c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 05:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28.exe
Size

79KB
MD5

b659bc818327b7b8e90185631e11490e
SHA1

0166c6ef81f40092651a46058b5da0da11a03cc7
SHA256

c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28
SHA512

21ad23e4347801c5fda6f04ec6dfd7fad6b7bb5f888ce52e02bfac29410102aded278851439ca3b2ab66c0e5c9e3dd44f0286cdc837061a5ef3b78d762c35900
SSDEEP

1536:GBrkneyxo+EZEDQphVg2sK/H6U5hZOmhsZrI1jHJZrR:erkneybwEDQm2sKioOisu1jHJ9R

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaedkdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hioiji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmhale32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfnphn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iejcji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdpmpdbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jifhaenk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdqejn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klljnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffddka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heapdjlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibcmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gokdeeec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdjjckag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lllcen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mipcob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe

Executes dropped EXE 64 IoCs

pid	Process
4864	Ffddka32.exe
4724	Fdgdgnbm.exe
3004	Fkalchij.exe
2484	Fchddejl.exe
1004	Ffgqqaip.exe
2952	Flqimk32.exe
1284	Fckajehi.exe
3692	Ffimfqgm.exe
3020	Flceckoj.exe
4396	Foabofnn.exe
2392	Ffkjlp32.exe
2240	Fdnjgmle.exe
4936	Gcojed32.exe
456	Gdqgmmjb.exe
964	Glhonj32.exe
4464	Gcagkdba.exe
4712	Gfpcgpae.exe
2992	Gmjlcj32.exe
3936	Gohhpe32.exe
2684	Gbgdlq32.exe
428	Gdeqhl32.exe
3152	Gmlhii32.exe
2228	Gokdeeec.exe
4928	Gfembo32.exe
2052	Gblngpbd.exe
1288	Gdjjckag.exe
1152	Hiefcj32.exe
4244	Hopnqdan.exe
4032	Hckjacjg.exe
3464	Hfifmnij.exe
5112	Hmcojh32.exe
4048	Hobkfd32.exe
5004	Hflcbngh.exe
464	Hijooifk.exe
3944	Hkikkeeo.exe
4764	Hodgkc32.exe
4560	Hfnphn32.exe
3824	Heapdjlp.exe
3828	Himldi32.exe
216	Hkkhqd32.exe
3652	Hcbpab32.exe
4804	Hfqlnm32.exe
920	Hioiji32.exe
2900	Hkmefd32.exe
1940	Hcdmga32.exe
2364	Iefioj32.exe
2288	Ikpaldog.exe
4736	Ipknlb32.exe
4532	Ifefimom.exe
4268	Iicbehnq.exe
4820	Imoneg32.exe
5016	Ipnjab32.exe
4992	Icifbang.exe
4408	Iejcji32.exe
4892	Imakkfdg.exe
1320	Ippggbck.exe
3524	Ibnccmbo.exe
1028	Iihkpg32.exe
4644	Ilghlc32.exe
3876	Ibqpimpl.exe
724	Ieolehop.exe
640	Imfdff32.exe
4304	Ipdqba32.exe
4488	Ibcmom32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gmlhii32.exe	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Hcbpab32.exe	Hkkhqd32.exe
File opened for modification	C:\Windows\SysWOW64\Andqdh32.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Ipdqba32.exe	Imfdff32.exe
File opened for modification	C:\Windows\SysWOW64\Pdifoehl.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Dbnamnpl.dll	Pggbkagp.exe
File created	C:\Windows\SysWOW64\Ehaaclak.dll	Pcncpbmd.exe
File opened for modification	C:\Windows\SysWOW64\Kibgmdcn.exe	Kbhoqj32.exe
File created	C:\Windows\SysWOW64\Nnneknob.exe	Nfgmjqop.exe
File created	C:\Windows\SysWOW64\Pgefeajb.exe	Pdfjifjo.exe
File created	C:\Windows\SysWOW64\Geplnioe.dll	Fkalchij.exe
File created	C:\Windows\SysWOW64\Kebbafoj.exe	Kdqejn32.exe
File created	C:\Windows\SysWOW64\Fhccdhqf.dll	Kedoge32.exe
File opened for modification	C:\Windows\SysWOW64\Kbhoqj32.exe	Kdeoemeg.exe
File opened for modification	C:\Windows\SysWOW64\Leihbeib.exe	Lbjlfi32.exe
File created	C:\Windows\SysWOW64\Npjebj32.exe	Njqmepik.exe
File created	C:\Windows\SysWOW64\Keajjc32.dll	Hkmefd32.exe
File created	C:\Windows\SysWOW64\Mibpda32.exe	Megdccmb.exe
File opened for modification	C:\Windows\SysWOW64\Hiefcj32.exe	Gdjjckag.exe
File created	C:\Windows\SysWOW64\Ndqgbjkm.dll	Jeklag32.exe
File created	C:\Windows\SysWOW64\Qffbbldm.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Jmehcnhg.dll	Icifbang.exe
File opened for modification	C:\Windows\SysWOW64\Lllcen32.exe	Lingibiq.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Fchddejl.exe	Fkalchij.exe
File opened for modification	C:\Windows\SysWOW64\Jianff32.exe	Jefbfgig.exe
File created	C:\Windows\SysWOW64\Ojjolnaq.exe	Oncofm32.exe
File created	C:\Windows\SysWOW64\Ljbncc32.dll	Acqimo32.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Gblngpbd.exe	Gfembo32.exe
File created	C:\Windows\SysWOW64\Migjoaaf.exe	Melnob32.exe
File created	C:\Windows\SysWOW64\Fjbodfcj.dll	Accfbokl.exe
File created	C:\Windows\SysWOW64\Hfifmnij.exe	Hckjacjg.exe
File created	C:\Windows\SysWOW64\Hppdbdbc.dll	Ogpmjb32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Ibnccmbo.exe	Ippggbck.exe
File created	C:\Windows\SysWOW64\Aceghl32.dll	Kikame32.exe
File created	C:\Windows\SysWOW64\Cnkfcl32.dll	Gmjlcj32.exe
File created	C:\Windows\SysWOW64\Mpjlklok.exe	Mlopkm32.exe
File created	C:\Windows\SysWOW64\Mnkhmbin.dll	Miemjaci.exe
File opened for modification	C:\Windows\SysWOW64\Jbjcolha.exe	Jplfcpin.exe
File opened for modification	C:\Windows\SysWOW64\Jfeopj32.exe	Jbjcolha.exe
File created	C:\Windows\SysWOW64\Onjegled.exe	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Okokppbk.dll	Kmncnb32.exe
File created	C:\Windows\SysWOW64\Kdgljmcd.exe	Klqcioba.exe
File opened for modification	C:\Windows\SysWOW64\Mmnldp32.exe	Mibpda32.exe
File opened for modification	C:\Windows\SysWOW64\Ffgqqaip.exe	Fchddejl.exe
File created	C:\Windows\SysWOW64\Nnjlpo32.exe	Njnpppkn.exe
File created	C:\Windows\SysWOW64\Oddmdf32.exe	Olmeci32.exe
File created	C:\Windows\SysWOW64\Phkjck32.dll	Lllcen32.exe
File opened for modification	C:\Windows\SysWOW64\Fchddejl.exe	Fkalchij.exe
File opened for modification	C:\Windows\SysWOW64\Gblngpbd.exe	Gfembo32.exe
File created	C:\Windows\SysWOW64\Jbjcolha.exe	Jplfcpin.exe
File created	C:\Windows\SysWOW64\Megdccmb.exe	Mchhggno.exe
File created	C:\Windows\SysWOW64\Ajfhnjhq.exe	Agglboim.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Gdqgmmjb.exe	Gcojed32.exe
File opened for modification	C:\Windows\SysWOW64\Pcppfaka.exe	Pncgmkmj.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Heomgj32.dll	c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28.exe
File opened for modification	C:\Windows\SysWOW64\Hflcbngh.exe	Hobkfd32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8204	4400	WerFault.exe	350

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfaedkdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klngdpdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmgfda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffimfqgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcojed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdeoemeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncfdie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foabofnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlopkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibcmom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfjhkjle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lllcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnjlpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fckajehi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmcojh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfqlnm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imfdff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jplfcpin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olcbmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hopnqdan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hijooifk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcllonma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mplhql32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkkhqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbdolh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odkjng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mipcob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffddka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icifbang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeklag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oddmdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkalchij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Himldi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ippggbck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdqejn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlaegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jifhaenk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpeiioac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leihbeib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdmnlj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieolehop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpqiemge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbabgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmppcbjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lphoelqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mibpda32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpbmco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phkjck32.dll"	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icfpbq32.dll"	Flqimk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mchhggno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafdhogo.dll"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfqlnm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffimfqgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcinbcgc.dll"	Ifefimom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjgaigfg.dll"	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odqjbebh.dll"	Hmcojh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfeopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbaipkbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mibpda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghkebndc.dll"	Hfnphn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hodgkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejnjpohk.dll"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anogiicl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggacefk.dll"	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Glhonj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmcdaagm.dll"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfqlnm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kedoge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmnoof32.dll"	Gfembo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gblngpbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mchhggno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkalchij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmpmkplp.dll"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ognpebpj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 4864	736	c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28.exe	84
PID 736 wrote to memory of 4864	736	c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28.exe	84
PID 736 wrote to memory of 4864	736	c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28.exe	84
PID 4864 wrote to memory of 4724	4864	Ffddka32.exe	85
PID 4864 wrote to memory of 4724	4864	Ffddka32.exe	85
PID 4864 wrote to memory of 4724	4864	Ffddka32.exe	85
PID 4724 wrote to memory of 3004	4724	Fdgdgnbm.exe	86
PID 4724 wrote to memory of 3004	4724	Fdgdgnbm.exe	86
PID 4724 wrote to memory of 3004	4724	Fdgdgnbm.exe	86
PID 3004 wrote to memory of 2484	3004	Fkalchij.exe	87
PID 3004 wrote to memory of 2484	3004	Fkalchij.exe	87
PID 3004 wrote to memory of 2484	3004	Fkalchij.exe	87
PID 2484 wrote to memory of 1004	2484	Fchddejl.exe	88
PID 2484 wrote to memory of 1004	2484	Fchddejl.exe	88
PID 2484 wrote to memory of 1004	2484	Fchddejl.exe	88
PID 1004 wrote to memory of 2952	1004	Ffgqqaip.exe	89
PID 1004 wrote to memory of 2952	1004	Ffgqqaip.exe	89
PID 1004 wrote to memory of 2952	1004	Ffgqqaip.exe	89
PID 2952 wrote to memory of 1284	2952	Flqimk32.exe	90
PID 2952 wrote to memory of 1284	2952	Flqimk32.exe	90
PID 2952 wrote to memory of 1284	2952	Flqimk32.exe	90
PID 1284 wrote to memory of 3692	1284	Fckajehi.exe	91
PID 1284 wrote to memory of 3692	1284	Fckajehi.exe	91
PID 1284 wrote to memory of 3692	1284	Fckajehi.exe	91
PID 3692 wrote to memory of 3020	3692	Ffimfqgm.exe	92
PID 3692 wrote to memory of 3020	3692	Ffimfqgm.exe	92
PID 3692 wrote to memory of 3020	3692	Ffimfqgm.exe	92
PID 3020 wrote to memory of 4396	3020	Flceckoj.exe	93
PID 3020 wrote to memory of 4396	3020	Flceckoj.exe	93
PID 3020 wrote to memory of 4396	3020	Flceckoj.exe	93
PID 4396 wrote to memory of 2392	4396	Foabofnn.exe	95
PID 4396 wrote to memory of 2392	4396	Foabofnn.exe	95
PID 4396 wrote to memory of 2392	4396	Foabofnn.exe	95
PID 2392 wrote to memory of 2240	2392	Ffkjlp32.exe	96
PID 2392 wrote to memory of 2240	2392	Ffkjlp32.exe	96
PID 2392 wrote to memory of 2240	2392	Ffkjlp32.exe	96
PID 2240 wrote to memory of 4936	2240	Fdnjgmle.exe	98
PID 2240 wrote to memory of 4936	2240	Fdnjgmle.exe	98
PID 2240 wrote to memory of 4936	2240	Fdnjgmle.exe	98
PID 4936 wrote to memory of 456	4936	Gcojed32.exe	99
PID 4936 wrote to memory of 456	4936	Gcojed32.exe	99
PID 4936 wrote to memory of 456	4936	Gcojed32.exe	99
PID 456 wrote to memory of 964	456	Gdqgmmjb.exe	100
PID 456 wrote to memory of 964	456	Gdqgmmjb.exe	100
PID 456 wrote to memory of 964	456	Gdqgmmjb.exe	100
PID 964 wrote to memory of 4464	964	Glhonj32.exe	101
PID 964 wrote to memory of 4464	964	Glhonj32.exe	101
PID 964 wrote to memory of 4464	964	Glhonj32.exe	101
PID 4464 wrote to memory of 4712	4464	Gcagkdba.exe	103
PID 4464 wrote to memory of 4712	4464	Gcagkdba.exe	103
PID 4464 wrote to memory of 4712	4464	Gcagkdba.exe	103
PID 4712 wrote to memory of 2992	4712	Gfpcgpae.exe	104
PID 4712 wrote to memory of 2992	4712	Gfpcgpae.exe	104
PID 4712 wrote to memory of 2992	4712	Gfpcgpae.exe	104
PID 2992 wrote to memory of 3936	2992	Gmjlcj32.exe	105
PID 2992 wrote to memory of 3936	2992	Gmjlcj32.exe	105
PID 2992 wrote to memory of 3936	2992	Gmjlcj32.exe	105
PID 3936 wrote to memory of 2684	3936	Gohhpe32.exe	106
PID 3936 wrote to memory of 2684	3936	Gohhpe32.exe	106
PID 3936 wrote to memory of 2684	3936	Gohhpe32.exe	106
PID 2684 wrote to memory of 428	2684	Gbgdlq32.exe	107
PID 2684 wrote to memory of 428	2684	Gbgdlq32.exe	107
PID 2684 wrote to memory of 428	2684	Gbgdlq32.exe	107
PID 428 wrote to memory of 3152	428	Gdeqhl32.exe	108

C:\Users\Admin\AppData\Local\Temp\c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28.exe
"C:\Users\Admin\AppData\Local\Temp\c94cfc3c2ed4caec704e768c0067e3c6a2fa0dc87449b20c4cb2f71439d74f28.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\Ffddka32.exe
  C:\Windows\system32\Ffddka32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\Fdgdgnbm.exe
    C:\Windows\system32\Fdgdgnbm.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\SysWOW64\Fkalchij.exe
      C:\Windows\system32\Fkalchij.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        23⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1288
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        28⤵
        Executes dropped EXE
        
        PID:1152
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        31⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4048
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        34⤵
        Executes dropped EXE
        
        PID:5004
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:464
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        36⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:216
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        42⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:920
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2900
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        46⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        47⤵
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        48⤵
        Executes dropped EXE
        
        PID:2288
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        49⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        51⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        52⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        53⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4892
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1320
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3524
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        59⤵
        Executes dropped EXE
        
        PID:1028
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3876
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:724
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:640
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4488
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:860
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        67⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4684
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        69⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        70⤵
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        71⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        72⤵
        Drops file in System32 directory
        
        PID:716
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        73⤵
        
        PID:668
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        75⤵
        Drops file in System32 directory
        
        PID:756
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        76⤵
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2504
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        78⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4920
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        83⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        84⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        85⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        89⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5472
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        92⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        93⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        94⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        95⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        96⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        98⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        99⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        101⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        102⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        106⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        107⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        109⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        110⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        111⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        114⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        116⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        118⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        119⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        120⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        123⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        127⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        128⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        129⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        131⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        133⤵
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        134⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        135⤵
        Drops file in System32 directory
        
        PID:6172
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        137⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        138⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        140⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        141⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6524
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        144⤵
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        145⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        146⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        147⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6832
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        151⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        153⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        154⤵
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        155⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        156⤵
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        157⤵
        Drops file in System32 directory
        
        PID:6160
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        158⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        159⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        160⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        161⤵
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        165⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        166⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        168⤵
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7036
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        170⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        171⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6248
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        173⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        174⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        175⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        178⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        179⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        180⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        181⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        182⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        183⤵
        Drops file in System32 directory
        
        PID:6644
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        184⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:7024
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6272
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        187⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        188⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        189⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        190⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        193⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        194⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        195⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        196⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        198⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7348
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        200⤵
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        201⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7448
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7504
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7564
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        204⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7652
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7696
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7732
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        209⤵
        Modifies registry class
        
        PID:7828
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        210⤵
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7908
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        212⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        213⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        214⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        215⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        216⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8176
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        218⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        219⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        220⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        221⤵
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        222⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        223⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        224⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        225⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7780
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        228⤵
        Drops file in System32 directory
        
        PID:2896
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        229⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        230⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        231⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        233⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        234⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        235⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        236⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        237⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        238⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        239⤵
        Modifies registry class
        
        PID:7712
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        240⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        241⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        242⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        243⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        244⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6940
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7316
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        247⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        248⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7896
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:3752
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8052
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        252⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        253⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7552
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        254⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        255⤵
        Modifies registry class
        
        PID:832
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        256⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        257⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        258⤵
        Drops file in System32 directory
        
        PID:1660
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        259⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 396
        261⤵
        Program crash
        
        PID:8204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4400 -ip 4400
1⤵
PID:8020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acqimo32.exe

Filesize
79KB

MD5
dcdea30c2f4ca598c4ce9421b37e1160

SHA1
89f0556b7274de258a865609de0ffc0d153e3689

SHA256
6c7ce594b1a7f17c8ab934ad88037a165d4b6032d12f2fb36841dec34fdc3131

SHA512
6d608bf5f841eea6340f2c6028bab2a4521b6cb68b67dbfe576ede0fd798db3e2a8f678baa47fa4d9dfeb58ee1dbb4c013657e9e60c14fc0e7c181ff4e200956

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
79KB

MD5
f84f3f735a0ba5b626e9199bd28375ff

SHA1
fce7892583afee2eba177fa2c023603bcf04951b

SHA256
e024b20ddc2be6c753f8eab80bca8d0b485412e8ba47850090716c4245359f37

SHA512
b26543c94929a56f4225edd15b8948f389cf55de59c274249eaad59967b2dc15b9efad931aee2e127b5f6c92fde47f539a7c808ee2f67cebc21acf9716bc2737

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
79KB

MD5
fcbdaa1a0ad604260185b13b83849349

SHA1
35c5cf9122b2af8467cfb72575384fd78c1fd3d6

SHA256
35ef7fcb22b79f096d1752a6235cae73f620808dd4031d79594031347983e7c2

SHA512
7997281d2802f4f2082076e828f7b2debf76467a270a9c90c817f0ec2aa10f82deb49409b2603be1906ec8fe27263bb4fa089806c8fa94dc3c3fa4df736575a8

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
79KB

MD5
d42555b220188f0c7f39df18ba885e1b

SHA1
fdfc0125d3419297b5de072f1c9cbc3c5a5b6f26

SHA256
ed250695e952e46d472719d671f650dfa9aacf6ba89184ee8b36096118e36a71

SHA512
f21820111583ce038d2a5e08319a7f67b7bc4eed7d11e22090caa36720b666782e713bbb6ba5a16199241f7e47b0e812c31c992389138ed934f5a01cccb3db30

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
79KB

MD5
3fba0bdfaa3e251a9fc6ddb10e85d08d

SHA1
d045ab6485e80198c687f2e40ca454b907a2d20b

SHA256
a2f12070dbd578a1b3e56b99f35292451411e1ee553a91d5d8b505ed50ab7996

SHA512
09c9c3807d4c85203142c9d74550e3111bf001efe6eaaf08c4ac52880515d0de1cdfea828e7af93b49b8262af2a6a3c847056816b78763c608c6f4e2e0e1990c

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
79KB

MD5
81b19aaad1daabedb6b52cf3076b0645

SHA1
c26b6e5098f819b060b3337d33e4f108e9f8bbd0

SHA256
64074237559f9f0cb384e8b425d905c8a71a053ee499bc169fdb38318b263a3e

SHA512
8fbed89c8cccaf0c12cd22d135931a3eb485ef2a7f2095b65436a3b532b1c4bcbf7dfcf9ad5c77c98430afa91d7a90dec9f4596022ed038957282cd19e8fab82

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
79KB

MD5
adaa9f77a4a80a4dd1bc1a84a575ff40

SHA1
a05d3c0738370f0e3d859544e8e8d2507fffa4e0

SHA256
60e32b5bc8d0a791ba18c089180721387929a3e65a514aa230b3dc24023fc771

SHA512
b9043b933a6768759a402e5718df0bec5dde5f6243c4110c8610f0eae7ab9c5903a1c89266374d6bc8de961c717b0d4e68101e68af99df400895c42879b36981

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
79KB

MD5
826bf4582514aac2b407262586a88326

SHA1
58c1bb43073a932324a23c60f3350ef1bf7b5fd9

SHA256
d88e754c9f31068b3bf258fcad6f32fa3abac4e5b1ae71046ecb12fec1515887

SHA512
9b7585378403824b80553263f3721f2bbe0aceaa0cb7657f46582d9db768f378d76a507ea15788b87cc703878fb1cdd4e37131382fe7bf3bcf2c77894e87f65b

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
79KB

MD5
8dddcd1f258b9181c95faf57add791f7

SHA1
202ee1cb18652f615df202260d212cc43c7f9b82

SHA256
91d0782e1f7bf7263fd1751b4536b07a0d3caa79d6155c251d861e815c4adc0c

SHA512
00dd68bf807d39a3bc2441855baf57773f109c87dd08eeb83cbee8f0a65d2189905be72fd220d7f1a4008c163fb8c613e1cb1944bcfbf91c41c44a71027ff6c6

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
64KB

MD5
fe6c9b55d3be775c2995634c820462bf

SHA1
1dcc851b8d5b7617e60e0a44e27b9a26918131cd

SHA256
be2cbd315ebe8cd1d8cd783f2efbde09ba2f332251969c07a211716a6803f3b2

SHA512
3ba696f79d9d2b2d4295196d45d8da942fd90b1c17d6170b911273469838acd6160c2b34ef8c3e02a3f595cc9092eaf6c667f5dac66c6d72797e098e1443672d

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
79KB

MD5
de078419425e86c27421c460c6115367

SHA1
ce6450e7ca05ed4496d6475017431ebb3f5c88b6

SHA256
697a57c0f329c9b80eaff03bcee28ded41980a57f8d5abc126aabf43e523f864

SHA512
feb0bf050993d314017fe1979ae506442a6b23736fd024a923ab57a01e34e24aa983e935f96137f1986a3f51b478fc3deff664b039050fa819eb2a1001e3554b

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
79KB

MD5
94868c690fc03d09d41a058d6ac89076

SHA1
7342a768c07b41cd39a8916f5ba695b0373710dc

SHA256
40fb738647cc1ee8930af76a4d0fdd35a89653532ce2fcfa20c2cd7e6576c341

SHA512
36befadae411020882ce1262c9ee9144a7a84e181ded236c64435434a136e6376c9b269c721b33204cdc65ce52243f30ee63f96018f39c5396ab7f67a2a442e3

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
79KB

MD5
3c06dc8fc169281b4d42cdd5c4f694aa

SHA1
8406025c87a10f6f98010893ef9361bd619430c2

SHA256
9e85d8f56c1d881866e4a81083e8c9df11c1dc2adbd563166ff29daea2932253

SHA512
e9f94da0c69e1da21fcdb4ac640aaf9ab65e739f30b5ed02f69321a0d58366363d851a0a9ef9786d18e97a7dd017bbec5ad0fe2e8697c5ec2572cd127f2c4d3b

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
79KB

MD5
f70fd63025cfe287ce3d84cf1ad282a4

SHA1
60ff6611ea29917ec7171d001af663ba75c942cc

SHA256
b8b9b012cddfef4a1910d5febdb7f48f96e0543dbcd8dabd7511ea064629d378

SHA512
592309b3f9cb51cf94efbb0cfe98880e13cc2d3a92087e8c0399b9bacbf1007f3cad033af6730861416f1bb341651b9a2a54540cadeeb7029f9c241c0fcba8cf

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
79KB

MD5
ba5878c18e0690e225b4f809e3433980

SHA1
b1af78ef55b9af4542f3ea12ef584e6717638cd7

SHA256
5cd697f65bf7d77ddc9739c597c5aea34bc69caf07bd12bf9f8e6e8723acdac9

SHA512
b732c829d18648d9dd9dd0c7bac3eaf30abed26ffe8617edcd5be70934d3aac0240d0796086015fafd124a3646a92148af42b891ce31abb83775736d9b3042cd

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
79KB

MD5
9492aaa6f3bfd2a6cf86ba9f9aaad049

SHA1
72d25bc0ba9aa0b63d0366a294afaba62c7cd52f

SHA256
738ecda508b146dda0c8925cca9b3976c1f2849aa53e67c5afcb54d2d9d17b78

SHA512
e63e54dccbcfd8ad121f03bf9ee258c9b2b30c75568d0ee546a66cae9a5f870e8e8e565766ef3d74a94336563f1ee045612fc039e78a9ee154fc86a70c4c3f98

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
79KB

MD5
6f26b7a23f728bfbfb5b1c99d5a8782d

SHA1
f4804273797491e99bc655e2a8558f216a62ac8e

SHA256
281ca71532700ca59cb47ee4f30a43e475937bec15d007419161dde80a269586

SHA512
1b4e1f5a36bd955db0ad34f2178ae8c638b65b780d2817ba4004f17bcba0c73b9aa5d6603f106bd409528a26ba8e50e70156c2399b1b7cd866379a366f78eebf

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
79KB

MD5
a83f47360cdb9a3b7fb08869dc6fb44b

SHA1
10d2abf298b37348f27b51eb947ead7c8a61711a

SHA256
d814f895c86729abbae7796037be14d568970554ee850c3c823b8a00ecfc457e

SHA512
62dfaaaa385844a973637391dd7d1a384aaf030f9dccadebf67d5864c1a56f15041131f06ca41480431982b623161b04e18f36165c3f4dcdf42dbd8ba92555a9

Download Submit
C:\Windows\SysWOW64\Fckajehi.exe

Filesize
79KB

MD5
88891787e6160519f87a42f82cc54a6a

SHA1
f999f53d55281738ecca85ca3e2862e7b622ddde

SHA256
a7f8966e695d9bbb7ad11a3d408adafd1eaf2b5f843d7218dca31b6ac4362da6

SHA512
dd050fbb5d8682fae1f80a5a31ea430c8ec3065528cda275b6252906cde04427780ab419c9720ec11b9412cd5192d3a26bfa3075dce1fc0ece3124fcaca5bbbe

Download Submit
C:\Windows\SysWOW64\Fdgdgnbm.exe

Filesize
79KB

MD5
b0891db3be992c87fbac0fe126b8c4aa

SHA1
7f0b065f4bcc9a4f5463d72f7e0e2ed081b5f975

SHA256
379cbf1a9ffa935146300ccc064335424e87f064ec790d659a4d881a2da69627

SHA512
44bc2a14cfb6024760d15b6a1a28304a52fbc73144e3cca95f3f4215b9ae2729317764c63636ce83323c260b38387a6af1de808161744996ceeb68017ca17887

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
79KB

MD5
4c94d21566932953cea1d1441ee0fcd6

SHA1
8423b8a7f90274f270cb5d4e8b0f68d8598f54ed

SHA256
47fc196a7a31d8bb8c1177cc22305476b0f2600bd662aa9a353df54ae3c96c29

SHA512
e827e5fddb4d1c19c46b5c321e2dde4119329e7d392af5b1b692bb57b57237b3988b966ae199947936a6194e88eaf5a81e092df9b40daa2d1c25109efab6af48

Download Submit
C:\Windows\SysWOW64\Ffddka32.exe

Filesize
79KB

MD5
3196292fdf04e69521a85c0655e42eb6

SHA1
0fb512c9f107c8fc620a18d1dfb631559874472e

SHA256
9fffa653e92ad204b44cd6d7a6e23a993c6afe88ef714f0a2e53497c922ab26f

SHA512
8e8689c3e7e99c6ffda1568acb833efe038272d32c1a9335b6b4d34724c48a1efaa21e4c67eb8559d9fa5b6c3c3044a801eb5c0e06569b5ee729f76c907f4c3b

Download Submit
C:\Windows\SysWOW64\Ffgqqaip.exe

Filesize
79KB

MD5
d6965cc1fb05fb68e05e9ebbb5830bc4

SHA1
66192ac9e70ad1607f9acfe04c7151b026a34225

SHA256
a39a61e766c4a8b86b894f8c9072ac3085863aa9e968708282a7142998547dfc

SHA512
6bcd90dde3f70d5361ba638655cab3535ec29da673986d04ef52f4d8153d2525a46ca86d9da1510b1b8d2547d9318e6d052c6072e3da63c62db1d214e582085a

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
79KB

MD5
9e86d8cc742589de7e104c556bba624b

SHA1
84801187e714bb8069ed6544183c6b86b66becc3

SHA256
ef442174230417fa40d6512a58e6f4536234fc024499528fda62cd47a8e4441f

SHA512
ecd13c2a06095016a5c13c577409344ce275b684f4e0e12d33bf627b93efc655787100ce806ed862c3965cb84adde1c0b9ce0a50bf21dbe7217a6bc30382b0d9

Download Submit
C:\Windows\SysWOW64\Ffkjlp32.exe

Filesize
79KB

MD5
fc1d86afbae2dfe6715e30bdec70a87c

SHA1
13264bad7fd70d695d164b517148814498e1f140

SHA256
0f891860432d0711dfe89c94c1caee470fa79ba6c3dd9f7bab57402396de056c

SHA512
e8ddf8e45b395f1efe4ad33d39ed91d8e36e24b9e77fc8fa3b0480db5c10e6cdad1bd1e7fd6108a31fcd38430c7347255ea4db88505cbbf7ba69735437e899dd

Download Submit
C:\Windows\SysWOW64\Fkalchij.exe

Filesize
79KB

MD5
ad954ea821acffe3f6155c923781691d

SHA1
db6b888b94862fca0f4782a4aca7c0d3264e8fe2

SHA256
514cffb2aaa1715eb5615fa19ff6d94716fe5338f8d8c3d7d42a1c770acfe8fb

SHA512
5ebd61d0f869bac1392141ff99f7dc390036479c567e22b20382e98f6dcba7a014827b4309e1e4e2bdbd7ff2dd2b3c6f180fd3c18371fc8c50874bc6d64db3f0

Download Submit
C:\Windows\SysWOW64\Flceckoj.exe

Filesize
79KB

MD5
41be9d6ac2c5031272e69cbecef7dc26

SHA1
ed51d6773a98894e1daf6ded57fea9df6fd4cf1d

SHA256
21db466f1d7a884914062b0a64c6a05ecf11a57260870f09874312b090849d85

SHA512
5d161998fc0adbd83f795490cde92718d96d1a45e8cc507ff9003cc054a025c4e31b122a0739e2d2cbbdcca7791098f4f98478fc766594eaa84e41e6a5680dcb

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
79KB

MD5
425e27a7e63dd6d5ea776ddab56e6770

SHA1
8e749101aea20dfd43b19c1ec6832fcc6d97115e

SHA256
63dcd6b06afb3e79a82e963be9104040aec1ec3e369a2a0f2dfa090591155716

SHA512
7e8096d3e5ed95ff6e1ef866c8bbc69596786014b8c1c1a478469dad93648db9917c9c940a53d543786db1fe600bdc782b8b8b88d48fc70bf6245fce7c559d56

Download Submit
C:\Windows\SysWOW64\Foabofnn.exe

Filesize
79KB

MD5
9dd44c475064322a88b7047ce14c9204

SHA1
f4a6774be31d8438448d7385d947fa666b8a9b96

SHA256
111d35b15a4b25567a4135a53f9b924c3b176a7b99bb2344aad7d03c4de22efd

SHA512
3871119924607c8795f3c8c6d69f4fce6950a4328b75b477ede49678232a9114f5bbcac27e70464a692bc5c573e2bebd1ac59fb86c1e4b9d5cfb5f68f0bb4500

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
79KB

MD5
9314428a69ad523d29265fd6099ba022

SHA1
737aa2cf213efb200f25b698c969d2254ebe348b

SHA256
f4442e84f869233586150032731d9d4806dfb0f64b5bce9172714584b83fb762

SHA512
60b318294dff68a2eacbf2c85c8c864fb93562c78879fdf68f76a807c3eb380d5928235ba393bbf547318d47f0d2aeea039a733a0fd0b5d6c3821c957a24f609

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
79KB

MD5
74566936a25f75e2dfa8e724528de4ed

SHA1
a723396f5b6e39486d73516d849fb567104baa01

SHA256
a7c1eb4b4a87c981dd101c26c0c69f44ec490279419bc8e57cef887b24b2b500

SHA512
33ed50e1c60605d102a8d1086d0645e96cf86b8da37bcdc98a22c0ae5c7f46a48d0ef3ce2ba29b17508a4061882e68cb8761236a4e7403865e4e6938c1dfc7f9

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
79KB

MD5
67c6758688e1e09cccd367c4723a046f

SHA1
cfe2c26f1d319f4f12a1d175db728e6016246fc2

SHA256
b48dda2ab541a622e2f5a950d43875bae97056e2764622c6db7ca469834d8466

SHA512
afe02ebb97360cefc0ba3c130c7b6b0456c8f595c30b0ffad225b8e11093ee3193ab46e53a3b894c393c1e805e9f32f64fe0f63acc744e0d20a183d7f1f2ebd4

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
79KB

MD5
dcb994e1004d60183f6ddaf90dde7875

SHA1
38883b31e3328cd88fc3b4be810c579e6f3493c6

SHA256
5ecabcc3bb90390ed52174f0623bc29d2364fc9daa726accad3420a55f3468d0

SHA512
80661b88893d78256d252f666080bcaf675302aee2f7ae89504cd61c2387c307e521559c84612241944328e7d2b2a9536c0558e0a0d8cc274326dc91149734a6

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
79KB

MD5
bd1b4a51bbfc009a04da04380ff1df1b

SHA1
6ac663e7d0bb3de565811850c7bc7867bab40d6d

SHA256
f6029b23b2a9ec6f492fbdf4eebf5f970ef667b978155ff9810e0cda70edd727

SHA512
878d6f17333a692518e2f15f2fb0ae6b0e2164c389ab8a1cf720d5fec4b53b9d44ee62ea98c8ec5ca6b138046e5398687576a4a4d3e3a750a6d458ad6bf57b00

Download Submit
C:\Windows\SysWOW64\Gdjjckag.exe

Filesize
79KB

MD5
42ef8167d44c74550990c19e28650bf6

SHA1
58c8e65c8a0a49a76e92b44956fa03a4dc0a6660

SHA256
9ddacd4c2c200c393a53eb10fc6e19bf1e1c27456e13d4cf8ce0c81ead8f1ecb

SHA512
ac122cd6f36a0406f5eee0d95bb92549f8f541e4ea7435bd8a8db00306e99fef52ab7572e64cc1f815a09da41480dcb2c84515e15339ae5477aa5695f3844418

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
79KB

MD5
47fb4fb62f614f6ac811e3f4fe229e63

SHA1
9b4ebf38b32f5ca2d1ccd2adb23205d10d8cfffa

SHA256
f66bba87db9d259b663d2c3f537811101f03acdac40f4717e610bd331f4f68ce

SHA512
455d4913e116d29f136c3cbdfa314249ae2c54a00d2fa452ec36f03326dc5bf82c45506f504f81328efc53fc9ad63facb076769384ef25b75be6267dc1fffc04

Download Submit
C:\Windows\SysWOW64\Gfembo32.exe

Filesize
79KB

MD5
f5401fa6f445506adbe7dd36b7e66985

SHA1
71cfe219220125a3528c4af5caa91b8cd5529bfa

SHA256
daee48461b1d524d922bce27ce50b7988f65414482baac4903b496358a7e3cc7

SHA512
ee11c2b0267a426cffc09d64f35581b73c743e7598eb97e491b14d76d65660873e8f8bd8048f0f0447614fa0e6204097dcaae62276e5d82fa671513e960019a5

Download Submit
C:\Windows\SysWOW64\Gfpcgpae.exe

Filesize
79KB

MD5
8954bce6b2af7cb79274f882f506cb0c

SHA1
8c1ab26f1a9517451aace050e71b922385754532

SHA256
588249fabbabbd08f4de6e69ea3eb27c953da0889c0eba40ed5dcbdbcee33de2

SHA512
021d58b525f60f896ea6c01189f5f95e58e3898801205acb2fbd30f6644b81db40d7e6ed76b45c2b72e7eef064c35ca4231f75d7055efe9d6e889b3e480c84e0

Download Submit
C:\Windows\SysWOW64\Glhonj32.exe

Filesize
79KB

MD5
8f357a3cda9d0a554396418e94534a1c

SHA1
5aac443a908f010e5f789cdb6dcd66153629a73b

SHA256
5a08415446c39071248059b6d7dd150000b5618589c535124d690186c532a739

SHA512
417b5b52b434d163091cec7bc1af532a6184b4b1d3a9a9e574c00cee7accb69a719764a0811d8be39952218afb05840e25c77297074303ee3189885a3a6c2a1a

Download Submit
C:\Windows\SysWOW64\Gmjlcj32.exe

Filesize
79KB

MD5
d877a493c34d72ab92bf20771751da9b

SHA1
e97bcc76868e1812dd27561964d4ac5c0be41487

SHA256
1009d8c69c7d692d5869f1d993d23fe32a5de0550afc5198fcad92fb52801bd4

SHA512
aeaddab00b0820fbc7b2b053621ef6b2c72e227b479f1a525543062018ad5c456fde3eb1d75bbf98fad96fb199b0eaa25917df9bc3bfdcb136080166d3a4a766

Download Submit
C:\Windows\SysWOW64\Gmlhii32.exe

Filesize
79KB

MD5
72c00ad5a105923edf5f93046711e48a

SHA1
50fa88e6666e4c1b835680b95e7fdf4439b7f189

SHA256
940d1e4add1e56981c78ec26c5d5a2e4d1757752f2fda48db640441d793262b1

SHA512
35386d497493f81ea7207201f22b9b54edf1a0a5dce58892c039a1259f5fd14e32189306fed1e9e8d8e6b9f30c1afdb85a2332b593e302a413e3e78646e073a0

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
79KB

MD5
4d52545ac6fa8102fed679636423df0d

SHA1
5e6b05007443f436a1d86ea3bbc094a811523367

SHA256
1747abb8506525189f00fba9576922b5011bb95057a06910870fda96bfb317f1

SHA512
5ca340ef3cbb730f61cc3f6d6a4e4777504565ddc3de4c47ba5e772c93b7ebcaf4c62dc7901f419f91baa71d6fb292d9275ed4afc0269e50787644f845d81d4d

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
79KB

MD5
db0b272b57dc14444f709fb3c44d1f44

SHA1
94a51eefc8b0674655794eebcf39af47d552e9aa

SHA256
3bb76f002f66e90c30e9edc5f7d36739555a277182bde798914d04c41c32b27d

SHA512
98ee6a35b879926cbc124c8cebb2cb61304f6db0f34ec0041e1b2bd0b9c83e48e41bfe780fac04db453d26b3c387b6099422f6285d1e4ff84a50e0c8d7b9c29f

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
79KB

MD5
480bfb03fbd184662df8597c41499c5e

SHA1
80776e8e091fb15f811f8b271badd2d97fcdd86a

SHA256
b75a796ae8a0f079343757b79461f615d4e12f1c602efbbb45fadb1abfe136c9

SHA512
b1f8a00b2c21872cdaa719932c90fe97439e084cde83c306c9a1a197b7b8620837f6ebfaefc1348f087e50448e0a9c50471bf333750bc0b1d1663f8a9c393754

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
79KB

MD5
356b2074de0ab7867f90bdd59325f2d8

SHA1
e540827cc5d2c87a8cfeb74c1b18b2571a074f52

SHA256
b627fc6742b62e2c0ab1f44812a88b585a4cb1a8e336d16e8f067c25b3d81c98

SHA512
c3e23cafc3aa51c0f24ab32ee767419bd8bdda9bad14a8181d3be8e9ec6241b9d889c4dc205ddf17af9de96791c81edac3dfa75742cded81ed4cb5165dd32c71

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
79KB

MD5
cba00a821324cb65c8cdc3ef54425bcf

SHA1
0978eab518624745a77a76a0adb65106131fa37c

SHA256
3839573017e9316bdade9fbac4245f952fcd94e9388d0dfb0466fb12bdefff28

SHA512
53b8e87cdeed9bcc478d51986d729b63e10f9787740fd2898e4be9c7632b33bb2766d9d6356966f749d9b8d9b1c14d42b26026c3bbbc4550269cbd82839ec7a6

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
79KB

MD5
5054f9d4aba2938783b0d26c1edfc395

SHA1
d7029cf5acafb4be7af997810dd069f63cbfd542

SHA256
b87efb316e482b92d731f2a46414398410066afec46ff4875da1eafc0e100ec2

SHA512
fb65e0a29b356425df12e34a9ac929896d300fa64b58f839588cfd89ba28e6806dd99dcab9234ce33693c0f96b28cf0c7962ce86f27b628172957948b8ada6cc

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
79KB

MD5
abc47a399c331b6c7149cd49ae20c961

SHA1
4d00906b20cf07be623ba87c771de1f72a7af472

SHA256
ce2e5d643ccfc3a99f99265b6e43c27764a20e440d11ac984b2a7ecd71e20123

SHA512
f0026cb4a1c172b3ca19996a8dc62d4c8f838ad3ae9bfdad8e209487737253e2dfe01d8c1b3d525f98882426a38b229a753232d525636dc6fafa633c018929b3

Download Submit
C:\Windows\SysWOW64\Hopnqdan.exe

Filesize
79KB

MD5
cc01675055150f58b959d3630396c40c

SHA1
625e833a095a64709a81750af85340acebe0af27

SHA256
17bd85085a8695abfd7a61aa589aadf96f39dcf3230d13f5424df57b1f3d922d

SHA512
e7d12d2328f97278602160a8556f1e934898b0610b99d223fd22810f42fc5ec4466c57bdb9297ba27bfa3ee774215554d70e858036853b2dd3cab2fcfb71d6e1

Download Submit
C:\Windows\SysWOW64\Ilghlc32.exe

Filesize
79KB

MD5
d1016c7ec5b2251afa2bf5e3471892bf

SHA1
931a5abdb5ca0842d5dd5bc8b15e7c9375d59819

SHA256
d08d78ce509a0853076ceb33d3ef95cbf40c99577c83b4a996abb75cdc97e697

SHA512
a2c05e779396bf6f94466864a467954dd9082cccbaaaf4c02e6c2261acca22f17de5afda86eed13e6c708cd86c2ce2ca271321c5ad1091543411834d41ebc64d

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
79KB

MD5
2777dd8d812690467d078ae03252c7aa

SHA1
bba785209e279feab59d9dfcadefe864b0bcaf2f

SHA256
7e1f6bd34ca8338e92aed125d06be169d2c5e1bc63aed5c2c17f508c4f895f81

SHA512
4a3db106eca5e8ab99b66d81a4056db1e50f55fe88cbdab0364300ab0cc7146a54da4a278b5b6de620c5981cfd825dd1a1c7c489a280594ebeeceabdb9aec2f4

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
79KB

MD5
a57fbbff2c6e34acb9ff0439c962403a

SHA1
89c65391fdc7eb5687b040d5985d75dd91edb189

SHA256
8af83cc7e68dd866375b8ed0083d46e0ff45c2c6f3629a2a1a47d59d8f7bfe46

SHA512
9daa048a2ece5b763fbfa3614393592b99287ae431e616248827accd5adb647a45a17ab11bc7ca337922b52dd03af7b8b0bf2ad314e70b20e9345d057defb166

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
79KB

MD5
03b8ae8393982ec7c63eac7204a0bfd2

SHA1
3e14b3d194582ca7f9a34ea29fa4d83d536c6a52

SHA256
a96b183732a2f8139cbe4fc8b20839ac77832f293229fd991535c209b6b31f70

SHA512
31bb68b86438d1a7effa3110c4a9a76fc3ffce0d03cdba14fd1f8ef47e6dbc091d1acc4f35bdad559e28633cd58792126c66bd63b65aafbbfb9e506f2c945971

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
79KB

MD5
6db733c3cc335ae5542a54507f663093

SHA1
dc438b0485154a43eac2e678201c0c98fe7fffa6

SHA256
c09d460a289ed9b1db51e9528cb850038f3225f3a90cd96ad2c79817028a2882

SHA512
d39f35dde9000c4703863f2c896ff0dda9eb324d56dfccb5448a07ada926283f32a8430add985c83690ddc3e17510d66e3cb1b52df54044fa88c435079311fbe

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
79KB

MD5
3a79926ae60839be658f43f684de732b

SHA1
9022f9a7816c83fa358041d78aa9979343694ae1

SHA256
09c3f24911a700e72a28f7176737fecb8015e0853e237420246e4f8379f55384

SHA512
6f1eeaa97fa350e475f650c84f2c6eee3c690d22e7fd834d79f882e6e71d73f1fdba9e7385e96295a2f696bc84e09ea64674f76d2b81ae4eb125af791b1cc817

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
79KB

MD5
9397e78f2d9b579c4e92ab578ef9d1a8

SHA1
8057da2ccbef3ab917c3199c89bcf6dd95df065a

SHA256
161da7820cf0e9591fd8a87630de2bae5806a1beb8a3ee64becbab9d5f1623f5

SHA512
2dcd3406c50b7e56490b2c3b464fb752b967dbb4b07ba62ec73c410271080c49700332aafd198f89d306f66f1a6eaab7f9001d70dc1e71c0cc569008e9eaaf01

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
79KB

MD5
7043e7d4d650c8e1f4a8c11e7f191202

SHA1
e89a2f07be00be6087c64cae7787fb3aee2285e9

SHA256
122f8e947695b65e59ecf82bdc2e6c8a406df55778e5f47cc6e1ceb4566297a6

SHA512
040984eed16c6eb257fa1ae9b63f6efd5ed7f9d1e6c596873731ece21a276ac956c5dc9abb7ffa38f577d30b12bc6d7d3fecc971d6895c302c6410f538e8d3d3

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
79KB

MD5
04e0a90ca2dea9051db3aef20c24b106

SHA1
e2145ea71079bb0e9e5bf8c265233c4cb1136063

SHA256
dc1b6acbec0dea473cd98aa0fee4fda68c42d00679e37c76bb462ed5511af0b7

SHA512
131c8351023cec5b310b239227fd76f5ccb3c64a0ff9fa14e5822acdc2ac3187f45752642a045d91bc3f2e07cbda62db3183b0dd76ed3660148056e64b33ad04

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
79KB

MD5
d70037875b7a55d6b012c4b0a267520f

SHA1
f6daf00c20ca9fa24cad91d463df28584078ef6e

SHA256
ebe874e62808c2a77d755bb3c1ca2702bc50928fe79062cfd0f9b953c2886780

SHA512
3c9ddb40276e465c35490aeb57cb7ac6a80a6808fed02416275a669f1603e87a9a35dfe5aaedabb6583728ea81c24dfb618e9af1dd536973c4ac3d5cc8b71a0e

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
79KB

MD5
3e54bb2319d32b339ac22e7cdc856d56

SHA1
c96c6384f56d005c84d521295d7672be1ee0b342

SHA256
2b287a4b8015aba0b27293b1a3b885e55c425b31a363430bbab97f6cc7e4d648

SHA512
3f6efacba6af2080c2848b1218d08577ab56f3a1aa76e7f112d2060fd28ae784da982ddbd604b3ca75637ff42ba2bdf2564cb21909b31add9c28a5c4349f2a8c

Download Submit
C:\Windows\SysWOW64\Pfolbmje.exe

Filesize
79KB

MD5
9088ce0e15186f36bb06c21370e18be5

SHA1
e25a7bfaee5bd3d71a5a0f9bf6ad777f34da4d85

SHA256
5bc9cd1b75e59863cc1333069755b4d4b5c533f0af1b3b3a4b4f30647767854d

SHA512
cb7d6eeff0bf940c048b15fccf9ecae1d2e2dfd3b8280e4fa6061cb4d8834575b9218358a83be912cab9ec731f98ad9441583a3fcc137a39d1e85155dae533a9

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
79KB

MD5
ca3d8f4c8b5480c8318416a634b29065

SHA1
8b627f0fd661292a104bff9131f028cc3b8960d2

SHA256
e1b01a3ba61e4435f5554c28e4d11a82a08b60c97a1b5bbf32ab2c0cd8bca18f

SHA512
6a09488ea9d1d0494b734883801f4a97dd2f6c3506abd035719d471ca555e226b7b65a70b87ba5847d0e4769981ba4313384dfd6429c52335830dac2ea174465

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
79KB

MD5
38eff10108429214f4452da973c81f28

SHA1
97991eb244b7bd00b8cd5ecdb8ea84ac85152339

SHA256
98fe4b88e54e370e8fb8301bbfc6735704893a96edf559dc786d9749a63f262e

SHA512
c6d4c509d91cbc5a9b0d91557c07822422b30a613f1fea8d648c275e89307a9ff308cdf41a63f463d0e2ba7390494fc363a79b73b946a619321cc03087b52ec0

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
79KB

MD5
98fdf010c41624badbfbe827420231d3

SHA1
7324e0a142f35d16ecf3f53b12d3c5dd47319424

SHA256
82e9cba507fff18fa30cc5f2c341af9e9cdaa0753031bb7bb015ec9823efb767

SHA512
bf93d1dd200bd196947b3c0f0584c8206cb9cd88d71744153a2690e4705c62b854a9fab52460343798956c6827ca6ec1553e7bdae96c15384343ae7beea53913

Download Submit
memory/216-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/428-168-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/456-113-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/464-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/548-503-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/628-527-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/640-437-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/668-497-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/716-496-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/724-431-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/736-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/736-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/736-539-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/756-509-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/860-455-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/920-323-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/964-120-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1004-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1004-580-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1028-413-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1152-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1284-594-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1284-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1288-209-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1320-401-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1708-515-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1860-533-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1940-335-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2028-557-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2052-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2228-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2240-97-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2288-351-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2364-341-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2392-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2484-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2484-573-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2504-521-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-160-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2900-329-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2952-587-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2952-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2992-145-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3004-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3004-566-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3020-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3152-177-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3464-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3524-407-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3552-485-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3652-311-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3692-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3824-293-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3828-299-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3876-425-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3936-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3944-275-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4032-233-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4048-256-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4244-230-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4268-365-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4304-443-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4396-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4404-461-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4408-389-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4464-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4488-449-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4532-359-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4556-473-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4560-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4580-540-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4644-419-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4684-467-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4712-137-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4724-559-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4724-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4736-353-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4764-281-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4804-317-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4820-371-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4864-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4864-552-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4892-395-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4920-546-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4928-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4936-105-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4992-383-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5004-263-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5016-377-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5072-479-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-248-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5148-560-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5204-567-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5248-574-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5288-581-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5336-588-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads