SysWOW64\Qmjmhiki.exe
        
        C:\Windows\system32\Qmjmhiki.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3924
        
        C:\Windows\SysWOW64\Qpiiddjm.exe
        
        C:\Windows\system32\Qpiiddjm.exe
        50⤵
        Executes dropped EXE
        
        PID:5152
        
        C:\Windows\SysWOW64\Qolipa32.exe
        
        C:\Windows\system32\Qolipa32.exe
        51⤵
        Executes dropped EXE
        
        PID:5188
        
        C:\Windows\SysWOW64\Qfbaqnbj.exe
        
        C:\Windows\system32\Qfbaqnbj.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Windows\SysWOW64\Qianmjam.exe
        
        C:\Windows\system32\Qianmjam.exe
        53⤵
        Executes dropped EXE
        
        PID:5264
        
        C:\Windows\SysWOW64\Qmmimh32.exe
        
        C:\Windows\system32\Qmmimh32.exe
        54⤵
        Executes dropped EXE
        
        PID:5300
        
        C:\Windows\SysWOW64\Apkfid32.exe
        
        C:\Windows\system32\Apkfid32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5336
        
        C:\Windows\SysWOW64\Afenfnpg.exe
        
        C:\Windows\system32\Afenfnpg.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Aicjbiok.exe
        
        C:\Windows\system32\Aicjbiok.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5408
        
        C:\Windows\SysWOW64\Albfoeno.exe
        
        C:\Windows\system32\Albfoeno.exe
        58⤵
        Executes dropped EXE
        
        PID:5444
        
        C:\Windows\SysWOW64\Aopbkpmb.exe
        
        C:\Windows\system32\Aopbkpmb.exe
        59⤵
        Executes dropped EXE
        
        PID:5496
        
        C:\Windows\SysWOW64\Aggklnnd.exe
        
        C:\Windows\system32\Aggklnnd.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5552
        
        C:\Windows\SysWOW64\Amachhea.exe
        
        C:\Windows\system32\Amachhea.exe
        61⤵
        Executes dropped EXE
        
        PID:5592
        
        C:\Windows\SysWOW64\Appodcde.exe
        
        C:\Windows\system32\Appodcde.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Aobopp32.exe
        
        C:\Windows\system32\Aobopp32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Abnkqoci.exe
        
        C:\Windows\system32\Abnkqoci.exe
        64⤵
        Executes dropped EXE
        
        PID:5708
        
        C:\Windows\SysWOW64\Aemhmjbl.exe
        
        C:\Windows\system32\Aemhmjbl.exe
        65⤵
        Executes dropped EXE
        
        PID:5744
        
        C:\Windows\SysWOW64\Aihcmi32.exe
        
        C:\Windows\system32\Aihcmi32.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Alfpjd32.exe
        
        C:\Windows\system32\Alfpjd32.exe
        67⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Aoelfp32.exe
        
        C:\Windows\system32\Aoelfp32.exe
        68⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Acqhfnaf.exe
        
        C:\Windows\system32\Acqhfnaf.exe
        69⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Aeodbjqj.exe
        
        C:\Windows\system32\Aeodbjqj.exe
        70⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Aijpch32.exe
        
        C:\Windows\system32\Aijpch32.exe
        71⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Alimodhf.exe
        
        C:\Windows\system32\Alimodhf.exe
        72⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Apdhpb32.exe
        
        C:\Windows\system32\Apdhpb32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Acceln32.exe
        
        C:\Windows\system32\Acceln32.exe
        74⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Aeaahi32.exe
        
        C:\Windows\system32\Aeaahi32.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Windows\SysWOW64\Aimmhhgp.exe
        
        C:\Windows\system32\Aimmhhgp.exe
        76⤵
        Drops file in System32 directory
        
        PID:6140
        
        C:\Windows\SysWOW64\Blkidcfd.exe
        
        C:\Windows\system32\Blkidcfd.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
        
        C:\Windows\SysWOW64\Bpgeeb32.exe
        
        C:\Windows\system32\Bpgeeb32.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
        
        C:\Windows\SysWOW64\Bceaan32.exe
        
        C:\Windows\system32\Bceaan32.exe
        79⤵
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\Bgqnblfj.exe
        
        C:\Windows\system32\Bgqnblfj.exe
        80⤵
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\Becnni32.exe
        
        C:\Windows\system32\Becnni32.exe
        81⤵
        Drops file in System32 directory
        
        PID:1900
        
        C:\Windows\SysWOW64\Bmkfof32.exe
        
        C:\Windows\system32\Bmkfof32.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\Blnfjc32.exe
        
        C:\Windows\system32\Blnfjc32.exe
        83⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Bolbfo32.exe
        
        C:\Windows\system32\Bolbfo32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:880
        
        C:\Windows\SysWOW64\Bcgngmkn.exe
        
        C:\Windows\system32\Bcgngmkn.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Bgcjgl32.exe
        
        C:\Windows\system32\Bgcjgl32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Biafcg32.exe
        
        C:\Windows\system32\Biafcg32.exe
        87⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Bnmbdfkd.exe
        
        C:\Windows\system32\Bnmbdfkd.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\Blpbpc32.exe
        
        C:\Windows\system32\Blpbpc32.exe
        89⤵
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Bonoln32.exe
        
        C:\Windows\system32\Bonoln32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Bcjklmik.exe
        
        C:\Windows\system32\Bcjklmik.exe
        91⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Behgihho.exe
        
        C:\Windows\system32\Behgihho.exe
        92⤵
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Bidcig32.exe
        
        C:\Windows\system32\Bidcig32.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\Blboeb32.exe
        
        C:\Windows\system32\Blboeb32.exe
        94⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Bpnkfa32.exe
        
        C:\Windows\system32\Bpnkfa32.exe
        95⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Boqlanop.exe
        
        C:\Windows\system32\Boqlanop.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6004
        
        C:\Windows\SysWOW64\Bclhbm32.exe
        
        C:\Windows\system32\Bclhbm32.exe
        97⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bekdnh32.exe
        
        C:\Windows\system32\Bekdnh32.exe
        98⤵
        Drops file in System32 directory
        
        PID:3372
        
        C:\Windows\SysWOW64\Bjfpogoe.exe
        
        C:\Windows\system32\Bjfpogoe.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Windows\SysWOW64\Bldlkbni.exe
        
        C:\Windows\system32\Bldlkbni.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2852
        
        C:\Windows\SysWOW64\Bpphka32.exe
        
        C:\Windows\system32\Bpphka32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Bcodgl32.exe
        
        C:\Windows\system32\Bcodgl32.exe
        102⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Bgjphkno.exe
        
        C:\Windows\system32\Bgjphkno.exe
        103⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Cjhmdfmc.exe
        
        C:\Windows\system32\Cjhmdfmc.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Cndhee32.exe
        
        C:\Windows\system32\Cndhee32.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Cpbeaq32.exe
        
        C:\Windows\system32\Cpbeaq32.exe
        106⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Ccaamlcc.exe
        
        C:\Windows\system32\Ccaamlcc.exe
        107⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Cglmnk32.exe
        
        C:\Windows\system32\Cglmnk32.exe
        108⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Cjkijf32.exe
        
        C:\Windows\system32\Cjkijf32.exe
        109⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Cnfejeci.exe
        
        C:\Windows\system32\Cnfejeci.exe
        110⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Cpeafpbm.exe
        
        C:\Windows\system32\Cpeafpbm.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
        
        C:\Windows\SysWOW64\Cohbbm32.exe
        
        C:\Windows\system32\Cohbbm32.exe
        112⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Cgojcj32.exe
        
        C:\Windows\system32\Cgojcj32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:6608
        
        C:\Windows\SysWOW64\Cfajogpd.exe
        
        C:\Windows\system32\Cfajogpd.exe
        114⤵
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Cjmfof32.exe
        
        C:\Windows\system32\Cjmfof32.exe
        115⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Cllbla32.exe
        
        C:\Windows\system32\Cllbla32.exe
        116⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Cpgnlppj.exe
        
        C:\Windows\system32\Cpgnlppj.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6752
        
        C:\Windows\SysWOW64\Cojohm32.exe
        
        C:\Windows\system32\Cojohm32.exe
        118⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Cgafijgg.exe
        
        C:\Windows\system32\Cgafijgg.exe
        119⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Cfdgdg32.exe
        
        C:\Windows\system32\Cfdgdg32.exe
        120⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Cjpbeefk.exe
        
        C:\Windows\system32\Cjpbeefk.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6896
        
        C:\Windows\SysWOW64\Clnoaafo.exe
        
        C:\Windows\system32\Clnoaafo.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Cpikap32.exe
        
        C:\Windows\system32\Cpikap32.exe
        123⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Colkmleb.exe
        
        C:\Windows\system32\Colkmleb.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:7004
        
        C:\Windows\SysWOW64\Cgccnjed.exe
        
        C:\Windows\system32\Cgccnjed.exe
        125⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Cjbojedh.exe
        
        C:\Windows\system32\Cjbojedh.exe
        126⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Cnmkkd32.exe
        
        C:\Windows\system32\Cnmkkd32.exe
        127⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Cplhgo32.exe
        
        C:\Windows\system32\Cplhgo32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7148
        
        C:\Windows\SysWOW64\Coohclcp.exe
        
        C:\Windows\system32\Coohclcp.exe
        129⤵
        
        PID:520
        
        C:\Windows\SysWOW64\Ccjdck32.exe
        
        C:\Windows\system32\Ccjdck32.exe
        130⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Dfippfjl.exe
        
        C:\Windows\system32\Dfippfjl.exe
        131⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Djdlpe32.exe
        
        C:\Windows\system32\Djdlpe32.exe
        132⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Dlbhlp32.exe
        
        C:\Windows\system32\Dlbhlp32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Dqndmojb.exe
        
        C:\Windows\system32\Dqndmojb.exe
        134⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Dcmqijif.exe
        
        C:\Windows\system32\Dcmqijif.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Dghmii32.exe
        
        C:\Windows\system32\Dghmii32.exe
        136⤵
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Djfied32.exe
        
        C:\Windows\system32\Djfied32.exe
        137⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Dleeap32.exe
        
        C:\Windows\system32\Dleeap32.exe
        138⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Dfmikefg.exe
        
        C:\Windows\system32\Dfmikefg.exe
        139⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Eoanoibj.exe
        
        C:\Windows\system32\Eoanoibj.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Windows\SysWOW64\Emeninad.exe
        
        C:\Windows\system32\Emeninad.exe
        141⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7096
        
        C:\Windows\SysWOW64\Eodjei32.exe
        
        C:\Windows\system32\Eodjei32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Ecofehiq.exe
        
        C:\Windows\system32\Ecofehiq.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Efnbachd.exe
        
        C:\Windows\system32\Efnbachd.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Ejiobb32.exe
        
        C:\Windows\system32\Ejiobb32.exe
        145⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Enejbqhf.exe
        
        C:\Windows\system32\Enejbqhf.exe
        146⤵
        Modifies registry class
        
        PID:4860
        
        C:\Windows\SysWOW64\Eqcgolhj.exe
        
        C:\Windows\system32\Eqcgolhj.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5392
        
        C:\Windows\SysWOW64\Epfgji32.exe
        
        C:\Windows\system32\Epfgji32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Fgmokf32.exe
        
        C:\Windows\system32\Fgmokf32.exe
        149⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Ffpogcfa.exe
        
        C:\Windows\system32\Ffpogcfa.exe
        150⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Fngghpfd.exe
        
        C:\Windows\system32\Fngghpfd.exe
        151⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Fmjgcm32.exe
        
        C:\Windows\system32\Fmjgcm32.exe
        152⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Fcdpqg32.exe
        
        C:\Windows\system32\Fcdpqg32.exe
        153⤵
        Modifies registry class
        
        PID:3188
        
        C:\Windows\SysWOW64\Fgplafmd.exe
        
        C:\Windows\system32\Fgplafmd.exe
        154⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Ffblmb32.exe
        
        C:\Windows\system32\Ffblmb32.exe
        155⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Fjnhmalh.exe
        
        C:\Windows\system32\Fjnhmalh.exe
        156⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Fmldimkl.exe
        
        C:\Windows\system32\Fmldimkl.exe
        157⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Fqhpjk32.exe
        
        C:\Windows\system32\Fqhpjk32.exe
        158⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Fpkpehjp.exe
        
        C:\Windows\system32\Fpkpehjp.exe
        159⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Fcflfg32.exe
        
        C:\Windows\system32\Fcflfg32.exe
        160⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Ffeibb32.exe
        
        C:\Windows\system32\Ffeibb32.exe
        161⤵
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Fjpdbaje.exe
        
        C:\Windows\system32\Fjpdbaje.exe
        162⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Fmoaolii.exe
        
        C:\Windows\system32\Fmoaolii.exe
        163⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Fajmok32.exe
        
        C:\Windows\system32\Fajmok32.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:7376
        
        C:\Windows\SysWOW64\Gmfgpkca.exe
        
        C:\Windows\system32\Gmfgpkca.exe
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:7560
        
        C:\Windows\SysWOW64\Gpdclgbe.exe
        
        C:\Windows\system32\Gpdclgbe.exe
        166⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Gjjgipbk.exe
        
        C:\Windows\system32\Gjjgipbk.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Gmhcekao.exe
        
        C:\Windows\system32\Gmhcekao.exe
        168⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Gcblae32.exe
        
        C:\Windows\system32\Gcblae32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7772
        
        C:\Windows\SysWOW64\Gjldno32.exe
        
        C:\Windows\system32\Gjldno32.exe
        170⤵
        Drops file in System32 directory
        
        PID:7812
        
        C:\Windows\SysWOW64\Gmjqkk32.exe
        
        C:\Windows\system32\Gmjqkk32.exe
        171⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Gpimgf32.exe
        
        C:\Windows\system32\Gpimgf32.exe
        172⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Ghpdhc32.exe
        
        C:\Windows\system32\Ghpdhc32.exe
        173⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Gjnado32.exe
        
        C:\Windows\system32\Gjnado32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Gnjmdnfo.exe
        
        C:\Windows\system32\Gnjmdnfo.exe
        175⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Gahiqieb.exe
        
        C:\Windows\system32\Gahiqieb.exe
        176⤵
        Drops file in System32 directory
        
        PID:8048
        
        C:\Windows\SysWOW64\Gfeaipcj.exe
        
        C:\Windows\system32\Gfeaipcj.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:8092
        
        C:\Windows\SysWOW64\Gnljjm32.exe
        
        C:\Windows\system32\Gnljjm32.exe
        178⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Hpnfbejj.exe
        
        C:\Windows\system32\Hpnfbejj.exe
        179⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Hfgnop32.exe
        
        C:\Windows\system32\Hfgnop32.exe
        180⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Hnofpm32.exe
        
        C:\Windows\system32\Hnofpm32.exe
        181⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Hdkohc32.exe
        
        C:\Windows\system32\Hdkohc32.exe
        182⤵
        Modifies registry class
        
        PID:4284
        
        C:\Windows\SysWOW64\Hfjkdo32.exe
        
        C:\Windows\system32\Hfjkdo32.exe
        183⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Hnacem32.exe
        
        C:\Windows\system32\Hnacem32.exe
        184⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Hpbpme32.exe
        
        C:\Windows\system32\Hpbpme32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Hhignb32.exe
        
        C:\Windows\system32\Hhignb32.exe
        186⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Hflhjona.exe
        
        C:\Windows\system32\Hflhjona.exe
        187⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Hncpklnd.exe
        
        C:\Windows\system32\Hncpklnd.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6964
        
        C:\Windows\SysWOW64\Haalggmg.exe
        
        C:\Windows\system32\Haalggmg.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6920
        
        C:\Windows\SysWOW64\Hhldca32.exe
        
        C:\Windows\system32\Hhldca32.exe
        190⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Hjjqpm32.exe
        
        C:\Windows\system32\Hjjqpm32.exe
        191⤵
        Drops file in System32 directory
        
        PID:7264
        
        C:\Windows\SysWOW64\Hmhmli32.exe
        
        C:\Windows\system32\Hmhmli32.exe
        192⤵
        Drops file in System32 directory
        
        PID:2716
        
        C:\Windows\SysWOW64\Hpgihdbp.exe
        
        C:\Windows\system32\Hpgihdbp.exe
        193⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6668
        
        C:\Windows\SysWOW64\Hhnaiaba.exe
        
        C:\Windows\system32\Hhnaiaba.exe
        194⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Hjlmemae.exe
        
        C:\Windows\system32\Hjlmemae.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:7332
        
        C:\Windows\SysWOW64\Iafebg32.exe
        
        C:\Windows\system32\Iafebg32.exe
        196⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7408
        
        C:\Windows\SysWOW64\Ihpnoaqo.exe
        
        C:\Windows\system32\Ihpnoaqo.exe
        197⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Ijojklpc.exe
        
        C:\Windows\system32\Ijojklpc.exe
        198⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Immfghof.exe
        
        C:\Windows\system32\Immfghof.exe
        199⤵
        Drops file in System32 directory
        
        PID:7524
        
        C:\Windows\SysWOW64\Idgncbfc.exe
        
        C:\Windows\system32\Idgncbfc.exe
        200⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ifekpneg.exe
        
        C:\Windows\system32\Ifekpneg.exe
        201⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Ikafql32.exe
        
        C:\Windows\system32\Ikafql32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7784
        
        C:\Windows\SysWOW64\Ipnoic32.exe
        
        C:\Windows\system32\Ipnoic32.exe
        203⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Ifhgemcd.exe
        
        C:\Windows\system32\Ifhgemcd.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7936
        
        C:\Windows\SysWOW64\Iooofjdf.exe
        
        C:\Windows\system32\Iooofjdf.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Iamkbfcj.exe
        
        C:\Windows\system32\Iamkbfcj.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8060
        
        C:\Windows\SysWOW64\Ipplnb32.exe
        
        C:\Windows\system32\Ipplnb32.exe
        207⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Ihgdopjg.exe
        
        C:\Windows\system32\Ihgdopjg.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Ikfpkkjk.exe
        
        C:\Windows\system32\Ikfpkkjk.exe
        209⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Imdlhgio.exe
        
        C:\Windows\system32\Imdlhgio.exe
        210⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Ipbhdbhb.exe
        
        C:\Windows\system32\Ipbhdbhb.exe
        211⤵
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Idndda32.exe
        
        C:\Windows\system32\Idndda32.exe
        212⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Igmqql32.exe
        
        C:\Windows\system32\Igmqql32.exe
        213⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Jmfimfgl.exe
        
        C:\Windows\system32\Jmfimfgl.exe
        214⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Jpeeibfp.exe
        
        C:\Windows\system32\Jpeeibfp.exe
        215⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Jhlmjo32.exe
        
        C:\Windows\system32\Jhlmjo32.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Windows\SysWOW64\Jmiecf32.exe
        
        C:\Windows\system32\Jmiecf32.exe
        217⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Jpgboa32.exe
        
        C:\Windows\system32\Jpgboa32.exe
        218⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Jhnjpo32.exe
        
        C:\Windows\system32\Jhnjpo32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Johbmill.exe
        
        C:\Windows\system32\Johbmill.exe
        220⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7508
        
        C:\Windows\SysWOW64\Jagnidkp.exe
        
        C:\Windows\system32\Jagnidkp.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Jdekepjc.exe
        
        C:\Windows\system32\Jdekepjc.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Jgcgakig.exe
        
        C:\Windows\system32\Jgcgakig.exe
        223⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Jokobi32.exe
        
        C:\Windows\system32\Jokobi32.exe
        224⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Jaiknd32.exe
        
        C:\Windows\system32\Jaiknd32.exe
        225⤵
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Jdggkp32.exe
        
        C:\Windows\system32\Jdggkp32.exe
        226⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Jkapgjpm.exe
        
        C:\Windows\system32\Jkapgjpm.exe
        227⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Jmplceoa.exe
        
        C:\Windows\system32\Jmplceoa.exe
        228⤵
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Jghplk32.exe
        
        C:\Windows\system32\Jghplk32.exe
        229⤵
        Drops file in System32 directory
        
        PID:6848
        
        C:\Windows\SysWOW64\Joohmhfd.exe
        
        C:\Windows\system32\Joohmhfd.exe
        230⤵
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Kpqdep32.exe
        
        C:\Windows\system32\Kpqdep32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7452
        
        C:\Windows\SysWOW64\Khhmfn32.exe
        
        C:\Windows\system32\Khhmfn32.exe
        232⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Kobechda.exe
        
        C:\Windows\system32\Kobechda.exe
        233⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7744
        
        C:\Windows\SysWOW64\Kpcakp32.exe
        
        C:\Windows\system32\Kpcakp32.exe
        234⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Kngbddhi.exe
        
        C:\Windows\system32\Kngbddhi.exe
        235⤵
        System Location Discovery: System Language Discovery
        
        PID:8184
        
        C:\Windows\SysWOW64\Kpenppgm.exe
        
        C:\Windows\system32\Kpenppgm.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Khlfamho.exe
        
        C:\Windows\system32\Khlfamho.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7240
        
        C:\Windows\SysWOW64\Kkkbmhgc.exe
        
        C:\Windows\system32\Kkkbmhgc.exe
        238⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Kniojdff.exe
        
        C:\Windows\system32\Kniojdff.exe
        239⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Kphkfoej.exe
        
        C:\Windows\system32\Kphkfoej.exe
        240⤵
        Drops file in System32 directory
        
        PID:8132
        
        C:\Windows\SysWOW64\Kdcgfn32.exe
        
        C:\Windows\system32\Kdcgfn32.exe
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Windows\SysWOW64\Kgacbi32.exe
        
        C:\Windows\system32\Kgacbi32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7348
        
        C:\Windows\SysWOW64\Kkmochep.exe
        
        C:\Windows\system32\Kkmochep.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7756
        
        C:\Windows\SysWOW64\Knlkocdd.exe
        
        C:\Windows\system32\Knlkocdd.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:1500
        
        C:\Windows\SysWOW64\Kpjgko32.exe
        
        C:\Windows\system32\Kpjgko32.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
        
        C:\Windows\SysWOW64\Khapll32.exe
        
        C:\Windows\system32\Khapll32.exe
        246⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Kgdphikd.exe
        
        C:\Windows\system32\Kgdphikd.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Kkplhh32.exe
        
        C:\Windows\system32\Kkplhh32.exe
        248⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Laidebkj.exe
        
        C:\Windows\system32\Laidebkj.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Lhclbl32.exe
        
        C:\Windows\system32\Lhclbl32.exe
        250⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Lnpejc32.exe
        
        C:\Windows\system32\Lnpejc32.exe
        251⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8260
        
        C:\Windows\SysWOW64\Ldjmgm32.exe
        
        C:\Windows\system32\Ldjmgm32.exe
        252⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Lgiich32.exe
        
        C:\Windows\system32\Lgiich32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8344
        
        C:\Windows\SysWOW64\Lopadf32.exe
        
        C:\Windows\system32\Lopadf32.exe
        254⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Lqanlnmp.exe
        
        C:\Windows\system32\Lqanlnmp.exe
        255⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Lobnje32.exe
        
        C:\Windows\system32\Lobnje32.exe
        256⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Laqjfa32.exe
        
        C:\Windows\system32\Laqjfa32.exe
        257⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Lodkoecl.exe
        
        C:\Windows\system32\Lodkoecl.exe
        258⤵
        Modifies registry class
        
        PID:8580
        
        C:\Windows\SysWOW64\Lngkkb32.exe
        
        C:\Windows\system32\Lngkkb32.exe
        259⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Lqfggm32.exe
        
        C:\Windows\system32\Lqfggm32.exe
        260⤵
        Modifies registry class
        
        PID:8684
        
        C:\Windows\SysWOW64\Lgpodgag.exe
        
        C:\Windows\system32\Lgpodgag.exe
        261⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Mnjgqa32.exe
        
        C:\Windows\system32\Mnjgqa32.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:8780
        
        C:\Windows\SysWOW64\Mqhdmm32.exe
        
        C:\Windows\system32\Mqhdmm32.exe
        263⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8820
        
        C:\Windows\SysWOW64\Mholnjhj.exe
        
        C:\Windows\system32\Mholnjhj.exe
        264⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Moidjd32.exe
        
        C:\Windows\system32\Moidjd32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8904
        
        C:\Windows\SysWOW64\Mdflbk32.exe
        
        C:\Windows\system32\Mdflbk32.exe
        266⤵
        Modifies registry class
        
        PID:8944
        
        C:\Windows\SysWOW64\Mkpepeek.exe
        
        C:\Windows\system32\Mkpepeek.exe
        267⤵
        Drops file in System32 directory
        
        PID:8988
        
        C:\Windows\SysWOW64\Mbjmlp32.exe
        
        C:\Windows\system32\Mbjmlp32.exe
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:9032
        
        C:\Windows\SysWOW64\Mhdeijdd.exe
        
        C:\Windows\system32\Mhdeijdd.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9072
        
        C:\Windows\SysWOW64\Monmedka.exe
        
        C:\Windows\system32\Monmedka.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:9112
        
        C:\Windows\SysWOW64\Mbljaoje.exe
        
        C:\Windows\system32\Mbljaoje.exe
        271⤵
        Modifies registry class
        
        PID:9152
        
        C:\Windows\SysWOW64\Mhfbni32.exe
        
        C:\Windows\system32\Mhfbni32.exe
        272⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Mdmbcjgf.exe
        
        C:\Windows\system32\Mdmbcjgf.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8204
        
        C:\Windows\SysWOW64\Ngkopfgj.exe
        
        C:\Windows\system32\Ngkopfgj.exe
        274⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Nbacmo32.exe
        
        C:\Windows\system32\Nbacmo32.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
        
        C:\Windows\SysWOW64\Nqdchkmj.exe
        
        C:\Windows\system32\Nqdchkmj.exe
        276⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Nkigedmp.exe
        
        C:\Windows\system32\Nkigedmp.exe
        277⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Nnhdbpld.exe
        
        C:\Windows\system32\Nnhdbpld.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Nimhohlj.exe
        
        C:\Windows\system32\Nimhohlj.exe
        279⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Ngphke32.exe
        
        C:\Windows\system32\Ngphke32.exe
        280⤵
        Modifies registry class
        
        PID:8744
        
        C:\Windows\SysWOW64\Nnjqgo32.exe
        
        C:\Windows\system32\Nnjqgo32.exe
        281⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Nbelhnbj.exe
        
        C:\Windows\system32\Nbelhnbj.exe
        282⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Nedidian.exe
        
        C:\Windows\system32\Nedidian.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8956
        
        C:\Windows\SysWOW64\Ngbepeqa.exe
        
        C:\Windows\system32\Ngbepeqa.exe
        284⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Nojmabad.exe
        
        C:\Windows\system32\Nojmabad.exe
        285⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Nbhimnpg.exe
        
        C:\Windows\system32\Nbhimnpg.exe
        286⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Nefejiok.exe
        
        C:\Windows\system32\Nefejiok.exe
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:8428
        
        C:\Windows\SysWOW64\Nkpnfc32.exe
        
        C:\Windows\system32\Nkpnfc32.exe
        288⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8504 -s 420
        289⤵
        Program crash
        
        PID:9064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4056,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:8
1⤵
PID:7536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8504 -ip 8504
1⤵
PID:8912

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:8076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Gnljjm32.exe

Filesize
790KB

MD5
fb7a60ccb3ef24660a5316a4aaed7929

SHA1
3b3bc1c459bc7d5068860f12bbdaa8a6a69ac090

SHA256
cb190894282d8f21d256888c762932932f45943646524ed3146f75c30ac011ad

SHA512
46d995a83c3e8352a0768ff8e3085d7c5e592abb26dd7a637e00a203543c4375ac421132bdabf602d569dccfd8f11b796a7bb6eb0ec4b61dc2aae419b3cb3574

Download Submit
C:\Windows\SysWOW64\Hfgnop32.exe

Filesize
790KB

MD5
07ede1a7a100f038a64a9a91ffab796d

SHA1
7608a8782b9763df99b93c305e1560640d82c418

SHA256
1ccd381e35c069c9df42aa17c1f45cc8b3ee5cfa1305246574fbcf40bdff4f0c

SHA512
b00e20d90d0474fba0b0cf82be3d0343a21f966240ce7d9dbf0c262c5567c9f0fea1f5a29bf7740ed90d898cc9097956956b148a7fe7ea9bd514c15760b6c588

Download Submit
C:\Windows\SysWOW64\Hjlmemae.exe

Filesize
790KB

MD5
3fbf6028cf047d89270ba5cc82bfa8ed

SHA1
1cf24bb1ae44340629bb75088e79be6793435f94

SHA256
db5ec1a089a25903ffc96f07781b12fb39f9a79d79e9ec31fc9ce71de26eea9f

SHA512
a9239f17ce530150df0a4a3141bc17d46def3f6e2c34f0454f4c6b944bc462db7efb4c0de442eabe3ac7304a04c34872d8850159652d731e13c25a51472a5964

Download Submit
C:\Windows\SysWOW64\Hncpklnd.exe

Filesize
790KB

MD5
d1468625de78bbe818f538a198854bd9

SHA1
211cface2b67f2da388d7e0eb13eef2448251ce7

SHA256
914da2e05e076858ff72df63ada2b8ab417e7a1cdd61a0ed715a5d3f52accb07

SHA512
4f94d9d2d08bfbbacda7506027847d57c9524fbf61ddfca9a7054aadfd2273418f70eda6a032ec5d543a61222d4e9f261b2b0475da71c0906980b1cfb8a1ec53

Download Submit
C:\Windows\SysWOW64\Ikafql32.exe

Filesize
790KB

MD5
ce7d5c1e57bb50f7c5d52f3e3b392e34

SHA1
e89b42d003e0157e075424b5e8fdcdced79470e7

SHA256
006d56db9e0f47a2dd3d6231c8cd49edd606e239b66eaf69f2901619e002da83

SHA512
7cf5be0cac4f713d3acc70e82d675feb33dffb337a2e408b34414f58b9f4378f724ee9c66e7b39e496994905e648955002768a7325784b7988b1c51c010112f6

Download Submit
C:\Windows\SysWOW64\Jhlmjo32.exe

Filesize
790KB

MD5
63e782535e30e54105c7aef3850526bc

SHA1
4a5195c099f9ad3f2e76e86ed3b4f5cf5d650013

SHA256
359e14e9b3f496b6bddeab05459319f52a2c6e0c600035df1bce9a1fa122d09d

SHA512
d882c7e6e64705c4f41e0d1c57b1dd30faa3cabb2fdfd818ace430ece51b2365a1b7e538c6783054293471e8cf935287dc73acf3397e2f2ad38834338966cdf9

Download Submit
C:\Windows\SysWOW64\Kpcakp32.exe

Filesize
790KB

MD5
cf3f034ba5a58422378aea746f69e542

SHA1
7e651e7ec19807385f1a9c9fbe77fbeee47a9f51

SHA256
6988d21f42e92affc6e9af82de29d7db08e716f8dd04644dd355f9cf30d18418

SHA512
4ad3d058d727483ef99ecb5fb0dc34fd0a85bca6628d0c29f6a972030aafcf8497997b0363c28e57631d34fc8bbdb784c546eeea3cfd601ae540f46b5c6d1dfa

Download Submit
C:\Windows\SysWOW64\Lfolhfop.dll

Filesize
7KB

MD5
970a1cec12d9090f9896fb5759b24237

SHA1
628ba7a35e0ada4f2412ea8b40dd81f6b09f5403

SHA256
d0ae066e2b83e185d88921d48fbec612d3c37b062652b1b9036d9fec507b3054

SHA512
fdae0e62fa138924aaedeec879e6617a73f63b66e2ce0e0b40d04101686e77b7a11b91f389ee16972ab618ec2df64552c9974a6a9b8c03dbf08211424fe1459f

Download Submit
C:\Windows\SysWOW64\Lgpodgag.exe

Filesize
790KB

MD5
234d723110127338dbe929c1c3a7fb12

SHA1
d2b33b68558b0b7c668502c08413863cef301edb

SHA256
db34fd0f1533e1a1ca1b51d54595c7890368bef3df822cdf2e6fcf373fc777c7

SHA512
95bd86c4d6aaacd026a96ef5cab35d5cddb5bfcea4dbff8dd37bc3d2283b76eb3412e306861ef2dcf26a73a5369df0bef0b25903a049bbd9b0371a8e3b9bb79c

Download Submit
C:\Windows\SysWOW64\Lhclbl32.exe

Filesize
790KB

MD5
2134b528391f37cff0f11e10bb69f2ed

SHA1
35836b203157385b4efd1d800f1bc65d1ba1c880

SHA256
f18548790c2ff1d56e475533fa734564f1b4300b3a23011ad3242f7d894d7ada

SHA512
8105327383fb11804987ba670831807f46b1fc5e138c39a37008b879b2cc6ab2a3f389208da11c1994eb4002d6fdc7b6d1486cbe9ff615f332ef886dcab31ab2

Download Submit
C:\Windows\SysWOW64\Mholnjhj.exe

Filesize
790KB

MD5
7e46a1050f51980e03dd40e373452ea8

SHA1
15fcc2d18642570a9b6fe2067ea4ddeab3c3e704

SHA256
8d7256753098d3c25dda19fe06d2a6224ebc344fee5f788e5d2af7950a4732c2

SHA512
e3d16cec1b0a192e5a81a0a95eec62d18e333d6e95e18c7e37d338d2494bf2157f07b5fed9f6c372c5f1a439c672a1dd4933a054740b6164c54fdb8a70e66561

Download Submit
C:\Windows\SysWOW64\Nffinbjj.exe

Filesize
790KB

MD5
a1b26f865b20256e12c57c6d97ab99fc

SHA1
3d14fe694cd2cf5ce5306413a82ff6505d8c37ea

SHA256
957d5b126dd45fcf4d66699f7461de9519b03d235b497c9e511a7eafb5d9cd37

SHA512
f0ad42ac0fa05c4d6107a8e36cdfe2b38f45fa17274a7f9f65b7f808c6cee043c50b62f63c1b0a5606f44caefad8874333f93e7c7428b51915596f6f2b646323

Download Submit
C:\Windows\SysWOW64\Npjdlhep.exe

Filesize
790KB

MD5
6ec1b476534ae7a89b8c2a2323addfb8

SHA1
ed74b9a6f74e82c15700b511d35015e45e5a1f18

SHA256
74773ec1600982ae6790d0568bae45c1233e639b1d54e9b858c86b2e90dd1c94

SHA512
510aa04854af705f0b4aa75d3422d934ea84a30e967356d97c60a4f555b6ad7f535357fddf89f494439c9c6dc1e6f3e8ecf47ba7ec5e1f3609cb365f4eab5fa0

Download Submit
C:\Windows\SysWOW64\Npomgh32.exe

Filesize
790KB

MD5
9ef3be2780ff1504f13ef0aff44480ff

SHA1
02364d3a77f2d1b515f57bd6d404114919a219ca

SHA256
db8059a71d6c26ef50715aa608073208610325de64330474e13c8dcf2376ff1a

SHA512
f24905fe0b947ff85e577cdc401cae871070ac4c5e7a813d0c2ca13f698f11a7b2b8b4c3f639de2c703aceea210606dea9591d52d2374caaddfaf6e0e8304049

Download Submit
C:\Windows\SysWOW64\Nqdchkmj.exe

Filesize
790KB

MD5
9f459c1e376a9edda7b26982ea862616

SHA1
9b74c416fac6ce1b7a68fb0f1c2b74c647cd5d7f

SHA256
ea7ee07614a2f2e51cf55f239d0ac855fa84f5c2a42f35aaf1ef8966571b8610

SHA512
8ba42fe631b9952c3606e31d49c2e090814ce15f039df1bda7dc6472cff361205594a478ee1415526f42a8b9481fcf3dfc0c106f77ef59d772a7cceeac8d9872

Download Submit
C:\Windows\SysWOW64\Obbcnbli.exe

Filesize
790KB

MD5
18ccafdb937f15f045491f0b47c8f7bc

SHA1
dbe4eca3e0e09a02d4d838fc20b2a52e1e351bf5

SHA256
e3209f4616e0d01dbd3a41e643607bd844239dd0f29e53d880d6d973fcf5e29c

SHA512
f86244caa8aaab0134a1263b988a800c421eb25e1917940f5bdfc954cd304286c074710fb81413b822053581699607aa64a542d366c7986ce990e1a9639088eb

Download Submit
C:\Windows\SysWOW64\Obdpcb32.exe

Filesize
790KB

MD5
d3378b72284a0b95a1a61d5a3e584a57

SHA1
982b4d9b7702876d878b64daaf429199c3a943f1

SHA256
3a6ae3c74b4aeac4dd6e180de05741c096822f86a6187025963babf97c62843b

SHA512
2f35216c03140964fced6da10de6755b0b2ce33a50e5b8ab90bb93e51013d2de30cee9ceaa6e73112654ac1d0d4177020314ffc777ed9795f336ba97fab29f77

Download Submit
C:\Windows\SysWOW64\Obglib32.exe

Filesize
790KB

MD5
9c01174c24c10aa52d95ed4f314d8315

SHA1
d992010fec05336b7188eee1953547e7182ee77e

SHA256
7f8fbd6f109019e8e4695a43f8157282ceeb631796d6dc1fbcd4b810195bdfec

SHA512
b95f05c6e49ff0080bcc66de8dbfb7a76f2d94df6cf77f1c3c783edd903b6f1166b83575ac3fc993c277128946107a7ce2c18e6fe03185bdde65dc76d027107d

Download Submit
C:\Windows\SysWOW64\Oeclpn32.exe

Filesize
790KB

MD5
27c82e7aac8852bd9c5aa63febdeca73

SHA1
e3a878ae13317d3b0ecf88b50cbad89c72f4af19

SHA256
bdd88994dfcc71d32a252315f57937f7e848888dd8ed49e7591520f66faefba8

SHA512
d83d7a6352ce19c760ebe5ad4bcb6d480c7a975cc4fc7c2a393b0fee5d536ce3f41697db93f7874ac93a96d1b50084032223414924a8f8c64e7e5650a8d269c5

Download Submit
C:\Windows\SysWOW64\Oelfoo32.exe

Filesize
790KB

MD5
28c249eef081618afe2010f4a4628117

SHA1
809d8d98af4af6b1c3a2ea48820ad1d2ad60436e

SHA256
10f062342749ccf81d470a354db21201185130bf29857ad8a29ad7677a833a26

SHA512
7c0eddaf021afde33d068e8c3f4cfadd68f01cf54d2dfc95b0056a9adf6b9d8cc49787c7ae7fd11e3915dbcfd07b53a40f44f4119379bb86c82d200892977669

Download Submit
C:\Windows\SysWOW64\Oenbenmo.exe

Filesize
790KB

MD5
c200532815731636d8155b8fc405dd21

SHA1
969f21558d1f6f2d0f18b8f5812873e2e61e3c3c

SHA256
e1d5913546185636628f31943ea96c6af24c8e104b43d53923b58edc7d8cee55

SHA512
806252c5089d17a573a2492f226fd32d17fe06c367522cdba47557dc57d03c7d7bb2adb01320329022d92d4ca89d80acdd226d3c4df42b91676b4b756bd31728

Download Submit
C:\Windows\SysWOW64\Oeqojnkl.exe

Filesize
790KB

MD5
e541ee64d18bad294d57f52f729b1c8b

SHA1
6f92d00e27eddf169480d6c979fa8baae25d7580

SHA256
276d9aa28ce82198c8eee4ed4a84599729fa5fb972f216d1ab575a47ab9bb5f1

SHA512
3eab7ce88bfe4599ac565d4d68b65fe381cd51fc370613350d39571d6d9988930a4537cf50a6f855b7c1a7eeac7167a2b550fd863d689f8c382b5955cecbb310

Download Submit
C:\Windows\SysWOW64\Ofbhjqpl.exe

Filesize
790KB

MD5
b997211eb094b3a866d14e1851618e6a

SHA1
32214d74c3f54819ddece353fec081a45bda1903

SHA256
4b7d980a982ab83030785d08bbb6e5220f798af159034ab81d341baaa02dccb7

SHA512
adee002123aaf4aa6a87335568ebb142741c128b04205b3ede62e5a7ea1d3331797b8ab595ad05bbc0c6f1d687a0e496556b6366402f1ac0abb69f5933271881

Download Submit
C:\Windows\SysWOW64\Ofkbia32.exe

Filesize
790KB

MD5
84254650c3d9fff48f2a7e36dba64d92

SHA1
2d8a3c7bfa220e4d29f1a927bba7acf5d1f10704

SHA256
f82cf7b6370712b85061522185cfca61639c4cf71661647838ad1c1f196b7af8

SHA512
9d62f942e04ad265181c17f5542e1830e2a2a092a0039aabcdfb9586e2521ddad5230edcacfc2a1a29b298813eb4786775e77f992d607d8848fb37f9abcdf2ad

Download Submit
C:\Windows\SysWOW64\Ofpldabo.exe

Filesize
790KB

MD5
ec994dfb52eee941a6e4e9ea5cbfdfd0

SHA1
63ffb769014e6d4f72a6ac0cf44c6c734e5d31f1

SHA256
00d91f2ba4543bbe0540e810bfa444ebcd73af1d9646f818995b9e2011a5970d

SHA512
9d6e820e2f153e65e2339309b5880abeb13d307957c79847e739bb0007753ae90212f3fea1d2a64ea81deca83210576ee98f3f00a382b99f18fa97a3384ef902

Download Submit
C:\Windows\SysWOW64\Oilkkm32.exe

Filesize
790KB

MD5
7f691c6e034d6466e8f31db6b9474a10

SHA1
e40f97914a22efb4a9e864e9d2d0efb447ac04e8

SHA256
b804614eae705afefef2832d68b0a05b35e4436623ecb32d2b77d17857fa8371

SHA512
56c140d5693badfd3b2746ee215c940680bb1eca7ba00098749bf807d9d1eabab86115bda2620d09fc16f877485e77141122589857668c0dcb89fbdba9465cca

Download Submit
C:\Windows\SysWOW64\Oiqdflop.exe

Filesize
790KB

MD5
07d66b8b3fa3f1b5e44655d747a03b3f

SHA1
92b1bf507bef4fa0ace307d4de9032f6df0db4c8

SHA256
de4b62dc61af162b104f7a3e636764dfc0ab9e163a71603cd43a9363bbb642d8

SHA512
8459a346cb9805516c897d18a8221da4cb8733726959087d065476fa7a7cbab4bf90ab519965d828ea1c32d908b5f5c36adc8534b6179b15807df3e91a22c602

Download Submit
C:\Windows\SysWOW64\Oljgghbi.exe

Filesize
790KB

MD5
6bd5a12075b70be269d8cce3cd91b9dc

SHA1
c04c6b4a0a9aae31f0ed7809d36cf09674ce372f

SHA256
d63e177eb8d4d924a8dedc1ee2162a6df41d35f278d826271aefda72fe04dce1

SHA512
34b89ba82da4f6fb5796fa00846d28332e80cf94da75e09fdbb1151bdd420bd70b59de1c6cd505831d8f5d4de1da7718843e5b7aeeb0dc25eb8a6a5cb9f9f9ed

Download Submit
C:\Windows\SysWOW64\Oloabgnd.exe

Filesize
790KB

MD5
7963675a2f67483efec35c0ec7a7eab1

SHA1
00a9de9bbf482febd30ed11ecebcb87d31744db0

SHA256
607e5327ab3709eaf62b9c5355973ac6a949e169b7963fb2414463348f041094

SHA512
8a19ccb611ca936869bc2ec8a05416a5198adab643f4e2ad67d09a04a7da9131ff41b741172f8b1a6cddcbbb35c17f034a3749e4f1a5d7494b3ca450bae595f4

Download Submit
C:\Windows\SysWOW64\Omejflna.exe

Filesize
790KB

MD5
aff1b44a418f1fea98dd1bbb2627551b

SHA1
8b365f4ea5bbb14bce20dd0ce1626dfb0e2abdb1

SHA256
f827b40e14eacea279978ab3f412a7be3e3de961feddf981dad2aa7fadc5f755

SHA512
e690234976d8421e9441f23ec900461a279843e371aa52bb628e3cab40293400106facc987cd030b20fc75a9b9e477ed14cb610f3be3e1fb4a96f615ac474fe3

Download Submit
C:\Windows\SysWOW64\Omjdak32.exe

Filesize
790KB

MD5
f372afec6dd77ab3bccc3874ef14f988

SHA1
2d77b8085c134052b74cbe1eed8c6a4f2eee03fa

SHA256
ee50df5aeae75decde21e00e0e981f055a43cc80682a27d034da8f41ce062b11

SHA512
4f73243217413e7877bdfc6cf1c855702e53f6f883bfc251b4d432d8edda4d94d30259a22c6296661a0997063ea54437f11077eb62fd3078d21b54168d01f27c

Download Submit
C:\Windows\SysWOW64\Ondjhd32.exe

Filesize
790KB

MD5
2d3c6999a658de4685ca72f68d01abb3

SHA1
4727919129ba6e51fc91d51ccf78ad3c4acbb773

SHA256
4398d72c0ec2712f2e8fc3414d51d9bf156639ff0b563bd750e0fcd4f35ec34b

SHA512
815ef181c99948c2375a81b8638ef6ba8dd4b14785885418177a952460af6abe1cc3a42125d36e283ee76cf352ccfe00485a4d9621cbae4a617f3b6db010f323

Download Submit
C:\Windows\SysWOW64\Onfgnd32.exe

Filesize
790KB

MD5
4f76405aef072441e926e051ff647896

SHA1
fcca13ad9a981f48ca94778c7187382261d50d49

SHA256
603ac2f3d6e7c32e21c1b021b7390203c2217b363cb3e23fa13cf5b0cd59875e

SHA512
adb152b21d67f81bae2e0e1ed0f6c0b3f97f0232206b0b8a546dd6382c7ea877e50b97fa80d20a27c917443b332a93b2c40ea21d59d006e1a18a68e4db34a3f2

Download Submit
C:\Windows\SysWOW64\Opajlgog.exe

Filesize
790KB

MD5
638d07abad1a2575e27ad4ff42856e84

SHA1
f740995843e3ace0df2aabf87e1a7e64276127ed

SHA256
41562e504286dd57687730a5c9367639e1ef29d354f7cb7b8a5d8e70007cd8e0

SHA512
e0b310e08996ecbad7aaf81953dc834913b146865271298f59510c65b8ccdf2e2eee25bd2d8055bf0cc2fec5003da891b8893db84a6890ed4c698b1cdf75b2e6

Download Submit
C:\Windows\SysWOW64\Opcgbgme.exe

Filesize
790KB

MD5
6435743b9602daeeafb1b370c6276e16

SHA1
0f0a991acc1786ce255bf82791c28e0b77d19fef

SHA256
79f3c1e0644e66a5396512604becc4ee019f1f08d809d25563e792521387dbce

SHA512
730922e1739be5949fb05e9918f88f967b5bc4358c24b637d2996ef27094089c613c515230344db4611400693783bdb56c658e82bcdc56515d30aa4f65dac29d

Download Submit
C:\Windows\SysWOW64\Opfcgg32.exe

Filesize
790KB

MD5
d8411cacb241ccdd5384bb451057ac1e

SHA1
43dda599337143d93431407369f8ecac558aa2f5

SHA256
36ad996aaa0bdeafff2954725bff32652da9a7a266faf06d94afafb14129eb42

SHA512
1692652028a73240bf66f5dcc91592298deedb512c01835f1c36e69fafd5d76ddb6988abd9a2c739a645b5fc03fc4895b262c877a65e546467ba6287aa745f90

Download Submit
C:\Windows\SysWOW64\Ophpmf32.exe

Filesize
790KB

MD5
97c61dd7950f6eda82bd2d28f977e0a8

SHA1
bb04082116d4dcbbfb803697f23c12f7da86d9c0

SHA256
e8011a47fa2b9900b26dbb40d84d9b549be6573d216d800509895b0f6e2af27a

SHA512
7b2073d1cf0348e43dad98ff8bf92101dfc0a9ba63911ebb2ccbd484b2728ea33c7280cb7db7282ce35077a0554e27321524bc5f29f9eb4905852ff2f1bc7f28

Download Submit
C:\Windows\SysWOW64\Pbkfdacn.exe

Filesize
790KB

MD5
0b4c62a02e94c184b81912a06c87b8bf

SHA1
33e1afca9485baf731717834ff588eba924b271e

SHA256
14984a2c13f685aa89673df0dcdb5e41b6893321376b4a107fcb8e082aad188d

SHA512
db59ecea0942fb3046caba86e8c4e182e192dd8c9bf240a244333ddddf4f5f6caf30c7fe716bc80ad31d8e0f1dd4fd57609eec17e7a0f186187337489507e52e

Download Submit
C:\Windows\SysWOW64\Pejbqmca.exe

Filesize
790KB

MD5
e9cf5b41fc412e8639358f9a6ce06ec4

SHA1
9b8961b653103158e23ec98a9ab68a6d19e04745

SHA256
6eebd1a742408f40f748984245a4fc2126601b75952175006b5f0cc3221bd737

SHA512
25ba4c9ad450d9728d77d470f2e14f685d4ca0335312fd33b94d13693219524530e1f9814b59aa77d7afc4198f87efce7699a3639d8ff7a7d376c4df0b652348

Download Submit
C:\Windows\SysWOW64\Pfdeop32.exe

Filesize
790KB

MD5
e1beb5427aa10f70444cfae5e6193eb9

SHA1
43c4b3e1e07d26ebdab327b4d5488c7e374d1969

SHA256
790dc3d04fbfa903ed46907091977bf437516bce09726e351697234539567395

SHA512
d4ab472a13f950652985ee1750ed07671e82beccd4baa2c6a151ced8466afe2d262fda661cf39692cac53e71d424bbcd91ac29905ae0e3eb1def4c20eba90937

Download Submit
C:\Windows\SysWOW64\Picakl32.exe

Filesize
790KB

MD5
876549a7b9ee378799f5301ddab98ad6

SHA1
cc1338e21dbdb83660cf2f9147c2d9bf565c4074

SHA256
3a4c013ad9031f189bfbbd96dd4f380e0ae002f9de74a6396834d05615624e42

SHA512
ce997789ca715d2be628aefc253e8a8aab1936817093fc6aeb58c27f8f956e92e49e0557501f071b88d69e176e2d398df12906be3d80cb0c25f97ec39ffcdb8b

Download Submit
C:\Windows\SysWOW64\Pmomljef.exe

Filesize
790KB

MD5
b341010ec22f64e8428d1897dffb172c

SHA1
dfbafb7693c30e0210972918b0f128f2416e2fcc

SHA256
64cfd83a3e867f9e1a1203c6388d64a4084dc9e6da99a22c48c9f53ba8f64e29

SHA512
7696c341bb7f6f2c04aa9a5bf8c29322a5ee35f418ac4999935c312fb751331b873705a57ffc6e1f066cc1adef5768b23c9cfdbbb7d6fb0dd813c898a2a7bf40

Download Submit
C:\Windows\SysWOW64\Ponmnc32.exe

Filesize
790KB

MD5
dc8dd7b17053f9b685a5d44bc82077f7

SHA1
7e3fa17037c409c76f9d0557bc6cdc5338a1f1ad

SHA256
73d632f1a70f87995c987cc9f8c33bf45da1db4deee312ecfdb1f06135f73a4c

SHA512
32da02c7417f8484f9a995363db929d6fb4753be22e073e25aba82972a9492ca7976057b5196d1dd21d60ccbfac846d5dbaadea05d105ad94c9de41740f8174f

Download Submit
C:\Windows\SysWOW64\Ppmihfdj.exe

Filesize
790KB

MD5
2e4777659f085fbb081ca8163fd72550

SHA1
fe2e2f9017671cd31f7e6c7b7e3d5b1aa40932c4

SHA256
ecad7c98a08a027fac6883d756eddf58e4bb5988e2cc46b231b5f8c3842db64a

SHA512
da1e7fcffe1dde46e685e077001477cd1d1aa24ed6a37f732a9bd86dcf8edc9601ca8da7e1ecb80b0f8aacc824c4d4df6373bab8787f3422982cf6db287bfb37

Download Submit
memory/64-773-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/408-785-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/696-784-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/704-764-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/848-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-842-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/924-778-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/988-770-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-759-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1068-793-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1208-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1256-760-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1332-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1388-763-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-780-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1772-791-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-839-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-775-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2504-786-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2572-771-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2648-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2684-782-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2692-838-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2848-794-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2980-790-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-781-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3032-792-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3144-774-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3236-840-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-789-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3344-757-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-767-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3396-834-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3436-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-768-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-796-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3656-795-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3740-787-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3840-788-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3924-797-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-836-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4076-762-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4080-783-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4312-772-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-776-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4504-769-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-777-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4680-59-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4688-779-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-766-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4884-835-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4952-758-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5004-60-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5012-765-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5036-761-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5152-798-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5176-841-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5188-799-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5224-800-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5264-801-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5288-843-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5300-802-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5336-804-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5364-844-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5372-805-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5408-810-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5416-845-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5444-811-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5452-846-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5496-812-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5552-813-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5576-847-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5592-814-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5632-816-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5652-848-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5668-820-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5704-849-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5708-821-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5744-822-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5772-850-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5780-823-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5816-824-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5840-851-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5852-825-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5888-826-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5896-852-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5924-827-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5956-853-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5960-828-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5996-829-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6004-854-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6032-830-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6072-831-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6104-832-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6140-833-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads