e42438c3b64416d741960b954fd927aea94ca1df6fdf2c8b311a882867752161

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 05:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e42438c3b64416d741960b954fd927aea94ca1df6fdf2c8b311a882867752161.exe
Size

78KB
MD5

7da94d0948ac478bbd64f8071f6030fd
SHA1

4ef488574fedcaa256a341f8123cc69fd0e1f218
SHA256

e42438c3b64416d741960b954fd927aea94ca1df6fdf2c8b311a882867752161
SHA512

a5c30c1b43c9517128a0a3c4f542244dfb836c2fb2a22771947382becc4586b5a05d7aa0873b6a2f3a6836db043c7448950a053340bf7ad4cc5681dfbee1cab7
SSDEEP

1536:9w3HGvfrF5GdjoEFgzF/066666666666666/666666Qn6666661sAFWpiVeN+zLH:y3kfrOyEF6/066666666666666/6666O

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cglbhhga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebaplnie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klpakj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhenai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckidcpjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnmmboed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddnobj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqiibjlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jahqiaeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmdblp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckidcpjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Legben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nciopppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocihgnam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chkobkod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khgbqkhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpepbgbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lllagh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mofmobmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbebbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqgojmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkphhgfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbbajjlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpegkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amfobp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bboffejp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpmomo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbldphde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bigbmpco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpacqg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojdgnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgklmacf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khiofk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lplfcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcgdhkem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qppaclio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fganqbgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefphb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhgiim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eomffaag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Feqeog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chnlgjlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dggbcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpcgpihi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caqpkjcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npepkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klpakj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpeiie32.exe

Executes dropped EXE 64 IoCs

pid	Process
684	Moipoh32.exe
1576	Mjodla32.exe
3336	Mqimikfj.exe
5140	Mgbefe32.exe
5520	Mnmmboed.exe
5244	Mcifkf32.exe
4188	Nnojho32.exe
5024	Nqmfdj32.exe
2096	Nggnadib.exe
3764	Njfkmphe.exe
4476	Nmdgikhi.exe
2528	Nncccnol.exe
3144	Npepkf32.exe
2656	Njjdho32.exe
5672	Nadleilm.exe
5188	Njmqnobn.exe
3224	Nagiji32.exe
3936	Ngqagcag.exe
3456	Ojomcopk.exe
2736	Ocgbld32.exe
2968	Onmfimga.exe
1048	Ocjoadei.exe
5864	Ojdgnn32.exe
5240	Oanokhdb.exe
4484	Ofkgcobj.exe
1384	Onapdl32.exe
4064	Oaplqh32.exe
1944	Ofmdio32.exe
5372	Oabhfg32.exe
4076	Ohlqcagj.exe
3452	Pfoann32.exe
2768	Ppgegd32.exe
3604	Pmlfqh32.exe
5980	Ppjbmc32.exe
1208	Pjpfjl32.exe
5932	Paiogf32.exe
5192	Phcgcqab.exe
4936	Pjbcplpe.exe
2752	Pmpolgoi.exe
1320	Pdjgha32.exe
3540	Pnplfj32.exe
1972	Pdmdnadc.exe
4800	Qmeigg32.exe
848	Qhjmdp32.exe
3192	Qodeajbg.exe
3844	Qpeahb32.exe
5256	Ahmjjoig.exe
4336	Aaenbd32.exe
5136	Aknbkjfh.exe
4396	Aoioli32.exe
3884	Aokkahlo.exe
5456	Amnlme32.exe
5432	Akblfj32.exe
6088	Amqhbe32.exe
1352	Aaldccip.exe
2456	Adkqoohc.exe
5856	Agimkk32.exe
1604	Aopemh32.exe
1556	Amcehdod.exe
3288	Bdmmeo32.exe
4592	Bgkiaj32.exe
1508	Bmeandma.exe
3960	Bpdnjple.exe
6016	Bhkfkmmg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ppgegd32.exe	Pfoann32.exe
File opened for modification	C:\Windows\SysWOW64\Aoioli32.exe	Aknbkjfh.exe
File opened for modification	C:\Windows\SysWOW64\Koonge32.exe	Klpakj32.exe
File created	C:\Windows\SysWOW64\Dpifjj32.dll	Mljmhflh.exe
File created	C:\Windows\SysWOW64\Pjjfdfbb.exe	Pbcncibp.exe
File opened for modification	C:\Windows\SysWOW64\Pmphaaln.exe	Pfepdg32.exe
File created	C:\Windows\SysWOW64\Onapdl32.exe	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Mbkkam32.dll	Cdpcal32.exe
File created	C:\Windows\SysWOW64\Pkpbai32.dll	Hldiinke.exe
File opened for modification	C:\Windows\SysWOW64\Klpakj32.exe	Kibeoo32.exe
File opened for modification	C:\Windows\SysWOW64\Pbcncibp.exe	Ppdbgncl.exe
File opened for modification	C:\Windows\SysWOW64\Bmdkcnie.exe	Bfkbfd32.exe
File created	C:\Windows\SysWOW64\Diqnjl32.exe	Dcffnbee.exe
File created	C:\Windows\SysWOW64\Bdmmeo32.exe	Amcehdod.exe
File opened for modification	C:\Windows\SysWOW64\Chnlgjlb.exe	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Fbgdmb32.dll	Ddnobj32.exe
File opened for modification	C:\Windows\SysWOW64\Gpaihooo.exe	Ggkqgaol.exe
File opened for modification	C:\Windows\SysWOW64\Baegibae.exe	Bklomh32.exe
File created	C:\Windows\SysWOW64\Afjpan32.dll	Baepolni.exe
File created	C:\Windows\SysWOW64\Gebekb32.dll	Fkofga32.exe
File created	C:\Windows\SysWOW64\Ebdlangb.exe	Ekjded32.exe
File created	C:\Windows\SysWOW64\Jeapcq32.exe	Jbccge32.exe
File opened for modification	C:\Windows\SysWOW64\Lllagh32.exe	Lindkm32.exe
File created	C:\Windows\SysWOW64\Kolfbd32.dll	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Qodeajbg.exe	Qhjmdp32.exe
File created	C:\Windows\SysWOW64\Ddgibkpc.exe	Dnmaea32.exe
File created	C:\Windows\SysWOW64\Hpkknmgd.exe	Hlppno32.exe
File opened for modification	C:\Windows\SysWOW64\Ledepn32.exe	Lojmcdgl.exe
File opened for modification	C:\Windows\SysWOW64\Mapppn32.exe	Lpochfji.exe
File opened for modification	C:\Windows\SysWOW64\Nofefp32.exe	Nmhijd32.exe
File opened for modification	C:\Windows\SysWOW64\Pciqnk32.exe	Pmphaaln.exe
File created	C:\Windows\SysWOW64\Jihiic32.dll	Nqmfdj32.exe
File created	C:\Windows\SysWOW64\Ifncdb32.dll	Ckidcpjl.exe
File created	C:\Windows\SysWOW64\Fkjmlaac.exe	Feqeog32.exe
File created	C:\Windows\SysWOW64\Ihpcinld.exe	Ibcjqgnm.exe
File created	C:\Windows\SysWOW64\Dagdgfkf.dll	Iojkeh32.exe
File created	C:\Windows\SysWOW64\Lpepbgbd.exe	Likhem32.exe
File created	C:\Windows\SysWOW64\Kpbgeaba.dll	Mcdeeq32.exe
File created	C:\Windows\SysWOW64\Ojcpdg32.exe	Ocihgnam.exe
File created	C:\Windows\SysWOW64\Qgnnai32.dll	Moipoh32.exe
File created	C:\Windows\SysWOW64\Opcefi32.dll	Ocjoadei.exe
File created	C:\Windows\SysWOW64\Apmpkall.dll	Bigbmpco.exe
File created	C:\Windows\SysWOW64\Fiplni32.dll	Cgklmacf.exe
File opened for modification	C:\Windows\SysWOW64\Njmqnobn.exe	Nadleilm.exe
File created	C:\Windows\SysWOW64\Dddllkbf.exe	Dafppp32.exe
File opened for modification	C:\Windows\SysWOW64\Affikdfn.exe	Adgmoigj.exe
File opened for modification	C:\Windows\SysWOW64\Baepolni.exe	Bfolacnc.exe
File opened for modification	C:\Windows\SysWOW64\Cmgqpkip.exe	Ckidcpjl.exe
File created	C:\Windows\SysWOW64\Cocjiehd.exe	Cglbhhga.exe
File created	C:\Windows\SysWOW64\Hjaqmkhl.dll	Jhkbdmbg.exe
File created	C:\Windows\SysWOW64\Hobbfhjl.dll	Mhjhmhhd.exe
File created	C:\Windows\SysWOW64\Dgcihgaj.exe	Dddllkbf.exe
File opened for modification	C:\Windows\SysWOW64\Lpepbgbd.exe	Likhem32.exe
File opened for modification	C:\Windows\SysWOW64\Oqmhqapg.exe	Ojcpdg32.exe
File created	C:\Windows\SysWOW64\Dkkaiphj.exe	Ccdihbgg.exe
File created	C:\Windows\SysWOW64\Ckcdlpbd.dll	Fecadghc.exe
File created	C:\Windows\SysWOW64\Cogddd32.exe	Cgqlcg32.exe
File opened for modification	C:\Windows\SysWOW64\Nbebbk32.exe	Nofefp32.exe
File created	C:\Windows\SysWOW64\Obgohklm.exe	Ooibkpmi.exe
File opened for modification	C:\Windows\SysWOW64\Amfobp32.exe	Qikbaaml.exe
File opened for modification	C:\Windows\SysWOW64\Bdmmeo32.exe	Amcehdod.exe
File created	C:\Windows\SysWOW64\Bkamodje.dll	Bklomh32.exe
File created	C:\Windows\SysWOW64\Cpbjkn32.exe	Cncnob32.exe
File opened for modification	C:\Windows\SysWOW64\Eqiibjlj.exe	Eohmkb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10004	9912	WerFault.exe	435

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpqggh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplfcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qppaclio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgqpkip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dggbcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghojbq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piocecgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqgojmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adepji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocjoadei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdehlip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpioin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbdiknlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjdho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aopemh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bipecnkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nciopppp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbnlaldg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdjgha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqnjgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lllagh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mofmobmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmaciefp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obgohklm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggnadib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmdnadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbbicl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geldkfpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciihjmcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhgiim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khgbqkhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncpeaoih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckbncapd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nadleilm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjpfjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddcenpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmkofa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpcgpihi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckebcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddnobj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeapcq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiphjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhoeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfolacnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccmcgcmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcifkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlppno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhfpbpdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kabcopmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jocnlg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooibkpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nagiji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojdgnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phcgcqab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpmomo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adjjeieh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkaiphj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnojho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekjded32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihpcinld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqaiecjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iijfhbhl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngqagcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgamhc32.dll"	Dkekjdck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebaplnie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebifmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gpaihooo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qbajeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enalem32.dll"	Iolhkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qjffpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfkbfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfolacnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgqaip32.dll"	Dkkaiphj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocjoadei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqppgj32.dll"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkofga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oiccje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajohfcpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpcgpihi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qimkic32.dll"	Njfkmphe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Feqeog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pegopgia.dll"	Ebaplnie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncmhko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaagdbfm.dll"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccoecbmi.dll"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dggbcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fiqjke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmafal32.dll"	Bfolacnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlppno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jahqiaeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncpeaoih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajjokd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bigbmpco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqaiecjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpqjjjjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgqpkip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npakijcp.dll"	Mpclce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphnbpql.dll"	Kpqggh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ampaho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mioaanec.dll"	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbkkam32.dll"	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kadpdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmbegqjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkhpfbce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geldkfpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmdkcnie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hldiinke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njjdho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obgohklm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hejeak32.dll"	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgklmacf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccdihbgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oncelonn.dll"	Edbiniff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbdehlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqkplq32.dll"	Pbcncibp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 684	5360	e42438c3b64416d741960b954fd927aea94ca1df6fdf2c8b311a882867752161.exe	84
PID 5360 wrote to memory of 684	5360	e42438c3b64416d741960b954fd927aea94ca1df6fdf2c8b311a882867752161.exe	84
PID 5360 wrote to memory of 684	5360	e42438c3b64416d741960b954fd927aea94ca1df6fdf2c8b311a882867752161.exe	84
PID 684 wrote to memory of 1576	684	Moipoh32.exe	85
PID 684 wrote to memory of 1576	684	Moipoh32.exe	85
PID 684 wrote to memory of 1576	684	Moipoh32.exe	85
PID 1576 wrote to memory of 3336	1576	Mjodla32.exe	86
PID 1576 wrote to memory of 3336	1576	Mjodla32.exe	86
PID 1576 wrote to memory of 3336	1576	Mjodla32.exe	86
PID 3336 wrote to memory of 5140	3336	Mqimikfj.exe	87
PID 3336 wrote to memory of 5140	3336	Mqimikfj.exe	87
PID 3336 wrote to memory of 5140	3336	Mqimikfj.exe	87
PID 5140 wrote to memory of 5520	5140	Mgbefe32.exe	88
PID 5140 wrote to memory of 5520	5140	Mgbefe32.exe	88
PID 5140 wrote to memory of 5520	5140	Mgbefe32.exe	88
PID 5520 wrote to memory of 5244	5520	Mnmmboed.exe	89
PID 5520 wrote to memory of 5244	5520	Mnmmboed.exe	89
PID 5520 wrote to memory of 5244	5520	Mnmmboed.exe	89
PID 5244 wrote to memory of 4188	5244	Mcifkf32.exe	91
PID 5244 wrote to memory of 4188	5244	Mcifkf32.exe	91
PID 5244 wrote to memory of 4188	5244	Mcifkf32.exe	91
PID 4188 wrote to memory of 5024	4188	Nnojho32.exe	92
PID 4188 wrote to memory of 5024	4188	Nnojho32.exe	92
PID 4188 wrote to memory of 5024	4188	Nnojho32.exe	92
PID 5024 wrote to memory of 2096	5024	Nqmfdj32.exe	93
PID 5024 wrote to memory of 2096	5024	Nqmfdj32.exe	93
PID 5024 wrote to memory of 2096	5024	Nqmfdj32.exe	93
PID 2096 wrote to memory of 3764	2096	Nggnadib.exe	94
PID 2096 wrote to memory of 3764	2096	Nggnadib.exe	94
PID 2096 wrote to memory of 3764	2096	Nggnadib.exe	94
PID 3764 wrote to memory of 4476	3764	Njfkmphe.exe	95
PID 3764 wrote to memory of 4476	3764	Njfkmphe.exe	95
PID 3764 wrote to memory of 4476	3764	Njfkmphe.exe	95
PID 4476 wrote to memory of 2528	4476	Nmdgikhi.exe	97
PID 4476 wrote to memory of 2528	4476	Nmdgikhi.exe	97
PID 4476 wrote to memory of 2528	4476	Nmdgikhi.exe	97
PID 2528 wrote to memory of 3144	2528	Nncccnol.exe	98
PID 2528 wrote to memory of 3144	2528	Nncccnol.exe	98
PID 2528 wrote to memory of 3144	2528	Nncccnol.exe	98
PID 3144 wrote to memory of 2656	3144	Npepkf32.exe	100
PID 3144 wrote to memory of 2656	3144	Npepkf32.exe	100
PID 3144 wrote to memory of 2656	3144	Npepkf32.exe	100
PID 2656 wrote to memory of 5672	2656	Njjdho32.exe	101
PID 2656 wrote to memory of 5672	2656	Njjdho32.exe	101
PID 2656 wrote to memory of 5672	2656	Njjdho32.exe	101
PID 5672 wrote to memory of 5188	5672	Nadleilm.exe	102
PID 5672 wrote to memory of 5188	5672	Nadleilm.exe	102
PID 5672 wrote to memory of 5188	5672	Nadleilm.exe	102
PID 5188 wrote to memory of 3224	5188	Njmqnobn.exe	103
PID 5188 wrote to memory of 3224	5188	Njmqnobn.exe	103
PID 5188 wrote to memory of 3224	5188	Njmqnobn.exe	103
PID 3224 wrote to memory of 3936	3224	Nagiji32.exe	104
PID 3224 wrote to memory of 3936	3224	Nagiji32.exe	104
PID 3224 wrote to memory of 3936	3224	Nagiji32.exe	104
PID 3936 wrote to memory of 3456	3936	Ngqagcag.exe	105
PID 3936 wrote to memory of 3456	3936	Ngqagcag.exe	105
PID 3936 wrote to memory of 3456	3936	Ngqagcag.exe	105
PID 3456 wrote to memory of 2736	3456	Ojomcopk.exe	106
PID 3456 wrote to memory of 2736	3456	Ojomcopk.exe	106
PID 3456 wrote to memory of 2736	3456	Ojomcopk.exe	106
PID 2736 wrote to memory of 2968	2736	Ocgbld32.exe	107
PID 2736 wrote to memory of 2968	2736	Ocgbld32.exe	107
PID 2736 wrote to memory of 2968	2736	Ocgbld32.exe	107
PID 2968 wrote to memory of 1048	2968	Onmfimga.exe	108

C:\Users\Admin\AppData\Local\Temp\e42438c3b64416d741960b954fd927aea94ca1df6fdf2c8b311a882867752161.exe
"C:\Users\Admin\AppData\Local\Temp\e42438c3b64416d741960b954fd927aea94ca1df6fdf2c8b311a882867752161.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Windows\SysWOW64\Moipoh32.exe
  C:\Windows\system32\Moipoh32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\SysWOW64\Mjodla32.exe
    C:\Windows\system32\Mjodla32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\SysWOW64\Mqimikfj.exe
      C:\Windows\system32\Mqimikfj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5140
      - C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5520
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5244
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5672
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5188
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1048
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        25⤵
        Executes dropped EXE
        
        PID:5240
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4064
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        29⤵
        Executes dropped EXE
        
        PID:1944
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        30⤵
        Executes dropped EXE
        
        PID:5372
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        31⤵
        Executes dropped EXE
        
        PID:4076
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        33⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        34⤵
        Executes dropped EXE
        
        PID:3604
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        35⤵
        Executes dropped EXE
        
        PID:5980
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        37⤵
        Executes dropped EXE
        
        PID:5932
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        39⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        40⤵
        Executes dropped EXE
        
        PID:2752
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1320
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        42⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        44⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:848
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        46⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        47⤵
        Executes dropped EXE
        
        PID:3844
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        48⤵
        Executes dropped EXE
        
        PID:5256
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        49⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        51⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3884
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        53⤵
        Executes dropped EXE
        
        PID:5456
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        54⤵
        Executes dropped EXE
        
        PID:5432
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        55⤵
        Executes dropped EXE
        
        PID:6088
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        56⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        57⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        58⤵
        Executes dropped EXE
        
        PID:5856
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1556
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3288
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        64⤵
        Executes dropped EXE
        
        PID:3960
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        66⤵
        
        PID:372
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2148
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:1488
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4012
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        70⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        71⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        72⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        73⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        74⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4448
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        76⤵
        Drops file in System32 directory
        
        PID:2572
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        77⤵
        Modifies registry class
        
        PID:868
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        78⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        79⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3584
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        81⤵
        
        PID:536
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        82⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        84⤵
        Drops file in System32 directory
        
        PID:1536
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        85⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        86⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1588
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        89⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        90⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1144
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        92⤵
        Modifies registry class
        
        PID:3392
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3692
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        94⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2764
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        97⤵
        Drops file in System32 directory
        
        PID:4716
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        98⤵
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        99⤵
        Drops file in System32 directory
        
        PID:2484
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        100⤵
        Drops file in System32 directory
        
        PID:3156
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        101⤵
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        102⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        103⤵
        Drops file in System32 directory
        
        PID:4240
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3168
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        105⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        108⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        109⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        110⤵
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        112⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        114⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        115⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1348
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        116⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        117⤵
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        118⤵
        Drops file in System32 directory
        
        PID:4264
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2704
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        120⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        121⤵
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        122⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        123⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4228
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        125⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        126⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        127⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        128⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        129⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        130⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        131⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        132⤵
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:2536
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1668
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        135⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        136⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        137⤵
        Drops file in System32 directory
        
        PID:2780
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        139⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        140⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        141⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        142⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        143⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        145⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        146⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        147⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        148⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        149⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        150⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        151⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        154⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        155⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        157⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        158⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        159⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6196
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        162⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        163⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        164⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        165⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:6412
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        167⤵
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        170⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        171⤵
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6804
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        173⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        175⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        177⤵
        Drops file in System32 directory
        
        PID:5480
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        178⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        179⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        180⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        182⤵
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        184⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        185⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        188⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        189⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6588
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        192⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        193⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        195⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        196⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6720
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        198⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6956
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        200⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        201⤵
        Modifies registry class
        
        PID:6920
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        202⤵
        Drops file in System32 directory
        
        PID:1020
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6936
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        204⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        205⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        207⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        208⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        209⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7344
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7388
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7432
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7476
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        214⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        215⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        216⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        217⤵
        Drops file in System32 directory
        
        PID:7652
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        218⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        219⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        220⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        221⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        222⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        223⤵
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7980
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:8060
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        226⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        227⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        228⤵
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7328
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7404
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        231⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        232⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        233⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        234⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        235⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7824
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7860
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:7964
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        239⤵
        System Location Discovery: System Language Discovery
        
        PID:8096
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        240⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        241⤵
        Modifies registry class
        
        PID:7236
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        242⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        243⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        244⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        245⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7732
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        246⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7976
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        248⤵
        Drops file in System32 directory
        
        PID:8108
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        250⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        251⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7680
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        252⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        253⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:7312
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        255⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        256⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        257⤵
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        258⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        260⤵
        Drops file in System32 directory
        
        PID:7380
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        261⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        262⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        263⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        264⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        265⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        266⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        267⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        268⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        269⤵
        Drops file in System32 directory
        
        PID:8512
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        270⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8556
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        271⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        272⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        273⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:8732
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        275⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8776
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        276⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        277⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        278⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8956
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        280⤵
        Drops file in System32 directory
        
        PID:9000
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        281⤵
        Drops file in System32 directory
        
        PID:9044
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        282⤵
        Modifies registry class
        
        PID:9092
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        283⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        284⤵
        Modifies registry class
        
        PID:9180
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8200
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        286⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        287⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8416
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        289⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        290⤵
        Modifies registry class
        
        PID:8544
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        291⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        292⤵
        Drops file in System32 directory
        
        PID:8680
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8764
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        294⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8896
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        296⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        297⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        298⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        299⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        300⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        301⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8496
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        303⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        304⤵
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        305⤵
        Drops file in System32 directory
        
        PID:8804
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        306⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        307⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        308⤵
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:8352
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        310⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        312⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        313⤵
        Modifies registry class
        
        PID:9052
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8240
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        315⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8540
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        316⤵
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8292
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        318⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        319⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        320⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        321⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        322⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        323⤵
        Drops file in System32 directory
        
        PID:8392
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        324⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        325⤵
        System Location Discovery: System Language Discovery
        
        PID:8228
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        326⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        327⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:9248
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:9292
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9336
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9380
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        332⤵
        System Location Discovery: System Language Discovery
        
        PID:9424
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9468
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        334⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9556
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        336⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9600
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        337⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        338⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9688
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        339⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        340⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        341⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        342⤵
        Drops file in System32 directory
        
        PID:9868
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        343⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9912 -s 400
        344⤵
        Program crash
        
        PID:10004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9912 -ip 9912
1⤵
PID:9980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaldccip.exe

Filesize
78KB

MD5
699ac5883842a89b596d9c345a9c4997

SHA1
76d3788bd65761151e281e6d6984801b24b541d8

SHA256
1ecefd1f83923abab1e705b9031606f715f5176d1b037572934b8d4850037665

SHA512
50c2fce431647c32c24ab985afc7b87dd835bf5794df49d0b812328687bd8d33270867e15e125837637b72fcb6d4b0dd4ccad85ad4afee989011bdacfe20fdc5

Download Submit
C:\Windows\SysWOW64\Acccdj32.exe

Filesize
78KB

MD5
e689d0a459d846075e9d5cc333a202d0

SHA1
f4a1497b8bbe142a7202dc155a6347bd74728619

SHA256
4951a00ab48ba68afad9a49ca1c924769d0684ef2be96392bb9c0a51b430457d

SHA512
bc56582b0f0d643d1264dc7996aca81c933bb4ebac4a4d796f292f0816a9914b739cb710c57f63d19144aff8cfb84d99cdd3a75c70541aa13de2837b13bd082a

Download Submit
C:\Windows\SysWOW64\Adgmoigj.exe

Filesize
78KB

MD5
a381fbce99b72b516ff33909863bf254

SHA1
b62c3b0ba7695a3b8c9d265456b343ed8c0ee787

SHA256
78e64c92f17d344a5818cf3d7cdc01eec5caea922ebd1a7f3c10ea925a5a6a8f

SHA512
a390b57da0d859479020aa2b269fb9b42adf759f4e7701dda297d1983837f26c025d41835196dc898588b98332168a526559a0f291f91a920fdbc04e4e1765dd

Download Submit
C:\Windows\SysWOW64\Bbfmgd32.exe

Filesize
78KB

MD5
931b8e4b50f9a0772f22bd2747e9d336

SHA1
dc820dfc9da23ac16724281543402de0ff764b98

SHA256
72d56bd5d4757c7969702362f6bb81c7aef132deccb94432a8293de918097b4d

SHA512
f58c8416f9fc7239ea3dded0ca141469d4cf8f90d0625d8162154a31a25a26941d3c59b9158f77535a6179bcf14265cac5a7a44b7538cd5bfdcc574b85927466

Download Submit
C:\Windows\SysWOW64\Bgbpaipl.exe

Filesize
78KB

MD5
fcdedd8da8a6f24c69540e38e90cb3cb

SHA1
6208ed24e54277a199416801b83469162bf70e90

SHA256
200110a525eeccdd2af862914a8e15cf06da179d63c8473c68c90f427775aba3

SHA512
b623d87ff812c5107ea6e30fde0dd70f1398b6c63f29a11fbb49b72cbd47ddc739b56c9138ce7046c585179eda8abd4a501e675e717a6d5651534bffd16a7686

Download Submit
C:\Windows\SysWOW64\Bhmbqm32.exe

Filesize
78KB

MD5
58ad3daff3cf49de8672105992382fb4

SHA1
24cb27edec6ca8a3d7ba66959715560905baa90f

SHA256
575d435d50cf506af8ac56cab1b6122fce1907e538804c72e23d3dde18b739bf

SHA512
2cd533fff5394f54e4347fdd1c84a3a94967da036df6e8ab3bb439ca83764718085c26bc048da61d5381aac28aca54029f00885e40a855590ef2669872eb812c

Download Submit
C:\Windows\SysWOW64\Bjhkmbho.exe

Filesize
78KB

MD5
07814e654aef2c56408db6b9ba80bcf1

SHA1
b0c43a1fd4149fa553c6b749a402db96434264a0

SHA256
366f011135b45607967597abe04fde1f8c42d7bf3c20448c973a87a0b9ae36ee

SHA512
44908fab4e7301550324e44c9cd69b60e3ba0f940d2e77ad0ab0ba85f97f25af818a1d23e9528c693a781b25dd4b130d2f6275b8b73d3b993669e33d7ea36ef6

Download Submit
C:\Windows\SysWOW64\Bnoddcef.exe

Filesize
78KB

MD5
c993fb03ddcfc778f30313b10d29a2cf

SHA1
ac7e03d77a1e75be6446f11c40b6a063239b1acb

SHA256
b47c17979b72cdf3f9c2eb9f2607895cd8f60bb5621144ae084680f423445912

SHA512
9db51c54168438fab7ff422dde94deaf23927863fdfe070ce351c1c28cffde03a4e71db1d549a9084c30426a8a4da5de8de9ace6e4921dff4e748921ed8575c8

Download Submit
C:\Windows\SysWOW64\Bpdnjple.exe

Filesize
78KB

MD5
0c961960f30b6fcfd566e4158eae0c73

SHA1
17ce825828c133d65b1e33b7dddf279d314cd025

SHA256
abd3cd3100dcfda8b45e7dee4efc55424091fbb6a04d0d7ad30d40b6d58c0ea5

SHA512
83673f2dc2d31b54da7376a70417068e5780cce5e8c238c19b6f5d30a7d48b29f521cd3ceab5982d8e07c50b48e32b9deb59cf92c6c687e8b2c34495f0024110

Download Submit
C:\Windows\SysWOW64\Ccdihbgg.exe

Filesize
78KB

MD5
739c40a6c0d3372cc786846c5be15091

SHA1
53baa82964cc04c9d97a2b0c3085acaa164fc1ab

SHA256
fd36788b2bebf2650b0c1ea4470e23c554080a070d8ba28b5b766fbf695a63d2

SHA512
1d1422f406ddc41e6c1f7eec2a122f95916320170b6072290f080ae20cbf76d25d093495b258e46945d97e6608d46f74b47fcd1888e22822d1b5ac9a1c63f977

Download Submit
C:\Windows\SysWOW64\Ciihjmcj.exe

Filesize
78KB

MD5
14bc4baea7ba96a25a6e0a489589fd5d

SHA1
180a765d1395228b184128d1bf1c955eff0b7182

SHA256
27013f5a5ead0a52d2b18cd6f49fa432c10e11f0e9ca0652d66f4fd91a0983cf

SHA512
69e0454b7293b278889ed22169ab18c59d10c53515ec316f3e446979df7cea7de95a6c884696fc805ae90cc813f5e894bc545c83c661f3307bdce7243267295a

Download Submit
C:\Windows\SysWOW64\Cmnnimak.exe

Filesize
78KB

MD5
6fbd26ee3911dffcfaa8466208a636a3

SHA1
9b33a03d140692dd86ddf125b5ff2e1d8ed2bf74

SHA256
812d7953479ea11ebe00149e1ead2209554773fbce5438b61cf629af61c81ca6

SHA512
3ee354c9d2c0e6868f0bd1ac6288cfb7fac8c7778aa0f98396a1545c2dce05b27b9596b094022bd786191d45cd988db911a8ed9c3ed504be5f72c7ff82333bc3

Download Submit
C:\Windows\SysWOW64\Cncnob32.exe

Filesize
78KB

MD5
d8c9cfed4e91ee2d5830bc719cbd5f8a

SHA1
d08070c3fe73cd03797004eac405351a787232f0

SHA256
79343e52eedc1caddc065612ad2a65c33e27ee12b6dc0aaa85a407971adac882

SHA512
61d120f1db605b1977938f10a44eac801b89b6ae858c0e754dc99ca3f597e9c03ee7040c839f3817ab287f10c7decf9c46a930d0bb14887d81a3dd6ff9c9cbaf

Download Submit
C:\Windows\SysWOW64\Diqnjl32.exe

Filesize
78KB

MD5
6c7de3d9d27692ac73ba1c96a6403c45

SHA1
48183602895b1cf96e7a10a8b2890f48b38bf4d5

SHA256
2640a546ec5b0baf806bec7cc92e3b00972210511af372b09c006a97e735fc7a

SHA512
9e39c06c3a3e26868bd8983ddf06f265be339dc835b2f5ca9a874923391a79dba3c7a35d70366e4366afee13892a06f2dd0d6577c298113132e700bb99e65534

Download Submit
C:\Windows\SysWOW64\Dkhgod32.exe

Filesize
78KB

MD5
50ce43b75b51c01bca332696d879e770

SHA1
477a7a5cd3c8e014f56bc9c5a366af0e18f6d981

SHA256
bef547ffeb45db03f2bd0f976d5e3b57f7b81f3690d605420896581d3ad940b8

SHA512
067757209b504fa8320843f8e44ff1e9f5a57b43b8f88a09bca7575c83d5b8a82a67fd1f7d11e8620cdcc2049dd023530e08d374f4abfcf5130b22b429c0deeb

Download Submit
C:\Windows\SysWOW64\Ebdlangb.exe

Filesize
78KB

MD5
ac477a0c4e6a1f753c413e81e9b19a0e

SHA1
21ae4484101fa7979bfc32fd4d4ab90fec30d316

SHA256
4765e9cde13eaa1971021fe987c92249b2d147fc94551ef5c8e3f0736bbc0a6b

SHA512
8a9c48c59b6e2ea9105957d35fc8b69e37133f65c0de70ec1c3ab1352f9f161b7308d6cfd9f03cd9697fc34c94f269f06af067d4484bf17cd53a161ae81abf14

Download Submit
C:\Windows\SysWOW64\Eghkjdoa.exe

Filesize
78KB

MD5
2be268d17523f65246db0892781529b4

SHA1
bb0988b37e64199488f8bfc44196c666f916bf78

SHA256
e047a04df9648799a5f863dc7a1f61bc61596a3d3a9477489551ea99a556ab17

SHA512
1274fbb683242b4a8e567488653682e0159945ee8de02eff0678a76197c7f4d088278f93c512932f33512cb1ab5f7bcb6c869b6177fee44fcf42aefa898b003b

Download Submit
C:\Windows\SysWOW64\Figgdg32.exe

Filesize
78KB

MD5
5c512a6a13ba2326882a83bc002aa386

SHA1
cb59c1cc7515a13e395f30f510ee646ddb78589b

SHA256
7b6488e7b7caf20cea318cd45a3b20d5e5c51b6c22ae913367d8632e98de9077

SHA512
0538ef8bbd5451817677ae9364ec844c3945667cba00a333f46ecaf68ea7a537aa2810f9e7739230b1c98fe67c883e7ee6b059ebc7ae91781adfb83876fd0ac9

Download Submit
C:\Windows\SysWOW64\Ghojbq32.exe

Filesize
78KB

MD5
d2de93599d295e37aef4d5503aacab52

SHA1
c5a1aa7f278753eb3a1dcba93a96f12e931abd93

SHA256
111a2774fdcf6b26f82611997c5669c0c1406b79f514bd1fdda48b90ec54363e

SHA512
6b1b879ea13dcb15f41bf4fcc88eba8c19f6b1fa1ffde096fdb0e8345b3d2738e065d5ad8bdfca4a4f51df193c7d3cee5ceb7d13f5b9f2d00c68ee2b2471cfd7

Download Submit
C:\Windows\SysWOW64\Gpaihooo.exe

Filesize
78KB

MD5
0b90f0a0e7d2c0d723868fdbd9de7806

SHA1
db251e4f244b5a2c8422aab543b6a0a66dc68d3d

SHA256
5576106a9b6bc0897bfa2c087b43ccced5ebdac339375ced346dc4edb8448843

SHA512
4c975bc9934ff65183b273d2861ef4c47fa0436a14601b765752c1b4b71bbed2ca8f7da5bf91a40edd0926bf1209ed2bd0231e98c51b168a31ec04d858c385c3

Download Submit
C:\Windows\SysWOW64\Hpkknmgd.exe

Filesize
78KB

MD5
df06aa5214cbc846fa6bfb9d5a4e63ed

SHA1
e233ccc5abf405834c28c48877521edafa8c4537

SHA256
944705982367142e68339cba0d32cf3db1153e0c6b62d519a72ebe26c067d2c4

SHA512
3241d3a0fcec4f58b4468cd3efaed358e5d2a12c7c38404c36de5a337f7d23cb7bf50f9651b662f0a174485d96ec0a93159b07f0a054b56ca5fa481d54a7ed61

Download Submit
C:\Windows\SysWOW64\Ihpcinld.exe

Filesize
78KB

MD5
572c5d82c75411dedd98f461364a61e7

SHA1
7bc70580feeb31c1e279c8a26067ee5e6a1b409d

SHA256
d6dbfde2939c2fb94c777d8090d61cc178da70c97c447328fc7c5a6394e4ceb5

SHA512
00046d90c3996fdbe16e3744cedc290b15ce8c1c95124eff08d0ddcf816fefada1a66cd384ddbbf8d25ddb070b8039ec6e030f2ed5f8d64a47618b2e94c8eb3a

Download Submit
C:\Windows\SysWOW64\Iolhkh32.exe

Filesize
78KB

MD5
7f7e008f895c18c9dd379fd67ca13ced

SHA1
6e061b281a009825c1f00d3c806e2ec165e8874f

SHA256
e9eb58652cc1acdb4936439a7ee345f4e59dea3a9aeb64274e7f93e54d8aaa94

SHA512
9fa7f713968c6132039ed273d08e495cf796fdc7e9a4f4974bedf0bc69be4b7e10c7935267a79554b654b7292e0df411c810362a2371115119fb0f4cf77d8aa6

Download Submit
C:\Windows\SysWOW64\Iondqhpl.exe

Filesize
78KB

MD5
256ec5f7a562e3d1ac0c21262fb0c0f6

SHA1
ba24e7306e6175564eb47d9158c41d7adc2cde28

SHA256
17dccd1fca85e3618fd0f037bac768d90668e249b9fedf0d3a2a6e1165bd8f07

SHA512
22c3d93d03f2bd592ac7eccfd3d7de0f2d5d329f7f822757174de6f62390721fa27422a22fdbbe8725a169401fe9470d5e3dfdb6cafb4bfc7068e556a2b515c6

Download Submit
C:\Windows\SysWOW64\Ipbaol32.exe

Filesize
78KB

MD5
1a265114c056901735e0f78011bd185b

SHA1
44ea65feb5b6edf0c3b59ecd6a095f7e84b11cd5

SHA256
f60719c81b122edd4073a3150d794e2537827761dada1aa73e2cb9f3831b89b2

SHA512
ee3ced4abe23200683c4dba369ec142cf6f5cd195ce8c75b7bc23caeed8e222b06069ea102ee33919656f3919488f143f43bb33f1f551af7912ee397263b2103

Download Submit
C:\Windows\SysWOW64\Jahqiaeb.exe

Filesize
78KB

MD5
cb33d2d539854ae9bbd8afaea8df39a7

SHA1
8e2b921b546c0b290fb7179f523e7ffef27a32b6

SHA256
985477cbfb1688eee317e0d3fc7cc6914eda0f1983ea43ac6056a8ccb8fa880c

SHA512
d58b0eed3d29c3cdc2c16a93d0bce929074d6765093f6a6c20fa0e2560900ec750b490f25cbe7088aaf516ef2c48990a6d7f0b3a57c8050440f82ded909ae698

Download Submit
C:\Windows\SysWOW64\Jbagbebm.exe

Filesize
78KB

MD5
515eae3d9aed93a76db4a8cd36b887f2

SHA1
48ce4c2bff398c2db005ce7d855d030335964b23

SHA256
6a25b0b770919e116aa2e4a25a14d20b6f5529d239c2661f9f6fb7d14aa6ed6e

SHA512
749a962e80116d93dfc259f14cbb040166ac3f1e33e52bfda313649d6f6ad6a8fcebba8d5d2be45dd08c0970b31df4e784b1a17d7079c2f7bd860056c9942ca2

Download Submit
C:\Windows\SysWOW64\Jblmgf32.exe

Filesize
78KB

MD5
c927b445f7936626586653dec823e5c0

SHA1
764a09667cb27cf958a21497259fbca31f0d72a9

SHA256
48786192956d2c7b6adcb44aec9387f7354b38f42062a8bca623a21ede2eccc2

SHA512
fac134b632472b9e1101b69c8f2931a8c643376d3de7ed5e99da7176f3816b08ca11affd2494f317d028a83fda182ac751965db9983fd5dcde4767461f3ca24a

Download Submit
C:\Windows\SysWOW64\Kapfiqoj.exe

Filesize
78KB

MD5
ea5a234d0ec3d6da5e8ac211cab1284a

SHA1
a39ac42e3b11a8de0fd17356c1adf9dd86e95a1d

SHA256
63010a355e89f6542b3d11ee7ef96aa7d359b6591255f3d080220c9abadaa0cc

SHA512
64e95d51eb7380dd71a6ce620e0ec9a718058fcb1d9c04eb52fa220a2dac8839a9703564a6570f08a1c78ea8493bf4c4e8bc8284e88f38078fd7dafda8746351

Download Submit
C:\Windows\SysWOW64\Khgbqkhj.exe

Filesize
78KB

MD5
2704d709be1d14861c5299852f94fdbc

SHA1
02bf01a54c65cd67e259656711629e2196fe18c1

SHA256
c23879026b3b3ca1d95a5d391a87f5081f46b4878c3434b65ad39c81af04a694

SHA512
e24822283e89597e424a9976e0ce0b9dfe69aa9c509384eb488ccef7d055f551a9458bbb1f7c9adc1cb8113720aff3f94802d8df843c611c148e340b087d7fc5

Download Submit
C:\Windows\SysWOW64\Klpakj32.exe

Filesize
78KB

MD5
5cce5d4710ba3edb766ff1a3f1ce79d6

SHA1
78304335d674dae616d648c73b96a4052417b38f

SHA256
be5789a24332d43b5f2a243c8a9a6491259af7dbd3aef5986d0965c19f549205

SHA512
1b831a2a1fe799056d2bb999e7167addd01c4760b78b94ae5b737a9d35df0f3c69ea608310ec8ede32e4dddb48ce71f9b2c9e10fbd6f2b3afd7acb4b4fb273e1

Download Submit
C:\Windows\SysWOW64\Koonge32.exe

Filesize
78KB

MD5
91a46622ffdce6e311c7c6bcc0f495a0

SHA1
aa23d38ccb1bd4b24410d605b8e269154140cb02

SHA256
1674e2b9d172fd0eb2dcd8cf08c4c91b43e6a5c5ed361bf44403863b46096c42

SHA512
f22a03e637f20d34e9316fd3635d4a318edae19620da4fea6240d6477efd5c809ba2cee5f9ed5c1ddb6026270de0e66cbf78cf1af4cb8ed5a4d94a85eed66187

Download Submit
C:\Windows\SysWOW64\Kpqggh32.exe

Filesize
78KB

MD5
27f0626cb52854c937f5f3eb243443b6

SHA1
f26068a9eba06edb415b83c62b4b53ddbdd33e07

SHA256
e4c39d2833d7ab1fbf6f797075d4881c4e6d2b99acbc45d0a497cba2f80103c8

SHA512
ee47f085a6df862d20c55864d590d3b72ebf090fdb4d562981c52826d9c10573e1e07f48ae8ff3b2751b6f61466586674b95348ac803e370d634b4896ed9f4cb

Download Submit
C:\Windows\SysWOW64\Lancko32.exe

Filesize
78KB

MD5
6d3bae8ac195b2098720da3e97cfeadb

SHA1
f66ee8d6069ba6f0a2daa5f994da232b84e2e483

SHA256
0939238e9a51ffa73034bc96c30174c7104f338447d3c2311724a245aee32350

SHA512
2bd85756503ed0581d83a7bd532981e1103549de9311e38c426df454ed6299d59549ffb5650060e31103e8c91418e6b2e85503cd476a1e2288e68fb1c0f01801

Download Submit
C:\Windows\SysWOW64\Lcclncbh.exe

Filesize
78KB

MD5
d2e0ca4e135104a449ddecfdd197b9fd

SHA1
810fa6b2dc297b3b640bce58468dedd37b11253e

SHA256
bb2e1caf59cc71f084856e7c8f93f91a20e53f59cc16c5fe4574ddc2cc1a1899

SHA512
978b9e94239029b99bb64f172083d51d9811c265e754dc3b0b8b27da4b4f54fbe55298e1d70b532bb64917489a296862a679a3f721548ff3be3581d363246aaa

Download Submit
C:\Windows\SysWOW64\Ledepn32.exe

Filesize
78KB

MD5
9dddb78558cd566cd653b2e3e26fdc01

SHA1
24635d821cf2f21873254855bef1d7e16a418575

SHA256
47b833946219082ef2d0aba5b341352fdc23a715f01b986d240f1d6e6f30e2fd

SHA512
4adbc2143f51a8a157876337079048020621ad109635903a4f05f9ec8f010336903fc1287d52890f6860b25570c159893e211aa8ea6aa54f777e31ee9c388c49

Download Submit
C:\Windows\SysWOW64\Lllagh32.exe

Filesize
78KB

MD5
4e0ef6ce2a7f81ed24dfa309a4b52611

SHA1
d726866057551d4bde76183291a5cb0638640195

SHA256
5ac199fdea8bf8be6244c11bd76f2597acd66659d6a83f12453dfe32915cfbd5

SHA512
191c205673677df1ec5f163b66b50ae1644738aa3c41eb1f6c89a28139a933c07af3fc398d67d3a6932af2eaff7712ce102db868d1e750e7b4d62d32bb022b58

Download Submit
C:\Windows\SysWOW64\Lpjjmg32.exe

Filesize
78KB

MD5
5e905efd699a3a24be5bb2a8a7f49ed2

SHA1
409ad4151797bcb38d9a3b9eae7a049e954f7ed7

SHA256
8d46d2dea014d1ce5d44f5ad2cc37e3d4ad37000668ea00011bda9a9850b44ac

SHA512
9ff9b2687b54cded0484dbf5721948b75dd1c42ddf6922a9a1e6263d6d8d09ae6e276721c2aa14b74b06e6be5d9267420b5b6353102311ca85920bb5867bca3d

Download Submit
C:\Windows\SysWOW64\Lpochfji.exe

Filesize
78KB

MD5
b5481ae416fc23819f0257601bb4436b

SHA1
248749e687ccdb7adbdf64146731275b0d4ecceb

SHA256
166dae4ee1bdc60aff5b2854380ced7d1ade3ff9cccd7d18910d19233d1b3b75

SHA512
d75da6af1e64af9c4345078415f81c629a558e4fbc16ea8358e9060f60c75e0cf35e0bdbd20972aeebeaed3fd1f109e54274f4d3bb15cfd5e8cddc9b6fbdabf7

Download Submit
C:\Windows\SysWOW64\Mcifkf32.exe

Filesize
78KB

MD5
69cec5446a54f7c36048a683f5907ef6

SHA1
1c6d0524505d671b912355657eedf10c7cdde537

SHA256
f965b747a3cb3b53125525bbcc986ff1ac61cb7bc9b5424f7a0ba2cc304882a5

SHA512
29610710a95bbffde2e98151d7a118b34838ea71fc124b73bd57795c0cdba2ef7770e03a427e6df2de53cdfc4722cdf1b9679ce7b8330ffffeb1275022ef574e

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
78KB

MD5
0157450f3ae6bf2263bc4e6d6b24ab09

SHA1
a68876a26abb000e2d307f95e20ee8e2d36331af

SHA256
07fa836f204d1dff915b53c9bf95ecf99ff189055e152ebb98a0fafab3985a63

SHA512
6d6046830e03fd0ac933e416f916e91a1bde29089582c1b6656072e88280d2ab566a7c780e4fc99b39d8105f9bf061613aa803eb14923824742f66561434bce8

Download Submit
C:\Windows\SysWOW64\Mjodla32.exe

Filesize
78KB

MD5
7c6e702429cc6352c62fae4ba71dfaa9

SHA1
872761728c64c6ece151ed64e7d1c1b497f6de8c

SHA256
4edf98b5905a910f24a957a3d35cfe33f043cb95d7f0356deaeb4ef90a2e49b2

SHA512
17f34b05fd168a769fed9fbdcf10f268cbf30532cf20e743792c9d191737cd8a3f4b48365be1027d21fcf85a3f3bfec0d6e543f77222f7e0e5db24a872b41cc5

Download Submit
C:\Windows\SysWOW64\Mnmmboed.exe

Filesize
78KB

MD5
68c37bbb2519c00903cb64cf036332c4

SHA1
9cb82c65a8ec15fed2b8b78de2845f6e4cc98430

SHA256
354548e76d755850e085dabb6c6bb18f37f20662df19f4fd60116a8d1bf0533c

SHA512
12b0889b993b3a6b1821ec1a4358ff58e808e807f5fdb0b0d173a5d6540ce9bbb2580663b0bb3b7c81e9d027bc7944173e46d424b2d33e5f13cd6c4e3ea85440

Download Submit
C:\Windows\SysWOW64\Moipoh32.exe

Filesize
78KB

MD5
cf6342a341a79efe8d04a1983a909e37

SHA1
48a8fd9bcb853e5ffc1497d9e04db4cd07ee2c08

SHA256
6913065d1021c0f5593e13696e82a0ac4fc65b5638086db1568bf1d70d5dd0f7

SHA512
77bc5e291c3c24fa2e0aa9e6d1fb6b0277365bcc064d32f3e10b37f94c39c8ac6e37ef509203329b6aec4cce9a75a849c5c074d62edf5bfd4999150674eb462f

Download Submit
C:\Windows\SysWOW64\Mqimikfj.exe

Filesize
78KB

MD5
7ca1e16740698e6ae2cfc73e3d0b0a7b

SHA1
fb0957a450cf32f6995b32684ed7cea8d75831f1

SHA256
aff86957a7a304b30e3c58bf1d76a2e558accd903d7d260bde18400d97e82354

SHA512
4b5b7a920adabeeff8044394c089d74114cb35d215305824df3180fefae887c74bb87b20a9034ecfaaa022e1e67f0872b2574adf7c37bc0368f4dde65fdee0f6

Download Submit
C:\Windows\SysWOW64\Nadleilm.exe

Filesize
78KB

MD5
e872b38ace12cb6095375f5be855cd78

SHA1
c6169aa68cdf7c3a6f6319d067bd05bc4c20de6b

SHA256
501cca57f512ca499890aa12315db96cbd5954b5b6647786cda7526e1ce99373

SHA512
d19e7716f11393aac53910456cbfafa3f0f8716f5de18f306416ca78604418c793b633f94980024b9f6692fe1c99a67befda6a7498421717d01d96d56628c213

Download Submit
C:\Windows\SysWOW64\Nagiji32.exe

Filesize
78KB

MD5
11d924a424b2f21db55c4805f37d45ad

SHA1
a1f5d8ea6ad89f1a74ad7e7927eefda00561b756

SHA256
e105d17f7a7cc426fb805e05678bf9a5f2e66ac027b186e9d58ecbbbaba8268c

SHA512
d1ee0f5e43ade511ccce23a42c18cbb64893a6fc04861e250ac45792de1d2c9d382937a0f27f9328363b078bf6ba9613ef4107b399682eba79c609605f4210ec

Download Submit
C:\Windows\SysWOW64\Nggnadib.exe

Filesize
78KB

MD5
ab55752d006399dffdfd619b56c59f46

SHA1
cf0d9e50a5006914b2b1bb15c30f0cb2f9ac9543

SHA256
6c1e482fb6c2bde55364e307e758ff865e5c6c16f0d07fa1b9950be5e041ee8b

SHA512
4634e072137fb51f0f7037beec3192808b6e098a0a0b6cae16796cf3cb3998744a10be1fc18fc180f4b72b83ae7805da0d377676fbfc9f82ff9881048d5de69f

Download Submit
C:\Windows\SysWOW64\Ngqagcag.exe

Filesize
78KB

MD5
ed3ac558f82a17d93b688ec67383dc4a

SHA1
dc644d4824fffc9da756f768e928c47688d84c70

SHA256
6a363cdd45112895fa3b8efc88440cd41f17aa0cb990015d5e17af3e1021c529

SHA512
b402e34b73f3f339cb456ddad6e455ced895441084efb8f8f5caf8329deae446fcf57639e3e985b7ba9b97c16bb006eb5d2e0b3176900dfd084f492e9f167f61

Download Submit
C:\Windows\SysWOW64\Niojoeel.exe

Filesize
78KB

MD5
3777b89ef52efb529772dd8d583c322f

SHA1
5f944a470f34c8c02a831f08dc003aa8ca66ffab

SHA256
fc0f15f89de07c52b46263e49961a6fd9d17f3f83eab72969157900c67672e80

SHA512
8719ebeb36d1bb3053f77362989f71e148be1b60490287ed7a6af372e362a3d9645cdd3d1b1a270740028dc20e76e2961c917dbcaf8cb43f1575304c8f2dbd0e

Download Submit
C:\Windows\SysWOW64\Njfkmphe.exe

Filesize
78KB

MD5
3c01b50c181a4605fa900bf251efed52

SHA1
edaca4c47b226d4582f75fc796ac2f771e234389

SHA256
cb03cd746cb9864753cb38f77b0657b0b02bd73c7df97436708bd5c636adc4cd

SHA512
28e933d8c977d96c2f88a933237815d5076b59b38f05f5b9e041047bb78cd90b597a8fc07d17556413ccbea5e5a8ee2c41afb198aea878fbbf071727eb7a4a76

Download Submit
C:\Windows\SysWOW64\Njjdho32.exe

Filesize
78KB

MD5
634f5a8f5bf20976f8ca1d307c513f62

SHA1
41d4fe42319bc5a1a49bbe2340d2eb0b61143fcc

SHA256
0eec0800fbe95eb78890eea029309c7092a31a7701eb94f2795430c4788415c7

SHA512
fc9cf2dfcb84405fc971f6d01194f06eb581ee0a2f007ac7c857c4d46c42c0a6f680ed0c17b88bae3a9e9f5f3d4c9594436b7334298e47ef30a4d05fa232fab8

Download Submit
C:\Windows\SysWOW64\Njjmni32.exe

Filesize
78KB

MD5
5974dce425c944b36e745d8d9d245145

SHA1
76e9cafe6a2abccad01890c3590d8e3f79adbdd5

SHA256
2eaa60ce8e6fe554bf58baed052ed7a77a3c54fc1e8f8d6144a25a011a6367d7

SHA512
cfa98212b5a7bfffb0d228cc349a31e5e22ffa6e3bd99d7dbb147eb6649b07f3efef125b07bfaec55ae3c5b622f62a42b07fca8010cfaaa61bf85d8d52d62641

Download Submit
C:\Windows\SysWOW64\Njmqnobn.exe

Filesize
78KB

MD5
0547a4bce5e4a276baf7083103482f62

SHA1
7f528da051528e9fcb1eb7094f554096a9417b2e

SHA256
f377e317e18a2b10a1bf6b4e454db096facf5ec3167dbf2f7ebb8550a22daa03

SHA512
0b333e01d0e0f4f30c3fec6b3c39f7794e847c98b766028c15f036183e34df7103cc2391c64fce154317689bf5a389c8bb734794bc74edd3f75b8a0e74604fd7

Download Submit
C:\Windows\SysWOW64\Nmdgikhi.exe

Filesize
78KB

MD5
a9ea3c74285b6379610758fbeb3cc800

SHA1
737acede6fa3025a76a7bfacf1814d77e78f85a5

SHA256
1b7fa6bb623dc87c1780efe765899825a3e2b36ed4a636203926cdc79280c7c1

SHA512
5c570cdee817dd5335b36240762fe95b0edf66340ce3d89b89071cf62ed5552c48cbe6ea7a8de3f83dd9a1fbeb900ced5ef1e6528253513f827d13de880a85d0

Download Submit
C:\Windows\SysWOW64\Nncccnol.exe

Filesize
78KB

MD5
92d02615140b6d88c321b70f376e62c1

SHA1
8dc184a11552c50f0ec4dce849b82456f78a0625

SHA256
06bf8f72f062b03013b9dee8fd91ad835ebc675da452d96e8b963c7497b27e07

SHA512
5d25eb382d2feb31ba18e950f73ce024b58c225dc3344fe055c6ed7ff1b64336916164b2696091609a14a03833f1ea85dc313889c5cc868b024467fca3336e3d

Download Submit
C:\Windows\SysWOW64\Nnojho32.exe

Filesize
78KB

MD5
2823b2db5a1e24f33b9c8d5ec9956e8f

SHA1
7d983d48fa840528d2044ffc99981a9762acb8b4

SHA256
0587213303158dbc5e3b3f00ed06997636c9bb0e266525c79bf7e4e6a74aecf8

SHA512
3e07328627bb0424340e08e35418a088872d81f2ddfb8894497af5086363d64d59b3035ad09f3fc086d207177730b777e5f713bf5fb4261656fa9130536cfaa5

Download Submit
C:\Windows\SysWOW64\Npepkf32.exe

Filesize
78KB

MD5
f8e6eb386c00a4d0ae142ae9f2746b08

SHA1
3ac8687c09e04c806340fa78b1fd6de754262148

SHA256
3303e4bfed84ce1cae1958461c259bb38a1a5d2bb3b26fa440ae54c84180f637

SHA512
4923dc6bcee7b6fae5a4222d6ea02517e2e08f70cb1d6290e4ae48b9f9c0cf0441476455c95f4e8a13446d6f1374c20103a9ced93f05097750dd87df828ea0b3

Download Submit
C:\Windows\SysWOW64\Nqmfdj32.exe

Filesize
78KB

MD5
76073f851e81a803c24d1fc902842cc2

SHA1
be13abd5d9ddf15e3458c3a69c815d0d34900e18

SHA256
a9d3a8e77a2b616cca2d3b3c1a97b843457ce80975ef5ee3ad65e7608bac8378

SHA512
7a7e949cfee704d34caea333247cd0a4a2617b3eb1b6ef33c9d6ce711f6aaa4004072f25fde7c1edbe7c2f8e260b5c15bdd5ce20bb14c1a7b5d60a8d1148510b

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
78KB

MD5
217355e7e7c245f86e896077ab325bb6

SHA1
4520529fdde33a7df7ef81bbc2479fb2b41b20ba

SHA256
ad3f4c6e162f75e5a0f8ce9633d5703ff80bcb6c08fac8b015501a3ef36ae933

SHA512
e7d486cfda8ad6817c8e26a836d06e5a27688f5ca36e1ef3bfe4d2b47a550b42532e9fce470d589d91175aa85d8fac211130c76a189565d4b3033a14fa07caba

Download Submit
C:\Windows\SysWOW64\Oanokhdb.exe

Filesize
78KB

MD5
880533b0e58d6c1886826c18f0598127

SHA1
d5813d2d6e50b882d9c44be47dd9d2b78f0ea2ba

SHA256
b4df0955367b71c054ad005088ade3dce55ce71ed9bf118c1fd64f73d10e0b30

SHA512
41df90a5102d6292cb2c8c61678f9427579f6ffdbe0a3159c83f3f13552011112d9ff51c3604fa63377239ffd0e7e42d3cdc779310325b3aebd98d24f0bdee4f

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
78KB

MD5
fbf503ee55e2a79a4a6c1ac2ca557f06

SHA1
e889f5db0d29ae34b4f30641b9270acd36fc3451

SHA256
65d6def1c14723cff799d41c4591eb0862288d2a2a1504e089a101218608c6c3

SHA512
23daa5153ebfdef1fc1e4f35e4074a960f3b5cc4be28e2c8560b548b914d13ddf9da45ca2fad016104ba71495e9bdb29c6c022f53c485fdd383db821d7304833

Download Submit
C:\Windows\SysWOW64\Obgohklm.exe

Filesize
78KB

MD5
eb7cc93841ea4f40c4123d0a56b8ea62

SHA1
c87ff1cd288c72317bcaec8d3e3319b97538cc2b

SHA256
0371492c0b5ed359e0a8123c358a08196e130bb5c55a3837773f20494f3ff333

SHA512
11a0a869e062f012d1f8f35c67cac3231060bf0f4e35435fbe797a80e922df76bb6a5d742903af334893ed425833cf78e6ce2eab557d63ea92d36ff317799d0e

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
78KB

MD5
87103a4ca88b9ce50c7589ca97fd2eb9

SHA1
ccb91bffa9598b8cf1c68b8629b08ec38d3b3454

SHA256
c0cc33090e6f3585fec7484d9f1759e2adc359a6bfc141243b9214951763b0a0

SHA512
43f5e8b8a1682107681dd18f4b943b44848e256ca010b0549e267ad6289056652ec5303c6df2c689680fd8abdb4abfcd31ec4f1008b081247a37d96357cbb6a7

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
78KB

MD5
e56d859be14c19304b955c239cc6b7ef

SHA1
e9a9ef3e0f7d8899ded2da6cfa92515df43faa0b

SHA256
e34e11360694402eed22b21a23c6941c4888486a22744df011c8712d46060cb0

SHA512
c72895dd50c21426f83b22d314475f48c07510000f52d28849e4dc699d0e188a7f88735efe5541902dadd0ec448d111d5bb569ec12a18a400e683ed6cfb0e3a5

Download Submit
C:\Windows\SysWOW64\Ofkgcobj.exe

Filesize
78KB

MD5
6ddd8dacc21ff743a1b1bcce08f5b524

SHA1
75e629f4f0bc3a89bc5c2351ce16108dd59b2163

SHA256
791fd685ea74697338f76a069864ffc28f04558e5855509c54fd0c34baa464c4

SHA512
18edf8062acabf4b750640820ea04275c92c349cb633698a5bedec744016bf8b67956503a1ed08082616f0c6531694d371f227ba0f5a5ba31551516ca4d846bd

Download Submit
C:\Windows\SysWOW64\Ofmdio32.exe

Filesize
78KB

MD5
d1905b41bf61eee80639d7504d055501

SHA1
3c4cd097d7a9d5cbb24129623c54cc5c50db1002

SHA256
951af44a820ca6c456580efc7ad2738045e1882f78cb8ee89d11f2ebe58aadd3

SHA512
0b707ceedf6dbdfcdad1ebc3d5a5a83eb2580cdba89c4a5f729493d2988fc4c25d8d2eb76cd3ed7b881895205bf4b23e68827c019c1d01c970db564b2c8f0eb2

Download Submit
C:\Windows\SysWOW64\Ohlqcagj.exe

Filesize
78KB

MD5
28df3f937e8606bb42eaba378f741428

SHA1
af2bd11efd1b27582e748d0f636ffcc871b891e0

SHA256
95516cc8ee6d51627bfdf9e68468f8bdda8d4ca52de569a5e7c0d7cc91758722

SHA512
6b6f0a3d484dbe555d9a58dabb306cd6a5b291ec7980b0d6a2b5d28dba34c24f4f93a0c721fa37eb3dff8710bdb5387e5812777e460338a399b4174ccd6b9fe8

Download Submit
C:\Windows\SysWOW64\Oihmedma.exe

Filesize
78KB

MD5
f166c20cda3a45640ea98587ff0e15ec

SHA1
2118c843bd37283757facdd5938a4b997ad5d108

SHA256
b863a7cdcb970363d8cb954ddfb2d6a31cc2a8e71fb193735ebbde6696a619f9

SHA512
64da1a09860ce49c60c4b47221e1002e932142e9650646c9144739bb825ec749dc9d7c622d745361b233e9e560fffbb10fdd1c9b49c79177fb734ce2938da242

Download Submit
C:\Windows\SysWOW64\Ojcpdg32.exe

Filesize
78KB

MD5
324c3637365241e4869b1552037b26ed

SHA1
d8fbc1ad38ca66c84ba159112ef678fc735bd58f

SHA256
4711aa27bb22873ca5ad2c17e9fb617fae0fc654e45473812785b658f5bccae8

SHA512
72f74bae7269ea2014a5eb8bf5cdc6cc2b3774bdb64e0666bf42b1fb24394caffdcf4d2cede5fbd39fb7bab87d3d117af744f4cb4c2357632565b272ec67a1ca

Download Submit
C:\Windows\SysWOW64\Ojdgnn32.exe

Filesize
78KB

MD5
537389792ceb9de883a1695f5b50a239

SHA1
70f837c4fc1d33035767cb1fb31f675e94c2bc63

SHA256
9eb471bdbb4fdf6b8c0e3083e21b0f7ea1e72513c292988ddeb161602ef9a555

SHA512
3690e8c2f367175c1376958b02d01c86ed7d222899a2decfb63122d398dd39d6e3068ef5be5d2e40ac9be7bfdbe0e084225d1de2145058ffac5b182800150b1a

Download Submit
C:\Windows\SysWOW64\Ojhiogdd.exe

Filesize
78KB

MD5
14b924195cc198c34cb0032ddf6ddb16

SHA1
eb4fb21265fbb942714dabc7764d3ab81c243acc

SHA256
9651b257cf9e3f621e74b4077f78d0d6d036d2ee1da0a54c613d22ce24e004d7

SHA512
08b234dc2a225bf4442910dfde5733fedb507d2b581e454a21c0774bffeb09fb29fc190916868dfd6d7fd67fb9866b04e5eb3a0272a421875e3f67eb49830034

Download Submit
C:\Windows\SysWOW64\Ojomcopk.exe

Filesize
78KB

MD5
e97ad31aa4de4627834cf90a23229321

SHA1
cfa2b136d05f04b70bcc0312a4096cc7656abc19

SHA256
674c7c838614a4be88ba82129479bc0cff303fb20139ea3a4fd6b63ed7ffb423

SHA512
73c7cce84b55eebf1265b5150dddebdb8ded86f6cf40004ba45b84bb15d78a83a3a03dee41265d26770043b075b60f7dbc63180d031f8e86e3a95c189bd4587d

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
78KB

MD5
3eff9098ba9f7d3194896b702aebce35

SHA1
659d5af8119c899bdc9bcb1be268ade03a58aa7d

SHA256
0a356ca8362aeba784d62022f9d33b2153e740ca5981d3bcb73e1847d90a8e48

SHA512
a6b9383070ca8bbbeea2c8cc7b96a959002bba580c5ee411215bca1078abef7cd77f5e96792508c8faf0cc0b329073398af9e7e2ae8fec5e52da40dde6151b68

Download Submit
C:\Windows\SysWOW64\Onmfimga.exe

Filesize
78KB

MD5
0deb396ad5583ccba195711aae52bbc5

SHA1
cb5696d5c23e4ed579da1eca5244f6fc0901b562

SHA256
24b74a5113586664392de59f7264c119e59cd94b910c77e81fe57edf85f0cade

SHA512
8f71fa0847655d6f342f4f838e44aee95a328b7d8e0357b1613d5c4bdbb0fd6f23d5533c7a4e0f5b6398e195d4b1aa1219bff94f8ac3653288c6ae1b31e352cd

Download Submit
C:\Windows\SysWOW64\Padnaq32.exe

Filesize
78KB

MD5
aaa294ec8c1ef596a2377d6341711e69

SHA1
af490327105424cd7e3df0bc093e583ddcb395e5

SHA256
0c8c70083e58c409e1e4391d22cacc8a83e632776d236df82400161feecdf5af

SHA512
eb280e920a26f2413a75c8869a371e3bdffd8cdd40c67c81247d5ebfae3c035ade9203af98ec59e6c4b4322651018766a7c3591e8e9480ef20ae52b9713ce8b5

Download Submit
C:\Windows\SysWOW64\Pbhgoh32.exe

Filesize
78KB

MD5
7d62d0314d7738d10455c86056ca0a90

SHA1
4d8f02d05040b3e45e12e666436077b43333edda

SHA256
029f4399cdaf342d4a68115c3e6c55f578a3dfeb175d0ea5dadbf7a892ce5b88

SHA512
fc7d5614eb3485368565ee041456b81eea210c05a474e4bc6ac4bbb7c321baab510ea18cb0f28580dd570a6a5905769334a88d54beed6294ec2618cc3e8be3b2

Download Submit
C:\Windows\SysWOW64\Pciqnk32.exe

Filesize
78KB

MD5
65c36b5d874646f774d5e9f426aa5614

SHA1
16f80111e1e8ac50587a11642903a1a427944f8b

SHA256
28d376bc46644436d6b7c3142945f0fa1d04bc6518024265024f296f89af16e9

SHA512
599ce9ea66ad02981ea07274298c4f13835208682f593f29cc7c2d855d4e2adfea78721d8d0ef6320936c3fae41d73392fe49a63cc6f5843805a808cacae18ec

Download Submit
C:\Windows\SysWOW64\Pdmdnadc.exe

Filesize
78KB

MD5
7789aa1d5f4ec0a48c19373224aee4cb

SHA1
8d5aedc1c3a7a5ff69f34f5754b83c18e3e10c8e

SHA256
298e1e70c885d51f81e915e88924f0c86fed20939929cf5d312f9d7bcb928b77

SHA512
9691768a459c1d3f4142d0c508e039f84ea5742d55d38c562bde786422c27cf0c649fc75ae9cec515db30d565680c183622bfd62e00d272e71ab910927ead8d7

Download Submit
C:\Windows\SysWOW64\Pfoann32.exe

Filesize
78KB

MD5
eea048a9bdc2fa38b1ccaba27311e78c

SHA1
b00ea4a27b57c61be1ec3ac3e8631155724e2f3f

SHA256
676436cd3aef0c00ce8148097b9c77c40ce31842dace07ca49461a5a9e96cfe0

SHA512
e3c83d184ac6dc1e4f24120ff4d5c0a8e8d040e681ef5de20e0235939fb4ec08414c419e7878f8cc2a737ec3996de800e11cd0fb67a7ee3a3f62e8723dbcee6e

Download Submit
C:\Windows\SysWOW64\Piocecgj.exe

Filesize
78KB

MD5
f45e9e01783721fad97751a9b441be7a

SHA1
db8343238b84a7c8be0daa9530b4aff3d844976f

SHA256
d3387a3b756c91e02c0cb84b188ad4d5e7b9c4f264c9d5b4e9a48897ed32a266

SHA512
8f05523703f9d32bc319a0c713cadb5c469fb78880fa36a98cb59616b4ec07d2323997405a10e507320361737c079fd53a848840216ac635335b50f189e8d6a0

Download Submit
C:\Windows\SysWOW64\Ppgegd32.exe

Filesize
78KB

MD5
342f01feb658b48be685457fbf013367

SHA1
d54859e7cdd0c2f134bf8c5c872024face1d293c

SHA256
2c7876dc195d9612db90e49813e6a94fee85bfe74c5c53fc4eb82f6ed376ea32

SHA512
3d7930ee89beaea8f10298ecd7462004c01496ea60831a7a5a69a57d18bd497804d0a769a439c223f4d042847c234290ca759306e634b541db8b06e9a48c6f16

Download Submit
memory/684-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/684-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/848-362-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1048-190-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1048-276-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1208-299-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1208-368-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1320-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1320-403-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1384-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1384-230-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1576-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1576-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1944-319-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1944-242-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1972-348-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1972-417-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2096-166-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2096-78-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2528-100-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2528-188-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2656-206-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2656-118-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2736-258-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2736-171-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2752-396-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2752-327-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2768-347-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2768-277-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2968-181-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2968-267-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-198-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-109-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3192-369-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3224-145-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3224-234-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3336-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3336-107-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3452-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3452-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3456-167-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3540-341-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3540-410-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3604-354-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3604-285-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3764-170-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3764-82-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3844-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3884-411-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3936-158-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4064-235-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4064-312-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4076-259-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4076-333-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4188-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4188-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4336-390-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4396-404-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4476-91-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4476-180-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4800-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4800-355-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4936-389-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4936-324-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5024-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5024-157-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5136-397-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5140-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5140-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5188-225-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5188-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5192-313-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5192-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5240-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5240-291-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5244-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5244-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5256-383-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5360-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5360-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5360-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/5372-326-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5372-250-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5456-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5520-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5520-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5672-126-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5672-215-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5864-199-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5864-284-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5932-375-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5932-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5980-361-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5980-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads