87b20aeef5788e72a07bfe1d28211a1274036cdf9d886786c1fe6e6bbc540c1b

Analysis

max time kernel
137s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87b20aeef5788e72a07bfe1d28211a1274036cdf9d886786c1fe6e6bbc540c1b.exe
Size

55KB
MD5

5f6850c9dab55b7f475d4e5f7f3ea1fc
SHA1

8bfa4b3de5dd17f8b3ecebf81d6a2757945036d0
SHA256

87b20aeef5788e72a07bfe1d28211a1274036cdf9d886786c1fe6e6bbc540c1b
SHA512

9f64a0f908f3bdaf4dc852f2258c0f5e8ef1700dce81cc1e2d885a06a260d17d92646e6ef68857d18a2019fa234eeaba18c793ae6bcb091aea16c3fcc78399dc
SSDEEP

768:ubkKLuwxdE9+DkEOhfcDoRcHovNcOjx5xrAMkwEE8QRJZ/1H5QXdnh:yk9w/E9+DknhU0RMo11jx5xPzERQLA

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbmhlihl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnlnon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njqmepik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdegandp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdcdbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmfkoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeopki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Camphf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chbnia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceaehfjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifgbnlmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohoigfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icplcpgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eabbjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fafkecel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkopnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alfkbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbqlfkmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olmeci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deoaid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klimip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cojjqlpk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcmnpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbllbibl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeopki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdialn32.exe

Executes dropped EXE 64 IoCs

pid	Process
224	Qnnanphk.exe
716	Qalnjkgo.exe
4224	Agffge32.exe
2324	Anpncp32.exe
3456	Aanjpk32.exe
3604	Ahhblemi.exe
3132	Ajfoiqll.exe
3092	Aaqgek32.exe
4252	Acocaf32.exe
3112	Alfkbc32.exe
2860	Andgoobc.exe
3796	Aeopki32.exe
4332	Ahmlgd32.exe
2072	Ajkhdp32.exe
4756	Aaepqjpd.exe
2360	Ahoimd32.exe
1104	Ajneip32.exe
1028	Becifhfj.exe
2884	Bhaebcen.exe
464	Bnlnon32.exe
3056	Bajjli32.exe
4792	Bdhfhe32.exe
4156	Bjbndobo.exe
3780	Bbifelba.exe
4640	Behbag32.exe
1596	Bhfonc32.exe
2364	Blbknaib.exe
1488	Bblckl32.exe
448	Baocghgi.exe
1212	Bhikcb32.exe
3280	Bjghpn32.exe
4904	Bbnpqk32.exe
4920	Bemlmgnp.exe
3948	Bhkhibmc.exe
4412	Bkidenlg.exe
2328	Cbqlfkmi.exe
900	Ceoibflm.exe
3212	Chmeobkq.exe
724	Cliaoq32.exe
1448	Cogmkl32.exe
1688	Ceaehfjj.exe
1468	Chpada32.exe
780	Cknnpm32.exe
4056	Cojjqlpk.exe
4916	Cahfmgoo.exe
4140	Chbnia32.exe
2196	Clnjjpod.exe
4892	Colffknh.exe
2640	Cajcbgml.exe
3860	Cefoce32.exe
1464	Chdkoa32.exe
5028	Conclk32.exe
4512	Camphf32.exe
3172	Cdkldb32.exe
3232	Chghdqbf.exe
4012	Ckedalaj.exe
4768	Dbllbibl.exe
524	Ddmhja32.exe
2156	Dhidjpqc.exe
4616	Dkgqfl32.exe
3124	Docmgjhp.exe
1052	Daaicfgd.exe
2872	Dhkapp32.exe
4308	Dkjmlk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Foabofnn.exe	Fkffog32.exe
File created	C:\Windows\SysWOW64\Liddbc32.exe	Lffhfh32.exe
File opened for modification	C:\Windows\SysWOW64\Lljfpnjg.exe	Likjcbkc.exe
File opened for modification	C:\Windows\SysWOW64\Mpablkhc.exe	Mmbfpp32.exe
File created	C:\Windows\SysWOW64\Onhhamgg.exe	Opdghh32.exe
File opened for modification	C:\Windows\SysWOW64\Blbknaib.exe	Bhfonc32.exe
File created	C:\Windows\SysWOW64\Cknnpm32.exe	Chpada32.exe
File created	C:\Windows\SysWOW64\Ecandfpd.exe	Elgfgl32.exe
File opened for modification	C:\Windows\SysWOW64\Nckndeni.exe	Npmagine.exe
File created	C:\Windows\SysWOW64\Fljcmlfd.exe	Edbklofb.exe
File created	C:\Windows\SysWOW64\Ipnjafgo.dll	Hmabdibj.exe
File created	C:\Windows\SysWOW64\Ncbhll32.dll	Hmfkoh32.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Chghdqbf.exe	Cdkldb32.exe
File created	C:\Windows\SysWOW64\Ljodkeij.dll	Lboeaifi.exe
File created	C:\Windows\SysWOW64\Fjbodfcj.dll	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Lmbmibhb.exe	Ligqhc32.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Lcjakp32.dll	Ahhblemi.exe
File created	C:\Windows\SysWOW64\Lejfpelg.dll	Hckjacjg.exe
File opened for modification	C:\Windows\SysWOW64\Kboljk32.exe	Jmbdbd32.exe
File opened for modification	C:\Windows\SysWOW64\Olcbmj32.exe	Njefqo32.exe
File created	C:\Windows\SysWOW64\Fbegho32.dll	Bemlmgnp.exe
File opened for modification	C:\Windows\SysWOW64\Kpbmco32.exe	Kiidgeki.exe
File created	C:\Windows\SysWOW64\Ldanqkki.exe	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Eeijge32.dll	Ajkhdp32.exe
File created	C:\Windows\SysWOW64\Higchddh.dll	Dceohhja.exe
File created	C:\Windows\SysWOW64\Mgfqmfde.exe	Mplhql32.exe
File created	C:\Windows\SysWOW64\Lllcen32.exe	Lingibiq.exe
File created	C:\Windows\SysWOW64\Jholncde.dll	Mgfqmfde.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Bhfonc32.exe	Behbag32.exe
File created	C:\Windows\SysWOW64\Ajdhcbgd.dll	Baocghgi.exe
File created	C:\Windows\SysWOW64\Gfgjgo32.exe	Gomakdcp.exe
File opened for modification	C:\Windows\SysWOW64\Pncgmkmj.exe	Pflplnlg.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pmidog32.exe
File opened for modification	C:\Windows\SysWOW64\Qmkadgpo.exe	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Mkoqfnpl.dll	Jfhlejnh.exe
File opened for modification	C:\Windows\SysWOW64\Kdgljmcd.exe	Klqcioba.exe
File created	C:\Windows\SysWOW64\Gebgohck.dll	Liddbc32.exe
File created	C:\Windows\SysWOW64\Gomakdcp.exe	Gmoeoidl.exe
File created	C:\Windows\SysWOW64\Jcgbco32.exe	Jefbfgig.exe
File created	C:\Windows\SysWOW64\Nfjjppmm.exe	Nckndeni.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Ahhblemi.exe	Aanjpk32.exe
File created	C:\Windows\SysWOW64\Ajkhdp32.exe	Ahmlgd32.exe
File opened for modification	C:\Windows\SysWOW64\Aaepqjpd.exe	Ajkhdp32.exe
File opened for modification	C:\Windows\SysWOW64\Likjcbkc.exe	Lgmngglp.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Dedkdcie.exe	Dceohhja.exe
File created	C:\Windows\SysWOW64\Gcfqfc32.exe	Gkoiefmj.exe
File created	C:\Windows\SysWOW64\Lpnlpnih.exe	Lmppcbjd.exe
File created	C:\Windows\SysWOW64\Hcpclbfa.exe	Hmfkoh32.exe
File created	C:\Windows\SysWOW64\Pfjcgn32.exe	Pclgkb32.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Qalnjkgo.exe	Qnnanphk.exe
File created	C:\Windows\SysWOW64\Facagg32.dll	Bblckl32.exe
File created	C:\Windows\SysWOW64\Kcfcjd32.dll	Cojjqlpk.exe
File opened for modification	C:\Windows\SysWOW64\Jmknaell.exe	Jioaqfcc.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Jcbldglg.dll	Daaicfgd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10212	10120	WerFault.exe	446

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agffge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdgdgnbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmoeoidl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kepelfam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liddbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnjlpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alfkbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkidenlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flqimk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icplcpgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajneip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjbndobo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heapdjlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipdqba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klngdpdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opdghh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekhjmiad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcckif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdialn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hckjacjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blbknaib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcijeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbnpqk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkhibmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dohfbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfeopj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlhbal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olhlhjpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cahfmgoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Colffknh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conclk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbgqohi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hflcbngh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ildkgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjghpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhidjpqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfifmnij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjjnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgfqmfde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdegandp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdlnbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Helfik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfaedkdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jefbfgig.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inpocg32.dll"	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijlad32.dll"	Mchhggno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmcdaagm.dll"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhqcam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbnaa32.dll"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdlgno32.dll"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdcdbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eekaebcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cliaoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alfkbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cahfmgoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dafbne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cliaoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Camphf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogkcpbam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkidenlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clnjjpod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kihgme32.dll"	Ahoimd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llgjjnlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mplhql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baocghgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjkolmml.dll"	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafdhogo.dll"	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eohipl32.dll"	Njqmepik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfldb32.dll"	Chbnia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffimfqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eikdngcl.dll"	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mchhggno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmnemcc.dll"	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Becifhfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipdejo32.dll"	Imoneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmfmmcbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjgdmkj.dll"	Foabofnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daaicfgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehedfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cajolcjk.dll"	Ecandfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkalchij.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 224	4592	87b20aeef5788e72a07bfe1d28211a1274036cdf9d886786c1fe6e6bbc540c1b.exe	84
PID 4592 wrote to memory of 224	4592	87b20aeef5788e72a07bfe1d28211a1274036cdf9d886786c1fe6e6bbc540c1b.exe	84
PID 4592 wrote to memory of 224	4592	87b20aeef5788e72a07bfe1d28211a1274036cdf9d886786c1fe6e6bbc540c1b.exe	84
PID 224 wrote to memory of 716	224	Qnnanphk.exe	85
PID 224 wrote to memory of 716	224	Qnnanphk.exe	85
PID 224 wrote to memory of 716	224	Qnnanphk.exe	85
PID 716 wrote to memory of 4224	716	Qalnjkgo.exe	86
PID 716 wrote to memory of 4224	716	Qalnjkgo.exe	86
PID 716 wrote to memory of 4224	716	Qalnjkgo.exe	86
PID 4224 wrote to memory of 2324	4224	Agffge32.exe	87
PID 4224 wrote to memory of 2324	4224	Agffge32.exe	87
PID 4224 wrote to memory of 2324	4224	Agffge32.exe	87
PID 2324 wrote to memory of 3456	2324	Anpncp32.exe	88
PID 2324 wrote to memory of 3456	2324	Anpncp32.exe	88
PID 2324 wrote to memory of 3456	2324	Anpncp32.exe	88
PID 3456 wrote to memory of 3604	3456	Aanjpk32.exe	89
PID 3456 wrote to memory of 3604	3456	Aanjpk32.exe	89
PID 3456 wrote to memory of 3604	3456	Aanjpk32.exe	89
PID 3604 wrote to memory of 3132	3604	Ahhblemi.exe	90
PID 3604 wrote to memory of 3132	3604	Ahhblemi.exe	90
PID 3604 wrote to memory of 3132	3604	Ahhblemi.exe	90
PID 3132 wrote to memory of 3092	3132	Ajfoiqll.exe	91
PID 3132 wrote to memory of 3092	3132	Ajfoiqll.exe	91
PID 3132 wrote to memory of 3092	3132	Ajfoiqll.exe	91
PID 3092 wrote to memory of 4252	3092	Aaqgek32.exe	92
PID 3092 wrote to memory of 4252	3092	Aaqgek32.exe	92
PID 3092 wrote to memory of 4252	3092	Aaqgek32.exe	92
PID 4252 wrote to memory of 3112	4252	Acocaf32.exe	93
PID 4252 wrote to memory of 3112	4252	Acocaf32.exe	93
PID 4252 wrote to memory of 3112	4252	Acocaf32.exe	93
PID 3112 wrote to memory of 2860	3112	Alfkbc32.exe	94
PID 3112 wrote to memory of 2860	3112	Alfkbc32.exe	94
PID 3112 wrote to memory of 2860	3112	Alfkbc32.exe	94
PID 2860 wrote to memory of 3796	2860	Andgoobc.exe	95
PID 2860 wrote to memory of 3796	2860	Andgoobc.exe	95
PID 2860 wrote to memory of 3796	2860	Andgoobc.exe	95
PID 3796 wrote to memory of 4332	3796	Aeopki32.exe	96
PID 3796 wrote to memory of 4332	3796	Aeopki32.exe	96
PID 3796 wrote to memory of 4332	3796	Aeopki32.exe	96
PID 4332 wrote to memory of 2072	4332	Ahmlgd32.exe	97
PID 4332 wrote to memory of 2072	4332	Ahmlgd32.exe	97
PID 4332 wrote to memory of 2072	4332	Ahmlgd32.exe	97
PID 2072 wrote to memory of 4756	2072	Ajkhdp32.exe	99
PID 2072 wrote to memory of 4756	2072	Ajkhdp32.exe	99
PID 2072 wrote to memory of 4756	2072	Ajkhdp32.exe	99
PID 4756 wrote to memory of 2360	4756	Aaepqjpd.exe	100
PID 4756 wrote to memory of 2360	4756	Aaepqjpd.exe	100
PID 4756 wrote to memory of 2360	4756	Aaepqjpd.exe	100
PID 2360 wrote to memory of 1104	2360	Ahoimd32.exe	101
PID 2360 wrote to memory of 1104	2360	Ahoimd32.exe	101
PID 2360 wrote to memory of 1104	2360	Ahoimd32.exe	101
PID 1104 wrote to memory of 1028	1104	Ajneip32.exe	102
PID 1104 wrote to memory of 1028	1104	Ajneip32.exe	102
PID 1104 wrote to memory of 1028	1104	Ajneip32.exe	102
PID 1028 wrote to memory of 2884	1028	Becifhfj.exe	104
PID 1028 wrote to memory of 2884	1028	Becifhfj.exe	104
PID 1028 wrote to memory of 2884	1028	Becifhfj.exe	104
PID 2884 wrote to memory of 464	2884	Bhaebcen.exe	105
PID 2884 wrote to memory of 464	2884	Bhaebcen.exe	105
PID 2884 wrote to memory of 464	2884	Bhaebcen.exe	105
PID 464 wrote to memory of 3056	464	Bnlnon32.exe	106
PID 464 wrote to memory of 3056	464	Bnlnon32.exe	106
PID 464 wrote to memory of 3056	464	Bnlnon32.exe	106
PID 3056 wrote to memory of 4792	3056	Bajjli32.exe	108

C:\Users\Admin\AppData\Local\Temp\87b20aeef5788e72a07bfe1d28211a1274036cdf9d886786c1fe6e6bbc540c1b.exe
"C:\Users\Admin\AppData\Local\Temp\87b20aeef5788e72a07bfe1d28211a1274036cdf9d886786c1fe6e6bbc540c1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\Qnnanphk.exe
  C:\Windows\system32\Qnnanphk.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\Qalnjkgo.exe
    C:\Windows\system32\Qalnjkgo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Windows\SysWOW64\Agffge32.exe
      C:\Windows\system32\Agffge32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2324
      - C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        23⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4156
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        25⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4640
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1488
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        31⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3280
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4920
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        38⤵
        Executes dropped EXE
        
        PID:900
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        39⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:724
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        41⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1468
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        44⤵
        Executes dropped EXE
        
        PID:780
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4140
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2196
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        50⤵
        Executes dropped EXE
        
        PID:2640
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        51⤵
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        52⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3172
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        56⤵
        Executes dropped EXE
        
        PID:3232
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        57⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        59⤵
        Executes dropped EXE
        
        PID:524
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        61⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        62⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1052
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        65⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        66⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1452
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        68⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        70⤵
        Modifies registry class
        
        PID:1388
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        71⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        72⤵
        Drops file in System32 directory
        
        PID:4900
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        73⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        75⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        76⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        77⤵
        Modifies registry class
        
        PID:3244
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        78⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        79⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        80⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3304
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        82⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        83⤵
        Modifies registry class
        
        PID:1612
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2688
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        86⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:620
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        88⤵
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        89⤵
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        90⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        91⤵
        Drops file in System32 directory
        
        PID:624
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        92⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2344
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        97⤵
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5316
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        99⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        100⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        102⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        103⤵
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        104⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        105⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        108⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        109⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        110⤵
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        113⤵
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        115⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        116⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        117⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        118⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5344
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        120⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        121⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        122⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        123⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        124⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        125⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        126⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        127⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        128⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        129⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        130⤵
        Drops file in System32 directory
        
        PID:6084
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        131⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        132⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        133⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        137⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5288
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        141⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        143⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        144⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        145⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        146⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        147⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        148⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5964
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        152⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        153⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5568
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        155⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        156⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6252
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        159⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        160⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        162⤵
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6520
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        164⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6568
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        165⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        167⤵
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        168⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        170⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        171⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        172⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        173⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        175⤵
        Modifies registry class
        
        PID:7048
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        177⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        178⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        179⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        180⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        181⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        182⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        183⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6556
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        184⤵
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        186⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        187⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        188⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        189⤵
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        190⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6148
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6264
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        192⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6640
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6780
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        195⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        196⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        197⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        198⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        199⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        200⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        201⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        202⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        203⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        204⤵
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7228
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        207⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        208⤵
        Drops file in System32 directory
        
        PID:7316
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        209⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        210⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        211⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        212⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        213⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        214⤵
        Modifies registry class
        
        PID:7580
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        215⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        216⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        217⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7712
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        218⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        219⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7848
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        221⤵
        Drops file in System32 directory
        
        PID:7892
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        222⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        223⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        224⤵
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:8072
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        226⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        227⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7180
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:7260
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7328
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        232⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        233⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        234⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        235⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        237⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        238⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        239⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        240⤵
        Modifies registry class
        
        PID:8020
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        241⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        242⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        243⤵
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        245⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7460
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        246⤵
        Modifies registry class
        
        PID:7508
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        247⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        248⤵
        Modifies registry class
        
        PID:7752
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        249⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7972
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        251⤵
        Modifies registry class
        
        PID:8056
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        252⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        253⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        255⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        256⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8064
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        258⤵
        Drops file in System32 directory
        
        PID:3588
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        259⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        260⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        261⤵
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        262⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        263⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        264⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        265⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        266⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        267⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        268⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        269⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        270⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        271⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        272⤵
        Drops file in System32 directory
        
        PID:8208
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8252
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        274⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:8340
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        276⤵
        Modifies registry class
        
        PID:8384
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        277⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8472
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        279⤵
        Drops file in System32 directory
        
        PID:8516
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        280⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        281⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        282⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        283⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:8756
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8800
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        286⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        287⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8900
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        288⤵
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8992
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        290⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        291⤵
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9136
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        293⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        294⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        295⤵
        Drops file in System32 directory
        
        PID:8276
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        296⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        297⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        298⤵
        Drops file in System32 directory
        
        PID:8504
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        299⤵
        Modifies registry class
        
        PID:8576
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8648
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        301⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8796
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8872
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        304⤵
        Modifies registry class
        
        PID:8932
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9004
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        306⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        307⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9172
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        308⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        309⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        310⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        311⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        312⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8744
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        314⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8860
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        315⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        316⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        317⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        318⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        319⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8560
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        321⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        322⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        323⤵
        System Location Discovery: System Language Discovery
        
        PID:9028
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9184
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        325⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        326⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8608
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        327⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9100
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        329⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        330⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        331⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        332⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        333⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        334⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        335⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        336⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        337⤵
        Drops file in System32 directory
        
        PID:9288
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9336
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        339⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9380
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9424
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:9468
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        343⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:9600
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9640
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        346⤵
        System Location Discovery: System Language Discovery
        
        PID:9684
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9728
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        348⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:9820
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        350⤵
        System Location Discovery: System Language Discovery
        
        PID:9864
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        351⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        352⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9996
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        354⤵
        Drops file in System32 directory
        
        PID:10040
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        355⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        356⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10120 -s 396
        357⤵
        Program crash
        
        PID:10212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10120 -ip 10120
1⤵
PID:10188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
55KB

MD5
01445f20826d08413289c9cd799c7763

SHA1
6dd9a1196f10449b17ccee01b8f852707732c92b

SHA256
f5616cfa64d82ce7e6d404647dcf44af3fef9b11dcd6706c1efe8b00266b4029

SHA512
4f629f9530578f59047903345f20ed902284d3f8a1c24dbca57096e34be5ce3f1ce1933f4848ed0f5fae6c1aa2af1c43a7c55fe8bb63b2c289f46c4b5600a89f

Download Submit
C:\Windows\SysWOW64\Aaepqjpd.exe

Filesize
55KB

MD5
a5d96ef8fbc915974e85af9ce94a23f6

SHA1
d32e7bbfe692f9df24cd9e7c11b23ed39b6f1795

SHA256
f779549556e5e2dcf2d1cdb262225a305dc3f8c7cea3566b7a727a31d3f8c3c3

SHA512
4d207cc1aeeb90db01477ae2d8cda8e7e49ca599b240c244e3f90e4cbdb822d7e412a80dcca5b4bf6481b19751490ce656fed5b6d520b17469c84501b6278ced

Download Submit
C:\Windows\SysWOW64\Aanjpk32.exe

Filesize
55KB

MD5
04c0c491a4510ea77e95d7a86def492a

SHA1
7ff5211281a971dd2d7e60f66c0b198b02747e7d

SHA256
7cfcf46aac1434cde63d94bc17a0b494f796ad6f8767d36e43285b60e28404c4

SHA512
4ded3d2f7bbfb99f65f0feca6f6ca7dadcf233525a87c617bf56d28cc3347586cf36beca6732dcc22e9a7d7983d186a44880a815a33427c1816bcd3fb83b164e

Download Submit
C:\Windows\SysWOW64\Aaqgek32.exe

Filesize
55KB

MD5
458c67fea7beb841594072121bb8b429

SHA1
1601244bfdd9516a166e5b1a86e1938d30d60082

SHA256
3cf5762b73b8c2c3e2a98d4c36ec318d18fd3cd1d35d75836e285fb3391131e3

SHA512
578e2957adb412617c03eb20fcf2626e9287c03cdd8e89670b2b1f9fa035d54dcf36c11607da82c53e37fe4e71a80592b51cf82eb1f3f07ec543b45c0a24457d

Download Submit
C:\Windows\SysWOW64\Acocaf32.exe

Filesize
55KB

MD5
4260ca5899a5642df4780d63f5ae969c

SHA1
b0e8db30d0c0bd9a0b8039aa47e7a1462607046d

SHA256
da1793a26f8e95ab9584b9c691f2f3e407437854a089387bdbc255b622d4fd0b

SHA512
6e8cbc2127949d579bed90c5b5a0d5172b460dc226d992a2991fd9ecc3da0265b1c0bd4f9859b0b27d8c25423ea1afbf8ddb957877280cc11440530412ab0168

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
55KB

MD5
6a34c581791ab1e8bcd628ceb9d9ecec

SHA1
8c32100c362645dd2208fc1ba67931373c37e2ce

SHA256
0baf580bdb6d51bfae45ac90344e2d6a7b69f640af33133d24d36a0819d42d64

SHA512
20c9e049fef7efa732b3991fd8caaed0cf7882cb4ee79e699fb7dda03bd9b22041700fd39a644311da6eb7e13177cad43d60c88bc5c4eb640a726e13af6d80c3

Download Submit
C:\Windows\SysWOW64\Aeopki32.exe

Filesize
55KB

MD5
8804e2d85b9490e0558a80696c44c691

SHA1
5d83ee827c9f7e5f9d215109143cc045669c6818

SHA256
45221c57933a397920d5d163ba49e7b9c57ef6142f9f1022636a763698b198d7

SHA512
97b76731ba4478b5f30347ceb09a128a11a35c55472f0184179762b328b146c735e0fee03750b62ec3362f44f6aa14ccb9c40193d21b0ce710afb485048597cc

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
55KB

MD5
b4a3fbf189b69458ee0d2d5d1f382ea4

SHA1
a2b41954275e10adf031fe482bc9e4cfccc0a1fd

SHA256
3b6797466a8977eda549624c72f35c962f3db2d3083f54d65e2878860e02586b

SHA512
f8620aa722641453e9fe52b8808eaad41146964291a0ccad7927135db3416bd79450d3e78b37e279ed99598d534e9cf7df33ba9a93d160336db9212e725bcaee

Download Submit
C:\Windows\SysWOW64\Agffge32.exe

Filesize
55KB

MD5
7e17c50be09824bdeb68ae2a47bbb6b5

SHA1
969dc97fd3ff03182f2dfa2b51a89e2c4c1de86c

SHA256
83acc649577edea3a678b1c9af386af6738c71fefd3e880debe031c095742f66

SHA512
f43b74c35193ff631ae78838376c7ee0cd5f4226954c4fa741b12515dd50b64eea0b8ea565b43a23f52b1ed344a89a0047b154d851abe11a72edff0031ac43ae

Download Submit
C:\Windows\SysWOW64\Ahhblemi.exe

Filesize
55KB

MD5
73f3d68a6ef7accb44338ad176495785

SHA1
125f6e27934338b1ae83e731c0fb31b12f9f796a

SHA256
31e549e9cc0e35ed30ac6a70dbc46b8a4bcda3d0da70747081dc0747456a63d5

SHA512
b62b7694819e2d080660d5e31c52664b605c618f84da1f8fcada01c8c147d9b263b59c1c224e8a8be3af92bae9f6a661f796a9d9394de4f50647b2d8b1146f6c

Download Submit
C:\Windows\SysWOW64\Ahmlgd32.exe

Filesize
55KB

MD5
7c9d68b6e287905a74855c3b69d7992f

SHA1
82d50dc5bf91c57e9c7d9223948a2039386b0cae

SHA256
6bdd3bee05c6efb7054e5d7ce8b7ec73799eee24f79a78a34ccf0424a1b1e7fd

SHA512
4665455c1adeaa3a68369eb492896a0dacd681e73f9566c454d2f8c47a1e578b7bcfa9a05b51b1371aa770c14042422c4886f1e00febc0d09cf90c87c3b8b4e8

Download Submit
C:\Windows\SysWOW64\Ahoimd32.exe

Filesize
55KB

MD5
c98cd80e7ee2a97f3a32ff26a7720d86

SHA1
b6966730503389c56bf0b7e918b0f0ef359475dd

SHA256
c573fe3342bc67c07d074fb0d3cc054da3a5ed973ff14dd10a6dea35ca199af6

SHA512
c3477598221c7a7ee56b9bb7c1567a8ff726d670a17b75f3fb52b92e0bbde77a4297cb94fbafd2f99950d2a482b721dde89cd0f271fb410b6ca72f22105373bc

Download Submit
C:\Windows\SysWOW64\Ajfoiqll.exe

Filesize
55KB

MD5
e4b0c7b88955e6216c68dbf266b6f8f0

SHA1
aeab2fa795a3fe2f589cf41f5729bcb03ade08ec

SHA256
66b93265b3dae41cc01ccbb836b47d36275fac4d8e629e629a87aa10c99b1370

SHA512
37e3b0ac2eb7a7e1d905fd93eb6ff03acaebd85dc5503f265f925b2d0b812c3867f881eb760df24bba7afd2f58d41f2fda2e2524b2d09363f730875554bce6cf

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
55KB

MD5
3b03c0115cb55bdee58e3d5ed450a4c3

SHA1
9cd357e50ecaa148753f08b723c4d2e82516c42f

SHA256
e0e0cde8e57a79a417034e74d96d2243c80adaae49a5ad491b0e4ee8c6010b65

SHA512
36c07d5028e9021d6d9c72bf4068922404b3b84fd433f7457c81e7231b62e7f0cb60f13952b2d2ba2400111944c95c06f47e8e5fd90eb8d71714dcbfd6eb43bf

Download Submit
C:\Windows\SysWOW64\Ajneip32.exe

Filesize
55KB

MD5
0a55956ef1cb9c6c05afee0378058216

SHA1
67aaa6a4ae194ec86deb0cc361afd6381dbd2713

SHA256
c733623b725271f3d177d9b8004b5c71f7652d9bfed944ff7e4f9f9dc44d0f8e

SHA512
6b2f4014266d56a891ff12e80c3c8a4bd397ec65c8cbdb24299aba57a2a793de07fb70408f8e8a59dbb8f189327383af02b9238e8644593e134317b36cc216bd

Download Submit
C:\Windows\SysWOW64\Alfkbc32.exe

Filesize
55KB

MD5
e36336befeaac67d9b4da7b1496b1446

SHA1
a7a9ac705c9f186486ff70e2516723e0f9ee4bed

SHA256
ff980f9eeea848e1d872d89beb42d71baad49e2d162614a92c87588bd5caa468

SHA512
05b1a9c6a0fc8ee7360331d6dab8d233a2b31db027a13f02b5e47f175c989ebdb07b7ff6f4c0b78cf957807915371af6a922e14eed4245bc6dc3d73bcc5c0d19

Download Submit
C:\Windows\SysWOW64\Andgoobc.exe

Filesize
55KB

MD5
640f16c72ca2de38bcb53f464066f0b2

SHA1
54e8febebaf59a6cc52399fc76c5b79ca24f749a

SHA256
fde5251b96fc89bcff6c0917c7a002db5c914497e48652e88a455ab5802c34cf

SHA512
6b99ff1c6d28a693e3ef5e0c7b53b31adf99b114a4fc3dba495e72e40ce8a124563c8cae59d196d0d574f3aa9b983a67e28ece959739550866bcbf0082ed324f

Download Submit
C:\Windows\SysWOW64\Anpncp32.exe

Filesize
55KB

MD5
c868405c96a61e7439df192b12194c23

SHA1
c77d3c39ee0d5e11f36a9a466523581b511c42a1

SHA256
6de136481926bb6816d6d715302ad3998334af54920f89cf3b3c09684fba6a0f

SHA512
e32e1d64812ebb4357291f3cb930c50455da0f9896f43f4496e62059baafb907d3d8ffaa3216a28456e638915a6f872005cad98739e09c2c146891374db89b0c

Download Submit
C:\Windows\SysWOW64\Bajjli32.exe

Filesize
55KB

MD5
de93c277ff109086a1da1554499028dc

SHA1
794781c23fc8d7b99a8aa156ea3aa8420c73ddae

SHA256
da945acb651d4f205e49ca8fa4d092f82c684bcf5016574b933b455adf1a0c1c

SHA512
b72e08afd80c4b275a13afef45313ff59ed186071c07040f2b41473d053d4d4823b8ef9f1459f5293e9785c04b40b720311682b8f4a62bd082ebb5ea1537c7e3

Download Submit
C:\Windows\SysWOW64\Baocghgi.exe

Filesize
55KB

MD5
c47d20a7182137329fd52a57e0ad7b33

SHA1
10e48a8e798604167781f956f2dc8c452c72477f

SHA256
bb7e663af4fb8a13fab772c0b6df99240a65429ca501d01e78f42bd34b91d601

SHA512
7df0d680a2e29be020b0eaeaf36e7eefaf74ed55e1a248bf223d59b9e766a82021048d424dde190e01f36b874fa6dce378d93108a73d1648896f77b4f54b716f

Download Submit
C:\Windows\SysWOW64\Bbifelba.exe

Filesize
55KB

MD5
7e788e8a80101a8725c32882b05cc3e6

SHA1
c804337b8477fa3a850f706f53d37dafd77b50bd

SHA256
2dce0be1e8279149efd016d1f8c94b576680342595a44a568fd531c16fa440e9

SHA512
1d48971d7411a3b990fb8808ea7564083a0f8c006f0f543702744c618ff39ca98eaa25a094371d24ba905d5e9b011d3c18ac2e3cd8190354839841da0c3f3300

Download Submit
C:\Windows\SysWOW64\Bblckl32.exe

Filesize
55KB

MD5
a4ab95cdda3376df435cb9979d856d02

SHA1
eff575105e2d2e3372df536d68aa952b7c9cb461

SHA256
00e4c8a0bdbac1bc66843ad3c41efee2a5947d45a03b601ca24af0463c98a3fe

SHA512
e30ca9c7fbab9056dfb89a20b73ceafe8f2387dada5d0692cad675801cec7e695fd63096aade79f9413c7c79bf427f4d763f012e861e2685b7596f2be9594846

Download Submit
C:\Windows\SysWOW64\Bbnpqk32.exe

Filesize
55KB

MD5
7e2c4cdf0624989847e68015d35fd0c8

SHA1
1c8cd65470771607d1fe56f7f6e5b072bc4608be

SHA256
04f4e19256927fe6e3068d6a24040c740faebff5609db0fb9fd7cbbf53019ed3

SHA512
24305b75db48fb1e294c2c7cffe63a6f5bbd8c964d2acff824f8b334378167e1b663bdc257b2e342a099e20eb520886fe26d31dbb6ce91b643dc520b3f6063da

Download Submit
C:\Windows\SysWOW64\Bdhfhe32.exe

Filesize
55KB

MD5
95b9bfba315c471800d870e36344a579

SHA1
24182f3a70177e79b678344246e35cae90478fae

SHA256
e1c3d4083298c367c7e8aca0d74e099786bb962be799ab2faea6496cbdabb11a

SHA512
80da48ff1b385fcae4a6b30ce708dbd8dcb9fb6ea2394c466f17005e545fe63849bbb624f220f33f6145264e0265ac039c3b769c70a2fc528a3ad2d2969a9e0c

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
55KB

MD5
d6e5fdc8d1a3700dbd4c6d43b1b6e2a4

SHA1
62cef1f1fd516f4311721b201a66e5199a66561d

SHA256
92f8890544fded85b9da45b0f98bf26fbe7b182735f0588968290300ad1c691c

SHA512
cedf443494e8912a2ae422d6eb4810d9a0076002bad135e8f52c57ad00bfec2c2cd31b8d394a731509a969073d8041d7019c26069d9b04528522099ccef95321

Download Submit
C:\Windows\SysWOW64\Becifhfj.exe

Filesize
55KB

MD5
267f69ce9185d93d708798f6905ccc16

SHA1
235b03c7049cb59232a9429c24dc89c5d0c8b755

SHA256
4ff8f5e29807e8c4b08f947afd72520d130194621289e42043b3474ffa0de653

SHA512
aa389548093a5907dedb1f6629c6c7c601f8cbf3c94e02c2222fc5804351714964f071bcb80ba9e9bb575ea086a4871d28aea0d86a01dc759ab9d25480b9e666

Download Submit
C:\Windows\SysWOW64\Behbag32.exe

Filesize
55KB

MD5
2ee5ba0beafe8b746e00a37b975e19fc

SHA1
facf3d38678c4bef349c8e460a4dbe9b164f998f

SHA256
898361f8e83d3f8b7d6519add3a84229eebb4a787554b96948e4126b214a2605

SHA512
d5505704f73d3f2abad2231b00b29b678e55dbab58200dd9e50b4784a6f3693c29c9a85153406617fc9a828bc71ac9e15ff83f05262affcde047df767392aedd

Download Submit
C:\Windows\SysWOW64\Bhaebcen.exe

Filesize
55KB

MD5
e103a23eae1828527a69206e9a924ee4

SHA1
5c458c196a739c87c9502e5070f15e5aa597b200

SHA256
740f98e5b84a9e79e7ea589b183205e77a0ab448cd3f3a77321986aca090016a

SHA512
a5a56f2e6ca0f762ce8c41d65ff6b9069b50946b43c099ae7b19c0b507efbbd5af3df40de9aa9a0a891066f9c16c2d6a8da5c2fc809c38249dde50a4ecfaaa31

Download Submit
C:\Windows\SysWOW64\Bhfonc32.exe

Filesize
55KB

MD5
fc31175e2ccecc403fd6ff6326a84da1

SHA1
731f1c0a51717b90b078b080958f27fe5483c281

SHA256
a8c0df3cbc15624f2212ac52b8a244df5f6b956d0562ccbda06cbe275cfcedba

SHA512
a6fba074fc2928531e3db69a36be2e80a86106a4e6c05b48ea6e22a731363a2608b5c66573ca19730436c18236fe471e0cf746e60c7f30e302108e4fab06883a

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
55KB

MD5
dfd66bc2e2515d28e0c1f72cc1e89127

SHA1
1b614c2d26a874bd9bdf19e22c13ab3b6117bdaa

SHA256
1ca45f8eccd75dc80f47cbfc255f93eaf355340b178cacfabc01a09d0d6b6558

SHA512
ae38ae400c23aa81226e3273465dbb0bca098f1f0c9d57dd469e4a9498a4362b03657df9f75fa237b62bc0ffaa4c76ddca25c8cef991f7cd99d3b1131f6b5ef2

Download Submit
C:\Windows\SysWOW64\Bhikcb32.exe

Filesize
55KB

MD5
3c07c366646d759da6163adc1008de7c

SHA1
a401f30248d36660f8b1a632590f360c32872ccb

SHA256
a6c5a6fa35e4b2c494e538d4a780f46b13efdd4859a322e8fa63fbd059dc6f2f

SHA512
eeadf09949219a045bab09e3c3ac600e3781c68e4a7e0d5bd077aa46934fd71934584fcc40ba9a2c88f7a583bcd54d2bd89c61c18d431c81fde69ec2ddafbfce

Download Submit
C:\Windows\SysWOW64\Bjbndobo.exe

Filesize
55KB

MD5
1e73483168f7a531f577226a7d3441cb

SHA1
f1432152bbd157a3a2ddd04e63b94738df8d486d

SHA256
1061b4bc9527e063cfcdd7da0e81788288963895344128caf80882c627f3ef02

SHA512
a0e198248780db01b77d508e9bf90cb44f386be8c917fcc58a580430370fe82e7adaedd87507ecf578f703a11b015733bc79b59d3eaa528bc0427aecafd1f815

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
55KB

MD5
e0df8240e52e7776a1cf56167ac8b18e

SHA1
b4a609e07cba3974c29f275d9cb0f1862d2981f6

SHA256
ffb5ec31c104b051c6749d879d427ebb7b24cc3fa7cf8115e768ad982dea11ef

SHA512
99f758b223d0cda9bd41363f9d00c93d2f37a88a49094db18fc361d7cb57a7f2f19897ffa117bd1760a6c2c987818add37bacf8d10cd4c2292d7d88161dbd12f

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
55KB

MD5
2d4b553580da3b9b9d164337f8697381

SHA1
5aa2958ed524c6c2abccc7d9d82d1921040490c5

SHA256
2a805637c8db135d10ac96171297c45da782c8e311e5bf7020c9f49ea9ea70fb

SHA512
80c128ca2c649cf074d0c20c111325be44e236d67950b51e70802fb33ed69c2db6c71702d5a4a4a600f96dd217d2bba945b95a32155e9850a7b656b48a72ff08

Download Submit
C:\Windows\SysWOW64\Bjghpn32.exe

Filesize
55KB

MD5
392e2309e294e6e7006b05c3291dd5ba

SHA1
3166245318532463424a08ec10997d29daa2326a

SHA256
b8f1c92aa17050badba72e08ca577e5a60ed458d612a4a424b8aa1f92a5413d7

SHA512
2ec00ef65481b41dcb6798dbb215481b68d58ed9d77c04929d4376935076e65c6006cf7aee1d2013fc06b80e150827d3316824b83074815e1eb2786dbfd6eb10

Download Submit
C:\Windows\SysWOW64\Blbknaib.exe

Filesize
55KB

MD5
2f9c4341c0c5a54f6c3d80901d94a1c3

SHA1
7b48de3d204bd5874eb4424355105b83429104eb

SHA256
6650b6e564bb75b6bd9a152132dc6b3e79f424f01fb8923da4ceb332302bc3cc

SHA512
edfd4792a85623f1542ad1691b0ff01ede5f9066928d7d6f1c44dbf3ecdcecb050adf6fbaa453e98c8cd38a82b4099775db8fb0b9695a33cb498b5c7018062b9

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
55KB

MD5
f0fef58ff4fdaa1369558cf0e0436f48

SHA1
f26e065282beb6bad0c150344f7774fd8e1d45fe

SHA256
3d8226d66453c1a1deee4e04c38caacf08f21405dddd8bf34a8ad08562bc7af6

SHA512
1f905417352b76e0e37363567eda7f3b2d1723686b13ef7c5d7a7a764df5ab775d68ae319b2e8e384cea2e597e5b7202594c56021adf88e2571b591080662a8b

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
55KB

MD5
6c6ccecf0ad409efe7187cc54cab8585

SHA1
18b2888508fa953b8d47cec788551623b7d63083

SHA256
940f0610c2baeeefa13cb5093a62c162ab01d125c73132aa49a9d491a48b8b26

SHA512
985d12b2e6af4cfd0815f1fa41cb719ff0606c9d40523aba8e9e3cdb121167dd7f69dcbf55447b7a41cbf5f2147bc994832688645e30ada4ee4e0c3b5058c248

Download Submit
C:\Windows\SysWOW64\Bnlnon32.exe

Filesize
55KB

MD5
5267d60eeca76998c6df27bcaac7baf1

SHA1
fd48018d67bfa70fe30c9b4682a87202f17e524f

SHA256
1c6d6c52418002fba3f60f44b5d796f93c75874e79252d8335a5c5e743f5d86c

SHA512
00b73d3d14db978d6d825435e0b9d0fd6ccba92cac7753527cd53ae5b58fbf8bba5402e56ce0d80e2b989a131067e53112d909aae0ffcb1132623bb0d1738f47

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
55KB

MD5
b5b43bd4ca023c079fddf19b319644fb

SHA1
d8782d7160598a378b4b841f826ad4e8b37c1eda

SHA256
7aacf7be7cfc09dcaec0baa6f9e1821fdba1ea0918a971f180cc38d3d4324542

SHA512
3afa1e3cfe91581c39b1fafbc54ae647b1533ba1c1cde310bcfdb10c972f9bbc792975bb232ec6cfa395d2fd1e2cd64028aaaab49dff60a9da41ff8e4d12ff66

Download Submit
C:\Windows\SysWOW64\Ceoibflm.exe

Filesize
55KB

MD5
55cc20898516a8486490b1277c6a6164

SHA1
80a4760cbd5f5e304b5b0c094ec537050764bb46

SHA256
2a6c422b1ab085ec9a159e8e676244c27202b3c6db766866811ab48aca12dd37

SHA512
25c458f3add9cbc7550d533c513980ef3e7f6085a038525957784518004762cdf12c297b3bb59f99ce3820dba7fac07bb220d2e719bfbbad932f1566226763f6

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
55KB

MD5
635d1ec6e68cff357e7716f1ed7b45b6

SHA1
9b228fc1289d36e0321e376b6717d47dbc8bc865

SHA256
d2ca19dbec72caead42b16e048951d1a6904900d0ce58b1b325e9d28c4ce4bde

SHA512
77d15afac1a8d247bbceaa32f5c3d68f402af9710a3263a4026f419e8308e34c1157545934b6c5163e80d8cfb9c3c277ca8be0ec7cb575328aa02edc96c91b16

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
55KB

MD5
15fe49f4b158cecf95b9173d33524007

SHA1
c8725067e7a0e4710df4d7746f64df7eb333cd12

SHA256
827f693288da486461fa5777da7ad6c79fedcf548ee6b1251334a30f645c8420

SHA512
6eeadd93bde538bfabf94c8756d595db3755dae786908a8c4715ac04f075538d2f4438f1865c9ad65ca43653261076ec81835b4d0ad71e602d42ff03103846cd

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
55KB

MD5
7bb2be18ded3c9a638538710370384a0

SHA1
8c2b65fa84a8ab23bfa98eb1b69069479ef628df

SHA256
62d4ffb077fed08f1de551b14b5bfb54b0121e1f607bfc5a4666b5b0876735ad

SHA512
b61cd32dde0351824c1ef77efa3a418026d241864e62e7df4d0a7f7f1e6e14ce8de2eaa60f4920b6002daa6794330a5fb4dc573e364406be0af2b83b0c2efd26

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
55KB

MD5
cd344087fcf55cd7f71507361ee83d4a

SHA1
bed547d555c60137d171f6782d1814bfc18501af

SHA256
cfad031b84031b01b0bda0f4ecd464540179f6c44e74e150f2eaf2e3d7f4b614

SHA512
7810a139b4e685cc935d5cc3476dd3df30a22c1b4400848fca79ffb133afa090284a5615813aeaef168130c8f249ac53fc0ad8a67df2c251d4f10cff5dc681e5

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
55KB

MD5
2aca15fea1aece3652570b1e767e9104

SHA1
9e502f19189aaaf93bc009547186cb196894451d

SHA256
e3c3a1df4bdfe729bca2cfe495ad6c13a0a0fde2451b67ec8f46f49de681c4ac

SHA512
c54f6fd45e9a8b84ab574ba3ee3d9f28d678c2ba6c26e1e1413f28a043773189dc4ade8cb05937b5d02d839c564a7cbf9799252027ffa33e0d0d6980e9011d57

Download Submit
C:\Windows\SysWOW64\Dafbne32.exe

Filesize
55KB

MD5
ae8d0ac87425359cad57c94927a1f643

SHA1
e1f03be3558ea244b491874c1903a42fceebb061

SHA256
72cd5e3ce82f5c4b1592ec6d0118e748ffcaba220a61cec742644fa6d9cc8903

SHA512
24028ec5d131ec14679ade2e907a85c0bb26115679ff6bc68db76cf0539201862add434dadeb763c9057406a9a8b13450359be6810c7dfe755ff32403057d1f3

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
55KB

MD5
1c531f18bed15a75b11a382dab616d33

SHA1
f09fa8d41e1e75c4ff5808b1be5d1f7bceec2c85

SHA256
21b42d7d0b31a412038e1f1731a10a0892de13218f8306ef5789f3b6ad450fed

SHA512
21056b058f9ee98c0eb4cfda9f67988c625e8ea87f691897d405cacb8583d89861c5e1c88adcef1f635484a3a883018a546bf1919b5d4eeb3e567261ca6df98b

Download Submit
C:\Windows\SysWOW64\Dceohhja.exe

Filesize
55KB

MD5
fa4bc34664377e8c094a5fcbcdc79e4d

SHA1
8a2705997adfc6ddd00352b8f18355c59afd9955

SHA256
d4a3db1737712c3035a3731e8b689bc01804080038606bdb3404aee7e65fe911

SHA512
0d673bbee2cdcce433b836cfa64d248a4071827b5d9425ac5378bc707a751b86ebbff08e6a83e1466190bfa3fbea4983982c27f9fc430fee800fc5431e048b5f

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
55KB

MD5
06bbc1424a8d5ef547acf1357f9853c3

SHA1
9f3c77fd2715d32ae09e3a8598c1b311dd178577

SHA256
4fb19a23fc77e23764c8f0c743566ac35101d7cffd4ee18f834be22d301f2312

SHA512
49157ddc4be7eaeee87c59461c8f0dea6bd393abefb0e713aadcca5e805a641307ea2205dc875a97da71febaa972c78ea4b41ee9ab76517a9209ea832af2c75f

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
55KB

MD5
d0644dc5a4538ff6a0c18d8b8369203b

SHA1
d49c7809067d434806daa9f97ce704a8408bb4da

SHA256
83b261bdbf2f04addf6b954c203969a7e727e5d9690dee8518a15dd63871a7e1

SHA512
6d13fd2e75d2de5edbda4b741dd7c5aeaeddfc797f91670a3655377d46d6a662fcef814922b7ea881f7e6d15525da2b1411f47c9bda1f66d3b9d04e47cf264d4

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
55KB

MD5
4465bb7b3450bf2683b4679fb996e340

SHA1
3a0c65f1ef399276e1d2ca93491395049d50873f

SHA256
761088659927cd4c693a31ac2b72dcc57846735de23f64ec123b9d057babd987

SHA512
b16fa0ab36ef9859b07f5f52a2176730bdceef154939324cbe9856d184a662ca4c943691cb3c74b04fb07962434ecb544ae518797e6c956b6f1f16bee984b3c4

Download Submit
C:\Windows\SysWOW64\Dhkapp32.exe

Filesize
55KB

MD5
5d8dec160b402e97c16b1a33bfa5bce4

SHA1
9828d8bece465b85bb5e71e360ffd1085dbfe61d

SHA256
2497934d857d851d6e0740366f23c46bdf9eb184a3e488eebb7b1eb6d2d8baf0

SHA512
4b98042d0fc963a80229e58315c921931cf81fc576cf7409fd4281b45428aa29690d46796a3542c37743e49098d7b6f4c9d805d330ddaa331cca9681db05827a

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
55KB

MD5
db2173734b66a6c77ed5519a231e496b

SHA1
ca37fced040d2d468070b3cb4a9e5edf09934647

SHA256
2a4028d82c3491287c56772f85e81ee1bceff407e98c953445b2301f8d028bc4

SHA512
cedcbfa426e576ad38f980b5187fde7e078c91c8cfddd37671a3aa0b334d5500b3b8779f6204c29272a650b0b10be0ad5809de52238d72a4e7d1e62633c359ab

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
55KB

MD5
be52d67e07cf828e9c91f586f1d6a71f

SHA1
c464fff7f964fb2d51bfe66a15d0623fb0c807e6

SHA256
6ef8eff1af75a3bcb6249cd21a0a66b7f977931f8d41a398f68c99a6df0a1937

SHA512
ba3bf547bb4f0d9938f4b506c11b15d7b9b81771857a9c2d510ed4023c4334de4ddccc256b5b33221d664a92270fbdb692be8f5a0aa8eb15aa1328dc9ee0a942

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
55KB

MD5
1bd4b01c5ba98bc5e72fe2366f1a18bc

SHA1
543073f53fee451468b9a45f934c3141ecfddeae

SHA256
7d75ebc4048828a360a28877dde539f44324891cb7ba2386de8d6f1ae57e60e6

SHA512
79c397f459c08e9b610ba79bbaea0b105de036f0f071da9d4af4aac44317f65d266926a722314fb2589ace027dfb7d88647a18c83d84063f0458cff3c85aa66c

Download Submit
C:\Windows\SysWOW64\Gfembo32.exe

Filesize
55KB

MD5
974e56029194a57b630e9d9a57fd8b41

SHA1
f0c2d77b5afea26cf53009de88aa0e3886265afb

SHA256
31df20a41a92bf0721920253f5a1c59c120ea3c026fcb468dcd25813f1ed3283

SHA512
5776bfac333bd457eaf6731e43cba531af6284b9c05ae2ba5b7013b0ae5633e48f3da7a37604a9587f68d99165ff65192522f910ef07f62371901ba71ce99001

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
55KB

MD5
2a0ba7a8c9701faaeb7290477f024320

SHA1
8e6fab79dd065c88cfdafd58c894defd85712c7e

SHA256
1f79586543251ed0b7429c4d8b1cf986aeaf993a50a7ab6cb9905411125a9778

SHA512
639581549d3a0283db3cff0446db31dfdb1ad0d957506769adfe4cbaa42f42953a793eb6e2697c7b55c05a38077c15bed0459931777412335eca98af3cf06471

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
55KB

MD5
105c74211a66578f9f94a31468d78553

SHA1
04097bcb6b3976dc644c7e02fe500320d3144c00

SHA256
bc9e1deec06f651d3a275730c422fd8f16d0278f7597b4997d8fcdbee6e57b74

SHA512
7554c621b71aee988cfa01285dcb142be430097bf8e1c9f0794ad8e490f690990ad4fd635edae3c0d50beb5a979210e9d70e98ac9d04eb357b674b922babc885

Download Submit
C:\Windows\SysWOW64\Ifefimom.exe

Filesize
55KB

MD5
a68e69ca708e665a020d7b70f18473a8

SHA1
d491a7a75a6f5fc61dfdef9121882325c251701c

SHA256
ecd51542fd09366f6be312bc0d22a7763c6bd976d19fb32069dce435666dc0e2

SHA512
98dbf61583444a2be991033c09254f04e17147e82d33d55bd04c254d9d42cf3cc426693bc4a75566718a68a090e2f798e237a68af4443485c554dbcf8f1deb65

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
55KB

MD5
96adc3754b46d06a6b543daf7b875c84

SHA1
bd5d07e5c61710984769b58c45d1c2c5b1956657

SHA256
b609adbb69908797a58b40a1ea05f1f66d204d0e5da9bfc3a9baf6a257cd4724

SHA512
7bc7fba7325846a03131249e9fe5ae94b338e24ae47953aee55143eb2e2666065a6cecaae7f852eaf76b18c2177c60412131afb48f589a0b8938394a789c7477

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
55KB

MD5
dcafd50d6c8f92b26a91f4528d804736

SHA1
8aeddd93ff6fed32d39a44ecfe411362095a6ad6

SHA256
870e91e0a15ae9d679a2772a83882f4c062f655b212b75b421c7c4bdbd6d116f

SHA512
2f0e1ac762f0d413d8cb49a0e7038ace9357733ebbbe5928ceedc5b813877674cd0e0dfd327df514df62c4f12a120d60ce5b80811044823ac00d53261a6e5136

Download Submit
C:\Windows\SysWOW64\Jfhlejnh.exe

Filesize
55KB

MD5
d77c4217288e0f19d23732a10116be63

SHA1
3f48dbd8f31062cc0fc615430267b989dccdaa83

SHA256
31037287af60890bd025c7509dd4c976d10317a873e7b9e3d84f09b7d7e5019d

SHA512
a2e4f11c5981c00742bc036fafcc47319921b6658ce0f30ac987fb92d798ee42dc9c1fbc0943ea5cd32df30b25be565e67cc7d43b8aa7dd0cb5629f081980c90

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
55KB

MD5
b79ac245e8c5952868d5717ded193819

SHA1
d1b71b650f456899bf575fa79a55019c0eea5ea6

SHA256
f75f23aec366511f69c43b04ba32b2db47ca0e9c82221ec52016d4e5d22ef266

SHA512
159fa5bcfc1ebdf5fd0b562cd134f69806020147234b62af7d8eaf17ff88fe388ea62aae1194ff3d6b53e961d60714f2af8a759ae69d70b502c09aefb54a8bd7

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
55KB

MD5
fcb36a81fbbba20cb3914f71a8f5b400

SHA1
1b4c1380ce34dc0d0355e0ff79dbdc0d06a35c27

SHA256
8a7fe7b01e5eb99afdc7c95d0a16ec3abad7c329c7d56ae2b7533e56ce1f826a

SHA512
d8288bd4dd9e939a1c118512fd175a36f23af8c37008da3db6cc1ea83d9c79f63a08985f27fb83b4e8eb324301d2b247281ef5f6aceb62fc0ceba5f231f1cf62

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
55KB

MD5
62dd4249709242bdae3443cf31993fcc

SHA1
f7ad9d5d0e85cbdab2d166ad150c51e5776cc8c8

SHA256
f6360c355c5d5c2b9b60beeaf0a8b7ec863f1865a8e8b7fa6991cf80f0a844ac

SHA512
24c9db9491e868174a4ff5d90efa10f9a84311b4b2905cac22ecb627cc646682fc0808e161f94b9e57e67ddfe4cc5539b14b7c135183e2acb32f8e592fac2b13

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
55KB

MD5
dd40998e718d41b653f6adddc4743e7a

SHA1
e27d21b088b614f8c147fec68d83c7ed3add7700

SHA256
548670a528bea381dd84b41fb13dd2ebe314310edfd4715004cd844f7ff8204c

SHA512
67b1f852529c61c23345ae0aba34ab745c116cf60bb8f2efd49bcb7c77323d9250716dd004df563ecec4ab524e9b1bc9a51461b08f9991d4ccad424328f0b802

Download Submit
C:\Windows\SysWOW64\Ldoaklml.exe

Filesize
55KB

MD5
dde0d377981ae8587c1e39648daf20f7

SHA1
9a88499d40d3d70867e93e273507203a3feb22f2

SHA256
e599e1c251a7a92e121d59f6816eeb0ada17c7b7a422c34548ab91567583ada4

SHA512
1dd581953f9615e9fdd47958e571124d501c6cda012f2ce68d85e4b36d9d3d6b6d969d00cac1ba343055ef6cd47acc0081ebdeda3ae52cfcf869c749f58d920c

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
55KB

MD5
61b473b6dc878697b56e982f93c1ca48

SHA1
eb829543777390d73fa7326e639178a1f1427382

SHA256
857623522acd449d58cd3b9bad785adce140dac5bf6bb5a848f8259bdfc81e6d

SHA512
e20eec5eb59f8feb6d5dea70c6fc31f2678c9516d963c07309b35dcce3e3fbc700ae21d4117caf83a925d568c2bebd8fc306804789856e9ab42abf0db9129ff8

Download Submit
C:\Windows\SysWOW64\Mchhggno.exe

Filesize
55KB

MD5
ad6a41515abfd2bbe3e13f4b68306102

SHA1
d2f3e524d282c17ee15b950335c321bf0ad3cfdf

SHA256
8021a159321d9a65ce04cc5949e0aa5756dbf1e3d42735ab497ad53840f3de07

SHA512
ba4e1adc3dc5b3ce4aa86ff404f69ceb8c90b487f2c7ee2e35cc2db8000c224952028a149e7403153468e1a647229758425519cabba61da3a67c08919a673b02

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
55KB

MD5
1cb0d5429361287b3bef417907cff77f

SHA1
5d0eed1ef2f71bcffbe935278a9804ea1f1a92f1

SHA256
8666abf6784f5b67de753f678b8b38259fbb20e8fe2b575bccae242a7ffe2bd9

SHA512
f3c569599fd256e98084f9107c27f129814ff682bd731039d485b765442ecdbbbc1166b65a03d608c60c739c1cb0e33ee1bd720e586cc66cc95a2cfdc0ee5a48

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
55KB

MD5
b72be91b60ab27c233c4d8450b923652

SHA1
f1ce9a100dd6e319eb66570259971870d8ef5037

SHA256
cc8bacd90b16653a5054a751eb70f386533bd325e1ffa903890fd860e52d91e6

SHA512
3309890d4768754713ca258dce17d8104067e9e049702eb45d85a0b577f12a814d89140449307161344bbaf0893d000d95632453ec3cfef0c9a4faf2351bf212

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
55KB

MD5
4d3a5c4823e1ffebb1131a69fa6d1e79

SHA1
3915f957c44041bc2cf981d3e777e46fc0fe2f7b

SHA256
bc160bdc70911e0642a830a67588733956b63918c8c7f2e5f9b08e05eaea3d30

SHA512
c2169acd22339f0a89b39833366369e75b5726527262bc9bc442225b83ca45c9c1724e57031fec194dc2341cdf703d9ba14db9fa5bf6f3af7ac1c9f79c49ba1d

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
55KB

MD5
e00d2ea4d0a41538284886fcd67b98fd

SHA1
ba93ee4e8ab02673825eb5a721e739ec0576dee1

SHA256
6eb253d6b86306da3ec2399d53902224ad749515e92b108c732873c91b09cd34

SHA512
45aabd43d8210fceebeffdadef6091e5f61f17910badc4b8faf47de3f2863bc84267436880747dd5813bfadbd73ff15b22f3c1a53892085c7e842a470f7521eb

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
55KB

MD5
43d8f87a0672a21e103b4874109b43b9

SHA1
41c553826665089ff7688657b113c76c60ac34a6

SHA256
8f38eeb76044d7ce0ad68be8ab9536db5cba3a032d64e5c0e3ced395849c9166

SHA512
658fc6e53ed661bfc3ad4f2a6a4f41d25064be357af5dbc8a272014b7b41ee564e82b79204b1b4c64044b66dcbfaf4c7dd7c471bf95b2d033503aac6e2ecbc5b

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
55KB

MD5
f7105e3b04f03cf01bbf06aeb0f5e25a

SHA1
8481f1b49f0f43177f38c3512b8f55b0038e4847

SHA256
a222da70cae0eb8e8c093be1d08eee8768ff65d222711cbc2dae28ea396ed176

SHA512
1ab84e14113aeb1160bf1905b131194e67220310faf1cf38695e413a43fd3ccd89a012c2d9008e80886d30bfb1191f755319956e2730a8ef4e4c0e54b9ec8a3f

Download Submit
C:\Windows\SysWOW64\Oddmdf32.exe

Filesize
55KB

MD5
34d1aa2ed955006e07282ad83fe3a2de

SHA1
c7d812ac5e16e381e42b0a5c54ef11be95756a7f

SHA256
c41b530203c60769506c4ddf9e5f3145bc7c1e364bc81456b17b14f6006c6298

SHA512
d03e87540e43f9b12c7e193b524daf5e5bc9bda1f7eed5f9d5e55f927ba486c0a5020c8d26c933681b522220b1a4337d9c7e6adc6847aa7c41c62b6f30f3bd16

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
55KB

MD5
df2a7de4b9ce56d7cbb14a0a828e1b09

SHA1
e83cbec94f34d904649495d0359d5c54a520561b

SHA256
9a602f0cab56336d9b77de484f7ff2e2f746b03627e916fbce4dee69a6d87b5e

SHA512
6f461c9d56d98fbbfca567b6a58bf98b8e1b75ce76f962c9fbd88779c80e2930c8076f51d441474b41245f0b91a8c39817251dc99e017cfc40f646b1a125915f

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
55KB

MD5
84b69839617bb2f22f649f6b6587948b

SHA1
491bdb1d5763a511e6dedd76c947eacd9c548f20

SHA256
bc20a968f9d02a77b66570f134e9e0239230697c71ddfe561ffdb133d3758990

SHA512
c46c3a3ded339c783cf0a49ae9cc8329c64ed105b7e413b3cba4e969305b023604ab46e922fd8d9765dddc72a2e886021df76a6095c2e1552ec9dee241492315

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
55KB

MD5
f770c028a21d43db1ac1deb658498a86

SHA1
f547dabfdb92b9d282755c3f195c145a91f943d5

SHA256
eefe3dad23e63815dc1fc71525bb2a58d19709e315db36183bdb6364084d137e

SHA512
dfc63104806a969c7c82d42134c931790c097083537f39d54ba31abacb65d1a3b2eaea3d8f45cebf384fa8636a7071cfa8cd611b37d1aa9d5ed12951a312613c

Download Submit
C:\Windows\SysWOW64\Qalnjkgo.exe

Filesize
55KB

MD5
ca09fcfc58dccc528d8975e27e16d5b7

SHA1
c14aa14b796825bf0ce03a83d090b9fbd2aa917d

SHA256
b5fd469ffa7d753eeab812b720622dbb86b23a4865adeef506b5ec32ee6399c4

SHA512
89a4cf3a1d2ca070d76af128a766129246d2b8c973875bee6ef926f6b22b5ac54ad238a935b356453e989254d90a3b8ecf2e5e9b29e607037597ee764fb05e52

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
55KB

MD5
18882ac329a532db1153223c79443e8b

SHA1
041782280144285ae2f02d43ebb48c529dcc02b3

SHA256
e0d38997f82ab544f45836f3725471e9396ab237e2b49839d4aab8bf380fd9b7

SHA512
e0079a9269dee0fb50addb7424629f734fadcc4ae489166bc163b5c9586c5e5cb61fc612a8a9a69679abc23462da4700dd751dcaec0ebf3078b5e2340e86cd5b

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
55KB

MD5
7d15ce8aeec86fc8e4942d4da6ddf1ac

SHA1
2f7e2a02df7649776c0f20d2e21f7505fce7bafb

SHA256
bd5c1ec4dbba9b06e6c0b8dcf44de750becc128b9e7161c76960b3d05484ea24

SHA512
0e6463f0b25dcc635c886752849a88bdbea1b11708387b9baf824f0e107547383588b70b2a99fb65781bab7d2a4729c6285ab5f9ef189ed6f91579764c98931d

Download Submit
C:\Windows\SysWOW64\Qnnanphk.exe

Filesize
55KB

MD5
fce41ef289171e2352f4c62da8c62644

SHA1
11ab2fe2035a139f4de21092dddc93f464bda7cf

SHA256
0364f2a31c97b83737457aace5094a4f01ec1b96edb746bc01209895ebe3bcab

SHA512
bb5751fac5b0344b89997f7ffc67643e7089381c02eb1bd6eb93e5afc1d078849c8ba99377bc16b08dbda6069ddbcb6cfb871cb36dae6d25b0f820514c2784a3

Download Submit
memory/224-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/224-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/448-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/524-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/620-583-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/716-554-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/716-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/724-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/736-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/780-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/900-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1052-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1104-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1212-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1388-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1452-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1488-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1612-555-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1688-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1800-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2148-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2156-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2196-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2328-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2360-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2364-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2420-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2640-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2688-562-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2812-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2872-447-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2884-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3056-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3092-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3112-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3124-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-589-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3172-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3232-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3244-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3280-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3304-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3352-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-575-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3464-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3584-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3604-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3604-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3780-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3796-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3808-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3860-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3948-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3956-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4012-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4056-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4224-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4224-561-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4252-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4308-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4412-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4592-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4592-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4592-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4640-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4644-569-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4756-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4768-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4892-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4900-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4916-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4920-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/8372-2542-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/8608-2541-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads