80fb4a4836295ba8a6135b122f5e389bb5191638bc0dd540b5ec26bf3bfa784d

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80fb4a4836295ba8a6135b122f5e389bb5191638bc0dd540b5ec26bf3bfa784d.exe
Size

94KB
MD5

74f462de65176effd4f27da99a9b8046
SHA1

a20717cadad65e891178af417aa507bd59cb9c2a
SHA256

80fb4a4836295ba8a6135b122f5e389bb5191638bc0dd540b5ec26bf3bfa784d
SHA512

31b55c18b6bbf2c1d0887faf71397e44c69621ca2ca5cc627ae62b16e907211ebf09923c49f29cc4f8d7b0a5e4f63025c5d087585ebb3d7f666e2fb287acdcd3
SSDEEP

1536:gVLb6Xsj8LnhNqE2LwaIZTJ+7LhkiB0MPiKeEAgv:gVLb6Xsj8zhNiwaMU7uihJ5v

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Libgpooi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agniok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deckfkof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhidmlln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fllpegpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pddmga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkoihahd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjlldiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbhocegl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llbpbjlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngfqqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onekoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgplnmib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcgmbnnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aejfce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdbkoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajoaqfjc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncdgfaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkfhcdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mllchico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mllchico.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdqncffd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pddmga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abngmihi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Docmjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngkjlpkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopijpab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acjjibbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cknnchcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Megdfnhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgllil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjjalepf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfeobe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpnlbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Faoegofo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fadobo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfifpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifgbahhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lffhjcmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lekekp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blkdqnjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foaikdgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anedfffb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baicdncn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdoeaili.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odfqecdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocpgbodo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngmgap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddhhggdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbbphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cacmecno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Faabmodl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmgoaeeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmkndq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbhocegl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqonpdgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfcogecg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eogfeeoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Echkqcci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfjcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfonbdij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdjbpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpjlngje.exe

Executes dropped EXE 64 IoCs

pid	Process
3768	Abimaj32.exe
8	Acjjibbm.exe
5112	Alaajobo.exe
5016	Anpnfkac.exe
4540	Aejfce32.exe
1916	Ahhbpp32.exe
1840	Ajfoll32.exe
5080	Abngmihi.exe
3264	Belcidgm.exe
1516	Blfkeo32.exe
2216	Bbpcbiff.exe
3528	Bhmlkpdn.exe
620	Bbbphh32.exe
1500	Beqldd32.exe
456	Blkdqnjd.exe
628	Bbdmmh32.exe
1352	Beciic32.exe
3672	Blmafnhb.exe
4592	Bbgich32.exe
3160	Bajjodfi.exe
4564	Beefocob.exe
1520	Bhdbkonf.exe
3452	Bkbngjmj.exe
4448	Bonjhi32.exe
2984	Cehbdcmp.exe
4052	Cdjbpp32.exe
4088	Caocjd32.exe
3052	Chhkfn32.exe
2616	Ckghbi32.exe
4812	Cellpb32.exe
1628	Chkhln32.exe
1296	Ckidhi32.exe
5116	Coephhok.exe
1920	Cacmecno.exe
2064	Chmeamfk.exe
632	Cogmng32.exe
5040	Cbbiofea.exe
4576	Ceaekade.exe
1220	Chpagmdi.exe
3124	Cknnchcl.exe
4484	Dbefdfco.exe
1424	Decbqabb.exe
3512	Dlmjmkjo.exe
5024	Dolfigic.exe
3604	Dajbebhf.exe
2968	Dhdkbl32.exe
3960	Doncofgp.exe
2928	Damokbfd.exe
1664	Ddklgmeg.exe
4228	Dlbchkfj.exe
3384	Daolqa32.exe
1892	Dhidmlln.exe
1660	Dkgqigka.exe
1064	Docmjf32.exe
3944	Ddpebm32.exe
2236	Dhkackjk.exe
4304	Dkjmogio.exe
4556	Ecqepd32.exe
4664	Eacelapl.exe
408	Eeoalp32.exe
4508	Edbbhlop.exe
816	Ehnnhk32.exe
2548	Ekljdf32.exe
2020	Eogfeeoe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Belcidgm.exe	Abngmihi.exe
File created	C:\Windows\SysWOW64\Odcdpd32.exe	Nlllof32.exe
File opened for modification	C:\Windows\SysWOW64\Pmmefd32.exe	Pjnijihf.exe
File created	C:\Windows\SysWOW64\Ddpebm32.exe	Docmjf32.exe
File opened for modification	C:\Windows\SysWOW64\Hoakioje.exe	Hmcomdkb.exe
File created	C:\Windows\SysWOW64\Kpeilj32.exe	Klimllcd.exe
File created	C:\Windows\SysWOW64\Diikmo32.dll	Mllchico.exe
File created	C:\Windows\SysWOW64\Cmegcdno.dll	Nlllof32.exe
File opened for modification	C:\Windows\SysWOW64\Aefbcogf.exe	Anmjfe32.exe
File opened for modification	C:\Windows\SysWOW64\Blmafnhb.exe	Beciic32.exe
File opened for modification	C:\Windows\SysWOW64\Pcgmbnnf.exe	Pddmga32.exe
File created	C:\Windows\SysWOW64\Dnbdfk32.dll	Caebpm32.exe
File created	C:\Windows\SysWOW64\Cellpb32.exe	Ckghbi32.exe
File created	C:\Windows\SysWOW64\Eafbaqni.exe	Eogfeeoe.exe
File created	C:\Windows\SysWOW64\Idffifni.dll	Hmcomdkb.exe
File opened for modification	C:\Windows\SysWOW64\Jbcmahid.exe	Jmfdiakl.exe
File created	C:\Windows\SysWOW64\Blfkeo32.exe	Belcidgm.exe
File created	C:\Windows\SysWOW64\Gpkdonbn.dll	Dbefdfco.exe
File created	C:\Windows\SysWOW64\Deddgb32.dll	Klimllcd.exe
File opened for modification	C:\Windows\SysWOW64\Djpcnbmn.exe	Dhagbfnj.exe
File opened for modification	C:\Windows\SysWOW64\Mgokpbeh.exe	Mdqncffd.exe
File created	C:\Windows\SysWOW64\Pqfdac32.exe	Pmjhpdil.exe
File created	C:\Windows\SysWOW64\Jedhei32.dll	Cfkegd32.exe
File created	C:\Windows\SysWOW64\Bmddma32.exe	Bjfhae32.exe
File created	C:\Windows\SysWOW64\Akopddaj.dll	Anpnfkac.exe
File opened for modification	C:\Windows\SysWOW64\Elppii32.exe	Eefhmobm.exe
File opened for modification	C:\Windows\SysWOW64\Edkdnkge.exe	Eamhbp32.exe
File opened for modification	C:\Windows\SysWOW64\Foaikdgk.exe	Elbmohhg.exe
File created	C:\Windows\SysWOW64\Anplga32.dll	Ffddnm32.exe
File opened for modification	C:\Windows\SysWOW64\Lbmhod32.exe	Lpnlbi32.exe
File created	C:\Windows\SysWOW64\Fenfbena.dll	Mmkpbl32.exe
File created	C:\Windows\SysWOW64\Konjho32.dll	Ehgqoj32.exe
File opened for modification	C:\Windows\SysWOW64\Lffhjcmb.exe	Ldgkmhno.exe
File created	C:\Windows\SysWOW64\Cnopcb32.exe	Cjddbcgk.exe
File created	C:\Windows\SysWOW64\Dffdcccb.exe	Ddhhggdo.exe
File opened for modification	C:\Windows\SysWOW64\Bjhdgeai.exe	Bfmhff32.exe
File created	C:\Windows\SysWOW64\Eeoalp32.exe	Eacelapl.exe
File created	C:\Windows\SysWOW64\Hfbppkjm.exe	Hbgdol32.exe
File created	C:\Windows\SysWOW64\Mbijgo32.dll	Hbgdol32.exe
File created	C:\Windows\SysWOW64\Hcmgin32.exe	Hoakioje.exe
File created	C:\Windows\SysWOW64\Jmkndq32.exe	Jimenb32.exe
File opened for modification	C:\Windows\SysWOW64\Minglmdk.exe	Mgokpbeh.exe
File created	C:\Windows\SysWOW64\Mmkpbl32.exe	Mgageace.exe
File created	C:\Windows\SysWOW64\Ookhnoce.dll	Abimaj32.exe
File opened for modification	C:\Windows\SysWOW64\Ffddnm32.exe	Fcfhba32.exe
File created	C:\Windows\SysWOW64\Ldlehg32.exe	Lmbmlmbl.exe
File created	C:\Windows\SysWOW64\Pkpbmggk.dll	Mgokpbeh.exe
File opened for modification	C:\Windows\SysWOW64\Aebihpkl.exe	Amkagb32.exe
File created	C:\Windows\SysWOW64\Olheph32.dll	Bappnpkh.exe
File created	C:\Windows\SysWOW64\Dailkl32.exe	Djpcnbmn.exe
File created	C:\Windows\SysWOW64\Jdiaok32.dll	Chkhln32.exe
File created	C:\Windows\SysWOW64\Hdjmggnq.dll	Fbfkhn32.exe
File opened for modification	C:\Windows\SysWOW64\Jeainchg.exe	Jbcmahid.exe
File created	C:\Windows\SysWOW64\Lmijenkg.exe	Lfoaid32.exe
File created	C:\Windows\SysWOW64\Peodfhjp.dll	Bjfhae32.exe
File created	C:\Windows\SysWOW64\Dkjmogio.exe	Dhkackjk.exe
File opened for modification	C:\Windows\SysWOW64\Imekbc32.exe	Heocaf32.exe
File created	C:\Windows\SysWOW64\Bieplakc.dll	Kmadepao.exe
File created	C:\Windows\SysWOW64\Lfanod32.exe	Ldbbbh32.exe
File created	C:\Windows\SysWOW64\Lpnlbi32.exe	Llbpbjlj.exe
File created	C:\Windows\SysWOW64\Ekljdf32.exe	Ehnnhk32.exe
File created	C:\Windows\SysWOW64\Afafca32.dll	Pnoneglj.exe
File opened for modification	C:\Windows\SysWOW64\Cenakl32.exe	Cabfjmkc.exe
File opened for modification	C:\Windows\SysWOW64\Hfgjjj32.exe	Hbknjkno.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10092	10004	WerFault.exe	440

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hiqllfiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdkcgqad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcnccm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffkleae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eafbaqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heocaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdiolj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mllchico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcgopjba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fekahn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jempbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpcenhpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcabjcoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdoeaili.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdbkoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flibpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mepnfone.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgplnmib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ammnmbig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkfhcdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chehfhhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehbgcjcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoakioje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdehof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofgmml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qflpoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfhae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhimdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kianiamk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnnlgkho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgfaol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqakfdek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onekoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bappnpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekqcpfbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fccklail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnmcnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cakpjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopijpab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfoll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfanod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oloidfcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffddnm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlfhon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmbmlmbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miiman32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocmjlpfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kidkoa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Decbqabb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkjmogio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehgqoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbmaim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkffacpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icdmjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icfjpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kikappdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldbbbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgageace.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danefkqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blfkeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacmecno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cknnchcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doncofgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhia32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdnjjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhfgganp.dll"	Onekoh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aefbcogf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfmhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbdmmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Foaikdgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imajkn32.dll"	Hfifpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaccjp32.dll"	Ipmjen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fihfck32.dll"	Bmddma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elbmohhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Faabmodl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcfhba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hegmqg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kidkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncakqaqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eeoalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kikdno32.dll"	Ehnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eafbaqni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhpqdkqf.dll"	Edkdnkge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Albhmd32.dll"	Hegmqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkdbca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpcenhpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndjajeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mohioc32.dll"	Dhidmlln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chehfhhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkgfhh32.dll"	Bbgich32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doncofgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icfjpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aejfce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnaofijo.dll"	Ehbgcjcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnhblqgk.dll"	Gfngdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogkcbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfkegd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhidmlln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alaajobo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmkndq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ookhnoce.dll"	Abimaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blapfkad.dll"	Oqakfdek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocfhnnd.dll"	Aqdqbaee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Allndpio.dll"	Chehfhhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmkpbinn.dll"	Cdoeaili.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gofkmadc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkgqigka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbhocegl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjjalepf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cphmigqk.dll"	Cehbdcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkoihahd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fccklail.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Foceqceh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Helflfkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnelogk.dll"	Miiman32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqcgkc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmfhlcoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bonjhi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amkagb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lffhjcmb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elppii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkkmldbd.dll"	Lmijenkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anpnfkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eacelapl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhljjiki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpeilj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlefngkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bappnpkh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3768	1580	80fb4a4836295ba8a6135b122f5e389bb5191638bc0dd540b5ec26bf3bfa784d.exe	83
PID 1580 wrote to memory of 3768	1580	80fb4a4836295ba8a6135b122f5e389bb5191638bc0dd540b5ec26bf3bfa784d.exe	83
PID 1580 wrote to memory of 3768	1580	80fb4a4836295ba8a6135b122f5e389bb5191638bc0dd540b5ec26bf3bfa784d.exe	83
PID 3768 wrote to memory of 8	3768	Abimaj32.exe	84
PID 3768 wrote to memory of 8	3768	Abimaj32.exe	84
PID 3768 wrote to memory of 8	3768	Abimaj32.exe	84
PID 8 wrote to memory of 5112	8	Acjjibbm.exe	85
PID 8 wrote to memory of 5112	8	Acjjibbm.exe	85
PID 8 wrote to memory of 5112	8	Acjjibbm.exe	85
PID 5112 wrote to memory of 5016	5112	Alaajobo.exe	86
PID 5112 wrote to memory of 5016	5112	Alaajobo.exe	86
PID 5112 wrote to memory of 5016	5112	Alaajobo.exe	86
PID 5016 wrote to memory of 4540	5016	Anpnfkac.exe	87
PID 5016 wrote to memory of 4540	5016	Anpnfkac.exe	87
PID 5016 wrote to memory of 4540	5016	Anpnfkac.exe	87
PID 4540 wrote to memory of 1916	4540	Aejfce32.exe	88
PID 4540 wrote to memory of 1916	4540	Aejfce32.exe	88
PID 4540 wrote to memory of 1916	4540	Aejfce32.exe	88
PID 1916 wrote to memory of 1840	1916	Ahhbpp32.exe	89
PID 1916 wrote to memory of 1840	1916	Ahhbpp32.exe	89
PID 1916 wrote to memory of 1840	1916	Ahhbpp32.exe	89
PID 1840 wrote to memory of 5080	1840	Ajfoll32.exe	90
PID 1840 wrote to memory of 5080	1840	Ajfoll32.exe	90
PID 1840 wrote to memory of 5080	1840	Ajfoll32.exe	90
PID 5080 wrote to memory of 3264	5080	Abngmihi.exe	92
PID 5080 wrote to memory of 3264	5080	Abngmihi.exe	92
PID 5080 wrote to memory of 3264	5080	Abngmihi.exe	92
PID 3264 wrote to memory of 1516	3264	Belcidgm.exe	93
PID 3264 wrote to memory of 1516	3264	Belcidgm.exe	93
PID 3264 wrote to memory of 1516	3264	Belcidgm.exe	93
PID 1516 wrote to memory of 2216	1516	Blfkeo32.exe	94
PID 1516 wrote to memory of 2216	1516	Blfkeo32.exe	94
PID 1516 wrote to memory of 2216	1516	Blfkeo32.exe	94
PID 2216 wrote to memory of 3528	2216	Bbpcbiff.exe	96
PID 2216 wrote to memory of 3528	2216	Bbpcbiff.exe	96
PID 2216 wrote to memory of 3528	2216	Bbpcbiff.exe	96
PID 3528 wrote to memory of 620	3528	Bhmlkpdn.exe	97
PID 3528 wrote to memory of 620	3528	Bhmlkpdn.exe	97
PID 3528 wrote to memory of 620	3528	Bhmlkpdn.exe	97
PID 620 wrote to memory of 1500	620	Bbbphh32.exe	98
PID 620 wrote to memory of 1500	620	Bbbphh32.exe	98
PID 620 wrote to memory of 1500	620	Bbbphh32.exe	98
PID 1500 wrote to memory of 456	1500	Beqldd32.exe	99
PID 1500 wrote to memory of 456	1500	Beqldd32.exe	99
PID 1500 wrote to memory of 456	1500	Beqldd32.exe	99
PID 456 wrote to memory of 628	456	Blkdqnjd.exe	101
PID 456 wrote to memory of 628	456	Blkdqnjd.exe	101
PID 456 wrote to memory of 628	456	Blkdqnjd.exe	101
PID 628 wrote to memory of 1352	628	Bbdmmh32.exe	102
PID 628 wrote to memory of 1352	628	Bbdmmh32.exe	102
PID 628 wrote to memory of 1352	628	Bbdmmh32.exe	102
PID 1352 wrote to memory of 3672	1352	Beciic32.exe	103
PID 1352 wrote to memory of 3672	1352	Beciic32.exe	103
PID 1352 wrote to memory of 3672	1352	Beciic32.exe	103
PID 3672 wrote to memory of 4592	3672	Blmafnhb.exe	104
PID 3672 wrote to memory of 4592	3672	Blmafnhb.exe	104
PID 3672 wrote to memory of 4592	3672	Blmafnhb.exe	104
PID 4592 wrote to memory of 3160	4592	Bbgich32.exe	105
PID 4592 wrote to memory of 3160	4592	Bbgich32.exe	105
PID 4592 wrote to memory of 3160	4592	Bbgich32.exe	105
PID 3160 wrote to memory of 4564	3160	Bajjodfi.exe	106
PID 3160 wrote to memory of 4564	3160	Bajjodfi.exe	106
PID 3160 wrote to memory of 4564	3160	Bajjodfi.exe	106
PID 4564 wrote to memory of 1520	4564	Beefocob.exe	107

C:\Users\Admin\AppData\Local\Temp\80fb4a4836295ba8a6135b122f5e389bb5191638bc0dd540b5ec26bf3bfa784d.exe
"C:\Users\Admin\AppData\Local\Temp\80fb4a4836295ba8a6135b122f5e389bb5191638bc0dd540b5ec26bf3bfa784d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\Abimaj32.exe
  C:\Windows\system32\Abimaj32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\Acjjibbm.exe
    C:\Windows\system32\Acjjibbm.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\SysWOW64\Alaajobo.exe
      C:\Windows\system32\Alaajobo.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Windows\SysWOW64\Anpnfkac.exe
        
        C:\Windows\system32\Anpnfkac.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5016
      - C:\Windows\SysWOW64\Aejfce32.exe
        
        C:\Windows\system32\Aejfce32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Ahhbpp32.exe
        
        C:\Windows\system32\Ahhbpp32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\Ajfoll32.exe
        
        C:\Windows\system32\Ajfoll32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\Abngmihi.exe
        
        C:\Windows\system32\Abngmihi.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Belcidgm.exe
        
        C:\Windows\system32\Belcidgm.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Blfkeo32.exe
        
        C:\Windows\system32\Blfkeo32.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Bbpcbiff.exe
        
        C:\Windows\system32\Bbpcbiff.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Bhmlkpdn.exe
        
        C:\Windows\system32\Bhmlkpdn.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Bbbphh32.exe
        
        C:\Windows\system32\Bbbphh32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Windows\SysWOW64\Beqldd32.exe
        
        C:\Windows\system32\Beqldd32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Blkdqnjd.exe
        
        C:\Windows\system32\Blkdqnjd.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Bbdmmh32.exe
        
        C:\Windows\system32\Bbdmmh32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Beciic32.exe
        
        C:\Windows\system32\Beciic32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Blmafnhb.exe
        
        C:\Windows\system32\Blmafnhb.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Bbgich32.exe
        
        C:\Windows\system32\Bbgich32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Bajjodfi.exe
        
        C:\Windows\system32\Bajjodfi.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\Beefocob.exe
        
        C:\Windows\system32\Beefocob.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Bhdbkonf.exe
        
        C:\Windows\system32\Bhdbkonf.exe
        23⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Bkbngjmj.exe
        
        C:\Windows\system32\Bkbngjmj.exe
        24⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Bonjhi32.exe
        
        C:\Windows\system32\Bonjhi32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Cehbdcmp.exe
        
        C:\Windows\system32\Cehbdcmp.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2984
        
        C:\Windows\SysWOW64\Cdjbpp32.exe
        
        C:\Windows\system32\Cdjbpp32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4052
        
        C:\Windows\SysWOW64\Caocjd32.exe
        
        C:\Windows\system32\Caocjd32.exe
        28⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Chhkfn32.exe
        
        C:\Windows\system32\Chhkfn32.exe
        29⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Ckghbi32.exe
        
        C:\Windows\system32\Ckghbi32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2616
        
        C:\Windows\SysWOW64\Cellpb32.exe
        
        C:\Windows\system32\Cellpb32.exe
        31⤵
        Executes dropped EXE
        
        PID:4812
        
        C:\Windows\SysWOW64\Chkhln32.exe
        
        C:\Windows\system32\Chkhln32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\Ckidhi32.exe
        
        C:\Windows\system32\Ckidhi32.exe
        33⤵
        Executes dropped EXE
        
        PID:1296
        
        C:\Windows\SysWOW64\Coephhok.exe
        
        C:\Windows\system32\Coephhok.exe
        34⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Cacmecno.exe
        
        C:\Windows\system32\Cacmecno.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        C:\Windows\SysWOW64\Chmeamfk.exe
        
        C:\Windows\system32\Chmeamfk.exe
        36⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Cogmng32.exe
        
        C:\Windows\system32\Cogmng32.exe
        37⤵
        Executes dropped EXE
        
        PID:632
        
        C:\Windows\SysWOW64\Cbbiofea.exe
        
        C:\Windows\system32\Cbbiofea.exe
        38⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Ceaekade.exe
        
        C:\Windows\system32\Ceaekade.exe
        39⤵
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Chpagmdi.exe
        
        C:\Windows\system32\Chpagmdi.exe
        40⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Windows\SysWOW64\Cknnchcl.exe
        
        C:\Windows\system32\Cknnchcl.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3124
        
        C:\Windows\SysWOW64\Dbefdfco.exe
        
        C:\Windows\system32\Dbefdfco.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Decbqabb.exe
        
        C:\Windows\system32\Decbqabb.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Windows\SysWOW64\Dlmjmkjo.exe
        
        C:\Windows\system32\Dlmjmkjo.exe
        44⤵
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\Dolfigic.exe
        
        C:\Windows\system32\Dolfigic.exe
        45⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Dajbebhf.exe
        
        C:\Windows\system32\Dajbebhf.exe
        46⤵
        Executes dropped EXE
        
        PID:3604
        
        C:\Windows\SysWOW64\Dhdkbl32.exe
        
        C:\Windows\system32\Dhdkbl32.exe
        47⤵
        Executes dropped EXE
        
        PID:2968
        
        C:\Windows\SysWOW64\Doncofgp.exe
        
        C:\Windows\system32\Doncofgp.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Damokbfd.exe
        
        C:\Windows\system32\Damokbfd.exe
        49⤵
        Executes dropped EXE
        
        PID:2928
        
        C:\Windows\SysWOW64\Ddklgmeg.exe
        
        C:\Windows\system32\Ddklgmeg.exe
        50⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Dlbchkfj.exe
        
        C:\Windows\system32\Dlbchkfj.exe
        51⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Daolqa32.exe
        
        C:\Windows\system32\Daolqa32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Dhidmlln.exe
        
        C:\Windows\system32\Dhidmlln.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1892
        
        C:\Windows\SysWOW64\Dkgqigka.exe
        
        C:\Windows\system32\Dkgqigka.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1660
        
        C:\Windows\SysWOW64\Docmjf32.exe
        
        C:\Windows\system32\Docmjf32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1064
        
        C:\Windows\SysWOW64\Ddpebm32.exe
        
        C:\Windows\system32\Ddpebm32.exe
        56⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Dhkackjk.exe
        
        C:\Windows\system32\Dhkackjk.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\Dkjmogio.exe
        
        C:\Windows\system32\Dkjmogio.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\SysWOW64\Ecqepd32.exe
        
        C:\Windows\system32\Ecqepd32.exe
        59⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Eacelapl.exe
        
        C:\Windows\system32\Eacelapl.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Eeoalp32.exe
        
        C:\Windows\system32\Eeoalp32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Edbbhlop.exe
        
        C:\Windows\system32\Edbbhlop.exe
        62⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Ehnnhk32.exe
        
        C:\Windows\system32\Ehnnhk32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:816
        
        C:\Windows\SysWOW64\Ekljdf32.exe
        
        C:\Windows\system32\Ekljdf32.exe
        64⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Windows\SysWOW64\Eogfeeoe.exe
        
        C:\Windows\system32\Eogfeeoe.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2020
        
        C:\Windows\SysWOW64\Eafbaqni.exe
        
        C:\Windows\system32\Eafbaqni.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2624
        
        C:\Windows\SysWOW64\Eeanao32.exe
        
        C:\Windows\system32\Eeanao32.exe
        67⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Eddomlmm.exe
        
        C:\Windows\system32\Eddomlmm.exe
        68⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Elkfnino.exe
        
        C:\Windows\system32\Elkfnino.exe
        69⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Ehbgcjcc.exe
        
        C:\Windows\system32\Ehbgcjcc.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4732
        
        C:\Windows\SysWOW64\Ekqcpfbg.exe
        
        C:\Windows\system32\Ekqcpfbg.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
        
        C:\Windows\SysWOW64\Echkqcci.exe
        
        C:\Windows\system32\Echkqcci.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4648
        
        C:\Windows\SysWOW64\Eefhmobm.exe
        
        C:\Windows\system32\Eefhmobm.exe
        73⤵
        Drops file in System32 directory
        
        PID:4140
        
        C:\Windows\SysWOW64\Elppii32.exe
        
        C:\Windows\system32\Elppii32.exe
        74⤵
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Ekcpeeqd.exe
        
        C:\Windows\system32\Ekcpeeqd.exe
        75⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Eamhbp32.exe
        
        C:\Windows\system32\Eamhbp32.exe
        76⤵
        Drops file in System32 directory
        
        PID:3064
        
        C:\Windows\SysWOW64\Edkdnkge.exe
        
        C:\Windows\system32\Edkdnkge.exe
        77⤵
        Modifies registry class
        
        PID:2676
        
        C:\Windows\SysWOW64\Ehgqoj32.exe
        
        C:\Windows\system32\Ehgqoj32.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Windows\SysWOW64\Elbmohhg.exe
        
        C:\Windows\system32\Elbmohhg.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3976
        
        C:\Windows\SysWOW64\Foaikdgk.exe
        
        C:\Windows\system32\Foaikdgk.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:672
        
        C:\Windows\SysWOW64\Faoegofo.exe
        
        C:\Windows\system32\Faoegofo.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4296
        
        C:\Windows\SysWOW64\Fekahn32.exe
        
        C:\Windows\system32\Fekahn32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Windows\SysWOW64\Fhimdi32.exe
        
        C:\Windows\system32\Fhimdi32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\Foceqceh.exe
        
        C:\Windows\system32\Foceqceh.exe
        84⤵
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Faabmodl.exe
        
        C:\Windows\system32\Faabmodl.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Fhljjiki.exe
        
        C:\Windows\system32\Fhljjiki.exe
        86⤵
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Fkjffdjl.exe
        
        C:\Windows\system32\Fkjffdjl.exe
        87⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Foebfc32.exe
        
        C:\Windows\system32\Foebfc32.exe
        88⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Fcangbko.exe
        
        C:\Windows\system32\Fcangbko.exe
        89⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Fadobo32.exe
        
        C:\Windows\system32\Fadobo32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3188
        
        C:\Windows\SysWOW64\Fdbkoj32.exe
        
        C:\Windows\system32\Fdbkoj32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\Flibpg32.exe
        
        C:\Windows\system32\Flibpg32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Windows\SysWOW64\Fccklail.exe
        
        C:\Windows\system32\Fccklail.exe
        93⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2448
        
        C:\Windows\SysWOW64\Fbfkhn32.exe
        
        C:\Windows\system32\Fbfkhn32.exe
        94⤵
        Drops file in System32 directory
        
        PID:1240
        
        C:\Windows\SysWOW64\Fllpegpl.exe
        
        C:\Windows\system32\Fllpegpl.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Fcfhba32.exe
        
        C:\Windows\system32\Fcfhba32.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Ffddnm32.exe
        
        C:\Windows\system32\Ffddnm32.exe
        97⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Windows\SysWOW64\Fhbpjh32.exe
        
        C:\Windows\system32\Fhbpjh32.exe
        98⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Gomhgbmn.exe
        
        C:\Windows\system32\Gomhgbmn.exe
        99⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Gdiaoike.exe
        
        C:\Windows\system32\Gdiaoike.exe
        100⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Gcjamqcd.exe
        
        C:\Windows\system32\Gcjamqcd.exe
        101⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Gbmaim32.exe
        
        C:\Windows\system32\Gbmaim32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Gkffacpo.exe
        
        C:\Windows\system32\Gkffacpo.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\Gdnjjh32.exe
        
        C:\Windows\system32\Gdnjjh32.exe
        104⤵
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Gcojhp32.exe
        
        C:\Windows\system32\Gcojhp32.exe
        105⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Gfngdk32.exe
        
        C:\Windows\system32\Gfngdk32.exe
        106⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Gmgoaeeo.exe
        
        C:\Windows\system32\Gmgoaeeo.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Gkjomb32.exe
        
        C:\Windows\system32\Gkjomb32.exe
        108⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Gofkmadc.exe
        
        C:\Windows\system32\Gofkmadc.exe
        109⤵
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Gcagnp32.exe
        
        C:\Windows\system32\Gcagnp32.exe
        110⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Gfpcjk32.exe
        
        C:\Windows\system32\Gfpcjk32.exe
        111⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Ginpff32.exe
        
        C:\Windows\system32\Ginpff32.exe
        112⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Hohhbq32.exe
        
        C:\Windows\system32\Hohhbq32.exe
        113⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Hbgdol32.exe
        
        C:\Windows\system32\Hbgdol32.exe
        114⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Hfbppkjm.exe
        
        C:\Windows\system32\Hfbppkjm.exe
        115⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Hiqllfiq.exe
        
        C:\Windows\system32\Hiqllfiq.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Windows\SysWOW64\Hkoihahd.exe
        
        C:\Windows\system32\Hkoihahd.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Hokdhp32.exe
        
        C:\Windows\system32\Hokdhp32.exe
        118⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Hbiadl32.exe
        
        C:\Windows\system32\Hbiadl32.exe
        119⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Hegmqg32.exe
        
        C:\Windows\system32\Hegmqg32.exe
        120⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Hiciafgn.exe
        
        C:\Windows\system32\Hiciafgn.exe
        121⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Hkaemafa.exe
        
        C:\Windows\system32\Hkaemafa.exe
        122⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Hchmno32.exe
        
        C:\Windows\system32\Hchmno32.exe
        123⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Hbknjkno.exe
        
        C:\Windows\system32\Hbknjkno.exe
        124⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Hfgjjj32.exe
        
        C:\Windows\system32\Hfgjjj32.exe
        125⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Hiefge32.exe
        
        C:\Windows\system32\Hiefge32.exe
        126⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Hmabgdmd.exe
        
        C:\Windows\system32\Hmabgdmd.exe
        127⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Hkdbca32.exe
        
        C:\Windows\system32\Hkdbca32.exe
        128⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Hckjdn32.exe
        
        C:\Windows\system32\Hckjdn32.exe
        129⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Hfifpj32.exe
        
        C:\Windows\system32\Hfifpj32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Helflfkp.exe
        
        C:\Windows\system32\Helflfkp.exe
        131⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Hihble32.exe
        
        C:\Windows\system32\Hihble32.exe
        132⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Hmcomdkb.exe
        
        C:\Windows\system32\Hmcomdkb.exe
        133⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Hoakioje.exe
        
        C:\Windows\system32\Hoakioje.exe
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Hcmgin32.exe
        
        C:\Windows\system32\Hcmgin32.exe
        135⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Hflceibb.exe
        
        C:\Windows\system32\Hflceibb.exe
        136⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Heocaf32.exe
        
        C:\Windows\system32\Heocaf32.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Windows\SysWOW64\Imekbc32.exe
        
        C:\Windows\system32\Imekbc32.exe
        138⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ipdgoo32.exe
        
        C:\Windows\system32\Ipdgoo32.exe
        139⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Ibbckj32.exe
        
        C:\Windows\system32\Ibbckj32.exe
        140⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Ieapgf32.exe
        
        C:\Windows\system32\Ieapgf32.exe
        141⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ikkhcpng.exe
        
        C:\Windows\system32\Ikkhcpng.exe
        142⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Ibeqpj32.exe
        
        C:\Windows\system32\Ibeqpj32.exe
        143⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Iecmledg.exe
        
        C:\Windows\system32\Iecmledg.exe
        144⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Iioimd32.exe
        
        C:\Windows\system32\Iioimd32.exe
        145⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Icdmjm32.exe
        
        C:\Windows\system32\Icdmjm32.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:6240
        
        C:\Windows\SysWOW64\Icfjpm32.exe
        
        C:\Windows\system32\Icfjpm32.exe
        147⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Iicbhcik.exe
        
        C:\Windows\system32\Iicbhcik.exe
        148⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ipmjen32.exe
        
        C:\Windows\system32\Ipmjen32.exe
        149⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Ifgbahhe.exe
        
        C:\Windows\system32\Ifgbahhe.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Jejcmd32.exe
        
        C:\Windows\system32\Jejcmd32.exe
        151⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Jppgjm32.exe
        
        C:\Windows\system32\Jppgjm32.exe
        152⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Jempbd32.exe
        
        C:\Windows\system32\Jempbd32.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Windows\SysWOW64\Jlfhon32.exe
        
        C:\Windows\system32\Jlfhon32.exe
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:6600
        
        C:\Windows\SysWOW64\Jcnppl32.exe
        
        C:\Windows\system32\Jcnppl32.exe
        155⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Jeolhdjj.exe
        
        C:\Windows\system32\Jeolhdjj.exe
        156⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Jmfdiakl.exe
        
        C:\Windows\system32\Jmfdiakl.exe
        157⤵
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Jbcmahid.exe
        
        C:\Windows\system32\Jbcmahid.exe
        158⤵
        Drops file in System32 directory
        
        PID:6780
        
        C:\Windows\SysWOW64\Jeainchg.exe
        
        C:\Windows\system32\Jeainchg.exe
        159⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Jimenb32.exe
        
        C:\Windows\system32\Jimenb32.exe
        160⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Jmkndq32.exe
        
        C:\Windows\system32\Jmkndq32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Kianiamk.exe
        
        C:\Windows\system32\Kianiamk.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:6964
        
        C:\Windows\SysWOW64\Kdgbfj32.exe
        
        C:\Windows\system32\Kdgbfj32.exe
        163⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Kfeobe32.exe
        
        C:\Windows\system32\Kfeobe32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Kidkoa32.exe
        
        C:\Windows\system32\Kidkoa32.exe
        165⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Kdiolj32.exe
        
        C:\Windows\system32\Kdiolj32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:7140
        
        C:\Windows\SysWOW64\Kmadepao.exe
        
        C:\Windows\system32\Kmadepao.exe
        167⤵
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Klddql32.exe
        
        C:\Windows\system32\Klddql32.exe
        168⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Kdllaihl.exe
        
        C:\Windows\system32\Kdllaihl.exe
        169⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Kemhia32.exe
        
        C:\Windows\system32\Kemhia32.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\Kpbmgj32.exe
        
        C:\Windows\system32\Kpbmgj32.exe
        171⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Kikappdq.exe
        
        C:\Windows\system32\Kikappdq.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
        
        C:\Windows\SysWOW64\Klimllcd.exe
        
        C:\Windows\system32\Klimllcd.exe
        173⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Kpeilj32.exe
        
        C:\Windows\system32\Kpeilj32.exe
        174⤵
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Lfoaid32.exe
        
        C:\Windows\system32\Lfoaid32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6724
        
        C:\Windows\SysWOW64\Lmijenkg.exe
        
        C:\Windows\system32\Lmijenkg.exe
        176⤵
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Ldbbbh32.exe
        
        C:\Windows\system32\Ldbbbh32.exe
        177⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6856
        
        C:\Windows\SysWOW64\Lfanod32.exe
        
        C:\Windows\system32\Lfanod32.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Windows\SysWOW64\Ledojqhb.exe
        
        C:\Windows\system32\Ledojqhb.exe
        179⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Lpicgihh.exe
        
        C:\Windows\system32\Lpicgihh.exe
        180⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Lbhocegl.exe
        
        C:\Windows\system32\Lbhocegl.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Lefkpq32.exe
        
        C:\Windows\system32\Lefkpq32.exe
        182⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Libgpooi.exe
        
        C:\Windows\system32\Libgpooi.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Llpcljnl.exe
        
        C:\Windows\system32\Llpcljnl.exe
        184⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ldgkmhno.exe
        
        C:\Windows\system32\Ldgkmhno.exe
        185⤵
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Lffhjcmb.exe
        
        C:\Windows\system32\Lffhjcmb.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Liddfolf.exe
        
        C:\Windows\system32\Liddfolf.exe
        187⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Llbpbjlj.exe
        
        C:\Windows\system32\Llbpbjlj.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Lpnlbi32.exe
        
        C:\Windows\system32\Lpnlbi32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1156
        
        C:\Windows\SysWOW64\Lbmhod32.exe
        
        C:\Windows\system32\Lbmhod32.exe
        190⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\Lekekp32.exe
        
        C:\Windows\system32\Lekekp32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6976
        
        C:\Windows\SysWOW64\Lmbmlmbl.exe
        
        C:\Windows\system32\Lmbmlmbl.exe
        192⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7060
        
        C:\Windows\SysWOW64\Ldlehg32.exe
        
        C:\Windows\system32\Ldlehg32.exe
        193⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Mgjadb32.exe
        
        C:\Windows\system32\Mgjadb32.exe
        194⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Miiman32.exe
        
        C:\Windows\system32\Miiman32.exe
        195⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Mpcenhpn.exe
        
        C:\Windows\system32\Mpcenhpn.exe
        196⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6632
        
        C:\Windows\SysWOW64\Mcabjcoa.exe
        
        C:\Windows\system32\Mcabjcoa.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Windows\SysWOW64\Mepnfone.exe
        
        C:\Windows\system32\Mepnfone.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Windows\SysWOW64\Mmgfgl32.exe
        
        C:\Windows\system32\Mmgfgl32.exe
        199⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Mdqncffd.exe
        
        C:\Windows\system32\Mdqncffd.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Mgokpbeh.exe
        
        C:\Windows\system32\Mgokpbeh.exe
        201⤵
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Minglmdk.exe
        
        C:\Windows\system32\Minglmdk.exe
        202⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Mllchico.exe
        
        C:\Windows\system32\Mllchico.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6868
        
        C:\Windows\SysWOW64\Mcfkec32.exe
        
        C:\Windows\system32\Mcfkec32.exe
        204⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Mgageace.exe
        
        C:\Windows\system32\Mgageace.exe
        205⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\Mmkpbl32.exe
        
        C:\Windows\system32\Mmkpbl32.exe
        206⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Mpjlngje.exe
        
        C:\Windows\system32\Mpjlngje.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4312
        
        C:\Windows\SysWOW64\Mdehof32.exe
        
        C:\Windows\system32\Mdehof32.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\Megdfnhm.exe
        
        C:\Windows\system32\Megdfnhm.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7148
        
        C:\Windows\SysWOW64\Mnnlgkho.exe
        
        C:\Windows\system32\Mnnlgkho.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:3212
        
        C:\Windows\SysWOW64\Mplhdghc.exe
        
        C:\Windows\system32\Mplhdghc.exe
        211⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Ndhdde32.exe
        
        C:\Windows\system32\Ndhdde32.exe
        212⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ngfqqa32.exe
        
        C:\Windows\system32\Ngfqqa32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7256
        
        C:\Windows\SysWOW64\Nidmml32.exe
        
        C:\Windows\system32\Nidmml32.exe
        214⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Nlciih32.exe
        
        C:\Windows\system32\Nlciih32.exe
        215⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Ndjajeni.exe
        
        C:\Windows\system32\Ndjajeni.exe
        216⤵
        Modifies registry class
        
        PID:7392
        
        C:\Windows\SysWOW64\Nghmfqmm.exe
        
        C:\Windows\system32\Nghmfqmm.exe
        217⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Njgjbllq.exe
        
        C:\Windows\system32\Njgjbllq.exe
        218⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Nlefngkd.exe
        
        C:\Windows\system32\Nlefngkd.exe
        219⤵
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Ngkjlpkj.exe
        
        C:\Windows\system32\Ngkjlpkj.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Njifhljn.exe
        
        C:\Windows\system32\Njifhljn.exe
        221⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Nlhbdgia.exe
        
        C:\Windows\system32\Nlhbdgia.exe
        222⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Ncakqaqo.exe
        
        C:\Windows\system32\Ncakqaqo.exe
        223⤵
        Modifies registry class
        
        PID:7700
        
        C:\Windows\SysWOW64\Ngmgap32.exe
        
        C:\Windows\system32\Ngmgap32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7744
        
        C:\Windows\SysWOW64\Nngonjqd.exe
        
        C:\Windows\system32\Nngonjqd.exe
        225⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Npekjeph.exe
        
        C:\Windows\system32\Npekjeph.exe
        226⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Ncdgfaol.exe
        
        C:\Windows\system32\Ncdgfaol.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7876
        
        C:\Windows\SysWOW64\Ngpcgp32.exe
        
        C:\Windows\system32\Ngpcgp32.exe
        228⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Nnilcjnb.exe
        
        C:\Windows\system32\Nnilcjnb.exe
        229⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Nlllof32.exe
        
        C:\Windows\system32\Nlllof32.exe
        230⤵
        Drops file in System32 directory
        
        PID:8008
        
        C:\Windows\SysWOW64\Odcdpd32.exe
        
        C:\Windows\system32\Odcdpd32.exe
        231⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Ogbploeb.exe
        
        C:\Windows\system32\Ogbploeb.exe
        232⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ojplhkdf.exe
        
        C:\Windows\system32\Ojplhkdf.exe
        233⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Oloidfcj.exe
        
        C:\Windows\system32\Oloidfcj.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:8188
        
        C:\Windows\SysWOW64\Odfqecdl.exe
        
        C:\Windows\system32\Odfqecdl.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7220
        
        C:\Windows\SysWOW64\Ociaap32.exe
        
        C:\Windows\system32\Ociaap32.exe
        236⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ofgmml32.exe
        
        C:\Windows\system32\Ofgmml32.exe
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:7360
        
        C:\Windows\SysWOW64\Onneoi32.exe
        
        C:\Windows\system32\Onneoi32.exe
        238⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Opmakd32.exe
        
        C:\Windows\system32\Opmakd32.exe
        239⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Ockngp32.exe
        
        C:\Windows\system32\Ockngp32.exe
        240⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Ofijckhg.exe
        
        C:\Windows\system32\Ofijckhg.exe
        241⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Onqbdihj.exe
        
        C:\Windows\system32\Onqbdihj.exe
        242⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Oqonpdgn.exe
        
        C:\Windows\system32\Oqonpdgn.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Ocmjlpfa.exe
        
        C:\Windows\system32\Ocmjlpfa.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:7840
        
        C:\Windows\SysWOW64\Oflfhkee.exe
        
        C:\Windows\system32\Oflfhkee.exe
        245⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Oncoihfg.exe
        
        C:\Windows\system32\Oncoihfg.exe
        246⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Oqakfdek.exe
        
        C:\Windows\system32\Oqakfdek.exe
        247⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8048
        
        C:\Windows\SysWOW64\Ocpgbodo.exe
        
        C:\Windows\system32\Ocpgbodo.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8112
        
        C:\Windows\SysWOW64\Ogkcbn32.exe
        
        C:\Windows\system32\Ogkcbn32.exe
        249⤵
        Modifies registry class
        
        PID:8184
        
        C:\Windows\SysWOW64\Onekoh32.exe
        
        C:\Windows\system32\Onekoh32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Pqcgkc32.exe
        
        C:\Windows\system32\Pqcgkc32.exe
        251⤵
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Pdoclbla.exe
        
        C:\Windows\system32\Pdoclbla.exe
        252⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Pgnphnke.exe
        
        C:\Windows\system32\Pgnphnke.exe
        253⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Pjlldiji.exe
        
        C:\Windows\system32\Pjlldiji.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7668
        
        C:\Windows\SysWOW64\Pmjhpdil.exe
        
        C:\Windows\system32\Pmjhpdil.exe
        255⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Pqfdac32.exe
        
        C:\Windows\system32\Pqfdac32.exe
        256⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Pcdqmo32.exe
        
        C:\Windows\system32\Pcdqmo32.exe
        257⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Pgplnmib.exe
        
        C:\Windows\system32\Pgplnmib.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8128
        
        C:\Windows\SysWOW64\Pjnijihf.exe
        
        C:\Windows\system32\Pjnijihf.exe
        259⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Pmmefd32.exe
        
        C:\Windows\system32\Pmmefd32.exe
        260⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Pddmga32.exe
        
        C:\Windows\system32\Pddmga32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Pcgmbnnf.exe
        
        C:\Windows\system32\Pcgmbnnf.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7760
        
        C:\Windows\SysWOW64\Pfeiojnj.exe
        
        C:\Windows\system32\Pfeiojnj.exe
        263⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Pmoakd32.exe
        
        C:\Windows\system32\Pmoakd32.exe
        264⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Pqknlbmp.exe
        
        C:\Windows\system32\Pqknlbmp.exe
        265⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Pdfjla32.exe
        
        C:\Windows\system32\Pdfjla32.exe
        266⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Pfgfdikg.exe
        
        C:\Windows\system32\Pfgfdikg.exe
        267⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Pnoneglj.exe
        
        C:\Windows\system32\Pnoneglj.exe
        268⤵
        Drops file in System32 directory
        
        PID:8024
        
        C:\Windows\SysWOW64\Pqmjab32.exe
        
        C:\Windows\system32\Pqmjab32.exe
        269⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Pckfnn32.exe
        
        C:\Windows\system32\Pckfnn32.exe
        270⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Pfjcji32.exe
        
        C:\Windows\system32\Pfjcji32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8136
        
        C:\Windows\SysWOW64\Pnakkf32.exe
        
        C:\Windows\system32\Pnakkf32.exe
        272⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Qdkcgqad.exe
        
        C:\Windows\system32\Qdkcgqad.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:7512
        
        C:\Windows\SysWOW64\Qcnccm32.exe
        
        C:\Windows\system32\Qcnccm32.exe
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:7916
        
        C:\Windows\SysWOW64\Qflpoi32.exe
        
        C:\Windows\system32\Qflpoi32.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
        
        C:\Windows\SysWOW64\Qmfhlcoo.exe
        
        C:\Windows\system32\Qmfhlcoo.exe
        276⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Qqadmagh.exe
        
        C:\Windows\system32\Qqadmagh.exe
        277⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Qgllil32.exe
        
        C:\Windows\system32\Qgllil32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8336
        
        C:\Windows\SysWOW64\Anedfffb.exe
        
        C:\Windows\system32\Anedfffb.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8380
        
        C:\Windows\SysWOW64\Aqdqbaee.exe
        
        C:\Windows\system32\Aqdqbaee.exe
        280⤵
        Modifies registry class
        
        PID:8424
        
        C:\Windows\SysWOW64\Acbmnmdi.exe
        
        C:\Windows\system32\Acbmnmdi.exe
        281⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Agniok32.exe
        
        C:\Windows\system32\Agniok32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8512
        
        C:\Windows\SysWOW64\Ajlekg32.exe
        
        C:\Windows\system32\Ajlekg32.exe
        283⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Amkagb32.exe
        
        C:\Windows\system32\Amkagb32.exe
        284⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8600
        
        C:\Windows\SysWOW64\Aebihpkl.exe
        
        C:\Windows\system32\Aebihpkl.exe
        285⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Afcfph32.exe
        
        C:\Windows\system32\Afcfph32.exe
        286⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Ajoaqfjc.exe
        
        C:\Windows\system32\Ajoaqfjc.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8732
        
        C:\Windows\SysWOW64\Ammnmbig.exe
        
        C:\Windows\system32\Ammnmbig.exe
        288⤵
        System Location Discovery: System Language Discovery
        
        PID:8776
        
        C:\Windows\SysWOW64\Aedfnoii.exe
        
        C:\Windows\system32\Aedfnoii.exe
        289⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Anmjfe32.exe
        
        C:\Windows\system32\Anmjfe32.exe
        290⤵
        Drops file in System32 directory
        
        PID:8864
        
        C:\Windows\SysWOW64\Aefbcogf.exe
        
        C:\Windows\system32\Aefbcogf.exe
        291⤵
        Modifies registry class
        
        PID:8908
        
        C:\Windows\SysWOW64\Ageopj32.exe
        
        C:\Windows\system32\Ageopj32.exe
        292⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Ajcklf32.exe
        
        C:\Windows\system32\Ajcklf32.exe
        293⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Anogldng.exe
        
        C:\Windows\system32\Anogldng.exe
        294⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Aeioio32.exe
        
        C:\Windows\system32\Aeioio32.exe
        295⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Agglej32.exe
        
        C:\Windows\system32\Agglej32.exe
        296⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Bjfhae32.exe
        
        C:\Windows\system32\Bjfhae32.exe
        297⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9172
        
        C:\Windows\SysWOW64\Bmddma32.exe
        
        C:\Windows\system32\Bmddma32.exe
        298⤵
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Bappnpkh.exe
        
        C:\Windows\system32\Bappnpkh.exe
        299⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Bcnljkjl.exe
        
        C:\Windows\system32\Bcnljkjl.exe
        300⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Bfmhff32.exe
        
        C:\Windows\system32\Bfmhff32.exe
        301⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8544
        
        C:\Windows\SysWOW64\Bjhdgeai.exe
        
        C:\Windows\system32\Bjhdgeai.exe
        302⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Bmfqcqql.exe
        
        C:\Windows\system32\Bmfqcqql.exe
        303⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Babmco32.exe
        
        C:\Windows\system32\Babmco32.exe
        304⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Benidnao.exe
        
        C:\Windows\system32\Benidnao.exe
        305⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Bcqipk32.exe
        
        C:\Windows\system32\Bcqipk32.exe
        306⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Bglepipb.exe
        
        C:\Windows\system32\Bglepipb.exe
        307⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Bjjalepf.exe
        
        C:\Windows\system32\Bjjalepf.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9076
        
        C:\Windows\SysWOW64\Bgnafinp.exe
        
        C:\Windows\system32\Bgnafinp.exe
        309⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Bfcogecg.exe
        
        C:\Windows\system32\Bfcogecg.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8216
        
        C:\Windows\SysWOW64\Bnkfhcdj.exe
        
        C:\Windows\system32\Bnkfhcdj.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8240
        
        C:\Windows\SysWOW64\Baicdncn.exe
        
        C:\Windows\system32\Baicdncn.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8564
        
        C:\Windows\SysWOW64\Bcgopjba.exe
        
        C:\Windows\system32\Bcgopjba.exe
        313⤵
        System Location Discovery: System Language Discovery
        
        PID:8696
        
        C:\Windows\SysWOW64\Cffkleae.exe
        
        C:\Windows\system32\Cffkleae.exe
        314⤵
        System Location Discovery: System Language Discovery
        
        PID:8788
        
        C:\Windows\SysWOW64\Cnmcnb32.exe
        
        C:\Windows\system32\Cnmcnb32.exe
        315⤵
        System Location Discovery: System Language Discovery
        
        PID:8896
        
        C:\Windows\SysWOW64\Cakpjn32.exe
        
        C:\Windows\system32\Cakpjn32.exe
        316⤵
        System Location Discovery: System Language Discovery
        
        PID:8964
        
        C:\Windows\SysWOW64\Cegljmid.exe
        
        C:\Windows\system32\Cegljmid.exe
        317⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Chehfhhh.exe
        
        C:\Windows\system32\Chehfhhh.exe
        318⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Cjddbcgk.exe
        
        C:\Windows\system32\Cjddbcgk.exe
        319⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Cnopcb32.exe
        
        C:\Windows\system32\Cnopcb32.exe
        320⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Canlon32.exe
        
        C:\Windows\system32\Canlon32.exe
        321⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Chhdlhfe.exe
        
        C:\Windows\system32\Chhdlhfe.exe
        322⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Cfkegd32.exe
        
        C:\Windows\system32\Cfkegd32.exe
        323⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8284
        
        C:\Windows\SysWOW64\Cnamib32.exe
        
        C:\Windows\system32\Cnamib32.exe
        324⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Capiemme.exe
        
        C:\Windows\system32\Capiemme.exe
        325⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Cdoeaili.exe
        
        C:\Windows\system32\Cdoeaili.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Cfmamdkm.exe
        
        C:\Windows\system32\Cfmamdkm.exe
        327⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Cndinalo.exe
        
        C:\Windows\system32\Cndinalo.exe
        328⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Cabfjmkc.exe
        
        C:\Windows\system32\Cabfjmkc.exe
        329⤵
        Drops file in System32 directory
        
        PID:9124
        
        C:\Windows\SysWOW64\Cenakl32.exe
        
        C:\Windows\system32\Cenakl32.exe
        330⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Cfonbdij.exe
        
        C:\Windows\system32\Cfonbdij.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9028
        
        C:\Windows\SysWOW64\Cjkjcb32.exe
        
        C:\Windows\system32\Cjkjcb32.exe
        332⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Cmifon32.exe
        
        C:\Windows\system32\Cmifon32.exe
        333⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Caebpm32.exe
        
        C:\Windows\system32\Caebpm32.exe
        334⤵
        Drops file in System32 directory
        
        PID:9344
        
        C:\Windows\SysWOW64\Dhokmgpm.exe
        
        C:\Windows\system32\Dhokmgpm.exe
        335⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Djmgiboq.exe
        
        C:\Windows\system32\Djmgiboq.exe
        336⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Doicia32.exe
        
        C:\Windows\system32\Doicia32.exe
        337⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Deckfkof.exe
        
        C:\Windows\system32\Deckfkof.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9520
        
        C:\Windows\SysWOW64\Dhagbfnj.exe
        
        C:\Windows\system32\Dhagbfnj.exe
        339⤵
        Drops file in System32 directory
        
        PID:9564
        
        C:\Windows\SysWOW64\Djpcnbmn.exe
        
        C:\Windows\system32\Djpcnbmn.exe
        340⤵
        Drops file in System32 directory
        
        PID:9608
        
        C:\Windows\SysWOW64\Dailkl32.exe
        
        C:\Windows\system32\Dailkl32.exe
        341⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Ddhhggdo.exe
        
        C:\Windows\system32\Ddhhggdo.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9696
        
        C:\Windows\SysWOW64\Dffdcccb.exe
        
        C:\Windows\system32\Dffdcccb.exe
        343⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Domldpcd.exe
        
        C:\Windows\system32\Domldpcd.exe
        344⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Dalhqlbh.exe
        
        C:\Windows\system32\Dalhqlbh.exe
        345⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ddjemgal.exe
        
        C:\Windows\system32\Ddjemgal.exe
        346⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Dfiaibap.exe
        
        C:\Windows\system32\Dfiaibap.exe
        347⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Dopijpab.exe
        
        C:\Windows\system32\Dopijpab.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9960
        
        C:\Windows\SysWOW64\Danefkqe.exe
        
        C:\Windows\system32\Danefkqe.exe
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:10004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10004 -s 408
        350⤵
        Program crash
        
        PID:10092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 10004 -ip 10004
1⤵
PID:10068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abimaj32.exe

Filesize
94KB

MD5
104cde9c77c8b0b8d401f6a788cc1e0b

SHA1
6f034043bffbd7df98a68875026dac66bfef7858

SHA256
146842244c394113395319bc99415618735ba8508a94e417cf6ffc5986827031

SHA512
331732bbd9ce098087fedfa57ccf5c8320c21f21c2cae4de317fad2c3577a6f36c914375cd9ba01dc1b905251b6afda1e7541e6a692303e73be7aaf74f24b6f7

Download Submit
C:\Windows\SysWOW64\Abngmihi.exe

Filesize
94KB

MD5
81ae5a805cc34ece4a4ec4f7f33b1d5a

SHA1
40d348c334c38110ce08b6278bd42aeda05e102e

SHA256
fa6dad857e7362296d3453c5007ab9b1ae0409ca0cb027a95ca0e186174096e2

SHA512
20e6db8b4ccc1c71ede05a43976ee6703213a2b48d8d474e2f1a05e56672bc051aa62757af410f53682c66e0fee62ddc2c872effdb7c3cd02cec657c1550caed

Download Submit
C:\Windows\SysWOW64\Acjjibbm.exe

Filesize
94KB

MD5
9b326c9ee22b8bb78cfb61d89c6b67dc

SHA1
77b53237e26e39ae7c50c0ccf65985b5b079c911

SHA256
db540d9cf46f9895f0a0272bb056e1a1b2ecd873af530f1e3d0c59b63731abe2

SHA512
25aeff6995448d78935ec5fe4efe26d4d0bf820086c059b13d93220caf75e5cb3057d7807a4c91341345a60437717deaf6b8530f1aae23adb5f6bd7a90f54878

Download Submit
C:\Windows\SysWOW64\Aedfnoii.exe

Filesize
94KB

MD5
8b853d696c1658b57f794e6533b69deb

SHA1
5659e6417466e8eec4e0abd66ee37b14d8b616c8

SHA256
c3f196902960867d4a37e294c288c4479228cf86daac0dc5e6a1b7342724c124

SHA512
d5540bf723b37b5c326066fda073f4c4db736ef65ce10d7f4d123dc7ec76df08b000a4035f7a00c7e79a1d514a36b74473808209164e412f9488c635fb0667f8

Download Submit
C:\Windows\SysWOW64\Aejfce32.exe

Filesize
94KB

MD5
1519e2593df29e3794701a7e9563a829

SHA1
a8d9b57789359e887ee3e7b09fdddfc52bace788

SHA256
48b15588d28c0c8145b58ea5b0c5bdd9b790bfe4599c6ebfdb4c1d5531a14a0f

SHA512
b1fa535570b7c0321c17ced9d9a44aef1276bd5662a131280286f6e8d571230583aa224905130b5533f3195a3bfb28fab1d13f955cb79389ba79c029ece9095f

Download Submit
C:\Windows\SysWOW64\Afcfph32.exe

Filesize
94KB

MD5
97707530239c55772bc4471dce92025d

SHA1
e5bc33e8efbba4ef2320257a8fd89aa313bb53ad

SHA256
f6eb7a47358ddf2b13fb81b0c0f293db87862191fbecba769658856b0773d21d

SHA512
107619aa69fc54a8e85a5aa120b3e3ba7d2299462806bb50f276f749ab191d2457ca6ece58abd6ca3925f24db1f87411ad95cbe09eb14f548b2debcac7e441bf

Download Submit
C:\Windows\SysWOW64\Ageopj32.exe

Filesize
94KB

MD5
9cb9a1cfca567fa70789326bee992323

SHA1
e59b2f85015701362e4a41a3f0d170e654268945

SHA256
40926e259d4b2ef7ea4b22d8ba4f77b8579eac47e601cfdcf82a773b7764269d

SHA512
2ecbd6c76aa0de0a89204930e5df7df236a88a8780986657513554ee73699720b2eafa34245dc04c467b5738f1cec54508ad47070673496e4277f1d7baa54598

Download Submit
C:\Windows\SysWOW64\Ahhbpp32.exe

Filesize
94KB

MD5
69f295f2a040cb515d39655ada7759a7

SHA1
659f53765b150d7c38da1a655120ff4eef0b799a

SHA256
4c08d27db6f1a2c8b40f31e655643a5d56afb921476a22e5e141e98fd9c3aa1a

SHA512
baf3fda015bafa302b4acfa075c1b60b327badd61314e5e11d6e97671c7e61196af617b2145c7c205a717d7b80f5629fa5dc6f0db5ada672e0b85c76226da232

Download Submit
C:\Windows\SysWOW64\Ajfoll32.exe

Filesize
94KB

MD5
6deeea8471266b0a082fbf1c56e9758f

SHA1
349e6291e4b655b9bb14430b73b84484263356de

SHA256
a401d4ec93afcce4a8f59fcf6f17074f52c6deee1fd5ecdb947e5c1f45d165f6

SHA512
9bb8cd8a4398e3c846a851e6fdd2ca0ed2ca658731bb470f8b5087d716e6f4d09709c688f71f4448612f27ec6533bd0480dfafe6a3fed4eba8f9305e792da182

Download Submit
C:\Windows\SysWOW64\Ajlekg32.exe

Filesize
94KB

MD5
57bf02d8fcf205bb9b47b911a2f0fd3a

SHA1
b6fa0fa8bd29f615287dbac3339cf488da3d60e2

SHA256
b4beb136a8f0390897f4e5729fbb977bce887cd1317c68db2ac988328c325e2a

SHA512
494cb3bdc94b0c040aa8fc0c3d3f55ded4241dbc3667d375020a8ee9723887f6ccfee15ab7f83b521a73ea29ec4b1c160a085b6f4df495a4744b33360f11f116

Download Submit
C:\Windows\SysWOW64\Alaajobo.exe

Filesize
94KB

MD5
8799314ceb3c003761b3907ed4c82ad6

SHA1
75eec6fbebd1aa6a0afb2577ba979b690020ced2

SHA256
de20ed05eb8d8823ad6aa557bbd3bdb2c82c38737598a45dbac8d0016e756a3d

SHA512
869a878a41beca70fcfe8303d237794ea03eaaf5307a05f9bc1eafdb9e87447f872ca0fe9b3ba2f7e5f49e84f17512b53527532c9759365cda29ed421e55472f

Download Submit
C:\Windows\SysWOW64\Anmjfe32.exe

Filesize
94KB

MD5
e0a9518d34b36b24a2a8e4d48d344297

SHA1
a7b1b8b5e804749866d89b81eaad1448f9d83e32

SHA256
bc28bd98ce4cdf98a9b0ceb6a0eaff486a4e9379bb57e20726a036ca5be4e461

SHA512
222e271c5580b9411abd7320f0714b05dd45e808d9a1d4fc36cc06dd0dfd4b34c3210fc4e08ac233fc4b50e2bfaadfdd5f65b9721dbee4ca13b45efcee446aa4

Download Submit
C:\Windows\SysWOW64\Anpnfkac.exe

Filesize
94KB

MD5
e3aa73147878a9b2638e3912a9725ee0

SHA1
2703b41430ee690d5f91c5374fb00434efc40712

SHA256
0b6583b4418478ee0bbc50b8542ea4aa984db9cd296cd5082799ca7eeb52432d

SHA512
dcd239c5ef268dc74880461a332e12f70bed6df90ddbeff64a13eda47e698e5446ba799abd90a16312858f532655441aebd0abdc05e6755f6657fd5bf958c85f

Download Submit
C:\Windows\SysWOW64\Aqdqbaee.exe

Filesize
94KB

MD5
723b81b5b8ac859268b805c262fd2f90

SHA1
8ff9b4b70876be7fb3e187407cff634d22e1d82e

SHA256
ce565ca192b09e7c3649d8fb3eb8883f52dbaa11b6180bc18f3f18420abb658d

SHA512
4076aa49671747435035adcff3a2ddfe4fd31af57448981f13462d301846f1b070ff6141bbb13d4b51a25d56de162edfd24a297b438759260e3347d15cbb2ddb

Download Submit
C:\Windows\SysWOW64\Bajjodfi.exe

Filesize
94KB

MD5
7877e43c47238cc4c3023a7f59364eae

SHA1
de21a93632c24b33bed77abaecaee505e4e2b1e1

SHA256
b419463e1cfd35238ab07611812f6605b3c49d56fff59e33d426c2415bbbab73

SHA512
756db49e48bf8f5501d68c16853455e80ae9e35e98062a196cc2f695daf7280bc70777c777542e93e1238b5960db552a02555022add0f7beb3bcf64ae9050402

Download Submit
C:\Windows\SysWOW64\Bbbphh32.exe

Filesize
94KB

MD5
831b258ffd08da8baa47862b405b7c8e

SHA1
2a8702e80d1b2ad248c424a1591ce2671249e257

SHA256
11e3d7b1d1b20426abcf9500c21398ff0cd67c24b64158c4ada25bb2c5e866ba

SHA512
404fc2317dc33f369227fd73cd0547ffc35d17338a85a01e97b9f6bebb6b206294f273ad7ee3cd70883c6d5e97be33af48aa346f5a81311d3f91a8ed549b2126

Download Submit
C:\Windows\SysWOW64\Bbdmmh32.exe

Filesize
94KB

MD5
de736c067c632cce88246879dca6b7d1

SHA1
cc74747a96eff95e31e3684e3926aad34db12437

SHA256
a0594102208e121aaabccbcb16c4511b444edcb03f191159b80bd4608904c597

SHA512
de92a4c1ae9a1e5bb1374a4b2f6b88b459b34324733784ea413856c01092bb3b0dc5ea6b5d57f60a950a137fec5f2c275d41d97d3ca88a7d805fad96db63ff81

Download Submit
C:\Windows\SysWOW64\Bbgich32.exe

Filesize
94KB

MD5
dfc565525b3a1c267060520c8d8f742f

SHA1
72e6cffcf662aa744f591a44be00b4887cae0605

SHA256
f03f06e89de1d5874ce5aadf88c08e39951ee0decd2c3fac0c5f9a5a551ad788

SHA512
b992e0a624c46823ae0a730047175f95069c04c6af38bf228f07b9ba880961b377da237819fe9d89069fbbb5bef90e439c1b29b1de4de2e4dfa563309d1d9735

Download Submit
C:\Windows\SysWOW64\Bbpcbiff.exe

Filesize
94KB

MD5
d2cc3c080da62af573c8cb1e50783980

SHA1
26c8236df5b3959f6e8e8fe4184214f470af69ce

SHA256
a7a1b85b8d37bc6074ad9502cc2620e5e09ba3cbe5b5d87bc379f4621988ed5a

SHA512
85aa1b77a95c92cfee0318a9dda77fdac39b70c1a4e4bbb7ef92fbf472f76092fdabb82d31e729f856063383e2534a116f1859aab930b07d7a103a92c5519ee3

Download Submit
C:\Windows\SysWOW64\Beciic32.exe

Filesize
94KB

MD5
3eb4763b67913e256f15939a12629a2c

SHA1
a1d11299689a0c73238ff6ccec599190baf03975

SHA256
4d0c605912d1f638bd75e754462172e32ac5a5a2244e0accfc4c1ccb25491fbd

SHA512
b694b80a2eaf1e650966d4f558486dcf2de366be42ee50db2e68abe6fd41c9f6cb0135b0762c5075eb35d29b665daf987fa5623aeb80c48ddca7094cd802e269

Download Submit
C:\Windows\SysWOW64\Beefocob.exe

Filesize
94KB

MD5
1a15ff7ab80674840878170f332d70f2

SHA1
6c3406c12bef4827205cf250f9164d8a493e2155

SHA256
0b76b473c04f13c250d5ad2ac3eef5a8829e008ac3dd802264197c812a7ae72b

SHA512
5ef8458d7fb6e89773a2a4fbef3467ca386df2ca25795fe264507bab4be6a2ce5e2a9bfcb4deaed2c14783f3699598c1f3532733c7ff06c8413f64a1faabab2a

Download Submit
C:\Windows\SysWOW64\Belcidgm.exe

Filesize
94KB

MD5
84ee35b7a877d588bd06387559887d1a

SHA1
5dfbcd944162c324aa5376c43fca941615174d80

SHA256
ab22b5350c5a90ee55d05bb5762e015489cffd63ebe614171f89befe7a98ea4d

SHA512
fd7650e0dfe495ac0012a10d3d812c967ee3bcf66b7d848b1fe41c00157c3e63f1dfc547ff0f5813225630ee7dea00a7eb2de856434d4dcd2507049c51e84539

Download Submit
C:\Windows\SysWOW64\Beqldd32.exe

Filesize
94KB

MD5
564fd6439df8bb427a3ec6fd2b95d14b

SHA1
79b4d46eb402e40045515430a975e4633bf55e60

SHA256
d40995978fc0ccfbc907e663746c5a92a4b326df62dc520d8a6f2415a884efa5

SHA512
f5ace880e359a04215aadb36849d8fc1780d8a958dc8ca2695257b037a61a4da28c76b3990873b5a6efbb2e838089f34e9a66a0b1f6b44583ed39725e64d9e83

Download Submit
C:\Windows\SysWOW64\Bhdbkonf.exe

Filesize
94KB

MD5
dc83b56bdb16afbda31f07f08b00a697

SHA1
e50494b01a56ec995b3e502b79eedb68908854bd

SHA256
e10da2571c251918665c2fdbd6c32e18d9a5cb754d17f1b318e7b56f5a978a2f

SHA512
f42af29c1888500454ac347d0f275f96dd45f14d72b8533d5a3fba52d063698982ee32fb8669a064632fb3efc6c3bf58b05b88cb227b1e9d9dd47c854b309595

Download Submit
C:\Windows\SysWOW64\Bhmlkpdn.exe

Filesize
94KB

MD5
c17f4bbe42a4aa673d71eb1bf2aa861a

SHA1
1809c1fe44b5fb9a760f397d0e29819f3e417706

SHA256
995d2f84b115237308e4a849bd05b64ee85c559a782dbe83fbe7384c12220beb

SHA512
9833b4f8f77d4f439cbf45b6f30656138d78231070859a5d3e8487a473eea85deb7961182c55335b69773f9ac125d956c7800ff58cb42824f62f29c18533f2d1

Download Submit
C:\Windows\SysWOW64\Bkbngjmj.exe

Filesize
94KB

MD5
74136a8898269402dbaba08ff59e00b2

SHA1
d188b0fb0ca7ad169a95055ec98e85aef40eb857

SHA256
8436cc5ceefd09744e83a05e7214b46cad04689f229779b9514a8de901339d06

SHA512
60b9dd14a6f73b8f8bc051dbb22edfb24bfa391c36b5acafd6caa6f2119220f015624468ad56fe55fd527f2fcebc2b688e7a65cf1897d9a37ce947ccecf8cebd

Download Submit
C:\Windows\SysWOW64\Blfkeo32.exe

Filesize
94KB

MD5
1757f48fe434f5d2a3d1286944483d0d

SHA1
b8d4220af1a5644e244502ebbff90e20e4b41127

SHA256
2e0fe9c25e698b11e920151d5ef66ad0bbca30e56c665b220e8721cc1119eea1

SHA512
8bec8bb2df8a417b23e88dcda3546b5788292624fcbc640c9d7ac8c82769ddfd7d46e8fc4c80868741940030d44b1438423c78fc7b0d022c51f4c43eeab9c3c8

Download Submit
C:\Windows\SysWOW64\Blkdqnjd.exe

Filesize
94KB

MD5
9710643f4f9c73385f49f76eabea7fb8

SHA1
ee46e09ece2cc1cc6a7751175c53dcd019696c90

SHA256
345905406b4d440bfeedf5f4078ac38ee1905e3498c1ea0814033009e6f36c40

SHA512
de0575d981abf1031f9b98479e797967af6bfc96143aebd22cbb570d4febfc7b46e91fb843c4dbc3081c88cdb62e766d89e08290b6f2c7f28624be46bc328f56

Download Submit
C:\Windows\SysWOW64\Blmafnhb.exe

Filesize
94KB

MD5
26a9546a47d7c2049fa6c7fc1177bf00

SHA1
52ccdc8e08b3bdb84d1c669e924fa85e63cffecc

SHA256
caf7fb10e9691e772cc485ba2fd92ca57ae1b48a6e9a862aaba41f420c92de5a

SHA512
95d5e687b6256f319bf8d05d3002c01292c4ee69f6c0a7e7ea85ce2b1109bc7aa4ca37284adb2a4ee6b64cb363a30627b23c645efaad56af94e86d8eb6aab220

Download Submit
C:\Windows\SysWOW64\Bonjhi32.exe

Filesize
94KB

MD5
d1a09dd0380449feaa1adc920adc85dc

SHA1
dacf123da180e353237d687b37c28c7bfa28c7c3

SHA256
d5bd982b8db10bedf6e20e81c7c976172321d5a64e91838ec16f82ca10c39084

SHA512
c1a967e0ad1fc464572776af5853cf9f3e8f6ce0739f15ce0009e75064e64e321da8705eb63a104fc1b376831acc3a697ef203e92f5e7aceb8b9fea88d90a286

Download Submit
C:\Windows\SysWOW64\Cabfjmkc.exe

Filesize
94KB

MD5
30617949983a0c79b0b4ad1d74fa3d2a

SHA1
756eb096b8136bb625510d4efef3f329dcbccd0f

SHA256
6e59457490be114e3678aa2597529b5b40ac7d1c5b26463065b7b4684de7acc7

SHA512
f0f40b5dadd81d7068010f39f59af24a576d97bae3a750520998d005b16064c7f87b2d0cffe3f8754364d2ad1cf935fbb90f0152a08043e453278f0e4b949136

Download Submit
C:\Windows\SysWOW64\Caocjd32.exe

Filesize
94KB

MD5
8747d2afd6835cc84b064a60c299c086

SHA1
dc56dba86dff155aa4eabfe5fbc5a6fe23fc5e21

SHA256
374de40cb590102feea0f95277f85722be4cbcad94ea6d185e6100b0a3934cae

SHA512
3dcd3d43b47de1099d714d268942cd17bae5de9f5184b36f692f7054e7535a71529ba8939cf36bfd4442d8cb5c8a372cd1e7a4ff48a7d8e80e1295619aebbb18

Download Submit
C:\Windows\SysWOW64\Cdjbpp32.exe

Filesize
94KB

MD5
a195e2d78a1f9df113ec56b34ad89d39

SHA1
5ef260875959c56e40c1660f7e6dfe5870b9345e

SHA256
4987468656f81a9a9884129c219381d6f491882ac9601958884cf33e9c70667f

SHA512
b8dc6aa11be50ffb2ba086ca3bff8d60cacd325cb0c874828f1bc69c55e745d4e1a4ddad103e44e7dd959f61147e0ad8550bc9b69609bcc3e2997921664669d7

Download Submit
C:\Windows\SysWOW64\Cdoeaili.exe

Filesize
94KB

MD5
5154858696db5fe96875b883046e3151

SHA1
cc791deded9fc565223a92a59946bd9be8a481ad

SHA256
d24c8d2cf05ed45ffe73187dc1b8a7d32297b82cf7144829910ac88237623a8c

SHA512
7caa01671eee335ae5854c2151a503734bcdc63ec37b29d9630c7d5c0aeb3772ce3efb761a8d91fee54620e25950c45b4543120ae53f14b11e07b0cfd8d87479

Download Submit
C:\Windows\SysWOW64\Cehbdcmp.exe

Filesize
94KB

MD5
6d1ba8059c52d34d242df04aa654db9f

SHA1
41b7f679166db535cf479436185e175e9bb34830

SHA256
7c99ea1a140d3ff321b3396b99e01f4e4996d21b37ed9f1053d91658479bc4f2

SHA512
66de1c76d4ef4765596350fa9252515a4d5959ef77928c35ff56915d1e296ec0955ff7227ede72366ff03ab27d5a9e52fc5c3910bb0481da56d980e488df6f1c

Download Submit
C:\Windows\SysWOW64\Cellpb32.exe

Filesize
94KB

MD5
aa6ed0c59926d1cab270c9eac0f26a28

SHA1
a76d3b6617067e92c67f060b139c0c8a4975326d

SHA256
45926a2c6c9b2afa19757f09a4f24aa47e182f47d3ba6f5288ed9cf41b4a3d7e

SHA512
5081350eb8125383cdcd6a1c3f28bca61c082af7fbab8bc67fbca02837a316048666467a1967afa23f815bb5f374cc1c4040c92c6f6a5e13319780d5837b5eb9

Download Submit
C:\Windows\SysWOW64\Chhkfn32.exe

Filesize
94KB

MD5
61cba66c9af3c820d78b257847111462

SHA1
c24f3c17d0da61ce1b5cbcfdc04a58fd1586c1a3

SHA256
bb3c3c5c7fc9dcf4c18a0a06c8793c22024ffd497edca4d52a9d628a5862a71f

SHA512
11d7eac16c665aa8a0eba78e6126285713f1a15116f945c55d02547c1619c8119cc00f1b284f42fecf6c300ffd396ba8ce042607684c0046b87cd3c6d2a02c96

Download Submit
C:\Windows\SysWOW64\Chkhln32.exe

Filesize
94KB

MD5
07de91cf5b038f3ecead7a37261744c1

SHA1
d721e3aac8152914a26826c5a6e03461fe8db0a6

SHA256
b27d01f83693e2fb748e2fa8137753e3e1a7cc8342a46765a7fcd9581f7b86e3

SHA512
106d717f87406ed98a45bf0214f2de38bd4b4ef88f197eba93ad48d3c40bb8d94097723770c5bfeaa1d546d554eed912b727324301223f30e3787dd7cd78ffa9

Download Submit
C:\Windows\SysWOW64\Ckghbi32.exe

Filesize
94KB

MD5
4135eeb1f055589fb5ec54ad3adb5802

SHA1
7d680ac427b9fe28ef5352d8276cf12aa66e47b0

SHA256
9d0c8f73ae13b6d70a1694f25915798ae3b1eef130a700c5c0798447affaf130

SHA512
c62683d6050d44f74cb25dfb3a591eb184e78b02e5ede97c59302a21ccb3b9b4dc232dd2d6412a8cc70bec1d4d2da30f8ae63b388172a738e9e8442918ac84be

Download Submit
C:\Windows\SysWOW64\Ckidhi32.exe

Filesize
94KB

MD5
b89f0b56b3a7e327e778e2785f4ae30e

SHA1
5dd778756585d01a0c20753c528fe03656588157

SHA256
5ceb12e89afcd3d8097f9db9c583a90f73f5353fe485099768ce5ae48bfa3ac9

SHA512
98800c047213bcf68944194209ca9b50c4ac1d7179a1f95a7711bdc3619c755584f7299324042fa3f504f46d563b162bc3f38040fc0634e82bd9de429380b111

Download Submit
C:\Windows\SysWOW64\Deckfkof.exe

Filesize
94KB

MD5
cb128b16ae0c4113c3647a5cd8b43f23

SHA1
c72d0bf5ecc492db5ee2af0093d43575f72fd431

SHA256
df70008521bd3c2cfbe1eb1c84f7be1316ab968405c00883d34e55ee010d05a2

SHA512
73af22ae7cc08900465337768df35222cea5600bd2cdb1c1f971508c843a36ab1a720b7c8276264ed5f4145e88f813ab460275e837bbd93238accbe607a922ee

Download Submit
C:\Windows\SysWOW64\Dhokmgpm.exe

Filesize
94KB

MD5
cd961d92c5a207afde211087984ecd7d

SHA1
072d175bd9456cdc0ebe116ccb417a1f9f260630

SHA256
5595fdf8c90a18e77d8b5e16d9dde863d4c884d88b642e99bc02cc82be0e1bfb

SHA512
b76885a1c218311a66deb79cdabfcebd4c8802ac2fbf011e699fea8d781875c4a907c62e9c455c0291d7f27bae99bfc71b4ba9412c2b7f085ae635edfd5f8fab

Download Submit
C:\Windows\SysWOW64\Doncofgp.exe

Filesize
94KB

MD5
4dc75c35949371c8673218424dd0b1c0

SHA1
a0d0c833262439a37e797f11dc61195536271933

SHA256
71e952b95f1b251c2fd6b566f158a9049f593e3e74de7660f26b2a06312d9c59

SHA512
fe2b94c7cea4889b3a7c37cd9c3b912789303f87f45109dd76ce4a51a2aae3ac028fe4fec181ca69667cfea989daedcffb047635e67a37674ff88cea5d661da7

Download Submit
C:\Windows\SysWOW64\Ekcpeeqd.exe

Filesize
94KB

MD5
560c06f86228db419781c7c8214a8864

SHA1
de886b0247c45d5cf6d3276e7b21b7b720ba8d98

SHA256
908f3b703752120cc7b86abc030cd3b808141a1acbe590b4944522b14882d7f6

SHA512
ada122103b263a5fd9996cbc40a3bb8d964bf805cea2f70b385897319aef695c55c79a0c25349e9b69da33434ed9346f65fc5276c5f39279616f560a9d8c7d4e

Download Submit
C:\Windows\SysWOW64\Ekqcpfbg.exe

Filesize
94KB

MD5
fb998cc63addc8f7d62613a4b5707e12

SHA1
afd5e506d80864159a635885f6cf0121c795f3d9

SHA256
30412185a35b46e9f219cbad499eee0d6814b8bf5888fb49f91e98b7b42ef1a2

SHA512
04b50f54f24f77413e609a8c06fec0bd9ae7d46f358a6fffd8cc5aabdb87d03abc8c5666dab644b0298291d9ea5a163f80fcf99e110c54a23e752569406a30a3

Download Submit
C:\Windows\SysWOW64\Faoegofo.exe

Filesize
94KB

MD5
735f2d62895042f88b01d36d59f3262a

SHA1
7e45b171178d9d1175f4f4aabe31edb9ca56be32

SHA256
b4c0c1924b29d5f58807dfa9584a282f06b34d3c90be7954e09c01e21dbe5d5f

SHA512
77822ffd2fba56454fa07325447961da72e902737275934ebde05b894324ba405ab02d81a84125e9fcccbce2049c0362aa97757823a462d7f33cf5f7ad3e1bfc

Download Submit
C:\Windows\SysWOW64\Fhbpjh32.exe

Filesize
94KB

MD5
9c54f166450a4e226908d902b689bc38

SHA1
66109b34ef317105a8727bdd0b04b19423c6e497

SHA256
9722c21ad6e4a52f05f811da2fdfeb2ac7b62f16c0fb7571f859484ada9ca581

SHA512
2f829329abee43dd9c412c17611fc287005f457811bcc2faaff5298db0761b61820c863844ba911d2d291d2230f9223e8dde7823b1b676eb4520fde0ffa784ec

Download Submit
C:\Windows\SysWOW64\Gbmaim32.exe

Filesize
94KB

MD5
3467207c0d043219ad018e4388329f07

SHA1
a7dfad191af38eb91b3d6e2713c8a3b37155e858

SHA256
96a3ac2caf94f890118f161c52317274062da60106835e112ef914259d441d8a

SHA512
b263e186d9e21eb02ec1273dcc6c474fc05b67a63feefe619c0b7ac6d56f1b2fe4cbd5b3f300ff15de9d893e1cdc340072de05797c0f0a9c201b97ed6a4db58c

Download Submit
C:\Windows\SysWOW64\Gkffacpo.exe

Filesize
94KB

MD5
4853fe358db1f1e65021af71a49b9b3b

SHA1
8fc6706cb349d28a9984e82d88f14a4149e07ac9

SHA256
2e17b33a182468ae290634470247541dee6d1eaaa943780b24afc4cdfd8285d0

SHA512
80195266dec345597610476c99efe0454c945ffe0dc27ee1b3aa4ebb29ae668b79b4d243e008b1eb0f6488a8e3d0d22e7edcffafa68f6e81aa74c7ddc19576a0

Download Submit
C:\Windows\SysWOW64\Gofkmadc.exe

Filesize
94KB

MD5
beb3ab670d21b7a79c59576a1662e04f

SHA1
f2ab52e5e0231236e6e6e572ff27b2c1fde77d74

SHA256
67190af4001196a48b7963e04310548431eaa57dcf18e35e7316d36ebc482231

SHA512
3a1117b160f78865175d7c9393b6b790c983aeefb58f99bc0c249eb1328370c96225062dbb824b1622db558992f44e493ff20e2be16c2623c7289107382279e5

Download Submit
C:\Windows\SysWOW64\Hiqllfiq.exe

Filesize
94KB

MD5
143f95702c1865534bf71295be30fccd

SHA1
e0c1f27ded351106dead6f1c7e7a555cfc2b97bf

SHA256
625ff80e4d635a35e971926d94b236cc017aa4d06ef75650c5c7ffbdb96e1ec2

SHA512
a498c28f6c9a36f68b54b74c89e4f8de8c718af1776c830df11c047142b1a3520df50c3b4b5040dfe8d3c4013157bcc2547f8f2b935d9a2572ae64e780b1f478

Download Submit
C:\Windows\SysWOW64\Hkaemafa.exe

Filesize
94KB

MD5
2766efb226bdcd28e68d7b30b3235529

SHA1
663260ab61cf3941ffba35a248dc5194ea811203

SHA256
7212aa44ad30cf3d9bf71a25176bc0463fe7134378fd39ebd106f319b0926296

SHA512
8772017c175ceb967d6fb9c4fd1d93ab55cc57aea3dcc7ee8b13daf3d6c7a1c2395609252d62c3c9a9daf04ef92a082eb6fe7c93002c39d292b9e1e91b1511b6

Download Submit
C:\Windows\SysWOW64\Hohhbq32.exe

Filesize
94KB

MD5
1a49bfc749e12142d8bbbd7f94b22942

SHA1
0cb711e4f8a25a9e3e4e510554dd4770c638c003

SHA256
356f5f413b598ea2b5c038b2a2fe9b457781b6f5323e9aa1c3abfa53f35df23c

SHA512
78e19562a7cc7ff1fbc76de654046c9ed7e7f2af5456e2d14dfc7e4581ceadf42a67af84cdc1128f1cd04149578bcc20a32e94f21d303a7e5b665adb80257cea

Download Submit
C:\Windows\SysWOW64\Ieapgf32.exe

Filesize
94KB

MD5
d20b2fa0514213eed83ad097d49dd38b

SHA1
a3f190733a6df90f213faa7f113ffae177694eab

SHA256
50fdfa2f243145826d4eba368f204b585ae735274b6ba8f4ef5db5e8013a7ee6

SHA512
a1ece1f17242f691d4e8c756c2ef5bf4362305abae5179ddc76b4b870c141ee947f836bab6744adab247f7ec7e9f43beaac16ee4630518ea2516cb5516a3be3c

Download Submit
C:\Windows\SysWOW64\Jmkndq32.exe

Filesize
94KB

MD5
cda41d9900666acddeee7314e33143eb

SHA1
7550fd740ec82915cbf88c2ee87ccc77e776190b

SHA256
58ef797b1a443c5a4a300500446f99c11feb34464308605b0d542a4aadd02736

SHA512
3682cd52c0ca1b9169d5a4a84113e207a67d57b6a37f49a29a7acb47fcd4daf9eede8216db5f2bd00944479d8146eb8774db498616189dd8e1555d93967215b1

Download Submit
C:\Windows\SysWOW64\Kidkoa32.exe

Filesize
94KB

MD5
3030d678aa397fe380cdd56f75180dfd

SHA1
241115b4764bf8e2c8060de628d9371be1232abc

SHA256
87d4fca3441f252272988e81bc9caa00370868ce5eb210185f04cec18dd85650

SHA512
498e82950437e70fe422dbbd3983ec14f0da9941e594d1ce0d908df5c5049885c47abe9df9c8a1c7561fd8c8d42bba8f809bbbd0724f01e3ef65cc82d292cdef

Download Submit
C:\Windows\SysWOW64\Kmadepao.exe

Filesize
94KB

MD5
565ed0c46ffa1460f02326629c99e9d9

SHA1
40d5c0c43aa3da681290c762541a07b7d46896a1

SHA256
9cf0065542bb190a6ace062691d8e19fa091c2234d722ec318647f6e354d8179

SHA512
145d2f397a147eefe86fb2eb8e777d29e3a7e8f0421cde095d8459262949b9b570420de7421644c5fbade3ecf5d4d70c071ffd0ed8f1fb2167475f8fec580e8d

Download Submit
C:\Windows\SysWOW64\Kpbmgj32.exe

Filesize
94KB

MD5
7c1f5bbb4bd14997f977d7c416376b76

SHA1
e8d4178ced09933e0e8f49478755f09149e636c4

SHA256
249e479d7695c891bff05c9ce415b4acb2150885bb4ebb64ce325682dc97b02c

SHA512
800dfd50fb1e7d6d8d5191bdf2489687578ccd03c5be6a6980df70f33e87ab6003eed04cf1a0d86181b6f9fec3d8726b04a7aa5083adc683f74e0d83a445f3cd

Download Submit
C:\Windows\SysWOW64\Lbhocegl.exe

Filesize
94KB

MD5
6785e4e351415afb75770908ddb155de

SHA1
d6703bfffe03c95f29f542f552478cfd57ef3299

SHA256
afe483d5b63d9fe1f17de05c40f9d160d444445afec08c94ba2686c344f004f4

SHA512
bc6cefdedc398f7525fa5b192c47d75877da196b9be97792abf7010627363b831337e08165af843f4b2ba2d5d28a1205a7f9a13bd192ab60b2292ec46404a4ce

Download Submit
C:\Windows\SysWOW64\Lbmhod32.exe

Filesize
94KB

MD5
e350b9e7210fc74d1f56ad4f8a16fead

SHA1
45d0440a0dbfb2eb58d83e9ae58ef5dab6b1bc05

SHA256
a8dcbf68f52a8dd4eeb4e14e57047f4575b829d1ba4333e8b85162416b0188d0

SHA512
bd700ba453d0a3fa7fd1998ee8f0b1f706c11248476d91a12bd22673d079683711c999c9e2fdf2a17942a11e08318fcfab15e6d32271eb096002c7663cb5b1b3

Download Submit
C:\Windows\SysWOW64\Ldbbbh32.exe

Filesize
94KB

MD5
89aa767e9c55d35a5acd0076bc4c678b

SHA1
9944bcd432838b8cd16e2080119ae610df2a1fbe

SHA256
c8b4b10b764fb6113514f388380949cc6526d8b97cb1f453953c120ed780b107

SHA512
97ac3efb930dd6cc0f7a9edc9682cb75dd15a010d8e50da17e287ae77188a7c9a2aca8badf8b420dd997d205e16dbdd6c1d961ce06bcda1775d6d5576b5deaae

Download Submit
C:\Windows\SysWOW64\Lfoaid32.exe

Filesize
94KB

MD5
70c945ddd6795bf1dac72eae97fdbbd0

SHA1
9e9513359114902991efe2abe52a58fdb5bf8a65

SHA256
dc4257a72df526c0f6c0dc9b619443384fc98a87336b1593140c4948502d0bfa

SHA512
c016c1be5cb695211fee9a31ad0de8cf8569092f2af28468bdccfceb45fdf475b935b1ecbc4a0e655eb588b26937bb3e9cf403d93a49690ea0402c2b14260049

Download Submit
C:\Windows\SysWOW64\Llbpbjlj.exe

Filesize
94KB

MD5
a27a6c685b9f7a8055c8412449da60b2

SHA1
23a9ea137eb8552801f1861065db5f8f7416c1f7

SHA256
029297b4bfe63689aebd0776bb71bdd8866c968a2711a409ed269d0e54193557

SHA512
08d13f1f96b32b477db47b93f8d39234253e7a259dd3544e12c3811bc195b11d4de2db4302aaaaf7214c689de54f76fb79754274e47fb659c4fa5528523c4149

Download Submit
C:\Windows\SysWOW64\Llpcljnl.exe

Filesize
94KB

MD5
f79d4bce1b62b483b84ab23c0b9697af

SHA1
059d5fdc342d13c4f298b80d0f85956518e35b5c

SHA256
024b9d6ec90a4f19760264f78da016e4aec555bc44b11455ffc73d554cefcc6d

SHA512
7d826ad9edbc9f98f4f34dd193135e3105cb67d6eb8db0906b9b4e65da1383227c2b29adef6ed15fc072e773afda9351cbb8f10bbacb3a89644e26341fc027e9

Download Submit
C:\Windows\SysWOW64\Mmgfgl32.exe

Filesize
64KB

MD5
1786f99f38e580e20f6102ae54187a8b

SHA1
b6865de495193d2fc4cdebdcbfc072f40a7bd3a3

SHA256
5b64e8665d2788c119e271f1d79aba0a97bd55b4408f94c78ce1a9223df8c949

SHA512
d53a23b9960c23ff4616347b3517244cde0cbe5721faae1436895ff5cd2b4e7234aa7925d85e8f579b5fbc1c20345adf7179f93102f685a09e512ef4198f471f

Download Submit
C:\Windows\SysWOW64\Mmkpbl32.exe

Filesize
94KB

MD5
4b163ee0ee8b5883281b70926434b82f

SHA1
75bcf53516ac94338a1f518bcb4693d87711d150

SHA256
2e1057086f85ecf2da71c5fc0dc97eb581afca6d9a47a53762d5ba4603b2a292

SHA512
65b6cdc6292b6341fdc5f950dd8eded05c6c74cba0ceb837499001f09812e9bde5fd018ceec32a1fcfd90c59435a1f72f420584ae6155f35950b9139e73b7105

Download Submit
C:\Windows\SysWOW64\Mplhdghc.exe

Filesize
94KB

MD5
40cf5a71102aa8481826c69bcb6bbcd6

SHA1
3511990dad89894429a450f6a76d1a90a25ebc8e

SHA256
7553071b4e6b6883f45f49e95a8d7d9ae195b676e222eb0f0cf47983e14ec7e3

SHA512
66d5c31dba9b9c538cdda851bf1d323e75a583032735c422a9973440974e397272463910fa45546ec0fe1d54045e2486f60fc5f1f26eba0117b9248a58d96c90

Download Submit
C:\Windows\SysWOW64\Nidmml32.exe

Filesize
94KB

MD5
7d05a8f06803d9ca6c62258273ea52ff

SHA1
8b2fc5df5668da8a541107199d2bee18e1bf0e14

SHA256
682ab55599dd3bd6a885aed0ca5bdf07dd8a8738036917a416aa4cac9bd7c92e

SHA512
40b3f8475635260e235547a758633c7a3749ea31e309f922f9eddaffc8f14a995bd90a592a4ce2fd3bc0932a17d8a755a8d7804250881d046511fcebd2c56050

Download Submit
C:\Windows\SysWOW64\Njifhljn.exe

Filesize
94KB

MD5
2a6c5a05860daf123f1ae639c4b00bc0

SHA1
a48ecbe5819c7c487a12d2489c44f07a54e13039

SHA256
7ebc74551e18188b7db700c8a4b6c1c54b8fd53849475fa8284b084f390625f4

SHA512
d9486b42de2e60d8e736e98ce48d680bab7405588026f7f57f0331a6d79f25397b96debd6b5ef36a748a6f756028dfbb140871f72ec0ce71d7305ee26622daf6

Download Submit
C:\Windows\SysWOW64\Ockngp32.exe

Filesize
94KB

MD5
000218988a996955aac833e4315e57bc

SHA1
2f499f5ae4fad0f6cd3e061157a027099629c054

SHA256
5d8d855c7aaded773b5f428997a395eb9a40c2a3da00bb588ccba678e90c4132

SHA512
d04c6f1a8894b3c38a76cdef43472dfcc6df48bac08789e9074385226be0082318a717884f4d38a30a3622e07325843df025c48c98f07e262a69f0377092c1b7

Download Submit
C:\Windows\SysWOW64\Ocmjlpfa.exe

Filesize
94KB

MD5
94a4b0f03884335ee30ffaf2b6fc7586

SHA1
b3fb807f9dc2e73b10f28c768894d3d13b87c4f0

SHA256
dac66add36771323855f10a4933b5324ee11ab93c1c9d02b93a55a57f8d757af

SHA512
8a83804de5a998b13d799df665c3db51917c185a0af683ec8bab68ab97d93d18e957296f55ef41c3c7498ded6208a6f3020ef615f8fca036d921174d3fd70e6f

Download Submit
C:\Windows\SysWOW64\Ocpgbodo.exe

Filesize
94KB

MD5
d25c8fe083020be294ff23e24ab653e8

SHA1
d206dfd4b7ae3621df3f9d7e389fc2a79648efa1

SHA256
87916af6007b3b144145444d58af0baea8a2fc0989c046f3211454cc01d3d9c1

SHA512
7005853faeba41361ce0e9079b70bcd9b5491529944fd6cf1917dbac91876d9556011233ed6e5efbede42680b1b59bc0c172b45480134bcb161733733ae1a14d

Download Submit
C:\Windows\SysWOW64\Odcdpd32.exe

Filesize
94KB

MD5
78fa986ca0f31852156195672e5f2487

SHA1
8a21c71a76950cc1b95095b651fc3fcd3a3611f8

SHA256
5ba37d45c4df3da6ffa7f3e804e1c7ec218d7be231b7a4326a16ffb252fde144

SHA512
738a4fe118de8b533e310359b5cb1a850fafeaad4af39566bbffdfc09c9313d204c9dc79de5243fdfdff4303c625efc5f4e3e9cac9ed76fd7519ae16fedabe7e

Download Submit
C:\Windows\SysWOW64\Ofgmml32.exe

Filesize
94KB

MD5
45c4f7a5eb9a6333a0799917c9728496

SHA1
a0eadd34c84426176f50251d52c1e87ba2998c40

SHA256
d9e4c71a23dbc1d151b8f019dd31e691449410168a99b12a9e0e1efbc94924ea

SHA512
d83bc05b214b355fb35b629a5ae609870c938eee14ccab80f4d5f405e5e6c33105cbea7d65ccceafcc99d5d331095b18ffca99d8b8cc8ca78d50b5f9736d75bd

Download Submit
C:\Windows\SysWOW64\Oloidfcj.exe

Filesize
94KB

MD5
855737b2e86ef711269b0b6e0e3128d7

SHA1
d85b04f4b4a26bc45d6d3f2c35ea72c383308061

SHA256
3fbdcea7c7a05560305598d5add1c46781e834261c1c36ddece5b0707a715292

SHA512
f846bb32f66067e8803f1bafe36d1a928c2b61d1a67c521bf33dadc9e49cfcfdf2c2f06ad014f83edec8f40b1820c8284642c9385de4ecadf7948de729fc951c

Download Submit
C:\Windows\SysWOW64\Onekoh32.exe

Filesize
94KB

MD5
89ee1b1964f529cded3c4c2f29c88219

SHA1
0e3aff7824ca6e01e7b3e2e18b8915081dfe0e9d

SHA256
0d5dc109392e16d0294fd7e533e846e965574e8dfe517b78ea8a38c9f4a592ad

SHA512
62f102d996e4e4df564f23332bbd84cb59d7af398bd097977295accd8337fbebefa8e3da7b0652858d97b4e694a5c0d785bc754e89a1cbe7bef66e62beb767a9

Download Submit
C:\Windows\SysWOW64\Onqbdihj.exe

Filesize
94KB

MD5
3c70f28cebf292c905e91813987d8166

SHA1
c8d44995c6e707e45fa780e7395232a063b3d7ad

SHA256
c6b48f7ae035c20adee4d6ff1c163763e049c1f16f16d559c9e9f14781648277

SHA512
60da951f262f6da76e3d2ce7d1c38913a165c36759459d131b51021a89d75ef81f67fdf6f49adb40b425f24247cc07bea294baab9256840d1d00e15211e630ff

Download Submit
C:\Windows\SysWOW64\Pddmga32.exe

Filesize
94KB

MD5
3fec81f8ec8eb3a0e9f6e86f2911f846

SHA1
0840738aa946d012344161e06f4e5e051cc6cba1

SHA256
9b08c0ef8aa256005d7e0b14b8ab3f813210e3b49447d2b48aa2c506e0c63f00

SHA512
a6e7c50e36aef11b62fea3ab501779472b7aad5be28c1ddef41a48f6efb04729670a037bd67c780e76bd8b0d9f9a63a7a193c01cdbc34b0c6bb062a2359b081f

Download Submit
C:\Windows\SysWOW64\Pdoclbla.exe

Filesize
94KB

MD5
7270304002dc3cd31b9bc275f38628b6

SHA1
cbf5a634253d19ad960f53059084c7ffc3805e7b

SHA256
897982d5c3947ccbb73a0713ec31a7ec92ace910553e99a1d147a24c9319ed95

SHA512
cc1384325dd068b796bd76b5209eb7bd97cce920655218f6f11d830dfa5b12de1becc7d6fb63fd22cbeba15e49c056afc3377c17af6aba525ef00018448770f7

Download Submit
C:\Windows\SysWOW64\Pfgfdikg.exe

Filesize
94KB

MD5
7c331e3343bc52fa17712d815b14626a

SHA1
bbe4a461046db7ce041a6870e306bc6c570c833c

SHA256
bdc19118d84db29b69ebbe41f4594b8e0ff03cb25445b8b2ca422e20b30b29ed

SHA512
ceb49050d95727be0352d942de4dce424b6e36527c4b4280a08f7c587c0e5e9791de86770b9a062b363c7d20d9ecee1f1176c47401c9afab1e3e4834cc911b44

Download Submit
C:\Windows\SysWOW64\Pjlldiji.exe

Filesize
94KB

MD5
acdb075864cd114c77a000627472918e

SHA1
0a4708beaab6982de7a4c573c36146b7871e1fa0

SHA256
54f6ca7466b12dc7c2ede18b2a2a499bec87359b8e9f3e013b942216176d6069

SHA512
c6adcaf21e349f4de99b484f776488fbfb3dfac9f50181811955c6bd281cde3b075c8c52bf1fa304cd2726771b28d89659b9d0efa4eec59a79f79a7f1103356a

Download Submit
C:\Windows\SysWOW64\Pjnijihf.exe

Filesize
94KB

MD5
ebf6ddfffcbc44e0c1e36b2544e82a8d

SHA1
4fcc64f76113f180946a74a24587a8273059d5fc

SHA256
9399e4af95587a648fa89b8fcbea59c3e9c30719615cb18cfb3cf0ad1c0eb311

SHA512
0278bca06e1dd5177dc29f1a2aefedf8c77ebd2490f7c0fb5d8d7522d2fdfddbb26db588e439a9d744674a338a58a92ee75c9e237c87ce445b3effe19f659147

Download Submit
C:\Windows\SysWOW64\Pqfdac32.exe

Filesize
94KB

MD5
fd154649cb29142e2ccd0153d63fe4e2

SHA1
fc4f3ba1c07cf43285c7a47cd08a20bb0bce9fb3

SHA256
cd739afee77028ee61c06cf92c5752f4e00a0c843f6558be0d484e45a07fba30

SHA512
424357231ef1de25cbae261170d3e817ca0be17467c0dfc0a07b651e4920bb720cfe7c06b4547af76fabc2d2e73211bc231c07b21676b87489b3888aa11cc0d1

Download Submit
C:\Windows\SysWOW64\Qgllil32.exe

Filesize
94KB

MD5
27bf3f42c589e367d50ff664e7b65750

SHA1
a4f9a42b4c4a8e116acbc817b98c8f1be0f5b127

SHA256
3152e47c153f599a55ff9ff52bf930a4b2f64b6f675ab2e663069b3bf385399b

SHA512
543041cd44656c598e4595e62e4c3a96249b7b56491a8a31f9ba29e4c438bca7675454cf60b4266d9a11aae62e54a3054cbb21f370ae8da90609728b1d9411f3

Download Submit
C:\Windows\SysWOW64\Qmfhlcoo.exe

Filesize
94KB

MD5
149da9f60a9f5dcc180186784ec03366

SHA1
9c93c1dba40dcd6c2f0c295e8049b58c96d8e5d6

SHA256
5402c1e5b0416ed0831b6f9a2c5bd9d901d76b6b1e496bee30dd91617a343c82

SHA512
c71228f321ddfc2c6a28dba01426aa7c10f6b11d923c2ef0295cd796c4157fb9241d0a6d2c2d76c1146e3853708370163dbce0e4c0291ba22ba622bdf085f094

Download Submit
memory/8-98-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/8-16-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/456-126-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/456-216-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/620-198-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/620-109-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/628-136-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/628-225-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/632-371-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/632-306-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1064-427-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1220-391-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1220-325-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1296-283-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1352-144-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1352-238-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1424-345-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1424-412-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1500-118-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1500-211-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1516-81-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1516-171-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1520-282-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1520-190-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1580-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1580-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/1580-72-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1628-338-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1628-270-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1660-420-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1664-392-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1840-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1840-143-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1892-413-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1916-49-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1916-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1920-357-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1920-292-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2064-299-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2064-364-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2216-180-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2216-90-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2616-256-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2928-385-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2968-372-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2984-298-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2984-217-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3052-318-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3052-248-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3124-398-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3124-332-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3160-172-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3160-260-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3264-166-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3264-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3384-406-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3452-199-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3452-289-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3512-351-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3512-419-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3528-189-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3528-99-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3604-365-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3604-433-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3672-153-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3672-244-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3768-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3768-89-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3944-434-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3960-378-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4052-226-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4052-305-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4088-239-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4228-399-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4448-212-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4484-405-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4484-339-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4540-40-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4540-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4564-269-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4564-181-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4576-384-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4576-319-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4592-167-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4812-261-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4812-331-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5016-33-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5016-116-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5024-426-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5024-358-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5040-316-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5080-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5080-152-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5112-107-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5112-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5116-290-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads