86ac7113756e9214e42fb22a9347ee25cb9b68a9aa4e8e456e83b4b9d7f4f48f

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86ac7113756e9214e42fb22a9347ee25cb9b68a9aa4e8e456e83b4b9d7f4f48f.exe
Size

80KB
MD5

9892f4d8290e3f8a71c23b59fc84d340
SHA1

f34d7b7f88614f937fcbc6756e689bce3ee8cce2
SHA256

86ac7113756e9214e42fb22a9347ee25cb9b68a9aa4e8e456e83b4b9d7f4f48f
SHA512

a1e8feadbab3a383a4fda9a5dd49c640fc11ccfa5286f56c66dbec04027002828515443c16d73f58ff8efa06f26f634c9b0a8cc4d5f919690a4da32d5165619d
SSDEEP

1536:EQikw/xnwd/T4mq/7EGDna1ngiVmCN+zL20gJi1i9:CkwxngRq9jaaiVtgzL20WKS

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Megdccmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmbfpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lljfpnjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmbfpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfankifm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Melnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imakkfdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opakbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jblpek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldoaklml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mckemg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npcoakfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmpgldhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe

Executes dropped EXE 64 IoCs

pid	Process
4888	Ifgbnlmj.exe
692	Imakkfdg.exe
1860	Ippggbck.exe
4484	Ibnccmbo.exe
4580	Iihkpg32.exe
4004	Ipbdmaah.exe
1080	Ifllil32.exe
3440	Iikhfg32.exe
5112	Icplcpgo.exe
5076	Jfoiokfb.exe
4376	Jmhale32.exe
4468	Jpgmha32.exe
1348	Jfaedkdp.exe
5012	Jmknaell.exe
2656	Jefbfgig.exe
4616	Jlpkba32.exe
1052	Jfeopj32.exe
4524	Jmpgldhg.exe
2356	Jpnchp32.exe
1924	Jblpek32.exe
4712	Jifhaenk.exe
1964	Jlednamo.exe
2816	Jcllonma.exe
3504	Kiidgeki.exe
3056	Klgqcqkl.exe
2652	Kdnidn32.exe
4872	Kikame32.exe
4036	Kfoafi32.exe
1452	Klljnp32.exe
4772	Kfankifm.exe
2192	Klngdpdd.exe
4920	Kmncnb32.exe
3484	Lffhfh32.exe
1064	Liddbc32.exe
1044	Lpnlpnih.exe
3224	Lfhdlh32.exe
2964	Llemdo32.exe
3944	Lpqiemge.exe
976	Lenamdem.exe
1760	Llgjjnlj.exe
3864	Ldoaklml.exe
2164	Lepncd32.exe
4040	Lljfpnjg.exe
1204	Lbdolh32.exe
4532	Lingibiq.exe
4668	Mdckfk32.exe
760	Medgncoe.exe
1272	Mpjlklok.exe
1184	Megdccmb.exe
1980	Mlampmdo.exe
368	Mckemg32.exe
4792	Miemjaci.exe
2436	Mpoefk32.exe
388	Mgimcebb.exe
3352	Melnob32.exe
1488	Mmbfpp32.exe
5116	Mdmnlj32.exe
4408	Mgkjhe32.exe
2572	Menjdbgj.exe
3624	Mlhbal32.exe
2420	Npcoakfp.exe
2480	Ngmgne32.exe
4984	Nilcjp32.exe
4220	Nljofl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jblpek32.exe	Jpnchp32.exe
File created	C:\Windows\SysWOW64\Lbdolh32.exe	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Bhbopgfn.dll	Nloiakho.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Nfjjppmm.exe	Nckndeni.exe
File opened for modification	C:\Windows\SysWOW64\Pclgkb32.exe	Pqmjog32.exe
File opened for modification	C:\Windows\SysWOW64\Jfeopj32.exe	Jlpkba32.exe
File opened for modification	C:\Windows\SysWOW64\Jpnchp32.exe	Jmpgldhg.exe
File created	C:\Windows\SysWOW64\Nnneknob.exe	Ngdmod32.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Oqfdnhfk.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Npibja32.dll	Iikhfg32.exe
File created	C:\Windows\SysWOW64\Jfoiokfb.exe	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Kboeke32.dll	Adgbpc32.exe
File opened for modification	C:\Windows\SysWOW64\Pqknig32.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Pjhlml32.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Bmhnkg32.dll	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Ipbdmaah.exe	Iihkpg32.exe
File created	C:\Windows\SysWOW64\Jlednamo.exe	Jifhaenk.exe
File created	C:\Windows\SysWOW64\Llgjjnlj.exe	Lenamdem.exe
File opened for modification	C:\Windows\SysWOW64\Llgjjnlj.exe	Lenamdem.exe
File created	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Jblpek32.exe	Jpnchp32.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qmmnjfnl.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Ofeilobp.exe	Oddmdf32.exe
File opened for modification	C:\Windows\SysWOW64\Qdbiedpa.exe	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Jefbfgig.exe	Jmknaell.exe
File opened for modification	C:\Windows\SysWOW64\Pfolbmje.exe	Pcppfaka.exe
File opened for modification	C:\Windows\SysWOW64\Cenahpha.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Ocnjidkf.exe	Oponmilc.exe
File created	C:\Windows\SysWOW64\Kjpgii32.dll	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Ljbncc32.dll	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Ibnccmbo.exe	Ippggbck.exe
File created	C:\Windows\SysWOW64\Bchdhnom.dll	Mgkjhe32.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Mlhbal32.exe
File created	C:\Windows\SysWOW64\Agocgbni.dll	Npcoakfp.exe
File created	C:\Windows\SysWOW64\Jpnchp32.exe	Jmpgldhg.exe
File opened for modification	C:\Windows\SysWOW64\Lpqiemge.exe	Llemdo32.exe
File created	C:\Windows\SysWOW64\Qeobam32.dll	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Jlgbon32.dll	Lffhfh32.exe
File created	C:\Windows\SysWOW64\Ngbpidjh.exe	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Gpaekf32.dll	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Nphhmj32.exe	Nlmllkja.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Jfoiokfb.exe	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Fqplhmkl.dll	Jmknaell.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Fjbnapki.dll	Pfhfan32.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Cjkjpgfi.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Flakmgga.dll	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Mmbfpp32.exe	Melnob32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6884	6716	WerFault.exe	284

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldoaklml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ippggbck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klgqcqkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfhdlh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfaedkdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njqmepik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocpgod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onhhamgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kikame32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlpkba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmpgldhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmncnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkcde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imakkfdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfeopj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npcoakfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogkcpbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfjcgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpnchp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnonbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqdqof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfoiokfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Medgncoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llemdo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofeilobp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lljfpnjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljbncc32.dll"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflgme32.dll"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbnaa32.dll"	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifllil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfeopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debdld32.dll"	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imllie32.dll"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nphhmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcmjaol.dll"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	86ac7113756e9214e42fb22a9347ee25cb9b68a9aa4e8e456e83b4b9d7f4f48f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbeedbdm.dll"	Liddbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjdgn32.dll"	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcjnop32.dll"	Imakkfdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngbpidjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Oqfdnhfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imakkfdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfnphnen.dll"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnamnpl.dll"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klgqcqkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahioknai.dll"	Ngpccdlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpggmhkg.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlaqpipg.dll"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akichh32.dll"	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llemdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmlihfed.dll"	Mpoefk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmfhig32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4888	1940	86ac7113756e9214e42fb22a9347ee25cb9b68a9aa4e8e456e83b4b9d7f4f48f.exe	83
PID 1940 wrote to memory of 4888	1940	86ac7113756e9214e42fb22a9347ee25cb9b68a9aa4e8e456e83b4b9d7f4f48f.exe	83
PID 1940 wrote to memory of 4888	1940	86ac7113756e9214e42fb22a9347ee25cb9b68a9aa4e8e456e83b4b9d7f4f48f.exe	83
PID 4888 wrote to memory of 692	4888	Ifgbnlmj.exe	84
PID 4888 wrote to memory of 692	4888	Ifgbnlmj.exe	84
PID 4888 wrote to memory of 692	4888	Ifgbnlmj.exe	84
PID 692 wrote to memory of 1860	692	Imakkfdg.exe	85
PID 692 wrote to memory of 1860	692	Imakkfdg.exe	85
PID 692 wrote to memory of 1860	692	Imakkfdg.exe	85
PID 1860 wrote to memory of 4484	1860	Ippggbck.exe	86
PID 1860 wrote to memory of 4484	1860	Ippggbck.exe	86
PID 1860 wrote to memory of 4484	1860	Ippggbck.exe	86
PID 4484 wrote to memory of 4580	4484	Ibnccmbo.exe	87
PID 4484 wrote to memory of 4580	4484	Ibnccmbo.exe	87
PID 4484 wrote to memory of 4580	4484	Ibnccmbo.exe	87
PID 4580 wrote to memory of 4004	4580	Iihkpg32.exe	88
PID 4580 wrote to memory of 4004	4580	Iihkpg32.exe	88
PID 4580 wrote to memory of 4004	4580	Iihkpg32.exe	88
PID 4004 wrote to memory of 1080	4004	Ipbdmaah.exe	89
PID 4004 wrote to memory of 1080	4004	Ipbdmaah.exe	89
PID 4004 wrote to memory of 1080	4004	Ipbdmaah.exe	89
PID 1080 wrote to memory of 3440	1080	Ifllil32.exe	90
PID 1080 wrote to memory of 3440	1080	Ifllil32.exe	90
PID 1080 wrote to memory of 3440	1080	Ifllil32.exe	90
PID 3440 wrote to memory of 5112	3440	Iikhfg32.exe	91
PID 3440 wrote to memory of 5112	3440	Iikhfg32.exe	91
PID 3440 wrote to memory of 5112	3440	Iikhfg32.exe	91
PID 5112 wrote to memory of 5076	5112	Icplcpgo.exe	92
PID 5112 wrote to memory of 5076	5112	Icplcpgo.exe	92
PID 5112 wrote to memory of 5076	5112	Icplcpgo.exe	92
PID 5076 wrote to memory of 4376	5076	Jfoiokfb.exe	93
PID 5076 wrote to memory of 4376	5076	Jfoiokfb.exe	93
PID 5076 wrote to memory of 4376	5076	Jfoiokfb.exe	93
PID 4376 wrote to memory of 4468	4376	Jmhale32.exe	94
PID 4376 wrote to memory of 4468	4376	Jmhale32.exe	94
PID 4376 wrote to memory of 4468	4376	Jmhale32.exe	94
PID 4468 wrote to memory of 1348	4468	Jpgmha32.exe	95
PID 4468 wrote to memory of 1348	4468	Jpgmha32.exe	95
PID 4468 wrote to memory of 1348	4468	Jpgmha32.exe	95
PID 1348 wrote to memory of 5012	1348	Jfaedkdp.exe	96
PID 1348 wrote to memory of 5012	1348	Jfaedkdp.exe	96
PID 1348 wrote to memory of 5012	1348	Jfaedkdp.exe	96
PID 5012 wrote to memory of 2656	5012	Jmknaell.exe	97
PID 5012 wrote to memory of 2656	5012	Jmknaell.exe	97
PID 5012 wrote to memory of 2656	5012	Jmknaell.exe	97
PID 2656 wrote to memory of 4616	2656	Jefbfgig.exe	98
PID 2656 wrote to memory of 4616	2656	Jefbfgig.exe	98
PID 2656 wrote to memory of 4616	2656	Jefbfgig.exe	98
PID 4616 wrote to memory of 1052	4616	Jlpkba32.exe	99
PID 4616 wrote to memory of 1052	4616	Jlpkba32.exe	99
PID 4616 wrote to memory of 1052	4616	Jlpkba32.exe	99
PID 1052 wrote to memory of 4524	1052	Jfeopj32.exe	100
PID 1052 wrote to memory of 4524	1052	Jfeopj32.exe	100
PID 1052 wrote to memory of 4524	1052	Jfeopj32.exe	100
PID 4524 wrote to memory of 2356	4524	Jmpgldhg.exe	101
PID 4524 wrote to memory of 2356	4524	Jmpgldhg.exe	101
PID 4524 wrote to memory of 2356	4524	Jmpgldhg.exe	101
PID 2356 wrote to memory of 1924	2356	Jpnchp32.exe	102
PID 2356 wrote to memory of 1924	2356	Jpnchp32.exe	102
PID 2356 wrote to memory of 1924	2356	Jpnchp32.exe	102
PID 1924 wrote to memory of 4712	1924	Jblpek32.exe	103
PID 1924 wrote to memory of 4712	1924	Jblpek32.exe	103
PID 1924 wrote to memory of 4712	1924	Jblpek32.exe	103
PID 4712 wrote to memory of 1964	4712	Jifhaenk.exe	104

C:\Users\Admin\AppData\Local\Temp\86ac7113756e9214e42fb22a9347ee25cb9b68a9aa4e8e456e83b4b9d7f4f48f.exe
"C:\Users\Admin\AppData\Local\Temp\86ac7113756e9214e42fb22a9347ee25cb9b68a9aa4e8e456e83b4b9d7f4f48f.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\Ifgbnlmj.exe
  C:\Windows\system32\Ifgbnlmj.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\Imakkfdg.exe
    C:\Windows\system32\Imakkfdg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\Windows\SysWOW64\Ippggbck.exe
      C:\Windows\system32\Ippggbck.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4484
      - C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3440
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        23⤵
        Executes dropped EXE
        
        PID:1964
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        24⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        25⤵
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3056
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        27⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        29⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4920
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        39⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:976
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        41⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3864
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        43⤵
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        45⤵
        Executes dropped EXE
        
        PID:1204
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        47⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        49⤵
        Executes dropped EXE
        
        PID:1272
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1184
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        51⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        53⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2436
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:388
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5116
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4408
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        60⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3624
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        64⤵
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        65⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2492
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        67⤵
        Modifies registry class
        
        PID:412
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        68⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        69⤵
        Drops file in System32 directory
        
        PID:2504
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1436
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        71⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        73⤵
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3548
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3488
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        76⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        78⤵
        Drops file in System32 directory
        
        PID:3680
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3896
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1856
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        83⤵
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:812
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4688
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3972
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        88⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4996
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        90⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:316
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2888
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        95⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        96⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1804
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2444
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        99⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        100⤵
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1180
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1812
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        105⤵
        Drops file in System32 directory
        
        PID:1568
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:768
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        107⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1376
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        108⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:1016
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        112⤵
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        114⤵
        Drops file in System32 directory
        
        PID:5268
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        115⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5356
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        118⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        119⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        120⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        121⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        122⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        123⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        124⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        125⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        126⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        129⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        130⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        131⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        132⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        135⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        137⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        138⤵
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        139⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        140⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5744
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5828
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        147⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        148⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        149⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        150⤵
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        151⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        153⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        154⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        158⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        159⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        161⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        165⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        166⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        167⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        168⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        169⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        170⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        171⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        173⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        174⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        175⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        176⤵
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6396
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        179⤵
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        180⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        181⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        182⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6708
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        185⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        187⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        188⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        189⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        190⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7036
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7092
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        193⤵
        Drops file in System32 directory
        
        PID:7156
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        194⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        196⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6516
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        198⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        199⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 404
        200⤵
        Program crash
        
        PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6716 -ip 6716
1⤵
PID:6816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
80KB

MD5
fc91ed8069ae7d685ca711c7fb775f61

SHA1
8fead0f9d4083a77c3d1d68f6be150759c04bc31

SHA256
8fd1c2c62edd3443b62182767063149a93dd2251aa646507e1b81eb838bb64b6

SHA512
5cd1f8802c48ddf3db75ab40884826f659a9c94676a2ee6ba826e39f301ff0f0743107de1fe2ac5484a84f6133d8f7626905527d159447330000cdc7d31bc8ff

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
80KB

MD5
ada6e0b8b83b3bcd8df0f5e2672ad72b

SHA1
e8eb483a8183b6feb292cf35afcc1125d0ccc631

SHA256
6eb6f5cc5199a2c70f673c4fcf17f812b71d835f870c04b7ef6f437b1c0cc326

SHA512
7bd366218d5934aef9c7d8674c6fc74870c976ae4a13bfd517179bb94e425770a21df0dc8d1f365f494772b6aa38c7fd56f5e9289a4945afc64a91a9a6f7d22d

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
80KB

MD5
642c67e08c897cc9c9291be85af5a799

SHA1
0cf20649998365affb37ff5f77077ef94d5fc242

SHA256
b43bed7b1eae646727c761ec43212c16449586ab6490e059a76ab5ec57c99d9f

SHA512
242deedb10b59a9ce593f167662005608e62b4917d254ae6b89f4d118957c79aee1d404f421f55fc32e3ae3b3eb0957f4cbc1c9d8446e9fa4551cb83a03afc3e

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
80KB

MD5
95e5ec1b8ba4160c66aab28f97abba90

SHA1
6b5183ce78130c52fc0317d92ccea133e5082903

SHA256
8806b08c7926c15e620a80fa2e84358781e259aa7731bba3225f15b79213e10e

SHA512
0bb724b7bcbb4b7eb3476d9d694f9c08c891863e34415c0071d0ab26b03924994efbbe7aeddd00428514e840f09d38ec642a1d89c6e7d7243a9bda1a64d9874b

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
80KB

MD5
6bedf76cb58d5ff63db0a66f36a0caf1

SHA1
2c10ca29535b8449bd20ae16a9422d928303452d

SHA256
72057a078cfbf3cc485f43bed35f3ede00ebfe887e47d3560615f4bec773c0a0

SHA512
71dc125c162ed999a1831d9324bf6a0ef92b3149e56ffdc15b8a07dc926c1e1f8e1b5028f29d9a4c1581e73596c93e3ad2f7757b9b15c80adc7553bd9a72cdd9

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
80KB

MD5
b501c285e1155f28692c24535d5b67d9

SHA1
12725760777d09af26c68a2eeb07345c2c10bebd

SHA256
cd0da968b56f913670c2e5ebc6e84f897e0e46194f33052874134e0ed576fa01

SHA512
e3f209a2ded20276be02bb9c6a3df8f9638f695c25c959267bc884678123f9d6fb30696bd58f1a721010e210e1f64d16be9946bcc0e542f80100b8b9a8ed9991

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
80KB

MD5
9913565d34475fac13da00ef57be3df2

SHA1
f8d1f85e6e2daab8442258d6f16abcb830aee8d7

SHA256
ade6ec159087e42bc0a1541c520c296417e91974ce32aba08c2390f1de80ea3e

SHA512
7fa9c1eb8024f39bd4a5e08c2af964f018f646f2d643be04ef160db2018bb8add35b30b93fdf0d41b3984cff228f31bf4b6325b2754946bc1adc24e6d93cebf8

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
80KB

MD5
79409c21413fb530477e0056ffdab63e

SHA1
cfc74d7bf4083f92ab3b56b4d81ab295cd1d021b

SHA256
c40bf471fec3447e2737df12ae5fa63694d3615406938a671c458bc6d4535652

SHA512
03c22cc61228095b87fa27cefcea3449e0a2450bf18abc34f6ae97fa390100712796815021a491d62b825ebe6b3da18995c12118aab5eab6ddf00925d2fd9dbf

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
80KB

MD5
4f9cf0fff382ee6deb140c97686fbd3b

SHA1
4b9d69de3c629c86c6d82da11afa26beccfeea58

SHA256
6cf54960579ce8e246e9464b35985a3874d012c08e39700165fa7ccbebf3947d

SHA512
b3f823479d139ba04001c236c8fe190927cd7d7ef215487b11567f5d4a606ff41f0902db9bbc2dd304b60a1ca253f41648b6008b7254f2b2cbf00f973ceaaffa

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
64KB

MD5
c35fafcf3a38e321ce13e4ffd3bf66b7

SHA1
61671799bb4c87a630d22ebf5898b1c2dec12f3b

SHA256
b9456c7de8af7dd9d1002ce9946c0067daad111d58ca04ceb55906b3265b4c56

SHA512
77fafc6ffe9bc24ab5a89a2fdba496ced85d053133103ef2e4b51ba4280b07da66a08ab1de3a6ccb64849c12fbc19d6e1c22f543593071dad998ff4b4dbedd43

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
80KB

MD5
4d497d0521949344cb6305640e46ae77

SHA1
9734e50fc505dbc651b5d924c35593a92451974e

SHA256
970b7f625171c1c01ea3ce17c1bf0157830fb084a2f9befdecbb9df86bf6cf69

SHA512
56baa64f495ff814bee89beb1f0bf993cd15ae88dd927227fdb8ed87f54b4e77599d35dd7cfc7cc8ad73c4a4a14847233e7c3f0b3aaeb1a1f219ad8f19effba5

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
80KB

MD5
8138ab5b88de05818c7e638a0cc85dad

SHA1
755c0c73aa2ee064f402325a6f5899e62d1e7692

SHA256
3989d566a4c208e12c2fd15643ee3c9db52f574c46f7a48cc9d843e9fe120c05

SHA512
c7e988af77fe8b175e8ecb8b306f515d7422c1815ed4f60f3c23c20ba5a234ecd11a6a908fc475553ea14184309d24f1bac416f850346001002e9e0e447d4010

Download Submit
C:\Windows\SysWOW64\Ifgbnlmj.exe

Filesize
80KB

MD5
aef4a1b77bfd275dc539b16d6b8b926e

SHA1
567c4175e6c915a66d43cd42e46e270c86f6520a

SHA256
68274edde6b18bffa18d82a07ac62f167fab8b6dc6672e021b2047e45f4c513a

SHA512
2f5c9a58788ac42df1d288eb7f0c486840349259513bbf3b216394ac1da0d2ad35906f013df12ed51c32708a69b2746509ed7418038a77c77108ba873b025d45

Download Submit
C:\Windows\SysWOW64\Ifllil32.exe

Filesize
80KB

MD5
a2224d2127fe5bfa4b560f61fb9240a5

SHA1
4c3818f9a64898efedb7e110c7bface86d4a9590

SHA256
0727999c9934f40427e93f65fe8377cc59760fca66ac86beda3768d8dbbe6d41

SHA512
6983be19a6ddf36fa1a5673f803647319386669e1c9b4a954e4d1a953153ff09a026d4cc6d626fa52b892ecd17c5cb4bff45ce72f56ebc062cec13ef63a24087

Download Submit
C:\Windows\SysWOW64\Iihkpg32.exe

Filesize
80KB

MD5
c4e3d6b97dc00f4162db45b0e10b93b6

SHA1
709009771169df6ce79e2df9cc14ef64f048b031

SHA256
ac029b42d23be5312b3e01dce8455d48994044fb8a016c2e1f64f2ea17014f92

SHA512
6cedbb6d1d04f54fc3bd79a8f479a21d5a66f44585c1f4dbbe532d61e8cec2b82dd24e8006d28dae23c60559ef311c1319c6f9d5084454cbbb7179cc20e9f352

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
80KB

MD5
fb7bf07d57ecf8e5e87634ce98d54c4a

SHA1
5c78509f7a1080b53dcba25d2bc69bae25cead25

SHA256
82fc7e2b4b9907a467ffdeb11386e1e53d7e2d9822ecefbbc2d7f4775b795398

SHA512
8797e9cce5eaf551c9c991c90b9978887d42c7133729792fb80310e0e1eadc7d3b0734d2959b65737abd4167c5e8f2e16cffa3647d638329ff963d18c7f4be3c

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
80KB

MD5
008c596140fc987922b144c7da41510a

SHA1
b02f5f657077a2311fe935dbf546dbf6539e91d7

SHA256
7042567dee213b424fbe9afb92f57667ca3dbb8d85f7e1e373579bd7307d5f64

SHA512
5d0da06e6a3c73c80b433c564b7cd9c01aaa65cb8097ae4a0d56e0ce3349e3957e31dcbb8abe5b1637566be0e4b15138649a60178909d1a18cde4d91abbfb9c0

Download Submit
C:\Windows\SysWOW64\Ipbdmaah.exe

Filesize
80KB

MD5
edfb42d6088357c8cc9e28c1b75ed95a

SHA1
809ce5c14e4b3972fb5828628db3e53801dcd7b2

SHA256
e0299356037ebbb647cb75575a53e42f92e4c94b73ae1a50ebef6533bfe13187

SHA512
914605d433a3b8a5d55c6bf9ed1b258e90663f64c004699781fb618e1f2573eef62f8eece1d9fdd8462a2d455a2dff252f40e1b31f6e93e83f345eac5a196679

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
80KB

MD5
457edd50e7a89014a29a1048ec3bc33e

SHA1
4c528bf73b1a2bacbcbf1d54c407b63f1be7eab3

SHA256
89b2d1398b8f21845f67c062e207b3fbcf2e16380d13748a7d11f4dcfa2e4791

SHA512
28e3f92c9131a82bce3178b131693f6eaad0ea85685728b3337853662b2312025aa8bc81753db010fcb8917a36de61c215cd1cb46042ff4c0d4221fa965e6c52

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
80KB

MD5
bc7b8249be923cc021b2d59c1a434329

SHA1
3678ce1c02410146a2287ddeef0a207b09231828

SHA256
975c355ab35c6205a6a81d424832e74bfcceeb2fd1b2b40c49936db7ae038a80

SHA512
4536a76776da1cf49f051dc3541e0897e6df4eac9f3536a315139e4b8e66e5ed1641c016e34fbf13f1a00d927a63784dd4e395f6ef5043faea713499d4a2cef2

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
80KB

MD5
8b0762346ef5ba911facccdff7871d0c

SHA1
6d705a78b8acf3f8858e2b1ca03b65ef125a7d5f

SHA256
55ff1948b1343f473e3b924e7c5e3e09ef9394e98b2c0fffe190531072654348

SHA512
b0a1583a87bdf1e9049da864449bdd21ce479802f06d98495b6aa490bf6d0da074d8df771aeb6463b672d93a6c068bd3496ff31a5332a61b171762214aa7664e

Download Submit
C:\Windows\SysWOW64\Jefbfgig.exe

Filesize
80KB

MD5
361300b06632ebe47b7640ddb8b33050

SHA1
a9468ac1afa0b41d73816812e8dd20f92187fb19

SHA256
68fa5642cdc034d323b4569839d21edef30d31254b17e39736143b02841664b3

SHA512
33134cdc3fe77f4b82c39ecdc63e9cd304061319d221d2cff8778cc90959fabeb27ecaff956231eb9586a1f272a18d571941048d93dff3c7e42e92ea34501158

Download Submit
C:\Windows\SysWOW64\Jfaedkdp.exe

Filesize
80KB

MD5
555d6b15d2ef3295798b6a1b4211e8d2

SHA1
dfc0dce21c743666d41799ee02c70cda4cb36f2c

SHA256
a9d12dff52771516dcc6b42ea05a088e3b19a0934785f344a18c6099e9e30d32

SHA512
1deba4038ff9eea3a77acfb4a46385169fa337dc64d5abef541f91b91867df433097a1f8c96e69d73b47b39d345aad98fed76a111c32b4e76cd8c57053bb0896

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
80KB

MD5
db2a654428537af694cc4570b3779399

SHA1
5e3f3afb6028eb760b6520742e7cb0d7cd710b36

SHA256
bbb17674e357c98ac6e2ba4e3b8594a6413b3e41e957fcdf84a133bd8c4b7888

SHA512
3a3b397ebe46b406ffdf238bbbabfb0c3cc88b8c377ebdf72d7cc5494b20bfd8698bfceaa9c677b3a785b08e1cc6bcfc27078fceeed9db97b4f514d914528eda

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
80KB

MD5
e160e8023c346c2d02777f848566ac43

SHA1
658d1072b5aa3fa4ad1ace2faf32a324030a7a39

SHA256
66c7f2ea3b2cd3570f006bdc431e23e96a55dea1600b28811509aaf17e0f6464

SHA512
548006a3e1ed114745a5b8e260f8b34ec419293a4cbbf802626f7ffba92d0576d8c01f8e92571b17473a58ac0ad3f8a1df552284f88453eb652a1762f22e3a3d

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
80KB

MD5
fdc08da94cfd3bf981eca6808c5fa236

SHA1
5888e474dd5bf12548d15fb74fd599dfb9d0fc96

SHA256
0ab235559c326ddb1d2a287256660998ae21f77d4062759d0adc280323f31d6d

SHA512
f15ba34b1ab833f33462b357d039244d56f84c1820cbac1653d4dbc5c2b605a4ccc789cf0a868bd267f2fc0c1c56368da3b1a9b40f7912a25d0ce46474e24a3e

Download Submit
C:\Windows\SysWOW64\Jlednamo.exe

Filesize
80KB

MD5
60fe23df4a79743a4f03941d34f75d1e

SHA1
e78eef8ba7bab67e8a07c1a53acc9e5c2170e8af

SHA256
2d9a57799e7252be62566d0601972f45fb975806a5b204d20bb11d672102475c

SHA512
60257b4eeace75df25efbf6d9b5b63732ff5c4a58e36f501d089107ddb1d3200907890535a52a56bd6f924af7f7200a4ff7d62e0b169c497a3af42319a92b819

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
80KB

MD5
9390b70352bf42832a560610efd6fe8e

SHA1
7cc5d5f5e6ebb2604978a12b4b58e476c235ba6e

SHA256
55424fbb8e7733201f38c5644a17598e0220a0fbecde8bc9dfee338b40dff5cf

SHA512
698a8dce216a4e9754c2b973d1f2c65e7f36e2203e3844072625f8a6af279a838544032a5e26e07f78f9da24f6f46d25bb3f1cd768422668641a46875150f6c2

Download Submit
C:\Windows\SysWOW64\Jmhale32.exe

Filesize
80KB

MD5
0c0dd960a67f89a92226f534190df0fd

SHA1
9fe4808c08a1d73966cfb910e92bcc8cfdd6d2f4

SHA256
7451775e90e58c7bccc0672bab1e130098e7a6cd373adb85d1c9fe4af8979e22

SHA512
7d58fead9212df1f370a560775357837628787ca347424c36d8777b228629e04c494b1f85f4934cf8ed47933c6f9e78a964f22b1acf56b53cb4381f913ee772a

Download Submit
C:\Windows\SysWOW64\Jmknaell.exe

Filesize
80KB

MD5
10d459e308a4448cca8d84506877ac17

SHA1
cda7808c7cdce348e18ca1ac5c4df4407742408c

SHA256
d6e5b5f963b591c69a783d6fdd33e2ed34caa4f0af8135f327c2f86c08e3a237

SHA512
05710bd2d3ec4a3316564c31fcb0e506533250f5e29aca038b52e3b6f3b51da6d810339ff6088a92a785602ec6405c0d05017c5a77f1b1f9a6f48fc96fd74196

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
80KB

MD5
47606203c280398fb450c78224900f4f

SHA1
2175d59c4327f2d8789c6ed06afb6d0ed860f232

SHA256
f831c4475375c40dad1199e28f74c2dac5bdbbcb7cd7aab4d6153e0fac917063

SHA512
c171e92f2c368a184fb6f6c71aa02fbb6a2fc20106bf581bc55f813ef5368f9531be3b940d6b7a1befbc3b4ff5ab59b69397d1c2593390d1499597af0c9f37e3

Download Submit
C:\Windows\SysWOW64\Jpgmha32.exe

Filesize
80KB

MD5
b2139074379bc0df30a6286c155c76a2

SHA1
fb5c8b0ce82f70d3f01c31b379a5f6440f66c174

SHA256
51b3ffa99c73ef9ed3f0eafed2db26291aa4a973180317c3090c3ead93a64fa0

SHA512
37d979fe114613ead886a63b017018eb4f726a4d17ecea171d3ce02f95ef2d95dcfb0b7a51fddc969bd215c6a59797fcd295b9944a9484ada61551cbd01d341f

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
80KB

MD5
7a1be0c17eae036226d7f31ae35a48bb

SHA1
11bdb0506f45cb63a34c67918f303370e5c0d6b7

SHA256
6d9db45183f03ff258b02ef3c65531410b2d76fcad3e71548181063e76852bd7

SHA512
6c17cb8e0c069a9acca4dd9ce2fcf693c73c86e4713b0c018fc3159118dffff2d37146113a8ef4564e9d9ba235df68ae93fbf1eaa872f8b3b32345ccfdffb207

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
80KB

MD5
146c1fe3063226a462c321756a6c6c22

SHA1
58113c0ea1c48431908ba52926832944142bfdba

SHA256
9ea3f238a17e1c9768c7a2be15fdd2364d83b211efe99ee1ca418417b6de52df

SHA512
2f481434c2b8225e539729510719dcac806da33456b67dbf809f3412fc7c95293eeebbe5907617eb4097ee6602b4cc7bbc3f00a8417eedd5f6055aedc911ae59

Download Submit
C:\Windows\SysWOW64\Kfankifm.exe

Filesize
80KB

MD5
d1b620708a8228ef8739aa5e05b2868a

SHA1
57ffae6a8a642476d073209562b092c829ed6751

SHA256
11a5093ab838dbe8755abccc18153b34e2bbb073ff53c2dee693a9667b9ff744

SHA512
25286720aad7177ac9454b3c09cf1e81880fa4700f5d6bbff605752078284a51303b2ba90af5653ff32093e87756fe0c2c96bab6e869c48806dbcd6dabdab740

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
80KB

MD5
3a90a8c27e04fa83e5ec449ec56a33af

SHA1
bf63935d317ebb8b08360e06ae4ed5cbed718f60

SHA256
ac6eb835dcffd5655ab70232f55b64c18ad2d64a0f24608e9753ba8fb11b716a

SHA512
06a167f8d9397600734f9e5a34a29d558f68e34e890211bb7f1c425955f71b1505293e7e8204b0fc6831ca25716e724619c03c182e8b9b87b80925cedb4b89bb

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
80KB

MD5
96aae8125a1435d709e8755f168386fc

SHA1
1bbbbeb97f348012ec70ec967be632f1152aaaae

SHA256
931685b261d101a625a6d37de5f48791b56b73531dedac7207088063118fdf54

SHA512
6e139478b363d3e1ec5697890b527df8072d2a40e9bd870b4c1e89f0bfd6d0652d32c099ea36be32928e061371adbe742ec731be766059483f8e2012895ca193

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
80KB

MD5
bd2456da90f8ef0a056b1a0cd8e77af9

SHA1
ddfcdb280f471f99489b52740ccaa97b05152c92

SHA256
e81ae1048caf5c0926b4d53c0b993b03e93c378ea8700fd85bb680addcab9577

SHA512
f6ceeb1c9f24f2db7878ae1ea4700ab89a277862abe18faffd29fcec06360e438785653c36bebe337b0aff8f861727d50068a6eabe4744e8e45136763b50d94f

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
80KB

MD5
97142f3a55e4afd90f237c88d6925462

SHA1
ac01a678c69044ce6df4d651a52a2b1e1f1240e1

SHA256
d5b1e612f0bdc31efc112bf0e8ae3972915d2c7084fd3898289c55a7de4ccb74

SHA512
a52601dd62fa96eada310e35ebf167beb06ff240a552c49219c300030672e976f5e90ac31bf1957025277f8a5fc829b392bb430e2f9c639dfc55e64e2e211bdd

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
80KB

MD5
a2280b092162802e16b03cd7a676d34b

SHA1
19330f5441941bfc827a6b601dd77af8c884d11b

SHA256
397ce1a396e3d4722587824e64bf72bb881ab8e3b4471092a623f535e159812d

SHA512
5f4c2fdc6c1958169845c4dfbd93695c8d6941a66d307989550c0f731d7a254317a6d9743a9d27f62af66b616063550266812923196b82fda7c99df0a4d156e8

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
80KB

MD5
6e26cf3b912e2fccf2781a9926f9e170

SHA1
569f6fc58884c98b0a29b4968f2ba5bb0709930e

SHA256
4891905e35ff0ce89e3ceeb0c7b2f39a152246c57da9a19bcfaffb4ff4b7ae28

SHA512
b6d8c48e8bd9805b87acf2ffb96a4988352d9bade9cbcc6355c4d08e2d817f76f1138dd38917b6d0e9cc197415af47d65524dad9c94e69e9656d85655a1e19cf

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
80KB

MD5
555117d54a6ac2cb9fb597e820cedda3

SHA1
72c5e4a4ca32f6574a5dceb68879ef50f84d4ce4

SHA256
d13ca30399b42b1a9a5d7cc107f924c28b06142c6424ced470dd6e8aa18bf0dc

SHA512
a55f9b636cfe9c6f420636dabaf4246ba4ea05169831a57f54604bef6fd0a9727e3dfdaca69e249358cd62a928f3c239b19feb73ba81f6f5371d7ec9d6b92e65

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
80KB

MD5
075fd81b3ddb5177144f1fb402cb7812

SHA1
ae988852db9f8cd725752fd27fe6fef1e736acae

SHA256
7a84a2ed6b5b998b4723fff804378b2a4ab0a691da84d5d3d181e6029099f1c8

SHA512
3a73de1277479645978f18b167b9574dfd48ade3b3121e01fc3baf387ddcca041cb8c2d9247a09385f25f0c42d7113be4c65c5216342c189a2b5112a7520f928

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
80KB

MD5
0b379a68d4c847780299559033488e4f

SHA1
a014c28c5eb8fdc48736a9a41e1122e85ad95c03

SHA256
569d55b8e8e9ce9d80f707848a1ded1794c07a1df8d5c9744f7e335957388420

SHA512
d4dbfb0d4aa0aeebb44489477c9f5cbd35e4bf44cf78ccb1294d637827922d76800d5a2221362d572830853ee807f180b2e4cdca63b49eea96a321956b56142e

Download Submit
C:\Windows\SysWOW64\Medgncoe.exe

Filesize
80KB

MD5
45792d00d2a9797b130a094c9d2795a8

SHA1
160dabcf52b5171fb117a6eca3ba7db5dbaa45c1

SHA256
3cac66159f8112336a179f461fa790df66c0e08b097764163ad01e42f31112c3

SHA512
f059b4c36cb04b2cfe429dd19b6499366843a826c7973eef1e8e001d0e3873bc3e7245c77e73abfd4f2dfa2d7287b267bd3a8ecda2ae82efaadf1dccb06685e1

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
80KB

MD5
5ef6961b247910d88575b5c1575fec1a

SHA1
bf3da462e4dcf032b4db99be1d099a73f8786c58

SHA256
343c6ff3db67f15d8a56082412eb8572263f7b8033a840f98d7725462e9bbecb

SHA512
20498b226f6ced80f5605826184895f6793d65ac389d070261e57295d6f65903975a04affeb22ffcf6c2489f58cde5dab15c0f8e228550556e222dcec48c869d

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
80KB

MD5
babeb6bd95b564f43fe979ad8208dce3

SHA1
2aebbcd6be8814f94336af0fee20301701f41e79

SHA256
eb388714cb058f76991bb21dfac71ee4163b5494bb23dd3da3f8e88cb468b90f

SHA512
e2df952d244593a18acabca9cd8fb57455e92d5a20a324493afdb36c5cdb89fbec21200ec193b38ef7a59fe7b1f46ba96a6fd079bf769158c74fe3da66d8093f

Download Submit
C:\Windows\SysWOW64\Mmbfpp32.exe

Filesize
80KB

MD5
02379058ef590ae8e0b24d2c0f91a019

SHA1
4a650089c7aa7d2a140ed5a082d286b2c9674b33

SHA256
33c8ab6e50997387d47a662ddd55f2152e5f3bf3b07e9451900c4365edaffc9d

SHA512
7cbea304efdfd1f68f529c2fc9d6d13ef55b877d26fae9833ac36f50e6fb370b20740301a1b6c370a615e55b4e227847c4db8ce74d52c9efb7821239696bb10d

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
80KB

MD5
e2da5cf36582220b01adcb62660a8181

SHA1
c03cf5a2ab1be398b8537666d3906527964436ca

SHA256
5614358a0bbf614eb2b60cecc5fe24c17bd1e3196756b2867d72815e2b8c2a98

SHA512
e3cf97bd92ddf26ef646d327aad45a2c9b5524f47b9c1eec4d9d481817e88e0d91b8d56a16113c7f813c17eb553fd0ce271944b024970f458e5b91844e8705c8

Download Submit
C:\Windows\SysWOW64\Ngbpidjh.exe

Filesize
80KB

MD5
7810b0c370c5fe2330184afd24dff144

SHA1
4ba689bc2565cf8d0005408d92e199a7141f05cd

SHA256
05e50490010917e49240665dceb6fd47e7619860ff27ce6a5c7769cac1115bfd

SHA512
f7825694b38285ce0bd53e5ea4087febb2ec4c5f89f42deb64a9bcc3f4ef40947d2141b5a2069f457844f19ef4ec0f21a857c48f879f4ec01f4bf1c92f6fe964

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
80KB

MD5
03b611f0f5c04ae1617538e7a1112149

SHA1
49853fc269238afe9932e89cb4e6d8d6c213e655

SHA256
9c2c051a68bab3c5eb9657f823801217610a6f63cb86b287442bc65815aa329f

SHA512
91f26daeb429d9fa41260241089189757050542507af868a43e9da0d4d13e7c7e5e8792578f913de4ff02c5764d23f69fcfc3bfd69e421b1494ef99f13d1cda5

Download Submit
C:\Windows\SysWOW64\Ngmgne32.exe

Filesize
80KB

MD5
be565217e9dd5fc2bd61c8db3d18f0f7

SHA1
58cca7b143e43f72d3ffb60fde0f37d3b3ea0631

SHA256
d774365c5ec2481df3f58bd8f0fc4f011c23182b8d9c8def629e9140a1d810f9

SHA512
0e8fcab8f5b3310f995cfda0a585943198400904c76bfae64ec41f41b101a0c789daed1f2ec71f217fba49256770906f455564ad748a2a2a5f0a847ca96cadc0

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
80KB

MD5
5ca404918bceb1ec199bfe71dccd429b

SHA1
1c41457d396b4802b53f4d50298011597a45c7a7

SHA256
7ec0ba4232ebd4e06abde2b5d6c54d884d5784f7a78ce4318047a253d047e5c6

SHA512
7d1ff6339505e99cef1ce3937d95e5c72d5be06f7f5c2cfa0e725028fcf5895c816042c3af0b6f535a1e961c8e4b0086f1ad93870b0d38f04af02ac88307eb0e

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
80KB

MD5
683d5223cfc4319490dc6dfc30690337

SHA1
deb63610473b29becabc1859fd67f911632ab157

SHA256
8007a30c1b862696ceeb88f9f579b788eea96aa87e554db02bd33d841c4e8ad3

SHA512
2a7b07fac3d1a34f6a548901b1be5bffc44f95c6b59814a0b4a061c1f0c3b28126d6bff6b99cfaf775fd4ec7c918a717317a3b22999bde4d894fd39cbfb19c5a

Download Submit
C:\Windows\SysWOW64\Nlmllkja.exe

Filesize
80KB

MD5
519d6cd391c35e3596b51675d8ebc3e0

SHA1
b9416bd1d8f3dc0d05e120059b6a7ffa51292b64

SHA256
d78f32315e96b7403088b5726cbec4e09ab51773699b9c37ac1f859f9ab94023

SHA512
33f4d645e0eeba014aa10d28c8e1586b9dce90d15ea9c01d71f26c8e7973749a445cff0d1054d8db3c9e91787ddf033778cd9328af0bff270f9f829a8b0edaa8

Download Submit
C:\Windows\SysWOW64\Nloiakho.exe

Filesize
80KB

MD5
74b7f2d269ac33db00fa2fcca98fec4b

SHA1
97525f51a60352486d7e8b7b4c355781d1aa4a14

SHA256
a17d5f987aaf045325e299d48248dd9277113419cc92badd750b1886915a263a

SHA512
ed8940aa8a05d57dac08612ef9ac4ac5a490b7348fe3d91a9f1d15cc54ee8f348d95f1885ea77565b2a0166f83f22194a4a822542f4f82c8d1314d8eeec5a8ef

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
80KB

MD5
986b53df6e3782e5ffbddb246b93119b

SHA1
a017b8463a423f7375a206d36e3b03da29943923

SHA256
54c3973e496967ffb119e8b449cc652662694dee1cf9def8b8811ac27d57a41f

SHA512
e6c7888e475ef99131fd7f10fde6fffc93f8c9d1ef5d2e5d214f0525508a23d8abe1b3209a7c0b3d64fb361b8feff01f724e7a88c39333378d6664bd13e7aaf4

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
80KB

MD5
1bcc6fe3266c3cf7d72ee42cb0fd7649

SHA1
a9f482dc0816ccfbc2e9562933acb703b5d9092e

SHA256
06db0b97f705990bc6a1a2785f1f873d3cab46538f38eaa2ac2edcda6efc5072

SHA512
c66c4ccbe8c7699e1163607685787c1b82d2c93f868003ee4ae34e0c1be1de02f846a813a20e92c90df347977d2d392bc9e982d4cb665d4fb5e7212b3548104a

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
80KB

MD5
916180988c24651a351e62188c228e70

SHA1
6c14422565b56962c78482c99e189cb45fbaefa5

SHA256
75453f05d4d68252b89211aa146acc14d8d2530772689a47603c1ec3ac6d65ba

SHA512
279c9a7e522520675fa6ee3c62dc5bcdbea008a047affd9b17a17075ca8460dfbeeb0959456ce52157a57fa65aba58a29d1ae66773456d312d0c914d8acd4591

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
80KB

MD5
d386cdad0b679502d460469fea85f6d0

SHA1
267f8055bbf59be2e14ca24b9d4022f9e73f1281

SHA256
7fb22511dab8e43cbd95de649a016a858ceaf995cb9cf633ef3237f79cc70433

SHA512
93b5cdb4a8022f28f3704bbb0e6aad8d90ce5e00556d47a2c0c87924f256abe7fa6065d358767bb647c95e6d164fa33cf8d02c3d7b7f9d57dc4fa7a9d8f7d4c0

Download Submit
C:\Windows\SysWOW64\Ojjolnaq.exe

Filesize
80KB

MD5
ef5aae7ca4b2a48a0bde5155e3ee202c

SHA1
d84325366281ff7a1d480f77f195e3d02de76f68

SHA256
15d4a6420b50d009b85400e41b350d4e833d9f0d325fd7228c94d80b4ddba3c2

SHA512
a0f7d4a6e459d8e4d799b8007f2cd171d4073f35c571fc542cd5d7e32a6a8c05bfe58392f9285fe4caf030430985977364b69c0e2b12c14d98739ff246918285

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
80KB

MD5
441c3322209f056ac3f8356acde0291b

SHA1
c7fc794841d98769b59cd6e8c94f484cab4d485b

SHA256
7b81655d38341b8b6a3e607e56b843f9e59b97304313f28a9eb3ab848c547d73

SHA512
b78ed9f1d1b70334315252a5dcb1d249ee40b7141450c03630d29139a6c08bd356a8fa6ee1c22d463cd2f65dba1ad7c52868536d77f1c1afc828b7d22d485032

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
80KB

MD5
a0863b7c2510d81f87480d99266a80f5

SHA1
bbb5ae53f10b7043eee10b2ce4e925b3094846e5

SHA256
9478e6fdc9a722d11a3da1bf4e782130cf6e90bf3dea19c24d5a70d081ef6638

SHA512
2e4186ec62e71bd8534bd2ca1839ee2ce0415803554691aa738d6268c07b6ac801c2d7cd13c29bf67161967a9a0424852c4bfbe0c010b41180f7526f04c50edd

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
80KB

MD5
52cc981b253db9564197590b12834cc2

SHA1
d521f6f8bf6f16c1054c753fcaefd3fb81b813c2

SHA256
5551a6e4e194d2901e4d8fcb20fdf4ba6ddca0dadb30c337e15a9768f61f874e

SHA512
5ee7eb57f2aae5da8e7c857f46736b5a984673c39d56611b619b592409b23ab721366427377cbb4543ccc88999b61ffaaf2038b316f60e0eaf737fd397e7d7b4

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
80KB

MD5
c2c938b85dde7c32f971ea4a05c2abb0

SHA1
867b6712cdb4129749e453cbdc2e538ae03a5265

SHA256
cb25843813da16d394c29f5f45e4811907dd8b5d250ede5c3e9ab2949f3b6690

SHA512
eefed07ef61cdb147b1dad50e313f63f13af866e713d2da0797add91554748aa203df33902fa1f2b69cd0aebbb6bfe4f2ed542e611013c80bd090171f811a389

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
80KB

MD5
8ffe8120a27d3e3dde8b4e2214289ddf

SHA1
7869facafa56c686e026d408e012f38366cbb541

SHA256
8831eb13efea93ec83c409250672a728523873c5e7c6106a011ed9c7240e5611

SHA512
a4a679c03bad830ff96309ed773816c88a8ed1148f2be310f828fd02bd846c9cc409d3ad92024e396d568c7aa61cad8449dcfbd8cf8f99d32a83236e275032c3

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
80KB

MD5
4bff7c1b5c6be0f6cec1ecceb5282d56

SHA1
cf25152e3bc99969f398508aeb4d7c9ce35de00f

SHA256
582439a7b99de003530b640cbd7e65cd19f19ada04531fc03246a4d82ab4a0b3

SHA512
94b0c09beb7d9ea50de2e4bffef22d5309a308bd4d8ea4a9af1c6f6cbd172e99906bca2d8f711d4db168d97f66c8d34e312ce1a800395db23d57e57047a9d20c

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
80KB

MD5
5a825fd58ff380ebeceac13d9360f9e8

SHA1
ff550f8881d0314920eaff8ad04ac2c9af33d268

SHA256
cac92a41729a6b05eae1c812a5b5a5a084948a8dc1b9bce04c2efe9d78727099

SHA512
886d5906b275d32e4e76bb964f862bf4648720dcb622216132aece3c3d3699f27c5299a88963db3300087bb221513f1e448800bf416189bc3972c499a6a8d072

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
80KB

MD5
fb0ab27b3a12ad18af1ad960c8945cf6

SHA1
88efcfee3e36854657da02f0f2a88792e519879b

SHA256
1f3f0e69f88556e59ff7ec517eb2551773cab8bf830b02aba48d675934c850cd

SHA512
238ac3ce010c2d9c46c26dd19ff17073aa6021d82ca7da30a6e5998d38a6d3f568a48dc9036888c4275e51ab4048e9aaf70d698b30497d52d6f9a12d39954e75

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
80KB

MD5
4dfe800eee9af40faad16c54691abb99

SHA1
24ee636376bfda2ea2a4b5b546871008e2306e98

SHA256
07e294ae44b28d776bf96bd1be7b52c8c6f4aab3ff0fd280faeef264e2f43f00

SHA512
c8d95c74efa4e10b330a80c7b19430ec6c857e9920ae77fcf9a45c6b0898b279782374ed3c8e6a0458c34d6b8216a5d1d5c42288ef8e7a00741e24fc9af24114

Download Submit
memory/368-411-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/692-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/692-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/760-383-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/976-327-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/976-396-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1044-368-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1044-299-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1052-233-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1052-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1064-361-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1064-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1080-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1080-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1184-397-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1204-362-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1272-390-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1348-109-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1348-197-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1452-326-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1452-251-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1760-403-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1760-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1860-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1860-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-172-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-259-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1940-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1940-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1940-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/1964-195-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1964-277-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1980-404-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2164-417-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2164-348-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2192-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2192-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2356-167-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2652-225-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2652-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2656-126-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2656-215-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2816-285-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2816-198-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2964-313-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2964-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3056-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3056-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3224-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3224-375-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3440-153-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3440-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3484-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3484-354-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3504-213-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3864-341-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3864-410-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3944-320-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3944-389-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4004-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4004-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4036-243-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4036-319-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4040-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4040-355-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-179-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-90-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4468-189-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4468-99-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-33-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4524-242-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4524-154-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4532-369-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4580-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4580-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4616-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4616-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4668-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4712-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4712-180-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4772-333-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4772-260-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4792-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4872-234-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4872-312-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4888-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4888-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4920-347-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4920-278-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5012-117-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5012-212-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5076-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5076-171-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-74-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5112-166-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads