75d66f7bdbb609e13b9910245bced3b66b9479da209c0a2fb998441a8738b607

Analysis

max time kernel
131s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75d66f7bdbb609e13b9910245bced3b66b9479da209c0a2fb998441a8738b607.exe
Size

94KB
MD5

1cf5421cc88ec3a18401fcf93c5160f2
SHA1

1be2fd80aa7b785799196258d6ee1141da9c8885
SHA256

75d66f7bdbb609e13b9910245bced3b66b9479da209c0a2fb998441a8738b607
SHA512

19058d66cec8693749a932d0c6013748eadd7a716c46e9f48d827d826bd5260b7da2f5accabb7296b9c40c4f4bd4080c63d2c6cad1a3df6072c960d744973bb5
SSDEEP

1536:/X4oPl0QHK/NaNU1PYj2LPnaIZTJ+7LhkiB0MPiKeEAgv:/o6lhHIceFPaMU7uihJ5v

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ononmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hohjgpmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gckcap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfkamk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdpmkhjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agobna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjomldfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pocdba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Didjqoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmikb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndinck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcnkli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omgabj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfkamk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fiilblom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iqaiga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgeogb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpfcelml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkpbpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndkjik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oediim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Didjqoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebcdjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbknhqbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djbbhafj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enpknplq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgaelcgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdeffgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmdlflki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckmmpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oahnhncc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkonbamc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnhjig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgjcfgoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmghklif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkcjjhgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbniai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eflceb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpelqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cemndbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhdmfljb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Limpiomm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lplaaiqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhnichde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmnlpcel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgngih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofhcdlgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnhacn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhckeeam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meadlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgbpdgap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nockkcjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpomem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clpppmqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cldjkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mklpof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abpmpkoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flghognq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgdlcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdbooik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcike32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjfoja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgcbbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnnoip32.exe

Executes dropped EXE 64 IoCs

pid	Process
1544	Kfkamk32.exe
2364	Kmeiie32.exe
1756	Lhjnfn32.exe
1904	Lfmnbjcg.exe
2088	Lacbpccn.exe
4112	Ljkghi32.exe
1432	Laeoec32.exe
856	Lfbgmj32.exe
6116	Laglkb32.exe
1444	Ldfhgn32.exe
1944	Lmnlpcel.exe
1980	Lfgahikm.exe
2420	Lmqiec32.exe
5132	Mdkabmjf.exe
5224	Mkdiog32.exe
3472	Mhhjhlqm.exe
5824	Maaoaa32.exe
2456	Mgngih32.exe
5748	Mackfa32.exe
4544	Meoggpmd.exe
1548	Mklpof32.exe
3940	Mmjlkb32.exe
3464	Meadlo32.exe
2772	Mgbpdgap.exe
820	Moiheebb.exe
3972	Nmlhaa32.exe
2796	Necqbo32.exe
3344	Nhbmnj32.exe
3016	Ngemjg32.exe
1004	Nolekd32.exe
1140	Nnoefagj.exe
3616	Nefmgogl.exe
5452	Ndinck32.exe
5732	Nggjog32.exe
4912	Nkbfpeec.exe
4740	Nnabladg.exe
4404	Namnmp32.exe
5064	Ndkjik32.exe
4576	Ngifef32.exe
3660	Nkebee32.exe
2484	Noqofdlj.exe
4548	Naokbokn.exe
1796	Nejgbn32.exe
2852	Nhicoi32.exe
5352	Nkgoke32.exe
4400	Nockkcjg.exe
6056	Naaghoik.exe
2572	Ndpcdjho.exe
4412	Nhkpdi32.exe
2996	Nkjlqd32.exe
4352	Noehac32.exe
1040	Onhhmpoo.exe
5920	Oacdmo32.exe
3528	Odbpij32.exe
5260	Ohnljine.exe
3276	Ogqmee32.exe
5156	Oklifdmi.exe
3680	Onjebpml.exe
2092	Oeamcmmo.exe
4532	Oddmoj32.exe
5336	Ohpiphlb.exe
1008	Ogcike32.exe
4592	Oojalb32.exe
4220	Onmahojj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cnglpdin.dll	Ahgamo32.exe
File opened for modification	C:\Windows\SysWOW64\Mdkabmjf.exe	Lmqiec32.exe
File created	C:\Windows\SysWOW64\Nibaepqb.dll	Onmahojj.exe
File created	C:\Windows\SysWOW64\Oggbfdog.exe	Odifjipd.exe
File opened for modification	C:\Windows\SysWOW64\Hofmaq32.exe	Hpcmfchg.exe
File opened for modification	C:\Windows\SysWOW64\Hcdfho32.exe	Hohjgpmo.exe
File created	C:\Windows\SysWOW64\Nojgmmgl.dll	Oknnanhj.exe
File created	C:\Windows\SysWOW64\Mmjlkb32.exe	Mklpof32.exe
File created	C:\Windows\SysWOW64\Pbdgkjib.dll	Pfmlok32.exe
File created	C:\Windows\SysWOW64\Ggoiap32.exe	Fhnichde.exe
File opened for modification	C:\Windows\SysWOW64\Cejjdlap.exe	Cbknhqbl.exe
File opened for modification	C:\Windows\SysWOW64\Cbnknpqj.exe	Cnboma32.exe
File created	C:\Windows\SysWOW64\Onccdj32.dll	Dajnol32.exe
File created	C:\Windows\SysWOW64\Nhkpdi32.exe	Ndpcdjho.exe
File created	C:\Windows\SysWOW64\Gpdlfdin.dll	Oeffnl32.exe
File created	C:\Windows\SysWOW64\Aohfdnil.exe	Akmjdpac.exe
File created	C:\Windows\SysWOW64\Bkfmjnii.exe	Bihancje.exe
File created	C:\Windows\SysWOW64\Nghhhc32.dll	Flghognq.exe
File created	C:\Windows\SysWOW64\Oedeli32.dll	Mjafoapj.exe
File created	C:\Windows\SysWOW64\Jeqgecof.dll	Odifjipd.exe
File created	C:\Windows\SysWOW64\Mdodbf32.exe	Mmdlflki.exe
File opened for modification	C:\Windows\SysWOW64\Oknnanhj.exe	Ogbbqo32.exe
File opened for modification	C:\Windows\SysWOW64\Nnabladg.exe	Nkbfpeec.exe
File created	C:\Windows\SysWOW64\Andqol32.exe	Akfdcq32.exe
File created	C:\Windows\SysWOW64\Hgdlcm32.exe	Homcbo32.exe
File created	C:\Windows\SysWOW64\Gonngd32.dll	Mjfoja32.exe
File created	C:\Windows\SysWOW64\Mgngih32.exe	Maaoaa32.exe
File opened for modification	C:\Windows\SysWOW64\Nmlhaa32.exe	Moiheebb.exe
File created	C:\Windows\SysWOW64\Dpmihlcf.dll	Bihancje.exe
File opened for modification	C:\Windows\SysWOW64\Decdeama.exe	Dojlhg32.exe
File opened for modification	C:\Windows\SysWOW64\Dalkek32.exe	Dnnoip32.exe
File created	C:\Windows\SysWOW64\Pdeffgff.exe	Pbfjjlgc.exe
File created	C:\Windows\SysWOW64\Bejhhd32.exe	Bnppkj32.exe
File opened for modification	C:\Windows\SysWOW64\Eifffoob.exe	Eekjep32.exe
File opened for modification	C:\Windows\SysWOW64\Jflnafno.exe	Jfjakgpa.exe
File opened for modification	C:\Windows\SysWOW64\Ogmiepcf.exe	Npcaie32.exe
File created	C:\Windows\SysWOW64\Kaihqipl.dll	Ogqmee32.exe
File created	C:\Windows\SysWOW64\Bbbada32.dll	Pdbiphhi.exe
File opened for modification	C:\Windows\SysWOW64\Fpqgjf32.exe	Fhiphi32.exe
File created	C:\Windows\SysWOW64\Cdnchk32.dll	Homcbo32.exe
File created	C:\Windows\SysWOW64\Lfloio32.dll	Oggllnkl.exe
File created	C:\Windows\SysWOW64\Nnabladg.exe	Nkbfpeec.exe
File opened for modification	C:\Windows\SysWOW64\Pdeffgff.exe	Pbfjjlgc.exe
File created	C:\Windows\SysWOW64\Mjoqjkkb.dll	Bpfcelml.exe
File created	C:\Windows\SysWOW64\Cnlpgibd.exe	Ciogobcm.exe
File created	C:\Windows\SysWOW64\Oaegbm32.dll	Fibfbm32.exe
File created	C:\Windows\SysWOW64\Mmpbkm32.exe	Mjafoapj.exe
File created	C:\Windows\SysWOW64\Ejqdci32.dll	Oookgbpj.exe
File opened for modification	C:\Windows\SysWOW64\Adnilfnl.exe	Abpmpkoh.exe
File opened for modification	C:\Windows\SysWOW64\Ggoiap32.exe	Fhnichde.exe
File created	C:\Windows\SysWOW64\Kljhfc32.dll	Hfpenj32.exe
File created	C:\Windows\SysWOW64\Fnknkkci.dll	Ogbbqo32.exe
File created	C:\Windows\SysWOW64\Pdpmkhjl.exe	Pfmlok32.exe
File opened for modification	C:\Windows\SysWOW64\Dbgdnelk.exe	Dolinf32.exe
File created	C:\Windows\SysWOW64\Conpjg32.dll	Gegchl32.exe
File created	C:\Windows\SysWOW64\Jcgldl32.exe	Jokpcmmj.exe
File created	C:\Windows\SysWOW64\Cbiabq32.exe	Cqiehnml.exe
File created	C:\Windows\SysWOW64\Miagbi32.dll	Cejjdlap.exe
File created	C:\Windows\SysWOW64\Gcdnbiac.dll	Okqbac32.exe
File created	C:\Windows\SysWOW64\Mcjkng32.dll	Pgoigcip.exe
File created	C:\Windows\SysWOW64\Maghkogk.dll	Qdipag32.exe
File opened for modification	C:\Windows\SysWOW64\Dpglmjoj.exe	Dlkplk32.exe
File created	C:\Windows\SysWOW64\Meahle32.dll	Epehnhbj.exe
File created	C:\Windows\SysWOW64\Limpiomm.exe	Lcqgahoe.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10884	10788	WerFault.exe	485

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmnlpcel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdlgmgdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogdofo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhbmnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbbblhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmbfiokn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eieplhlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elaobdmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clpppmqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clbmfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noqofdlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjjggede.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbfema32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aohfdnil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcdfho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifleji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ophjdehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhaope32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dolinf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dehnpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eldbbjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoekde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhhjhlqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgngih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onmahojj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cehdib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacbpccn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofhcdlgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbdmdlie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdbiphhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgaelcgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbifol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Necqbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afnefieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icpecm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laglkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldfhgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pklamb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokcjngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihheqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijngkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogqmee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glqkefff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnhacn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cejjdlap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deejpjgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndkjik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdipag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnllhpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpkppbho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfbgmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qbmpjkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgfhnpde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfehpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eldlhckj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opjgidfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laeoec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efjgpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpjjpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnnoip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mackfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfmlok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhdmfljb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebcdjc32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbgdnelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcdfho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npjnbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	75d66f7bdbb609e13b9910245bced3b66b9479da209c0a2fb998441a8738b607.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfmnbjcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aijeme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ainnhdbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgokdomj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lahjag32.dll"	Jfgefg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpelqj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfcmhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ononmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qomghp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afpbkicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafhdj32.dll"	Pdmikb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhehkepj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nalgbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngifef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdbiphhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lofllk32.dll"	Aijeme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehofco32.dll"	Mgbpdgap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbeobhlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpnngh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkkdccim.dll"	Necqbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oalpigkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfmdccgi.dll"	Djbbhafj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnoiqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djpfbahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deejpjgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcmaho32.dll"	Nefmgogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgllad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjafoapj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miipencp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajjjjghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlbfmjqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eifffoob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eoekde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imneeb32.dll"	Ljmmcbdp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbfema32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfhaapee.dll"	Ndkjik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popdldep.dll"	Agjhbbob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chfaenfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfjebllk.dll"	Cbnknpqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cinndkag.dll"	Dlnlak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhemcq32.dll"	Ehkcgkdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Migcpneb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eieplhlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aokcjngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnppkj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnebmgjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npcaie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfjpai32.dll"	Qgehml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahpdcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbbkbbkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjomldfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgjaf32.dll"	Aokcjngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akghjq32.dll"	Aeglbeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plogne32.dll"	Belemd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkcancmc.dll"	Cbknhqbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elaobdmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnknkkci.dll"	Ogbbqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcpfdg32.dll"	Laglkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agjhbbob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppcjmk32.dll"	Anfmeldl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 1544	5684	75d66f7bdbb609e13b9910245bced3b66b9479da209c0a2fb998441a8738b607.exe	90
PID 5684 wrote to memory of 1544	5684	75d66f7bdbb609e13b9910245bced3b66b9479da209c0a2fb998441a8738b607.exe	90
PID 5684 wrote to memory of 1544	5684	75d66f7bdbb609e13b9910245bced3b66b9479da209c0a2fb998441a8738b607.exe	90
PID 1544 wrote to memory of 2364	1544	Kfkamk32.exe	91
PID 1544 wrote to memory of 2364	1544	Kfkamk32.exe	91
PID 1544 wrote to memory of 2364	1544	Kfkamk32.exe	91
PID 2364 wrote to memory of 1756	2364	Kmeiie32.exe	92
PID 2364 wrote to memory of 1756	2364	Kmeiie32.exe	92
PID 2364 wrote to memory of 1756	2364	Kmeiie32.exe	92
PID 1756 wrote to memory of 1904	1756	Lhjnfn32.exe	93
PID 1756 wrote to memory of 1904	1756	Lhjnfn32.exe	93
PID 1756 wrote to memory of 1904	1756	Lhjnfn32.exe	93
PID 1904 wrote to memory of 2088	1904	Lfmnbjcg.exe	94
PID 1904 wrote to memory of 2088	1904	Lfmnbjcg.exe	94
PID 1904 wrote to memory of 2088	1904	Lfmnbjcg.exe	94
PID 2088 wrote to memory of 4112	2088	Lacbpccn.exe	96
PID 2088 wrote to memory of 4112	2088	Lacbpccn.exe	96
PID 2088 wrote to memory of 4112	2088	Lacbpccn.exe	96
PID 4112 wrote to memory of 1432	4112	Ljkghi32.exe	97
PID 4112 wrote to memory of 1432	4112	Ljkghi32.exe	97
PID 4112 wrote to memory of 1432	4112	Ljkghi32.exe	97
PID 1432 wrote to memory of 856	1432	Laeoec32.exe	98
PID 1432 wrote to memory of 856	1432	Laeoec32.exe	98
PID 1432 wrote to memory of 856	1432	Laeoec32.exe	98
PID 856 wrote to memory of 6116	856	Lfbgmj32.exe	100
PID 856 wrote to memory of 6116	856	Lfbgmj32.exe	100
PID 856 wrote to memory of 6116	856	Lfbgmj32.exe	100
PID 6116 wrote to memory of 1444	6116	Laglkb32.exe	101
PID 6116 wrote to memory of 1444	6116	Laglkb32.exe	101
PID 6116 wrote to memory of 1444	6116	Laglkb32.exe	101
PID 1444 wrote to memory of 1944	1444	Ldfhgn32.exe	102
PID 1444 wrote to memory of 1944	1444	Ldfhgn32.exe	102
PID 1444 wrote to memory of 1944	1444	Ldfhgn32.exe	102
PID 1944 wrote to memory of 1980	1944	Lmnlpcel.exe	103
PID 1944 wrote to memory of 1980	1944	Lmnlpcel.exe	103
PID 1944 wrote to memory of 1980	1944	Lmnlpcel.exe	103
PID 1980 wrote to memory of 2420	1980	Lfgahikm.exe	104
PID 1980 wrote to memory of 2420	1980	Lfgahikm.exe	104
PID 1980 wrote to memory of 2420	1980	Lfgahikm.exe	104
PID 2420 wrote to memory of 5132	2420	Lmqiec32.exe	105
PID 2420 wrote to memory of 5132	2420	Lmqiec32.exe	105
PID 2420 wrote to memory of 5132	2420	Lmqiec32.exe	105
PID 5132 wrote to memory of 5224	5132	Mdkabmjf.exe	107
PID 5132 wrote to memory of 5224	5132	Mdkabmjf.exe	107
PID 5132 wrote to memory of 5224	5132	Mdkabmjf.exe	107
PID 5224 wrote to memory of 3472	5224	Mkdiog32.exe	108
PID 5224 wrote to memory of 3472	5224	Mkdiog32.exe	108
PID 5224 wrote to memory of 3472	5224	Mkdiog32.exe	108
PID 3472 wrote to memory of 5824	3472	Mhhjhlqm.exe	109
PID 3472 wrote to memory of 5824	3472	Mhhjhlqm.exe	109
PID 3472 wrote to memory of 5824	3472	Mhhjhlqm.exe	109
PID 5824 wrote to memory of 2456	5824	Maaoaa32.exe	110
PID 5824 wrote to memory of 2456	5824	Maaoaa32.exe	110
PID 5824 wrote to memory of 2456	5824	Maaoaa32.exe	110
PID 2456 wrote to memory of 5748	2456	Mgngih32.exe	111
PID 2456 wrote to memory of 5748	2456	Mgngih32.exe	111
PID 2456 wrote to memory of 5748	2456	Mgngih32.exe	111
PID 5748 wrote to memory of 4544	5748	Mackfa32.exe	112
PID 5748 wrote to memory of 4544	5748	Mackfa32.exe	112
PID 5748 wrote to memory of 4544	5748	Mackfa32.exe	112
PID 4544 wrote to memory of 1548	4544	Meoggpmd.exe	113
PID 4544 wrote to memory of 1548	4544	Meoggpmd.exe	113
PID 4544 wrote to memory of 1548	4544	Meoggpmd.exe	113
PID 1548 wrote to memory of 3940	1548	Mklpof32.exe	114

C:\Users\Admin\AppData\Local\Temp\75d66f7bdbb609e13b9910245bced3b66b9479da209c0a2fb998441a8738b607.exe
"C:\Users\Admin\AppData\Local\Temp\75d66f7bdbb609e13b9910245bced3b66b9479da209c0a2fb998441a8738b607.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\SysWOW64\Kfkamk32.exe
  C:\Windows\system32\Kfkamk32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\Kmeiie32.exe
    C:\Windows\system32\Kmeiie32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\SysWOW64\Lhjnfn32.exe
      C:\Windows\system32\Lhjnfn32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Windows\SysWOW64\Lfmnbjcg.exe
        
        C:\Windows\system32\Lfmnbjcg.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1904
      - C:\Windows\SysWOW64\Lacbpccn.exe
        
        C:\Windows\system32\Lacbpccn.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Ljkghi32.exe
        
        C:\Windows\system32\Ljkghi32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Laeoec32.exe
        
        C:\Windows\system32\Laeoec32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\SysWOW64\Lfbgmj32.exe
        
        C:\Windows\system32\Lfbgmj32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Windows\SysWOW64\Laglkb32.exe
        
        C:\Windows\system32\Laglkb32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6116
        
        C:\Windows\SysWOW64\Ldfhgn32.exe
        
        C:\Windows\system32\Ldfhgn32.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Lmnlpcel.exe
        
        C:\Windows\system32\Lmnlpcel.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\SysWOW64\Lfgahikm.exe
        
        C:\Windows\system32\Lfgahikm.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Lmqiec32.exe
        
        C:\Windows\system32\Lmqiec32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\SysWOW64\Mdkabmjf.exe
        
        C:\Windows\system32\Mdkabmjf.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5132
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5224
        
        C:\Windows\SysWOW64\Mhhjhlqm.exe
        
        C:\Windows\system32\Mhhjhlqm.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Maaoaa32.exe
        
        C:\Windows\system32\Maaoaa32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5824
        
        C:\Windows\SysWOW64\Mgngih32.exe
        
        C:\Windows\system32\Mgngih32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Mackfa32.exe
        
        C:\Windows\system32\Mackfa32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5748
        
        C:\Windows\SysWOW64\Meoggpmd.exe
        
        C:\Windows\system32\Meoggpmd.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Mklpof32.exe
        
        C:\Windows\system32\Mklpof32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\Mmjlkb32.exe
        
        C:\Windows\system32\Mmjlkb32.exe
        23⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Meadlo32.exe
        
        C:\Windows\system32\Meadlo32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Mgbpdgap.exe
        
        C:\Windows\system32\Mgbpdgap.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Moiheebb.exe
        
        C:\Windows\system32\Moiheebb.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:820
        
        C:\Windows\SysWOW64\Nmlhaa32.exe
        
        C:\Windows\system32\Nmlhaa32.exe
        27⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Necqbo32.exe
        
        C:\Windows\system32\Necqbo32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Nhbmnj32.exe
        
        C:\Windows\system32\Nhbmnj32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Windows\SysWOW64\Ngemjg32.exe
        
        C:\Windows\system32\Ngemjg32.exe
        30⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Windows\SysWOW64\Nolekd32.exe
        
        C:\Windows\system32\Nolekd32.exe
        31⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Nnoefagj.exe
        
        C:\Windows\system32\Nnoefagj.exe
        32⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\SysWOW64\Nefmgogl.exe
        
        C:\Windows\system32\Nefmgogl.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3616
        
        C:\Windows\SysWOW64\Ndinck32.exe
        
        C:\Windows\system32\Ndinck32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5452
        
        C:\Windows\SysWOW64\Nggjog32.exe
        
        C:\Windows\system32\Nggjog32.exe
        35⤵
        Executes dropped EXE
        
        PID:5732
        
        C:\Windows\SysWOW64\Nkbfpeec.exe
        
        C:\Windows\system32\Nkbfpeec.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4912
        
        C:\Windows\SysWOW64\Nnabladg.exe
        
        C:\Windows\system32\Nnabladg.exe
        37⤵
        Executes dropped EXE
        
        PID:4740
        
        C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        38⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Ndkjik32.exe
        
        C:\Windows\system32\Ndkjik32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\Ngifef32.exe
        
        C:\Windows\system32\Ngifef32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Nkebee32.exe
        
        C:\Windows\system32\Nkebee32.exe
        41⤵
        Executes dropped EXE
        
        PID:3660
        
        C:\Windows\SysWOW64\Noqofdlj.exe
        
        C:\Windows\system32\Noqofdlj.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Windows\SysWOW64\Naokbokn.exe
        
        C:\Windows\system32\Naokbokn.exe
        43⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Nejgbn32.exe
        
        C:\Windows\system32\Nejgbn32.exe
        44⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Nhicoi32.exe
        
        C:\Windows\system32\Nhicoi32.exe
        45⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\Nkgoke32.exe
        
        C:\Windows\system32\Nkgoke32.exe
        46⤵
        Executes dropped EXE
        
        PID:5352
        
        C:\Windows\SysWOW64\Nockkcjg.exe
        
        C:\Windows\system32\Nockkcjg.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Naaghoik.exe
        
        C:\Windows\system32\Naaghoik.exe
        48⤵
        Executes dropped EXE
        
        PID:6056
        
        C:\Windows\SysWOW64\Ndpcdjho.exe
        
        C:\Windows\system32\Ndpcdjho.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2572
        
        C:\Windows\SysWOW64\Nhkpdi32.exe
        
        C:\Windows\system32\Nhkpdi32.exe
        50⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Nkjlqd32.exe
        
        C:\Windows\system32\Nkjlqd32.exe
        51⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Noehac32.exe
        
        C:\Windows\system32\Noehac32.exe
        52⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Onhhmpoo.exe
        
        C:\Windows\system32\Onhhmpoo.exe
        53⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Windows\SysWOW64\Oacdmo32.exe
        
        C:\Windows\system32\Oacdmo32.exe
        54⤵
        Executes dropped EXE
        
        PID:5920
        
        C:\Windows\SysWOW64\Odbpij32.exe
        
        C:\Windows\system32\Odbpij32.exe
        55⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Ohnljine.exe
        
        C:\Windows\system32\Ohnljine.exe
        56⤵
        Executes dropped EXE
        
        PID:5260
        
        C:\Windows\SysWOW64\Ogqmee32.exe
        
        C:\Windows\system32\Ogqmee32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Windows\SysWOW64\Oklifdmi.exe
        
        C:\Windows\system32\Oklifdmi.exe
        58⤵
        Executes dropped EXE
        
        PID:5156
        
        C:\Windows\SysWOW64\Onjebpml.exe
        
        C:\Windows\system32\Onjebpml.exe
        59⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Oeamcmmo.exe
        
        C:\Windows\system32\Oeamcmmo.exe
        60⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Oddmoj32.exe
        
        C:\Windows\system32\Oddmoj32.exe
        61⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Ohpiphlb.exe
        
        C:\Windows\system32\Ohpiphlb.exe
        62⤵
        Executes dropped EXE
        
        PID:5336
        
        C:\Windows\SysWOW64\Ogcike32.exe
        
        C:\Windows\system32\Ogcike32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Oojalb32.exe
        
        C:\Windows\system32\Oojalb32.exe
        64⤵
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\SysWOW64\Onmahojj.exe
        
        C:\Windows\system32\Onmahojj.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Windows\SysWOW64\Oahnhncc.exe
        
        C:\Windows\system32\Oahnhncc.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2452
        
        C:\Windows\SysWOW64\Oediim32.exe
        
        C:\Windows\system32\Oediim32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3000
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        68⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Ogefqeaj.exe
        
        C:\Windows\system32\Ogefqeaj.exe
        69⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Okqbac32.exe
        
        C:\Windows\system32\Okqbac32.exe
        70⤵
        Drops file in System32 directory
        
        PID:1132
        
        C:\Windows\SysWOW64\Ononmo32.exe
        
        C:\Windows\system32\Ononmo32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Oakjnnap.exe
        
        C:\Windows\system32\Oakjnnap.exe
        72⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Oeffnl32.exe
        
        C:\Windows\system32\Oeffnl32.exe
        73⤵
        Drops file in System32 directory
        
        PID:4184
        
        C:\Windows\SysWOW64\Odifjipd.exe
        
        C:\Windows\system32\Odifjipd.exe
        74⤵
        Drops file in System32 directory
        
        PID:1064
        
        C:\Windows\SysWOW64\Oggbfdog.exe
        
        C:\Windows\system32\Oggbfdog.exe
        75⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Okcogc32.exe
        
        C:\Windows\system32\Okcogc32.exe
        76⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Oookgbpj.exe
        
        C:\Windows\system32\Oookgbpj.exe
        77⤵
        Drops file in System32 directory
        
        PID:4512
        
        C:\Windows\SysWOW64\Onakco32.exe
        
        C:\Windows\system32\Onakco32.exe
        78⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Ofhcdlgg.exe
        
        C:\Windows\system32\Ofhcdlgg.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3260
        
        C:\Windows\SysWOW64\Odkcpi32.exe
        
        C:\Windows\system32\Odkcpi32.exe
        80⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Ohgopgfj.exe
        
        C:\Windows\system32\Ohgopgfj.exe
        81⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Paocim32.exe
        
        C:\Windows\system32\Paocim32.exe
        82⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        83⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Philfgdh.exe
        
        C:\Windows\system32\Philfgdh.exe
        84⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Pgllad32.exe
        
        C:\Windows\system32\Pgllad32.exe
        85⤵
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Pocdba32.exe
        
        C:\Windows\system32\Pocdba32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1656
        
        C:\Windows\SysWOW64\Pnfdnnbo.exe
        
        C:\Windows\system32\Pnfdnnbo.exe
        87⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Pfmlok32.exe
        
        C:\Windows\system32\Pfmlok32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\Pdpmkhjl.exe
        
        C:\Windows\system32\Pdpmkhjl.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2408
        
        C:\Windows\SysWOW64\Pgoigcip.exe
        
        C:\Windows\system32\Pgoigcip.exe
        90⤵
        Drops file in System32 directory
        
        PID:4416
        
        C:\Windows\SysWOW64\Pkjegb32.exe
        
        C:\Windows\system32\Pkjegb32.exe
        91⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Pnhacn32.exe
        
        C:\Windows\system32\Pnhacn32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Windows\SysWOW64\Pbdmdlie.exe
        
        C:\Windows\system32\Pbdmdlie.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:116
        
        C:\Windows\SysWOW64\Pdbiphhi.exe
        
        C:\Windows\system32\Pdbiphhi.exe
        94⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Pgaelcgm.exe
        
        C:\Windows\system32\Pgaelcgm.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1524
        
        C:\Windows\SysWOW64\Pklamb32.exe
        
        C:\Windows\system32\Pklamb32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Windows\SysWOW64\Pnknim32.exe
        
        C:\Windows\system32\Pnknim32.exe
        97⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Pbfjjlgc.exe
        
        C:\Windows\system32\Pbfjjlgc.exe
        98⤵
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\Pdeffgff.exe
        
        C:\Windows\system32\Pdeffgff.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4456
        
        C:\Windows\SysWOW64\Pgcbbc32.exe
        
        C:\Windows\system32\Pgcbbc32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2864
        
        C:\Windows\SysWOW64\Pkonbamc.exe
        
        C:\Windows\system32\Pkonbamc.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4732
        
        C:\Windows\SysWOW64\Pbifol32.exe
        
        C:\Windows\system32\Pbifol32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:1392
        
        C:\Windows\SysWOW64\Pdgckg32.exe
        
        C:\Windows\system32\Pdgckg32.exe
        103⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Qomghp32.exe
        
        C:\Windows\system32\Qomghp32.exe
        105⤵
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Qbkcek32.exe
        
        C:\Windows\system32\Qbkcek32.exe
        106⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Qdipag32.exe
        
        C:\Windows\system32\Qdipag32.exe
        107⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Windows\SysWOW64\Qbmpjkqk.exe
        
        C:\Windows\system32\Qbmpjkqk.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
        
        C:\Windows\SysWOW64\Qfilkj32.exe
        
        C:\Windows\system32\Qfilkj32.exe
        109⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Agjhbbob.exe
        
        C:\Windows\system32\Agjhbbob.exe
        110⤵
        Modifies registry class
        
        PID:1052
        
        C:\Windows\SysWOW64\Akfdcq32.exe
        
        C:\Windows\system32\Akfdcq32.exe
        111⤵
        Drops file in System32 directory
        
        PID:4328
        
        C:\Windows\SysWOW64\Andqol32.exe
        
        C:\Windows\system32\Andqol32.exe
        112⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Abpmpkoh.exe
        
        C:\Windows\system32\Abpmpkoh.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2724
        
        C:\Windows\SysWOW64\Adnilfnl.exe
        
        C:\Windows\system32\Adnilfnl.exe
        114⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Aijeme32.exe
        
        C:\Windows\system32\Aijeme32.exe
        115⤵
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Akhaipei.exe
        
        C:\Windows\system32\Akhaipei.exe
        116⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Anfmeldl.exe
        
        C:\Windows\system32\Anfmeldl.exe
        117⤵
        Modifies registry class
        
        PID:3408
        
        C:\Windows\SysWOW64\Abbiej32.exe
        
        C:\Windows\system32\Abbiej32.exe
        118⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Afnefieo.exe
        
        C:\Windows\system32\Afnefieo.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:3192
        
        C:\Windows\SysWOW64\Ailabddb.exe
        
        C:\Windows\system32\Ailabddb.exe
        120⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Agobna32.exe
        
        C:\Windows\system32\Agobna32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3592
        
        C:\Windows\SysWOW64\Aofjoo32.exe
        
        C:\Windows\system32\Aofjoo32.exe
        122⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Anijjkbj.exe
        
        C:\Windows\system32\Anijjkbj.exe
        123⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Afpbkicl.exe
        
        C:\Windows\system32\Afpbkicl.exe
        124⤵
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Ainnhdbp.exe
        
        C:\Windows\system32\Ainnhdbp.exe
        125⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Akmjdpac.exe
        
        C:\Windows\system32\Akmjdpac.exe
        126⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Aohfdnil.exe
        
        C:\Windows\system32\Aohfdnil.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:1332
        
        C:\Windows\SysWOW64\Afboah32.exe
        
        C:\Windows\system32\Afboah32.exe
        128⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Agckiqgg.exe
        
        C:\Windows\system32\Agckiqgg.exe
        129⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Aokcjngj.exe
        
        C:\Windows\system32\Aokcjngj.exe
        130⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Abipfifn.exe
        
        C:\Windows\system32\Abipfifn.exe
        131⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Aeglbeea.exe
        
        C:\Windows\system32\Aeglbeea.exe
        132⤵
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Bgfhnpde.exe
        
        C:\Windows\system32\Bgfhnpde.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Windows\SysWOW64\Bomppneg.exe
        
        C:\Windows\system32\Bomppneg.exe
        134⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Bnppkj32.exe
        
        C:\Windows\system32\Bnppkj32.exe
        135⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Bejhhd32.exe
        
        C:\Windows\system32\Bejhhd32.exe
        136⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Bghddp32.exe
        
        C:\Windows\system32\Bghddp32.exe
        137⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Bpomem32.exe
        
        C:\Windows\system32\Bpomem32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Bbniai32.exe
        
        C:\Windows\system32\Bbniai32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6268
        
        C:\Windows\SysWOW64\Belemd32.exe
        
        C:\Windows\system32\Belemd32.exe
        140⤵
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Bihancje.exe
        
        C:\Windows\system32\Bihancje.exe
        141⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        142⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Bndjfjhl.exe
        
        C:\Windows\system32\Bndjfjhl.exe
        143⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Bbpeghpe.exe
        
        C:\Windows\system32\Bbpeghpe.exe
        144⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Beobcdoi.exe
        
        C:\Windows\system32\Beobcdoi.exe
        145⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Bkhjpn32.exe
        
        C:\Windows\system32\Bkhjpn32.exe
        146⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Bbbblhnc.exe
        
        C:\Windows\system32\Bbbblhnc.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Windows\SysWOW64\Beaohcmf.exe
        
        C:\Windows\system32\Beaohcmf.exe
        148⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        149⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Bpfcelml.exe
        
        C:\Windows\system32\Bpfcelml.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Bbeobhlp.exe
        
        C:\Windows\system32\Bbeobhlp.exe
        151⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Becknc32.exe
        
        C:\Windows\system32\Becknc32.exe
        152⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        153⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Cnlpgibd.exe
        
        C:\Windows\system32\Cnlpgibd.exe
        154⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ciaddaaj.exe
        
        C:\Windows\system32\Ciaddaaj.exe
        155⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Clpppmqn.exe
        
        C:\Windows\system32\Clpppmqn.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7024
        
        C:\Windows\SysWOW64\Cnnllhpa.exe
        
        C:\Windows\system32\Cnnllhpa.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Windows\SysWOW64\Cbihmg32.exe
        
        C:\Windows\system32\Cbihmg32.exe
        158⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Cehdib32.exe
        
        C:\Windows\system32\Cehdib32.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Windows\SysWOW64\Chfaenfb.exe
        
        C:\Windows\system32\Chfaenfb.exe
        160⤵
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Clbmfm32.exe
        
        C:\Windows\system32\Clbmfm32.exe
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Cnpibh32.exe
        
        C:\Windows\system32\Cnpibh32.exe
        162⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Cejaobel.exe
        
        C:\Windows\system32\Cejaobel.exe
        163⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        164⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Cldjkl32.exe
        
        C:\Windows\system32\Cldjkl32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Cemndbci.exe
        
        C:\Windows\system32\Cemndbci.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6676
        
        C:\Windows\SysWOW64\Chkjpm32.exe
        
        C:\Windows\system32\Chkjpm32.exe
        167⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Cpbbak32.exe
        
        C:\Windows\system32\Cpbbak32.exe
        168⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Cnebmgjj.exe
        
        C:\Windows\system32\Cnebmgjj.exe
        169⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Deokja32.exe
        
        C:\Windows\system32\Deokja32.exe
        170⤵
        
        PID:924
        
        C:\Windows\SysWOW64\Dijgjpip.exe
        
        C:\Windows\system32\Dijgjpip.exe
        171⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Dlicflic.exe
        
        C:\Windows\system32\Dlicflic.exe
        172⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        173⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Dfngcdhi.exe
        
        C:\Windows\system32\Dfngcdhi.exe
        174⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        175⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        176⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Dlkplk32.exe
        
        C:\Windows\system32\Dlkplk32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6512
        
        C:\Windows\SysWOW64\Dpglmjoj.exe
        
        C:\Windows\system32\Dpglmjoj.exe
        178⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Dojlhg32.exe
        
        C:\Windows\system32\Dojlhg32.exe
        179⤵
        Drops file in System32 directory
        
        PID:3652
        
        C:\Windows\SysWOW64\Decdeama.exe
        
        C:\Windows\system32\Decdeama.exe
        180⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Dlnlak32.exe
        
        C:\Windows\system32\Dlnlak32.exe
        181⤵
        Modifies registry class
        
        PID:6920
        
        C:\Windows\SysWOW64\Dolinf32.exe
        
        C:\Windows\system32\Dolinf32.exe
        182⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Windows\SysWOW64\Dbgdnelk.exe
        
        C:\Windows\system32\Dbgdnelk.exe
        183⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Dfcqod32.exe
        
        C:\Windows\system32\Dfcqod32.exe
        184⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Diamko32.exe
        
        C:\Windows\system32\Diamko32.exe
        185⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Dhdmfljb.exe
        
        C:\Windows\system32\Dhdmfljb.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6432
        
        C:\Windows\SysWOW64\Dpkehi32.exe
        
        C:\Windows\system32\Dpkehi32.exe
        187⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Donecfao.exe
        
        C:\Windows\system32\Donecfao.exe
        188⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Dbjade32.exe
        
        C:\Windows\system32\Dbjade32.exe
        189⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Dehnpp32.exe
        
        C:\Windows\system32\Dehnpp32.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Windows\SysWOW64\Didjqoae.exe
        
        C:\Windows\system32\Didjqoae.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Dlbfmjqi.exe
        
        C:\Windows\system32\Dlbfmjqi.exe
        192⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Dpnbmi32.exe
        
        C:\Windows\system32\Dpnbmi32.exe
        193⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Doqbifpl.exe
        
        C:\Windows\system32\Doqbifpl.exe
        194⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Efhjjcpo.exe
        
        C:\Windows\system32\Efhjjcpo.exe
        195⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Eekjep32.exe
        
        C:\Windows\system32\Eekjep32.exe
        196⤵
        Drops file in System32 directory
        
        PID:6588
        
        C:\Windows\SysWOW64\Eifffoob.exe
        
        C:\Windows\system32\Eifffoob.exe
        197⤵
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Eldbbjof.exe
        
        C:\Windows\system32\Eldbbjof.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
        
        C:\Windows\SysWOW64\Eppobi32.exe
        
        C:\Windows\system32\Eppobi32.exe
        199⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Eoconenj.exe
        
        C:\Windows\system32\Eoconenj.exe
        200⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Efjgpc32.exe
        
        C:\Windows\system32\Efjgpc32.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:7292
        
        C:\Windows\SysWOW64\Eemgkpef.exe
        
        C:\Windows\system32\Eemgkpef.exe
        202⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Ehkcgkdj.exe
        
        C:\Windows\system32\Ehkcgkdj.exe
        203⤵
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Epbkhhel.exe
        
        C:\Windows\system32\Epbkhhel.exe
        204⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Eoekde32.exe
        
        C:\Windows\system32\Eoekde32.exe
        205⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7552
        
        C:\Windows\SysWOW64\Eflceb32.exe
        
        C:\Windows\system32\Eflceb32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Eikpan32.exe
        
        C:\Windows\system32\Eikpan32.exe
        207⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Ehnpmkbg.exe
        
        C:\Windows\system32\Ehnpmkbg.exe
        208⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Elilmi32.exe
        
        C:\Windows\system32\Elilmi32.exe
        209⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        210⤵
        Drops file in System32 directory
        
        PID:7788
        
        C:\Windows\SysWOW64\Ebcdjc32.exe
        
        C:\Windows\system32\Ebcdjc32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7840
        
        C:\Windows\SysWOW64\Efopjbjg.exe
        
        C:\Windows\system32\Efopjbjg.exe
        212⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Eimlgnij.exe
        
        C:\Windows\system32\Eimlgnij.exe
        213⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Ellicihn.exe
        
        C:\Windows\system32\Ellicihn.exe
        214⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Eedmlo32.exe
        
        C:\Windows\system32\Eedmlo32.exe
        215⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Fgcjea32.exe
        
        C:\Windows\system32\Fgcjea32.exe
        216⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Fibfbm32.exe
        
        C:\Windows\system32\Fibfbm32.exe
        217⤵
        Drops file in System32 directory
        
        PID:8120
        
        C:\Windows\SysWOW64\Fplnogmb.exe
        
        C:\Windows\system32\Fplnogmb.exe
        218⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Fgffka32.exe
        
        C:\Windows\system32\Fgffka32.exe
        219⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Fhgccijm.exe
        
        C:\Windows\system32\Fhgccijm.exe
        220⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Fcmgpbjc.exe
        
        C:\Windows\system32\Fcmgpbjc.exe
        221⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Fhiphi32.exe
        
        C:\Windows\system32\Fhiphi32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7476
        
        C:\Windows\SysWOW64\Fpqgjf32.exe
        
        C:\Windows\system32\Fpqgjf32.exe
        223⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Fochecog.exe
        
        C:\Windows\system32\Fochecog.exe
        224⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7712
        
        C:\Windows\SysWOW64\Flghognq.exe
        
        C:\Windows\system32\Flghognq.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Fhnichde.exe
        
        C:\Windows\system32\Fhnichde.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        228⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Ghcbohpp.exe
        
        C:\Windows\system32\Ghcbohpp.exe
        229⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Gpjjpe32.exe
        
        C:\Windows\system32\Gpjjpe32.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:8088
        
        C:\Windows\SysWOW64\Gegchl32.exe
        
        C:\Windows\system32\Gegchl32.exe
        231⤵
        Drops file in System32 directory
        
        PID:8172
        
        C:\Windows\SysWOW64\Glqkefff.exe
        
        C:\Windows\system32\Glqkefff.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:7192
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7320
        
        C:\Windows\SysWOW64\Geipnl32.exe
        
        C:\Windows\system32\Geipnl32.exe
        234⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Goadfa32.exe
        
        C:\Windows\system32\Goadfa32.exe
        235⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        236⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Hgkimn32.exe
        
        C:\Windows\system32\Hgkimn32.exe
        237⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Hpcmfchg.exe
        
        C:\Windows\system32\Hpcmfchg.exe
        238⤵
        Drops file in System32 directory
        
        PID:7992
        
        C:\Windows\SysWOW64\Hofmaq32.exe
        
        C:\Windows\system32\Hofmaq32.exe
        239⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Hfpenj32.exe
        
        C:\Windows\system32\Hfpenj32.exe
        240⤵
        Drops file in System32 directory
        
        PID:6612
        
        C:\Windows\SysWOW64\Hljnkdnk.exe
        
        C:\Windows\system32\Hljnkdnk.exe
        241⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Hohjgpmo.exe
        
        C:\Windows\system32\Hohjgpmo.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Hcdfho32.exe
        
        C:\Windows\system32\Hcdfho32.exe
        243⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7852
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:8004
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        245⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Hhckeeam.exe
        
        C:\Windows\system32\Hhckeeam.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7456
        
        C:\Windows\SysWOW64\Homcbo32.exe
        
        C:\Windows\system32\Homcbo32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7732
        
        C:\Windows\SysWOW64\Hgdlcm32.exe
        
        C:\Windows\system32\Hgdlcm32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Hhehkepj.exe
        
        C:\Windows\system32\Hhehkepj.exe
        249⤵
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Ioppho32.exe
        
        C:\Windows\system32\Ioppho32.exe
        250⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Igghilhi.exe
        
        C:\Windows\system32\Igghilhi.exe
        251⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ihheqd32.exe
        
        C:\Windows\system32\Ihheqd32.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
        
        C:\Windows\SysWOW64\Ifleji32.exe
        
        C:\Windows\system32\Ifleji32.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:7752
        
        C:\Windows\SysWOW64\Iqaiga32.exe
        
        C:\Windows\system32\Iqaiga32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8204
        
        C:\Windows\SysWOW64\Icpecm32.exe
        
        C:\Windows\system32\Icpecm32.exe
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:8248
        
        C:\Windows\SysWOW64\Ihmnldib.exe
        
        C:\Windows\system32\Ihmnldib.exe
        256⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Iqdfmajd.exe
        
        C:\Windows\system32\Iqdfmajd.exe
        257⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Ifqoehhl.exe
        
        C:\Windows\system32\Ifqoehhl.exe
        258⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Ioicnn32.exe
        
        C:\Windows\system32\Ioicnn32.exe
        259⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Igpkok32.exe
        
        C:\Windows\system32\Igpkok32.exe
        260⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Ijngkf32.exe
        
        C:\Windows\system32\Ijngkf32.exe
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:8512
        
        C:\Windows\SysWOW64\Jokpcmmj.exe
        
        C:\Windows\system32\Jokpcmmj.exe
        262⤵
        Drops file in System32 directory
        
        PID:8564
        
        C:\Windows\SysWOW64\Jcgldl32.exe
        
        C:\Windows\system32\Jcgldl32.exe
        263⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        264⤵
        System Location Discovery: System Language Discovery
        
        PID:8676
        
        C:\Windows\SysWOW64\Jcihjl32.exe
        
        C:\Windows\system32\Jcihjl32.exe
        265⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Jfgefg32.exe
        
        C:\Windows\system32\Jfgefg32.exe
        266⤵
        Modifies registry class
        
        PID:8768
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        267⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Jfjakgpa.exe
        
        C:\Windows\system32\Jfjakgpa.exe
        268⤵
        Drops file in System32 directory
        
        PID:8856
        
        C:\Windows\SysWOW64\Jflnafno.exe
        
        C:\Windows\system32\Jflnafno.exe
        269⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Jjjggede.exe
        
        C:\Windows\system32\Jjjggede.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Windows\SysWOW64\Kgngqico.exe
        
        C:\Windows\system32\Kgngqico.exe
        271⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Kaflio32.exe
        
        C:\Windows\system32\Kaflio32.exe
        272⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Kplijk32.exe
        
        C:\Windows\system32\Kplijk32.exe
        273⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        274⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Kpnepk32.exe
        
        C:\Windows\system32\Kpnepk32.exe
        275⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Kmbfiokn.exe
        
        C:\Windows\system32\Kmbfiokn.exe
        276⤵
        System Location Discovery: System Language Discovery
        
        PID:9212
        
        C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        277⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ljffccjh.exe
        
        C:\Windows\system32\Ljffccjh.exe
        278⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Lmdbooik.exe
        
        C:\Windows\system32\Lmdbooik.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8332
        
        C:\Windows\SysWOW64\Lcnkli32.exe
        
        C:\Windows\system32\Lcnkli32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4884
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Lcqgahoe.exe
        
        C:\Windows\system32\Lcqgahoe.exe
        282⤵
        Drops file in System32 directory
        
        PID:8508
        
        C:\Windows\SysWOW64\Limpiomm.exe
        
        C:\Windows\system32\Limpiomm.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8572
        
        C:\Windows\SysWOW64\Ljmmcbdp.exe
        
        C:\Windows\system32\Ljmmcbdp.exe
        284⤵
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Lfcmhc32.exe
        
        C:\Windows\system32\Lfcmhc32.exe
        285⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Lplaaiqd.exe
        
        C:\Windows\system32\Lplaaiqd.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8800
        
        C:\Windows\SysWOW64\Mjafoapj.exe
        
        C:\Windows\system32\Mjafoapj.exe
        287⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8868
        
        C:\Windows\SysWOW64\Mmpbkm32.exe
        
        C:\Windows\system32\Mmpbkm32.exe
        288⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Mpnngh32.exe
        
        C:\Windows\system32\Mpnngh32.exe
        289⤵
        Modifies registry class
        
        PID:9004
        
        C:\Windows\SysWOW64\Migcpneb.exe
        
        C:\Windows\system32\Migcpneb.exe
        290⤵
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        291⤵
        System Location Discovery: System Language Discovery
        
        PID:9156
        
        C:\Windows\SysWOW64\Mhhcne32.exe
        
        C:\Windows\system32\Mhhcne32.exe
        292⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Mjfoja32.exe
        
        C:\Windows\system32\Mjfoja32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8300
        
        C:\Windows\SysWOW64\Miipencp.exe
        
        C:\Windows\system32\Miipencp.exe
        294⤵
        Modifies registry class
        
        PID:8376
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8480
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        296⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Miklkm32.exe
        
        C:\Windows\system32\Miklkm32.exe
        297⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Mmghklif.exe
        
        C:\Windows\system32\Mmghklif.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8864
        
        C:\Windows\SysWOW64\Mphamg32.exe
        
        C:\Windows\system32\Mphamg32.exe
        299⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        300⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Njmejp32.exe
        
        C:\Windows\system32\Njmejp32.exe
        301⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        302⤵
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Nkpbpp32.exe
        
        C:\Windows\system32\Nkpbpp32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8440
        
        C:\Windows\SysWOW64\Nplkhf32.exe
        
        C:\Windows\system32\Nplkhf32.exe
        304⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Nalgbi32.exe
        
        C:\Windows\system32\Nalgbi32.exe
        305⤵
        Modifies registry class
        
        PID:8820
        
        C:\Windows\SysWOW64\Nandhi32.exe
        
        C:\Windows\system32\Nandhi32.exe
        306⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Nhhldc32.exe
        
        C:\Windows\system32\Nhhldc32.exe
        307⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Npcaie32.exe
        
        C:\Windows\system32\Npcaie32.exe
        308⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1700
        
        C:\Windows\SysWOW64\Ogmiepcf.exe
        
        C:\Windows\system32\Ogmiepcf.exe
        309⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Okiefn32.exe
        
        C:\Windows\system32\Okiefn32.exe
        310⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Omgabj32.exe
        
        C:\Windows\system32\Omgabj32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8560
        
        C:\Windows\SysWOW64\Opfnne32.exe
        
        C:\Windows\system32\Opfnne32.exe
        312⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Odaiodbp.exe
        
        C:\Windows\system32\Odaiodbp.exe
        313⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Ogpfko32.exe
        
        C:\Windows\system32\Ogpfko32.exe
        314⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Okkalnjm.exe
        
        C:\Windows\system32\Okkalnjm.exe
        315⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Omjnhiiq.exe
        
        C:\Windows\system32\Omjnhiiq.exe
        316⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Ophjdehd.exe
        
        C:\Windows\system32\Ophjdehd.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:9464
        
        C:\Windows\SysWOW64\Odcfdc32.exe
        
        C:\Windows\system32\Odcfdc32.exe
        318⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Ogbbqo32.exe
        
        C:\Windows\system32\Ogbbqo32.exe
        319⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9560
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        320⤵
        Drops file in System32 directory
        
        PID:9608
        
        C:\Windows\SysWOW64\Opjgidfa.exe
        
        C:\Windows\system32\Opjgidfa.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:9656
        
        C:\Windows\SysWOW64\Ogdofo32.exe
        
        C:\Windows\system32\Ogdofo32.exe
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:9700
        
        C:\Windows\SysWOW64\Oggllnkl.exe
        
        C:\Windows\system32\Oggllnkl.exe
        323⤵
        Drops file in System32 directory
        
        PID:9744
        
        C:\Windows\SysWOW64\Oalpigkb.exe
        
        C:\Windows\system32\Oalpigkb.exe
        324⤵
        Modifies registry class
        
        PID:9788
        
        C:\Windows\SysWOW64\Pkedbmab.exe
        
        C:\Windows\system32\Pkedbmab.exe
        325⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9876
        
        C:\Windows\SysWOW64\Pnenchoc.exe
        
        C:\Windows\system32\Pnenchoc.exe
        327⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        328⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Pnhjig32.exe
        
        C:\Windows\system32\Pnhjig32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10004
        
        C:\Windows\SysWOW64\Phpklp32.exe
        
        C:\Windows\system32\Phpklp32.exe
        330⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Pjahchpb.exe
        
        C:\Windows\system32\Pjahchpb.exe
        331⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Qpkppbho.exe
        
        C:\Windows\system32\Qpkppbho.exe
        332⤵
        System Location Discovery: System Language Discovery
        
        PID:10144
        
        C:\Windows\SysWOW64\Qgehml32.exe
        
        C:\Windows\system32\Qgehml32.exe
        333⤵
        Modifies registry class
        
        PID:10188
        
        C:\Windows\SysWOW64\Qpmmfbfl.exe
        
        C:\Windows\system32\Qpmmfbfl.exe
        334⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Qggebl32.exe
        
        C:\Windows\system32\Qggebl32.exe
        335⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Qkcackeb.exe
        
        C:\Windows\system32\Qkcackeb.exe
        336⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Qnamofdf.exe
        
        C:\Windows\system32\Qnamofdf.exe
        337⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Ahgamo32.exe
        
        C:\Windows\system32\Ahgamo32.exe
        338⤵
        Drops file in System32 directory
        
        PID:9528
        
        C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        339⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Akgjnj32.exe
        
        C:\Windows\system32\Akgjnj32.exe
        340⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        341⤵
        Modifies registry class
        
        PID:9740
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        342⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        343⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Aqfolqna.exe
        
        C:\Windows\system32\Aqfolqna.exe
        344⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Ajodef32.exe
        
        C:\Windows\system32\Ajodef32.exe
        345⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Ahpdcn32.exe
        
        C:\Windows\system32\Ahpdcn32.exe
        346⤵
        Modifies registry class
        
        PID:10088
        
        C:\Windows\SysWOW64\Bnoiqd32.exe
        
        C:\Windows\system32\Bnoiqd32.exe
        347⤵
        Modifies registry class
        
        PID:10160
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10228
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        349⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        350⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Bbbkbbkg.exe
        
        C:\Windows\system32\Bbbkbbkg.exe
        351⤵
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Bjmpfdhb.exe
        
        C:\Windows\system32\Bjmpfdhb.exe
        352⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Ckmmpg32.exe
        
        C:\Windows\system32\Ckmmpg32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9824
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        355⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10036
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        356⤵
        Drops file in System32 directory
        
        PID:10136
        
        C:\Windows\SysWOW64\Cbiabq32.exe
        
        C:\Windows\system32\Cbiabq32.exe
        357⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ckafkfkp.exe
        
        C:\Windows\system32\Ckafkfkp.exe
        358⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Cjdfgc32.exe
        
        C:\Windows\system32\Cjdfgc32.exe
        359⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9796
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        361⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10012
        
        C:\Windows\SysWOW64\Cghgpgqd.exe
        
        C:\Windows\system32\Cghgpgqd.exe
        362⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        363⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Cnboma32.exe
        
        C:\Windows\system32\Cnboma32.exe
        364⤵
        Drops file in System32 directory
        
        PID:9804
        
        C:\Windows\SysWOW64\Cbnknpqj.exe
        
        C:\Windows\system32\Cbnknpqj.exe
        365⤵
        Modifies registry class
        
        PID:9968
        
        C:\Windows\SysWOW64\Cgjcfgoa.exe
        
        C:\Windows\system32\Cgjcfgoa.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9268
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        367⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Dendok32.exe
        
        C:\Windows\system32\Dendok32.exe
        368⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Dbbdip32.exe
        
        C:\Windows\system32\Dbbdip32.exe
        369⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        370⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Decmjjie.exe
        
        C:\Windows\system32\Decmjjie.exe
        371⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        372⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        373⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        374⤵
        Modifies registry class
        
        PID:10244
        
        C:\Windows\SysWOW64\Dnkbcp32.exe
        
        C:\Windows\system32\Dnkbcp32.exe
        375⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        376⤵
        Drops file in System32 directory
        
        PID:10332
        
        C:\Windows\SysWOW64\Deejpjgc.exe
        
        C:\Windows\system32\Deejpjgc.exe
        377⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10376
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10420
        
        C:\Windows\SysWOW64\Dnnoip32.exe
        
        C:\Windows\system32\Dnnoip32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10464
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        380⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        381⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        382⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10656
        
        C:\Windows\SysWOW64\Eangjkkd.exe
        
        C:\Windows\system32\Eangjkkd.exe
        384⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        385⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10744
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:10788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10788 -s 412
        387⤵
        Program crash
        
        PID:10884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
1⤵
PID:9132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10788 -ip 10788
1⤵
PID:10852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahgamo32.exe

Filesize
94KB

MD5
1e2aa2669af5b8a09b387c779b72c6b9

SHA1
362373ad93e9573164069bc266a2fa58a02d8c71

SHA256
73063f95e65b794896e77c296b5d33845db861d58eea5d0e5480998bb09f32e7

SHA512
dbcd3eba50499ccb41d7bea05db7926626773ece36fe0b09677291cd2bad73d7be27a8a40a6009e361266c7ce286765fe63a46df7e03a1c8c7343ed3a470a246

Download Submit
C:\Windows\SysWOW64\Ajjjjghg.exe

Filesize
94KB

MD5
f1956e35f1bf0599ca8e1fd6e6c74c45

SHA1
4f24ddd13ac155210741adba3f133b9a14cc84d5

SHA256
58ef0ae3a3ff9bbf70cb1675b5cbcc70274345e1e7c8261534d19e642c260341

SHA512
bcf761cb50fb2e4d17d4a38afcf942d429c36ec07a44190f0eba2a8d662ba05c42e06ca9d17f164485ee0bf73ea2f5991c963559537695edfe6b5bb6e9b9f16a

Download Submit
C:\Windows\SysWOW64\Ajodef32.exe

Filesize
94KB

MD5
bb1cbd6bad05fcb88185ba551d1a1c17

SHA1
30760ad3ad33a8eab141842b9b486734a30fba42

SHA256
c12c36076b09734df7fd65d8bb39511c96a7a0813ba94f169bb0a9c811e0b757

SHA512
8570f1208b6c88c5ac86d11eb1abb063198e431d79d959d863a22542ca4509111b07e76bbe6392ace95286866565558fd21d72a96352c80ead1078f92b84309d

Download Submit
C:\Windows\SysWOW64\Bbeobhlp.exe

Filesize
94KB

MD5
79d9068774d7f957749d4b00f07d3122

SHA1
54d7df40200e0436bfd7a26bea293bc8df35a1e7

SHA256
f29ffc7f680bd2fb451fbb8d79f74a89a490744946b7b55258c77239508d5506

SHA512
0e8f91297d9ae8cf75b59b9f3bc6d72d21422893b4e6b8a713c5632dffe0cd9627f721f4b0fbfebd2384307e0f5787a68bdd0a8fbda404fa460b5feba8fade03

Download Submit
C:\Windows\SysWOW64\Bgokdomj.exe

Filesize
94KB

MD5
cd7d46e6479aeac629f941f6c8804f22

SHA1
aad415bc7315f9e4a9af147a101cbb23d2659f67

SHA256
794fdcc93c2a6225cb88e308077130867d4ef1c9a49931cebeda459e1feb64a1

SHA512
267180b674ed9576559d2f7a540369deade3b72e53a8a3db10d67141fac0fcb7db2be1af1f58fab84da6e68e25a7e8d294d9ab56cfdc2b1090f4251f8a7f2f95

Download Submit
C:\Windows\SysWOW64\Bkhjpn32.exe

Filesize
94KB

MD5
1f61fa10498b248e202f7f42b43dc8ea

SHA1
927fb56fabe46c6a96c34a33ec7855966a91bd1a

SHA256
49ab9b600aaff4eec9c9017bfe1c55109fced7a8cf4067aa9022231f7e96f470

SHA512
272e70e82300f4881f962b3941974849a0eb65d743edcefb887a68b41086f3504354fe13cf4d1a6428654a8b7af0e5aa551bb728c7dcc8627cbfc842d4275f02

Download Submit
C:\Windows\SysWOW64\Bnppkj32.exe

Filesize
94KB

MD5
bf3784220e30067ec085960b0a3198f9

SHA1
fd3c16df757dbb01e4e117db7354fab5d4144f5c

SHA256
84069a15452a9f8183ac98c3b9a7ffd5c47f09e84fe41b18fde57db34401101a

SHA512
adef90a1b534c12e646c35694202eb3c28ebba3a3f2c0b6902e5f363500b8b6eb6223bb45da40c0be8020a1ae3d88c063be42964fda716d80120abdf9291c256

Download Submit
C:\Windows\SysWOW64\Bqbohocd.exe

Filesize
94KB

MD5
8b39b48da09e2d3ed23ce731605e5e60

SHA1
3506bdcf561b05a6fd382ebccc9e7dd9e3745a40

SHA256
586cb5956ccfa53c3e697f05f78dda18048ee5751940ee305f0f0206ecaf620f

SHA512
2f325d01ac2d9b4b74ee2389b4a960a81d61f4c0d6a4a3dedf3a4f1e2245a3b7a5816bfddba9f8342f40ba5c63ccd2e01f194e932bb717fed9d1e18f35f0b76a

Download Submit
C:\Windows\SysWOW64\Cbnknpqj.exe

Filesize
94KB

MD5
be977a2231d3d0fb87aa4a27e2fb8e74

SHA1
ce30705d4986124ccf97a50beef06ab101fdef1a

SHA256
b416b231b125ad7795bbc480124ee522de62a22495a8e16bb8a623b81fc30741

SHA512
1df21ad895225777ec1de624fdee380840442a97f2ee00e48882f062aa4b0dcd142189ace043fabdd8a0403c59ad7acf0662c366a3894956d127d9ec754e5584

Download Submit
C:\Windows\SysWOW64\Clpppmqn.exe

Filesize
94KB

MD5
9d2eb71d2c838040f3d6158ff76f8739

SHA1
654d7c098c3ffc8f804063e0a2c882ba08721340

SHA256
e8512c98adb29e664486f3e009cd2ea37b83f3cd57e3e81d4ca8fd1ef9e7438b

SHA512
d9584b0a1b75ead9d84e46d990f9b665140e71e4e2cd98e25d5eb473d5ef6a477a199a76e3aed8fc0d00bb6419564a70e990a7bb7d3e7ab39066babc0c2f35f9

Download Submit
C:\Windows\SysWOW64\Dgaiffii.exe

Filesize
94KB

MD5
483d9af0c8c895e66abcd661e0c85ce6

SHA1
1f9ac317ed03268de0b5640355e995b31676bd46

SHA256
8f48e9cce2fc7c875bf5342b0c0c19023bdf5a83fcac4bad7538c5ba61365f0a

SHA512
956badae6567f6adef2f818b15d5b59790aa461dd5ab7bff224f6170fd394880438260fd5c76946abf5f16254d61585c569df675198bb8c5847960044ecc3664

Download Submit
C:\Windows\SysWOW64\Dnnoip32.exe

Filesize
64KB

MD5
3c5ecff1ec938be2b0c02c573e77cfe0

SHA1
a0e027e81488c6fccc898588fca33c8bc0c026a4

SHA256
66aaee0dd8db546e0a66b2058def8d7f75efabe1bda57f5fd6d0ce85b192fafa

SHA512
e66a5795b02af56c2bff8bcd3629f0cf94f7b970bee427848d64445a4c99d1f5db683900e6a741e84b0406ce0eb276be126ca9f90762240667249feacb78f0e4

Download Submit
C:\Windows\SysWOW64\Eimlgnij.exe

Filesize
94KB

MD5
429db6e099bce0677a78eb09db29a213

SHA1
f97cc25962fdc5847d771f26b3b8b26e706bfe43

SHA256
590ad888b393695fd54f6c8bfaa59f67dbb97cc63be9e58e6342ba4782995b8a

SHA512
3f771d736d24c4f1201dbb6115692c9aa904b35c54350a166f2b5c08006bb1b19df00f151c321eb905fde9e212a3554145cebc7c3a3dabaf4ef5e851849cf0e7

Download Submit
C:\Windows\SysWOW64\Eldlhckj.exe

Filesize
94KB

MD5
1aeef17e0c386debd4e7e550f0efb8cf

SHA1
a1530c15caab7787820c6a67165d400c7d74aa52

SHA256
04bf484e0339e920b6b068c3b80aa84b836d095918e4226620ca0a0aed08376f

SHA512
d9fee563ec9ae0cb841475ea738bbaf3d86c63b1082bc422750d80baf998a66f48b4340ee61306e2acb3cd7d9ce2ecbdbe1e6b56dcf7ec29c845a8bc11bf0514

Download Submit
C:\Windows\SysWOW64\Fhgccijm.exe

Filesize
94KB

MD5
cd63ea0d589c831a33531de1abd35fb0

SHA1
51551c85687b660a3920efe4ac9053e70b14cc88

SHA256
1a9a83c4ea9f02076a86aea3c7c3c3a98af6f97c8146acc1f9f944bf28c459bf

SHA512
2787ad1b67021398029629a3839bfb9b950d2f53a279bb0b6d0b72103b7c773f941372e9708e9356c2359ea910f8fa4d6e30ed73440044103200d3152f43ba95

Download Submit
C:\Windows\SysWOW64\Fochecog.exe

Filesize
94KB

MD5
e8c807656d77367809554fd76be749bd

SHA1
303179e9c7bb1426bf0c680eea0b1e71d7a61948

SHA256
bcd14980d74eeb3c15d410a5cee8477af621623581313482fbe01375c51dc3ec

SHA512
70db521530a086510b26e161a2d28e38d099796b3865917c5dfc0ecd23a69713c0c3dd221100a18e6908c7626535daf64e009c380922c40237b9279f3c9cea96

Download Submit
C:\Windows\SysWOW64\Ggoiap32.exe

Filesize
94KB

MD5
395b0a6a1800f3a1f789285ae1ce8144

SHA1
8459bff28fcbeea25b0ce30d5dacfcca2edebede

SHA256
e334557ede5afa7da4dd34c36bee601918dbb7ba2b7402b04548eecf3651a7af

SHA512
2de27af7937693c4a6824415b870140adb50b85d4a752491b5baa9883374a46c9e8d96d203e29951e17fced24664d43630f3c52eb8ca2365a6eefea34a4677cd

Download Submit
C:\Windows\SysWOW64\Hljnkdnk.exe

Filesize
94KB

MD5
6c8bb00ed0c08795ab5779be8fbed773

SHA1
cf808587a10ffc457bd2e78d5d46e743c7f5330d

SHA256
b131023f110bc777f3b4b67141c85733a6089b396af3974579b8d93d57184755

SHA512
ec498a27aec173644a6274b15df4fbd1aa73da918d5bbf4707f0435030386299e5c6f6af15da01217220e62030e23eb670cd2d41cdc6bd5cb12aeeedb7ba43d2

Download Submit
C:\Windows\SysWOW64\Icpecm32.exe

Filesize
94KB

MD5
59c04299ba099e5c57b74339eaea3bc9

SHA1
175bd98ede38704be4e1e3141ba1057f605a7f2c

SHA256
f5e94d419bb47c695d9dd4cc443062c56ee633426b479d536d6e94f359613695

SHA512
7fc0fc7b7f5549054e34104d37e7f3a5cbf81b16855aa4f37803a7ce9fe0d03977914d74cd3b830d0c538e6bd5d3222d78e327549448da59730ccacd359c92b7

Download Submit
C:\Windows\SysWOW64\Igghilhi.exe

Filesize
94KB

MD5
bb9ef7e00d5c5b4f11fe6189fc0d3841

SHA1
49576e584772b8f03cac5286c9ac607a0ea57ab8

SHA256
b47a8e5297b1c6df8e0280392a0d7ae8ccc8433e2538e6d192b84e6c8b625359

SHA512
71b575422fa98add0ecaf4ac960b81a05126e8e77e3df0f04c53028070a10873dfb0c9c38c1ead13449d2878830c29e6f927d726993588bbff56d2b76410dc80

Download Submit
C:\Windows\SysWOW64\Ijngkf32.exe

Filesize
94KB

MD5
7e0607340ecb5c38f33fceb73f3546bf

SHA1
d346318301a535f6ce1714d0593842007f727936

SHA256
5158d3a2da0e2fcfc88290c6ed936f80bbd65938cce85c80e0236f5557d45d4f

SHA512
a11ea321db4e11a7900954d9435fc2bea2bbabc9f73e30e0fbdc282e0e2dabfca657b536d7d4db9740b8d71872112c13521b0217bb2ad0af6c41ebf849a77988

Download Submit
C:\Windows\SysWOW64\Jcihjl32.exe

Filesize
94KB

MD5
568e04196fe11ba26fe6a4d7717ab4a5

SHA1
92c8e8395cd4f971f0afc234d9c505b8c8b9444c

SHA256
b3dc85c533b4122bfd254d6c59395674964bae7bf50bc0ffe6faf90c30bc5758

SHA512
5fe806e3c8b73db85f4c5759aca54a44063b647c6fb607f9753585eb9be6667d4c55dfe745a08824bc3fdb5538d851fa1167d126d4b65ada437d8c64e730bee9

Download Submit
C:\Windows\SysWOW64\Jfjakgpa.exe

Filesize
94KB

MD5
216122d4c3450b04664c50c018c3f5be

SHA1
ed6800eec9cfe6084c0309540f5cfafe406a0b87

SHA256
e1169b6eca47108479446c97a56e1cb5755af245b64f323934003fc554937ce1

SHA512
a9376f27f849c272c354fd791a34c08ddf513f056d1a5e6e76383b98585738515463919f85ac3314a223a5d5df305557215635be38e86906464d5b180c0f7734

Download Submit
C:\Windows\SysWOW64\Jflnafno.exe

Filesize
94KB

MD5
12e4909bb14eea2cb6e39fe811eb7310

SHA1
16c6b57cb1c036ef850b8d87e3804168ac264313

SHA256
e0e19d6bbe0ee91129248bb4d31e70027802702ecdbd8cd4ecf718de9851c2e1

SHA512
83f61bb5731918e0230fb4ef431ca13469a0c5919f0504a424845fabd17d25985b7e6c9f4ef3244a382e52de24d5c7a006baa419a6cfea15e34e102c1d202ec5

Download Submit
C:\Windows\SysWOW64\Kaflio32.exe

Filesize
94KB

MD5
f22c90d2c70b39e5d1fea89241f4ca61

SHA1
396b6b945036d5ee442f9466008b1affd1f457cf

SHA256
2d702accf3efd4b9f953eb10b5efc2e5bf9d9594e15724860a771d458a0f30e1

SHA512
9198a35754b5870597de1437f90796551d3337b2854af5694a25ca0bda445247b3ff05c88b89a00b805baa359433f1671eaa915db03d4ab9fc3c6e841eba774e

Download Submit
C:\Windows\SysWOW64\Kfkamk32.exe

Filesize
94KB

MD5
0a9dbe8f48101657a2376fba84e06c33

SHA1
cb217b95df8745f4e57f58719a46ef465476305f

SHA256
57a50e2a33e2bf08ffd4b3d1d0cba118f1a1344c98c08f5eb608c2bec93491bc

SHA512
349e667da7703ccea277bc935d410602b4a5cc8796dc0be059225e54b7068414be782e8c2a29cf3a2bd2a386982a2ced02c0ddd9ba347f7afa98ebdad7709103

Download Submit
C:\Windows\SysWOW64\Kidmcqeg.exe

Filesize
94KB

MD5
42c31bc579659b23ca2c651547408479

SHA1
31e13c5db04f73416190fc92d6d32ba78cfe8ab2

SHA256
def3b06716f9e0544e1810941f2def8c0583685f8f04265eace1b7b28d50f3d9

SHA512
ee819d63e06582fb3a05fd6de34aab220c7210eb8eb23bbb4b435c375155b32b5d6a04ff23063e7c6bb9e010dfb60e2a3d4c9d9067107b6f7212b772a1db3d64

Download Submit
C:\Windows\SysWOW64\Kmbfiokn.exe

Filesize
94KB

MD5
0f0e18a869d5a3b3501d395647eeac71

SHA1
3e60efb6ffdcbdd39d6a991da2d48762c0104060

SHA256
4e857e160fd702bac77400ffda4c0e43c1b84f5a05029e1d113c24fcbbcfbb89

SHA512
a830a5b29f5c8ad4e2b8aa3162200e6fcf9c2123a55ae0b20b3dae8ec19ead3e7be6d395b6066bb38994491ac32f2dae34ad171f37fef9508cd8d0fb53631327

Download Submit
C:\Windows\SysWOW64\Kmeiie32.exe

Filesize
94KB

MD5
b3845b12b571addf7ab6dd7606875155

SHA1
560ba32a726d8d6b90931c764b2dd529799336ce

SHA256
99aae749f178b32bd22d194555f54571ca393e42426e8659928b8f2aaf6807bb

SHA512
78f0fdd618a30b3c8559caff7b52fc20c3ae045b6ab1ae87b727e479ef1b1008c4d322cb33df41f174631844e431c2e6f5c1146308dfd28e243f7a41b0177727

Download Submit
C:\Windows\SysWOW64\Lacbpccn.exe

Filesize
94KB

MD5
757832bf191f8cc9329e42d36354718a

SHA1
164229da1777dd65a4b051db14d5edd93895b7cd

SHA256
1e54854c73864321af884a7e3564312ce8e9cc34289c30766d2bb229f5d2df87

SHA512
582d0fcef3d4c9f6c7ff357c23e753a16af7ce4c20bff63660d02b73a013bb37ca2beb792078dfcaaac23dda4a0e41feea8b994f821d91fa23c8f7a0e7042b25

Download Submit
C:\Windows\SysWOW64\Laeoec32.exe

Filesize
94KB

MD5
1726b0aa3c241c5485da4c1faaa53e9a

SHA1
fa6050e81089c27e83b3b389d1556be3ad25952a

SHA256
ba70ca659ebd92a6c904f1a08b33b9c39aee4607dedad483889d45c0fcbe6edd

SHA512
145fcbd1827237485dbbeedb457f69794cb90035c00cb7513acd942a4b029cd931d7e82e19e7152f8d02ff127b0b68e192b6e5cc03de6b90ea664c7f101289c8

Download Submit
C:\Windows\SysWOW64\Laglkb32.exe

Filesize
94KB

MD5
a297f70fa23a794641801da318da6e6f

SHA1
f901411b64c22089d632ee9fc991605f0c2b9b3b

SHA256
a0ffbdebeff975000c8cb726a0889640b6e92bbca76451533a94cdedb8a81400

SHA512
bf5e8c6f777ba9c6f71ba086fb79b7be49732d27a0327650c4078da768cefd954b8f10f70b27059c4b883cb8ca5814480769032b515646d5a2cfbd218f656ead

Download Submit
C:\Windows\SysWOW64\Ldfhgn32.exe

Filesize
94KB

MD5
3e7e7ab863a8e4773b44006be1230ede

SHA1
50ef316728ec7f9c5324e4c473f3222ecc2325f6

SHA256
ea327af37f4c1842d3a8d030e876dd4f701d36aff75f14d1aab234ff50393951

SHA512
d98486b0a2ea8eb35bbfc1d55060254d9ddce4b10b9c0b01a1dc70418ff08c6df3ea3c826b219743b637669def97beee1182d66134b7ee74f0d1e1a116a803f1

Download Submit
C:\Windows\SysWOW64\Lfbgmj32.exe

Filesize
94KB

MD5
d749633c03ac8803f8457bf4e33b1bfb

SHA1
e996254a4e421f588a47a699451b8f4ab398c163

SHA256
a66f41ad6f64b8eba1d6de802bb73a6d0280c68e39ebd60e1a3c102df86a610a

SHA512
7221ec532426ce52077d791ce9391a03e2125721535a2f827a93ab609015446aa5a61f6e20eb812ed1067d43055f3d2104d74ba95a2bb17388c516332f1f4b80

Download Submit
C:\Windows\SysWOW64\Lfgahikm.exe

Filesize
94KB

MD5
2752014aebefdf4b5ee1db87bcfafb41

SHA1
decbc992ad85efe2c79ed365af29967bea74e5f5

SHA256
9497b2de870e943f6e8718f05d5d51ea9e61952130bac61cb15089de87ea09e7

SHA512
3e477e1211ee72608a9d87726ad26330cd523832dac62c8d97ca00dba6c665f02555cae77466916d9eaae06a0c2e911fe24f9b444182371f143833584a5882b0

Download Submit
C:\Windows\SysWOW64\Lfmnbjcg.exe

Filesize
94KB

MD5
1514e030faf591c7424bbce068b17569

SHA1
27ad2160343e64d4d80bfee95c86f3d3b2439732

SHA256
f7ec92a1141ef97e4e2daf20e272a1835ed17ce68c78c780c7ee36c237b95f45

SHA512
a04834f4eb16ff3b63543c6b84eb9449657bec719a987f162f7dc99ef7064514c286f04464f03e4e28eafc35961525a4c140f810a2ea273c8945acd7914933b9

Download Submit
C:\Windows\SysWOW64\Lhjnfn32.exe

Filesize
94KB

MD5
0e20e0a574f9060d33ebe20202904ed9

SHA1
37dbbad0df1df03fa265f857831e4216f3a5b016

SHA256
50083b85accd8cbdcc7f0daaef9b9ac57bda615ec05e325d1c052c87c9a74567

SHA512
96bb7c5b2ff76ebff350362d149581998361955ca6d61a174eb8cdd0e8912be3f4851ab45112e9717ba18fb697e8abe9ab1bff34c9476613ee1c0de7143a1627

Download Submit
C:\Windows\SysWOW64\Ljkghi32.exe

Filesize
94KB

MD5
b237f9616cedb2ebced5428f30649bde

SHA1
3b39aae381b03daa1bd30ca05f2e0f82e0301b29

SHA256
f943216248a0a4670e5c763d5327949eb8a0633157aceb1624387e95095549bd

SHA512
6139d1aeab3e76ba9bbca6a22fa1bfe6b7f685eba4990e03e0b760bc75f2f0921be5a2bcee94a956cb5cb95871838b10977f368e2c492e70c73dab37fd65b496

Download Submit
C:\Windows\SysWOW64\Lmnlpcel.exe

Filesize
94KB

MD5
c98331ef40c7b308d581b19853245938

SHA1
7dd042645ad8d0a04871a7c4ef48a8320309aaf6

SHA256
9596fee319341a7f11e36d6b2bf13e1b7ff29d41fd1e7764b59541d7c8b93671

SHA512
a9710b1519b7d9e955a078de9ed26caffc7c1adc6f53d5a8c427f8158106549d2730a8a7bca1fec60eb455b181c9b98a4300e526658d12a9988a36ea27fca973

Download Submit
C:\Windows\SysWOW64\Lmqiec32.exe

Filesize
94KB

MD5
d56439a4266f79e72130418f89047164

SHA1
de0dcd43da80b35951b3318d5f05c9dc2c5b2fa3

SHA256
4e9f3176256145f673623a02321ff5ed0bdcef8507bbe590556d269b21a0af09

SHA512
add218a351a925eb18af99f3f3fcd88b15e457ee868d9a9fe10308f7a26d7ccb3ac2486daf18fded44e3cc7b93e189b756d4fe702243ecb39bd8113217cd9c72

Download Submit
C:\Windows\SysWOW64\Maaoaa32.exe

Filesize
94KB

MD5
79a5414eaa69f8fd354483266de395d0

SHA1
02d5243ba8fc5d35840bc534e34ce19df7735497

SHA256
f731f9892055440c63994fe8dd7512ebf8ddf3014836789d41935302c1eef922

SHA512
b8d4be6d8f862c2d9b48232d11f3a16ecd363a2722671b2c78648cf5b714955fc55505e9abeaa0f0338abdddb7c07239660deaf8c85088a3cea5472be7036ba4

Download Submit
C:\Windows\SysWOW64\Mackfa32.exe

Filesize
94KB

MD5
b90c456cd775f13b6e606c0c97e57cd2

SHA1
4776d8a6e55d397de8dfe202e0cebea73a984249

SHA256
f1796829fc2d4d4ca00d274b980678ce6ceb75c1a5f1500678351aca3b905e5d

SHA512
49432ddbe34c388a13e556a352669dd136ae6bd792521c441e168117340cc3a8c761cfe5ba7188d216b8b28087228522d07e1167053cec2a5e5742223bafaee5

Download Submit
C:\Windows\SysWOW64\Mdkabmjf.exe

Filesize
94KB

MD5
cf94550a10cd25741e5cd2a94673e53d

SHA1
f0d496b468fc61efcc8afdfce665d76cbf89ffa2

SHA256
4ec7d7178ffcc378c2a6e45848e1d88e3c32a3a11ecd9649d2ed6374741a5726

SHA512
57eb5f9750b4541ba9df19bb54c6a6f3b33e09364b6a526a7f0488bdd155071403342a3189c2655874d187acea4704cb3feb0452896e25577d3ff53ae367382d

Download Submit
C:\Windows\SysWOW64\Mdodbf32.exe

Filesize
94KB

MD5
0839d95e29ce37f1fce435f09581a2b1

SHA1
27fbdfe01791047d70d3358895ee59382977720c

SHA256
00b26ba65ce8e4c3d8f1adc5f0a3f5fcb97854cc82fb99b7fe7325b0ad34f5b6

SHA512
65239cac1a0aad5d08367d6158d8d2583b51844f646a2c0c0b6899e377427ddc660054f788ec3ba664c20716cf19fcf999a98b322259e1de2d0da6f337502073

Download Submit
C:\Windows\SysWOW64\Meadlo32.exe

Filesize
94KB

MD5
1c47a5237bc01bf003c9c51b420a797b

SHA1
26bb5d9b32f7d84c3edcfe8cdcd750d16636293d

SHA256
aed83553dea74de82717e16b3acd6794e5105bfeee56cce3570bc555cf995bc9

SHA512
7c03ca425877539de95d95c8da6cba797789e173f3cc8b0c924d4c9cee846c77e2199b0cd8e408c69e04a7e810b5020b465de2d2a9214ea3bf37721b462f5f63

Download Submit
C:\Windows\SysWOW64\Meoggpmd.exe

Filesize
94KB

MD5
806563ecc51ec6d8ea7e9b94040b3fe5

SHA1
04333a50c2f6ffb115fd5449f03f557cb4df214e

SHA256
6a8ac3c25aa65112993ba01ef4bd0c9f6699aea876721be83172715999261d82

SHA512
ff3477f2be23cb8221abc68f49b9017888affd970955ab26142f368009e32ba8ed15d273272d28f26103db32fcddf70247c599d2bdb5ad9fdb20df30859fedb5

Download Submit
C:\Windows\SysWOW64\Mgbpdgap.exe

Filesize
94KB

MD5
3b1c75da96514918f18e8421cffbd24f

SHA1
5229b50184558242421c817f55ad686115260e13

SHA256
6ddf049a54d11bd9a57e7c9a6fb335a0006e03671c5dbdcc4122ebdfee4a6981

SHA512
bf1f7c005ccfffb9feaf9a26e6768747ab7f229fadef3f984440588c1452e04df58da16a4497d27b02bfcec5755aad0a8be294f0be52f9ae59b84cede58797a7

Download Submit
C:\Windows\SysWOW64\Mgngih32.exe

Filesize
94KB

MD5
79e85450d30ae7811f53b83e80193b1b

SHA1
ad3c3d70a60d20b939ba8c02f8313be6bc7d1d7c

SHA256
0d20c3408083161673ef7ad8a6382cac690b034e2a030cbdec00909742c0685e

SHA512
c23d8c634a1fb665870fff35892ea12bc1e1a348ba5864090329aabf63217eaa1203e91d34674192aaf7a4b50846c0366bd294903f030a8e4b6bc2a593ef6a83

Download Submit
C:\Windows\SysWOW64\Mhhjhlqm.exe

Filesize
94KB

MD5
5aaf7ce14d9e64f90152f14e2fa1807e

SHA1
194074fc3c5c9028466faf53976fa625325699a2

SHA256
9d0cdb11c573820088d240bf6afbe26c98ad5280e1b6404c03aa5ebb2fac133e

SHA512
b45f53fed790d1f58b7f73c24018f446e73ea0656ca7574bf5ae864f4821629366a5b354f7c7507039cd0465cd89bad15f0a86316fe6bb4fbf44ba222fbf01e1

Download Submit
C:\Windows\SysWOW64\Migcpneb.exe

Filesize
94KB

MD5
92c55eb79333508b2ed7df0d97c9ace9

SHA1
a36fe9447a27f3dcfb8888e766dacd50e2cdee84

SHA256
3e2eca8df04485e57253508132edee270461a63995d86dd99bb42202dcd0e217

SHA512
5111dbe1555b73024489c4b749cebaae21927464e45aff7744526423b34d929709679e05fc6f0651439263d4de8092caf2b1b576fc7e4ef68437b02f3c59d85c

Download Submit
C:\Windows\SysWOW64\Mjafoapj.exe

Filesize
94KB

MD5
738c4ca0a61f13b0c0e887ae02c62dae

SHA1
df4cefb1851354535adb6dfd5dd36f4155b34438

SHA256
075f8b2bedbcda51917a1bf87c551af9d1630d119543d592c78be526f8bca899

SHA512
958d8f96081871e4a69cb70e74303d32aaca65d364cd97a4292782e1510a8a697158daee5a3863e89287517502b291b0d0a5e27a6e0c53d90cc1f2e6500c78ed

Download Submit
C:\Windows\SysWOW64\Mkdiog32.exe

Filesize
94KB

MD5
ee68a425aa1312349e1b6a3184f024f6

SHA1
38d0f15c024464e6f616550148f67fadbd0c40cd

SHA256
3ca08a8b11652297380b5985452d6dc91259529d0fea6202c8b28c7d56dae375

SHA512
8db2a21c6d08b9e0bacf5eef1f83368fc7d725d5a762221aac593d169ff94a951fd4177e91c9d827d70f4357f4277015ece032cb139751e4db38aab52b20c8da

Download Submit
C:\Windows\SysWOW64\Mklpof32.exe

Filesize
94KB

MD5
8d9d7bd9cb06ddb78db6904afa8d8a08

SHA1
c3b83a9237443468a4c7c75a4df19cd5854f9f9c

SHA256
0f9015bcb081b2c46e4b08b0e4a191308681fcdc39cbfcdf6717322988e46bb7

SHA512
b32bf4a61abde5331552dde26480008e529d84690234f903ee1d4408de2074e8234c97ce54ce864fd3a93ee6940cd629819867c9cb20342799578365ad32d887

Download Submit
C:\Windows\SysWOW64\Mmghklif.exe

Filesize
94KB

MD5
aa51916fa27ccb24e415c5f4b6b6c422

SHA1
1e8cd6139e04fe15f9be6a83043a6a8883daad15

SHA256
6b8b29b53aa3cf31cce6dfc5ea36c12e011b4c22c76e35d97326431e353beecc

SHA512
54243f9e5b3843ced8e39e6dc6f5136ddb4e7daca71ced643ea64d9da25a2b85b85750bf093745c600eacd8b9b8522b57adad9392bfa4f1206d268de30e7caa1

Download Submit
C:\Windows\SysWOW64\Mmjlkb32.exe

Filesize
94KB

MD5
ac0eab45200773fd587b8b7107e14e77

SHA1
25481840f2b15e7e5503c06ead67805d029296e4

SHA256
850a67f3a6da42c160b525ceb2f3765445ba99a34676e436812d30cadccb61ca

SHA512
986056d6bef3ddca7654a9939af66dae61a29fbfae26a600edd0d3e8aecc45d6d09e38c41f52cc44cde3e79a3c8903dcbc4fa50bb6fd38940a5e17ec7927b2cd

Download Submit
C:\Windows\SysWOW64\Moiheebb.exe

Filesize
94KB

MD5
b730f82b779ebc2a06d5261714e28243

SHA1
1325e93718fd73632ae2f7b163693215036c9ead

SHA256
16e8d354a961e4ae55390b1d7e36d900f729041761315b003f9b51a5d69dcaa3

SHA512
f1a9ea51bbbd4fe02e2d59ebe6da8e77a232825c78bf4d4e6d20fc48bd2defca10d891f664e5c8da5531911ade4c70c4955184ac1da87685eba5e0510de60dae

Download Submit
C:\Windows\SysWOW64\Necqbo32.exe

Filesize
94KB

MD5
177c68f728b5423c6aab9b060eab1d42

SHA1
441cc872c81629d9bd90bdbfbe3f1ddd50b458c0

SHA256
d808b78529f98e412b3326ba476272c2c9491744aacbf4a9de220d3547dd7fdd

SHA512
0b17ca686e7bc67d1cfd366fecf18dedaceb663ad03471d345919aee36a21753c93408204f7263b2a8410e851ac1229e717b8ce37aa5bebdf19d8f99eb59083e

Download Submit
C:\Windows\SysWOW64\Nefmgogl.exe

Filesize
94KB

MD5
2aa2f34109afbf73c41e4c811c2a262f

SHA1
af909104590d6ecfe2197a0e7c8a859d19b2ece8

SHA256
85cbacd48c87c2d2b337de6ff1f7c269262ea6b00f845a5faedddc431af7e95e

SHA512
e795fa30088994b6b7b66f8a19023e51ad6a24d873174d0244b16773b4d422d18acd70c1569073e72456f957b5af9df509d706733414e1d726db2459104b9692

Download Submit
C:\Windows\SysWOW64\Ngemjg32.exe

Filesize
94KB

MD5
599b6c2a505bd2f54d0f48d5afa6feae

SHA1
56e94fdc0f6ba0bd6e30336d6ec0b4ccef0f2031

SHA256
d37b84f6fdcab9a37c27c97347d436e1a108bc8d0be7b67a32b46f8ea8bf0f99

SHA512
0d46e37e0e3d5de81e55a88e965b0c587593ffeb921bc84f44b520b59d52929b9cd3c0b77059943e539050bbe072e800aacac8c57f890505060ae2d1eb785491

Download Submit
C:\Windows\SysWOW64\Nhbmnj32.exe

Filesize
94KB

MD5
fe630af28f280e49ef6f7d02db7511ee

SHA1
acefcd899dd7b25e18ba9a1d858510f8404628ec

SHA256
1a750d688f80a66f2129bbee4b0d8ff6e6151b6bee70688bbe43328de6276a3c

SHA512
59b358b27706d9e9b5dee2e634efcd70238827e71eff6fde4498298e3407869d03ffb81252e20b720bcf476a9242d9197fae92811cb0859d6e8b24c5be3ccd40

Download Submit
C:\Windows\SysWOW64\Nhhldc32.exe

Filesize
94KB

MD5
621eb5f7dea62bdfad8672b5e655855d

SHA1
01a643c441094b670afe983a033f18ab061a2f3e

SHA256
c4a4609ffb050df6cc0654be4d80ff7bbee3c9328d056884bb14fc61ef989aa0

SHA512
dc8b2ee8db8195064bf939de50833fa3523c394dfc80a988d51a5e9d0d7f3433a5e3407ad06a345231f454afbc1ceb5c98801ece8ed3360ae02d218712c98dd8

Download Submit
C:\Windows\SysWOW64\Nmlhaa32.exe

Filesize
94KB

MD5
79841401febd6af6f641c4a1f736ce2e

SHA1
8fdee5ec343ebd58a1254786cbb988116ed3bea2

SHA256
ba84b74b4fc4917e416b6581301945bb98b6c712f848d499635cfa9f86ce6d5c

SHA512
6683dbcf1253a0d5dd3463590d96ab59c0cad8bc9729ddaa4d37b6c90d5dbb54e7b9b52aface8e04e9b001b26863d9f302ed22bc6c08cfb29bc05978ec555768

Download Submit
C:\Windows\SysWOW64\Nnoefagj.exe

Filesize
94KB

MD5
c819827eaabc3426c894003a3a795806

SHA1
f2bf81c8f0949928f5047524c2ebc123dcb80b60

SHA256
52846e281972215710e97ff0f0343032d1d69cf7f643763af57e812ba3d4d9a5

SHA512
40f5c57332dc28d70906891fdc4f122d2f896d4f49b4cf136bdbf4543630048add8cafb35c0c242351877c3c155522252e7af280f011885d1973d60f17ce1d33

Download Submit
C:\Windows\SysWOW64\Nolekd32.exe

Filesize
94KB

MD5
34691b34cc20d80018a995247f42a952

SHA1
c93ae28a65985d1c426629bf7ac0536929524140

SHA256
a0c1a9864d8a3b4a3a61bd1c9e06fdd23a692b95e5b9708359198e3f467ca5d0

SHA512
bff5d914aad7d28d0ba6c8935be2c73f30332eb6ee72f8e12114532238a9aeb91b9ddd8e99f1cf01741ad6531f514270390b24f01059103a3fc30f2bff823e2a

Download Submit
C:\Windows\SysWOW64\Npjnbg32.exe

Filesize
94KB

MD5
0c6c06143b1828bde7aa8b13f4d15416

SHA1
ab29ee6b6f1e312fa37d4e118aa881dc8697fe3a

SHA256
080fa64b95b81ccf10b383b9492cc4607a4e1dfbe7973ebbd9bac2921cb256bd

SHA512
c35f86da6411a3ebc94acb99dc3da02dfb9fee3ff9936012cf2bfdc03fb6f8d8abcba07531c4f938c5c6dc9a0788dbd00b21becdeaa0083babb2dd50207c2855

Download Submit
C:\Windows\SysWOW64\Oalpigkb.exe

Filesize
94KB

MD5
c7f5ed82aee84edd24009996ce376f8b

SHA1
4be6f0c2565868cb666bc7dd0d1aade30e498db7

SHA256
cb9a58aadadad4f09812cd6554a2d505743d524751b4755e8f9da4ee0bc379e0

SHA512
0687db223aa9e39cf5ff9cf204a8217959979aab596d0788958bc9fcda535ed092fff3ad7035815b3c2666eee5954b60f5c249d8add7c8ec217154748b1a3d18

Download Submit
C:\Windows\SysWOW64\Opjgidfa.exe

Filesize
94KB

MD5
b652fd46bd2cba7d44aa7b77b8b05220

SHA1
35f8fe8d165099f7bfc52bade74b49d3d6b48a0d

SHA256
ad3902adbc2ac5c26210c35b1a6e0d1a8ab5e47e8fef4f98d96414749c6211a5

SHA512
61e7289a2764c646873d24c65358b71d7eff30d1a9a608bb8c78e8cafc1cb6938818d25831d83754c78fd0932a6658937d1c8d0cc9b2405671c479a98ead73e1

Download Submit
C:\Windows\SysWOW64\Pdmikb32.exe

Filesize
94KB

MD5
b5e1ae2ff30c6a0c7ef71b847cdf9d3a

SHA1
1215698fc40efca383e48be574421894153b414f

SHA256
20c5f32b716dddc15a3b47c7c251cdf7b284c9d87d8fe3a133508af1e654caeb

SHA512
a091b76a25f04dffb733379625208f78d80d0131ebce3ce800b8f36c3177f3ce546fe947f40d1eaa05276624f95d640b9c7d7c123bf783edb0295f1f60ad4c27

Download Submit
C:\Windows\SysWOW64\Pklamb32.exe

Filesize
94KB

MD5
4f56c9b58955d7de222f6cc34c90796d

SHA1
b98a9fc55ad638ae89bc45549ec029aab69566d8

SHA256
cd8e5b81462f87f5b9b82d6139a88e4f5661c7e07434ea1b47a5b36ed153877a

SHA512
9aa7acdc6aafa847fcbea6b5e60b0018008a11beb338e0d49cb470a75f2e49a0a684f30154e1668ab4944da5779cc81b67987c08d5db7eb4effb5c22fd8f7c15

Download Submit
C:\Windows\SysWOW64\Qfilkj32.exe

Filesize
94KB

MD5
683cf0de14f1072856b1bc05b9eefb61

SHA1
ff4d34c9b322739f18eec332a317115158891d13

SHA256
3768da194c02684ee3baeee8e92b2fa08a1e0650d9da142c4425780b1f57b9ef

SHA512
cbbdfe5f77da40594f53df68735e79199548cf402ec2b326e3e7fac69b6314a9c3ce6e790752c92d61fa041ff3196da1bb0d0d212e15fccd08f377a514c824a9

Download Submit
C:\Windows\SysWOW64\Qgehml32.exe

Filesize
94KB

MD5
5c8d5ffcba4ca0e622c5841a7edd8356

SHA1
3dcec28ff2764d31dba59f0e87d352ad55efb8a2

SHA256
13d7fceccd8fdd7d7ef10253b894c8581ff3f721760c2581c734a40b6d0ad562

SHA512
91f2fb30494290d4b8baf52162ce0823a2a8244557fbf0ca6fc0dff15d0590be5e3ad2ec995246598675ac362f0ade5685e33651e26e80f2a3440588b78c15f2

Download Submit
memory/820-222-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/856-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/856-153-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1004-266-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1008-463-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1040-404-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1132-506-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1140-274-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1432-143-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1432-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1444-171-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1444-81-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1544-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1544-90-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1548-185-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1756-107-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1756-25-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1796-349-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1904-33-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1904-116-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1944-184-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1944-91-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1980-194-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1980-99-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2088-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2088-41-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2092-445-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2364-98-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2364-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2420-198-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2420-109-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2452-481-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2456-154-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2456-243-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2484-337-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2572-379-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2772-212-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2796-239-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2852-355-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-391-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3000-488-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3016-256-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3276-427-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3344-244-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3344-319-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3464-287-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3464-199-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3472-229-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3472-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3528-416-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3616-281-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3660-331-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3680-440-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3940-195-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3972-230-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4112-48-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4112-134-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4184-524-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4220-475-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4352-397-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4384-493-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4400-368-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4404-312-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4412-385-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4532-451-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4544-172-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4544-264-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4548-343-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4576-325-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4592-469-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4740-306-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4912-300-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5064-320-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5132-117-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5132-211-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5156-433-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5224-221-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5224-127-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5260-421-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5336-457-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5352-362-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5388-512-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5452-288-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5684-72-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5684-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5684-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/5732-295-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5748-167-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5824-238-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5824-144-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5852-500-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5920-410-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/6056-373-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/6116-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/6116-166-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/6132-517-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads