a779b81b1baf324eee77a007d78ccd2ee3a157cbda2dc3e7ca0d465d8fcf0ba3

Analysis

max time kernel
95s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a779b81b1baf324eee77a007d78ccd2ee3a157cbda2dc3e7ca0d465d8fcf0ba3.exe
Size

391KB
MD5

be22004f28bc121075090892ad659907
SHA1

2b150cf4e4a756400dcbdc0aa18ac35a939d905f
SHA256

a779b81b1baf324eee77a007d78ccd2ee3a157cbda2dc3e7ca0d465d8fcf0ba3
SHA512

c64db40a0cb3523d4ecb2934496d9f5bd6dccc463ff90209527d4ec6727e16fca8e241df10e436004a2f129d29d4f144cb549266e8bfe888d6fd9710bf4f8f18
SSDEEP

6144:Nl5fMhYBNTuz+xPMaAfbAfNtTAfMAfFAfNPUmKyIxLfYeOO9UmKyIxL:dfMhYzTuRmNtuhUNP3cOK3

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fiaael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibhkfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omdppiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fflohaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fimhjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpkibf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjdho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoioli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkceokii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoclopne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kodnmkap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekdnei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koaagkcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iipfmggc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mfnoqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hidgai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibcaknbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnipbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjoja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keimof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkhnjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eiahnnph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eehicoel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifmqfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eifaim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmhdkknd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ompfej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdojjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bpkdjofm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekodjiol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emoadlfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dflfac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibhkfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oghghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnifekmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnmopk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enigke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnangaoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onocomdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fligqhga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llodgnja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Paiogf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cponen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igajal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfnoqc32.exe

Executes dropped EXE 64 IoCs

pid	Process
836	Domdjj32.exe
3688	Dbkqfe32.exe
1584	Dfglfdkb.exe
3600	Dheibpje.exe
3504	Dkceokii.exe
4392	Dbnmke32.exe
4620	Ddligq32.exe
4536	Digehphc.exe
3596	Dkfadkgf.exe
3464	Doaneiop.exe
1908	Dbpjaeoc.exe
3228	Dflfac32.exe
1972	Ddnfmqng.exe
3436	Dijbno32.exe
1756	Dkhnjk32.exe
4464	Dodjjimm.exe
1624	Dbbffdlq.exe
3664	Deqcbpld.exe
1928	Eiloco32.exe
452	Ekkkoj32.exe
2400	Enigke32.exe
3848	Efpomccg.exe
3292	Emjgim32.exe
4908	Eoideh32.exe
1120	Enkdaepb.exe
2660	Ebgpad32.exe
1948	Efblbbqd.exe
368	Eiahnnph.exe
2684	Emmdom32.exe
4188	Ekodjiol.exe
1588	Eokqkh32.exe
3548	Ennqfenp.exe
2688	Efeihb32.exe
2708	Eehicoel.exe
2584	Eicedn32.exe
1820	Emoadlfo.exe
392	Epmmqheb.exe
4608	Enpmld32.exe
2916	Eblimcdf.exe
4056	Efgemb32.exe
3524	Eifaim32.exe
1940	Emanjldl.exe
1196	Ekdnei32.exe
1996	Eppjfgcp.exe
3116	Ebnfbcbc.exe
676	Efjbcakl.exe
4288	Felbnn32.exe
920	Fihnomjp.exe
2608	Fmcjpl32.exe
2460	Fpbflg32.exe
1992	Fneggdhg.exe
396	Fbpchb32.exe
2924	Fflohaij.exe
4416	Fijkdmhn.exe
3800	Fmfgek32.exe
1488	Fligqhga.exe
3820	Fngcmcfe.exe
2592	Fbbpmb32.exe
2964	Ffnknafg.exe
2840	Fimhjl32.exe
4568	Fmhdkknd.exe
3808	Flkdfh32.exe
3192	Fnipbc32.exe
212	Fbelcblk.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fngcmcfe.exe	Fligqhga.exe
File opened for modification	C:\Windows\SysWOW64\Hidgai32.exe	Hehkajig.exe
File created	C:\Windows\SysWOW64\Ncnofeof.exe	Nnafno32.exe
File opened for modification	C:\Windows\SysWOW64\Pnkbkk32.exe	Pfdjinjo.exe
File created	C:\Windows\SysWOW64\Ebnfbcbc.exe	Eppjfgcp.exe
File created	C:\Windows\SysWOW64\Cqopkcbn.dll	Fneggdhg.exe
File created	C:\Windows\SysWOW64\Cmpdihki.dll	Fmkqpkla.exe
File opened for modification	C:\Windows\SysWOW64\Gfeaopqo.exe	Fnnjmbpm.exe
File created	C:\Windows\SysWOW64\Hehkajig.exe	Hffken32.exe
File created	C:\Windows\SysWOW64\Hemdlj32.exe	Hoclopne.exe
File created	C:\Windows\SysWOW64\Lqhdbm32.exe	Ljnlecmp.exe
File created	C:\Windows\SysWOW64\Jgqjbf32.dll	Mgnlkfal.exe
File created	C:\Windows\SysWOW64\Ddligq32.exe	Dbnmke32.exe
File opened for modification	C:\Windows\SysWOW64\Aggpfkjj.exe	Adhdjpjf.exe
File created	C:\Windows\SysWOW64\Kcmgob32.dll	Enkdaepb.exe
File created	C:\Windows\SysWOW64\Nfmifiap.dll	Fngcmcfe.exe
File opened for modification	C:\Windows\SysWOW64\Ffceip32.exe	Fnlmhc32.exe
File created	C:\Windows\SysWOW64\Kmhjapnj.dll	Hfcnpn32.exe
File created	C:\Windows\SysWOW64\Jjofoqdn.dll	Hoclopne.exe
File created	C:\Windows\SysWOW64\Jcgmgn32.dll	Paiogf32.exe
File created	C:\Windows\SysWOW64\Gahamgib.dll	Dbnmke32.exe
File opened for modification	C:\Windows\SysWOW64\Mmfkhmdi.exe	Lflbkcll.exe
File opened for modification	C:\Windows\SysWOW64\Mnmmboed.exe	Mokmdh32.exe
File opened for modification	C:\Windows\SysWOW64\Njjdho32.exe	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Fneggdhg.exe	Fpbflg32.exe
File opened for modification	C:\Windows\SysWOW64\Jlgepanl.exe	Jgkmgk32.exe
File created	C:\Windows\SysWOW64\Nfjola32.exe	Nmbjcljl.exe
File created	C:\Windows\SysWOW64\Oabhfg32.exe	Ojhpimhp.exe
File created	C:\Windows\SysWOW64\Geqnma32.dll	Aoioli32.exe
File created	C:\Windows\SysWOW64\Aijjhbli.dll	Cponen32.exe
File created	C:\Windows\SysWOW64\Dgcihgaj.exe	Dddllkbf.exe
File opened for modification	C:\Windows\SysWOW64\Fbbpmb32.exe	Fngcmcfe.exe
File created	C:\Windows\SysWOW64\Fihnomjp.exe	Felbnn32.exe
File created	C:\Windows\SysWOW64\Kigcfhbi.dll	Ibaeen32.exe
File created	C:\Windows\SysWOW64\Ipeeobbe.exe	Iikmbh32.exe
File opened for modification	C:\Windows\SysWOW64\Jgkmgk32.exe	Jocefm32.exe
File opened for modification	C:\Windows\SysWOW64\Nmbjcljl.exe	Mjcngpjh.exe
File created	C:\Windows\SysWOW64\Bdlgcp32.dll	Oabhfg32.exe
File created	C:\Windows\SysWOW64\Igafkb32.dll	Pnmopk32.exe
File created	C:\Windows\SysWOW64\Ongbqjjf.dll	Dkceokii.exe
File created	C:\Windows\SysWOW64\Jofalmmp.exe	Jlgepanl.exe
File created	C:\Windows\SysWOW64\Mmmqhl32.exe	Moipoh32.exe
File created	C:\Windows\SysWOW64\Pipeabep.dll	Chiblk32.exe
File created	C:\Windows\SysWOW64\Pigbqakg.dll	Ekdnei32.exe
File opened for modification	C:\Windows\SysWOW64\Fnnjmbpm.exe	Fpkibf32.exe
File created	C:\Windows\SysWOW64\Hlglidlo.exe	Hemdlj32.exe
File opened for modification	C:\Windows\SysWOW64\Dbpjaeoc.exe	Doaneiop.exe
File opened for modification	C:\Windows\SysWOW64\Baannc32.exe	Bkgeainn.exe
File created	C:\Windows\SysWOW64\Ofkhal32.dll	Bdojjo32.exe
File created	C:\Windows\SysWOW64\Bpkdjofm.exe	Bahdob32.exe
File created	C:\Windows\SysWOW64\Linhgilm.dll	Fbelcblk.exe
File opened for modification	C:\Windows\SysWOW64\Fbelcblk.exe	Fnipbc32.exe
File opened for modification	C:\Windows\SysWOW64\Ibaeen32.exe	Hlglidlo.exe
File opened for modification	C:\Windows\SysWOW64\Iinjhh32.exe	Ibcaknbi.exe
File opened for modification	C:\Windows\SysWOW64\Apaadpng.exe	Agimkk32.exe
File opened for modification	C:\Windows\SysWOW64\Chnlgjlb.exe	Cpfcfmlp.exe
File opened for modification	C:\Windows\SysWOW64\Fnipbc32.exe	Flkdfh32.exe
File opened for modification	C:\Windows\SysWOW64\Jofalmmp.exe	Jlgepanl.exe
File created	C:\Windows\SysWOW64\Dpaagldf.dll	Fbbpmb32.exe
File opened for modification	C:\Windows\SysWOW64\Fpimlfke.exe	Fmkqpkla.exe
File opened for modification	C:\Windows\SysWOW64\Jlolpq32.exe	Jjpode32.exe
File created	C:\Windows\SysWOW64\Bkamodje.dll	Bogkmgba.exe
File opened for modification	C:\Windows\SysWOW64\Eppjfgcp.exe	Ekdnei32.exe
File opened for modification	C:\Windows\SysWOW64\Jocefm32.exe	Jleijb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7720	7616	WerFault.exe	328

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbelcblk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoclopne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgkmgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jphkkpbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oclkgccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cponen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiloco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fihnomjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjkmomfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkhnjk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kodnmkap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Domdjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chiblk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jekqmhia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncnofeof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkibgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dflfac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddnfmqng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emanjldl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fiodpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doaneiop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emoadlfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emjgim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnangaoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpcal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Moipoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfiplog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iikmbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnmmboed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bogkmgba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekkkoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocohmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmcjpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keimof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lflbkcll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjknfnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fneggdhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlolpq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgmjmjnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knnhjcog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ompfej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebgpad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iefgbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gehbjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iipfmggc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpenfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onocomdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfglfdkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmhdkknd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoideh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpimlfke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfhgkmpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmqnobn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjfmkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dijbno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efpomccg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boihcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monjjgkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdojjo32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fomnhddq.dll"	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdkgabfn.dll"	Eifaim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nfcabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Phonha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gidnkkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lciibdmj.dll"	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Accimdgp.dll"	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgfnagdi.dll"	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojhpimhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qjfmkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddnfmqng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Emanjldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmhkafda.dll"	Iinjhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nfcabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlnhqepf.dll"	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fmfgek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilcldb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jofalmmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjcngpjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlgcp32.dll"	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qdaniq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dbbffdlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emanjldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eglkdbfn.dll"	Fpimlfke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ffceip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kghfphob.dll"	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onahgf32.dll"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgijpe32.dll"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Efpomccg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkccgodj.dll"	Fiodpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jcfggkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omfmcjlk.dll"	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnfpnk32.dll"	Ppjbmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibaeen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kegpifod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abhemohm.dll"	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Doaneiop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekodjiol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjpbba32.dll"	Emoadlfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fiodpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fiaael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojhpimhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodjjimm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Flkdfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amdcghbo.dll"	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdjgha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ampillfk.dll"	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbblcj32.dll"	Enpmld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fngcmcfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jgmjmjnb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 836	4488	a779b81b1baf324eee77a007d78ccd2ee3a157cbda2dc3e7ca0d465d8fcf0ba3.exe	82
PID 4488 wrote to memory of 836	4488	a779b81b1baf324eee77a007d78ccd2ee3a157cbda2dc3e7ca0d465d8fcf0ba3.exe	82
PID 4488 wrote to memory of 836	4488	a779b81b1baf324eee77a007d78ccd2ee3a157cbda2dc3e7ca0d465d8fcf0ba3.exe	82
PID 836 wrote to memory of 3688	836	Domdjj32.exe	83
PID 836 wrote to memory of 3688	836	Domdjj32.exe	83
PID 836 wrote to memory of 3688	836	Domdjj32.exe	83
PID 3688 wrote to memory of 1584	3688	Dbkqfe32.exe	84
PID 3688 wrote to memory of 1584	3688	Dbkqfe32.exe	84
PID 3688 wrote to memory of 1584	3688	Dbkqfe32.exe	84
PID 1584 wrote to memory of 3600	1584	Dfglfdkb.exe	85
PID 1584 wrote to memory of 3600	1584	Dfglfdkb.exe	85
PID 1584 wrote to memory of 3600	1584	Dfglfdkb.exe	85
PID 3600 wrote to memory of 3504	3600	Dheibpje.exe	86
PID 3600 wrote to memory of 3504	3600	Dheibpje.exe	86
PID 3600 wrote to memory of 3504	3600	Dheibpje.exe	86
PID 3504 wrote to memory of 4392	3504	Dkceokii.exe	87
PID 3504 wrote to memory of 4392	3504	Dkceokii.exe	87
PID 3504 wrote to memory of 4392	3504	Dkceokii.exe	87
PID 4392 wrote to memory of 4620	4392	Dbnmke32.exe	88
PID 4392 wrote to memory of 4620	4392	Dbnmke32.exe	88
PID 4392 wrote to memory of 4620	4392	Dbnmke32.exe	88
PID 4620 wrote to memory of 4536	4620	Ddligq32.exe	89
PID 4620 wrote to memory of 4536	4620	Ddligq32.exe	89
PID 4620 wrote to memory of 4536	4620	Ddligq32.exe	89
PID 4536 wrote to memory of 3596	4536	Digehphc.exe	90
PID 4536 wrote to memory of 3596	4536	Digehphc.exe	90
PID 4536 wrote to memory of 3596	4536	Digehphc.exe	90
PID 3596 wrote to memory of 3464	3596	Dkfadkgf.exe	91
PID 3596 wrote to memory of 3464	3596	Dkfadkgf.exe	91
PID 3596 wrote to memory of 3464	3596	Dkfadkgf.exe	91
PID 3464 wrote to memory of 1908	3464	Doaneiop.exe	92
PID 3464 wrote to memory of 1908	3464	Doaneiop.exe	92
PID 3464 wrote to memory of 1908	3464	Doaneiop.exe	92
PID 1908 wrote to memory of 3228	1908	Dbpjaeoc.exe	93
PID 1908 wrote to memory of 3228	1908	Dbpjaeoc.exe	93
PID 1908 wrote to memory of 3228	1908	Dbpjaeoc.exe	93
PID 3228 wrote to memory of 1972	3228	Dflfac32.exe	94
PID 3228 wrote to memory of 1972	3228	Dflfac32.exe	94
PID 3228 wrote to memory of 1972	3228	Dflfac32.exe	94
PID 1972 wrote to memory of 3436	1972	Ddnfmqng.exe	95
PID 1972 wrote to memory of 3436	1972	Ddnfmqng.exe	95
PID 1972 wrote to memory of 3436	1972	Ddnfmqng.exe	95
PID 3436 wrote to memory of 1756	3436	Dijbno32.exe	96
PID 3436 wrote to memory of 1756	3436	Dijbno32.exe	96
PID 3436 wrote to memory of 1756	3436	Dijbno32.exe	96
PID 1756 wrote to memory of 4464	1756	Dkhnjk32.exe	97
PID 1756 wrote to memory of 4464	1756	Dkhnjk32.exe	97
PID 1756 wrote to memory of 4464	1756	Dkhnjk32.exe	97
PID 4464 wrote to memory of 1624	4464	Dodjjimm.exe	98
PID 4464 wrote to memory of 1624	4464	Dodjjimm.exe	98
PID 4464 wrote to memory of 1624	4464	Dodjjimm.exe	98
PID 1624 wrote to memory of 3664	1624	Dbbffdlq.exe	99
PID 1624 wrote to memory of 3664	1624	Dbbffdlq.exe	99
PID 1624 wrote to memory of 3664	1624	Dbbffdlq.exe	99
PID 3664 wrote to memory of 1928	3664	Deqcbpld.exe	100
PID 3664 wrote to memory of 1928	3664	Deqcbpld.exe	100
PID 3664 wrote to memory of 1928	3664	Deqcbpld.exe	100
PID 1928 wrote to memory of 452	1928	Eiloco32.exe	101
PID 1928 wrote to memory of 452	1928	Eiloco32.exe	101
PID 1928 wrote to memory of 452	1928	Eiloco32.exe	101
PID 452 wrote to memory of 2400	452	Ekkkoj32.exe	102
PID 452 wrote to memory of 2400	452	Ekkkoj32.exe	102
PID 452 wrote to memory of 2400	452	Ekkkoj32.exe	102
PID 2400 wrote to memory of 3848	2400	Enigke32.exe	103

C:\Users\Admin\AppData\Local\Temp\a779b81b1baf324eee77a007d78ccd2ee3a157cbda2dc3e7ca0d465d8fcf0ba3.exe
"C:\Users\Admin\AppData\Local\Temp\a779b81b1baf324eee77a007d78ccd2ee3a157cbda2dc3e7ca0d465d8fcf0ba3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\Domdjj32.exe
  C:\Windows\system32\Domdjj32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\Dbkqfe32.exe
    C:\Windows\system32\Dbkqfe32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\SysWOW64\Dfglfdkb.exe
      C:\Windows\system32\Dfglfdkb.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3600
      - C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3848
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3292
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1120
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        28⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        30⤵
        Executes dropped EXE
        
        PID:2684
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4188
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        32⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        33⤵
        Executes dropped EXE
        
        PID:3548
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        34⤵
        Executes dropped EXE
        
        PID:2688
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        36⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1820
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        38⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        40⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1196
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1996
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        46⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        47⤵
        Executes dropped EXE
        
        PID:676
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4288
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2460
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1992
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        53⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        55⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1488
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2592
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3808
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3192
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:212
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        66⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        67⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:944
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        68⤵
        Drops file in System32 directory
        
        PID:4296
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        69⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1784
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        70⤵
        Drops file in System32 directory
        
        PID:748
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        71⤵
        Modifies registry class
        
        PID:4472
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        72⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1616
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        74⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        76⤵
        Drops file in System32 directory
        
        PID:5036
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        77⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:4596
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        79⤵
        Modifies registry class
        
        PID:3840
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        80⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        81⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        82⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2572
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        84⤵
        Drops file in System32 directory
        
        PID:884
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        85⤵
        Drops file in System32 directory
        
        PID:1132
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4348
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        87⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        88⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        90⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        91⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        93⤵
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2272
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        97⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        98⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        100⤵
        Modifies registry class
        
        PID:3904
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        101⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1536
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3032
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3212
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4912
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        107⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        108⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        109⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        110⤵
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        111⤵
        Modifies registry class
        
        PID:3920
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        112⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        114⤵
        Drops file in System32 directory
        
        PID:4272
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        115⤵
        Drops file in System32 directory
        
        PID:2928
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        116⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        117⤵
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        118⤵
        Modifies registry class
        
        PID:3712
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:968
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        120⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        122⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        123⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        125⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        128⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        129⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        130⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        132⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        135⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        136⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        137⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5816
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        139⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        140⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        141⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        143⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        144⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        145⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        147⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        148⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        149⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        151⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        152⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        153⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        154⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        155⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        157⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        158⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        159⤵
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        160⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        163⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        166⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        167⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        168⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        170⤵
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        171⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        172⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        173⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        183⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        185⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        186⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        188⤵
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        189⤵
        Drops file in System32 directory
        
        PID:6380
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        190⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6464
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        192⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6556
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        196⤵
        Modifies registry class
        
        PID:6704
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6776
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        198⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        199⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        201⤵
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        202⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        203⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7092
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        205⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        206⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        207⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6288
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        209⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        210⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6504
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        212⤵
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        213⤵
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6800
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        216⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        217⤵
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        219⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        220⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        221⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        222⤵
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        225⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6652
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        227⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        228⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        229⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        230⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        232⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        233⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        234⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7220
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        235⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7312
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        237⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7356
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        238⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        239⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        240⤵
        Drops file in System32 directory
        
        PID:7480
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        241⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        242⤵
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        243⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 412
        244⤵
        Program crash
        
        PID:7720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 7616 -ip 7616
1⤵
PID:7696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Akblfj32.exe

Filesize
391KB

MD5
7abb9d679d618b6a93cbe17713f7f4cd

SHA1
cb955d63830ac51e722ee33e58a64671a27d9321

SHA256
67bcd84b76f6684e60932e0cbc085fe5beba7373fcb9988cee4a044a764c3ccb

SHA512
e6ee15b65eeab5548d570dcfe47e4cc9ccd2432d428e58038150aa5e05d21fec1814db10cf4dd19c1d2b30b8a98d8b9a1d504fb2c7066a19a8da90189ae7963b

Download Submit
C:\Windows\SysWOW64\Akpoaj32.exe

Filesize
391KB

MD5
9d277067a2b3d1c84169d23f79f747c8

SHA1
de9ded1a30e7f7cf5a81848e77201924719e4d94

SHA256
8643f8c563864af952716a38cccfb0a0e7847a15e2a4570ff562314561a254b5

SHA512
9cd5b1bc9bfad34008de238a412fa223634571688727b8c55af08eaf30e92c45c390ea4de2dfad6ffd0d74b7c7df293a57611fe0b26e755b4100e854f200dd4b

Download Submit
C:\Windows\SysWOW64\Aogbfi32.exe

Filesize
391KB

MD5
8908fcdd133096338bafbc0e02f67b3f

SHA1
36de35b5035eca4ac63855b957ea890f5a9888fd

SHA256
c45026f8ec74b8a978331b96e0f741cd5e6a15b46f9278c208ba9e4e393247f2

SHA512
8480ee647ba029bcc4a40e96613e1bd1b4b9d6ae13171f9669c53599a764abe0bb00a29842e2753a5296ec11a04405ef9507fc64de1039aa80a45e40e1d7ec70

Download Submit
C:\Windows\SysWOW64\Bahdob32.exe

Filesize
391KB

MD5
51499ca6cc6af69cbf9650344eacf88a

SHA1
62fbd666db9ab2b10c408f53662e304e8b09ca18

SHA256
c590a96dadf189fe74851f12d7e07796bb70bd8643b225b2fa76d18471b1e317

SHA512
f68944aee532a812da5b77622bebac6db1764049f037b4b83c08624dedccb9507fa5bc697f8760082534224af1f050201078c675cacd8927ec4b83afac5ccbe9

Download Submit
C:\Windows\SysWOW64\Bdojjo32.exe

Filesize
391KB

MD5
d6ff4639bf640284328fa1cfea76194a

SHA1
9d443eaca3482c327618178a8f7feb1c39c8112a

SHA256
d5570b25b826a0ecd2d9de3a6a9983f1a7f4a5ed7e2e452160556697a85446e4

SHA512
f3062e41d0013b418b0871a4062f1d1ab58226da0d95652f60eee582461dbc8992cf029398dd885396ecb51fd04ec16aeedd7c30924e1b2c75c56e8cb1d59ddd

Download Submit
C:\Windows\SysWOW64\Cdecba32.dll

Filesize
7KB

MD5
fc969cd9068e57b415196ccf339e51c0

SHA1
d3afdd0f863c0674d446731f94885af96cf65315

SHA256
8cd4409f678a7ab6cc931bbbb876e52b479aa5adb844b6187b4485534901371b

SHA512
1e7af92c788ec82c1199b92e395d86286752bb3cfc9a9b863cee4f2a9625c7745ad8f2d2de764798c87495b52b0a835717ef19d56a16c7df5a45aba638ce00a3

Download Submit
C:\Windows\SysWOW64\Cdimqm32.exe

Filesize
391KB

MD5
1142f8355c0a937971045b05c4a7fa31

SHA1
a47bfdd4b50aae5992d178a91784af3eb6affd88

SHA256
5a94f67c9139385c392655a3f596ce71087803827975a1d543f134e8fa3d4da1

SHA512
73b4558eecedf6795c93e42967cbb8cc154098f61d12f273e5f0aff2ab8e891573b4f1214dcc58bc88875bebd93ef9ec8fb88a62ad17911fe248e5b2c4eafe20

Download Submit
C:\Windows\SysWOW64\Ckbemgcp.exe

Filesize
391KB

MD5
bef288b5374332254402dc147979578d

SHA1
6329bb0ca062ed40d8f39aa3405e62d372ddbfbd

SHA256
7cfb8ac885b90488596b537b4adc4354a5222970917bd62ded55f63414361ff0

SHA512
f87e9569cc8878256dac6a5ec2cbffe4e8f69d6d2dd80baa39de96414ae0f270e8209de1ce807f1ea8d5513b1a0960348a54ab5c9a6c94bc2516a512f9641224

Download Submit
C:\Windows\SysWOW64\Ckjknfnh.exe

Filesize
391KB

MD5
1688c0aa9297e451346251b4f13337da

SHA1
4ab7e2aa9bded89f7d9f2c3499d0bf230f4799de

SHA256
a8cefa0afe4880898e464dbcbd2ada49d0d6b1aeab5aabf63b021bd3c6c339e9

SHA512
c8fe15f92eb7afa335184adff000b09014555dbc1eab780b103eef89685ee9d7a3a09b46a28811a139a32d712bba487f7fcd2b925337e8af78724a17b35bde63

Download Submit
C:\Windows\SysWOW64\Coqncejg.exe

Filesize
391KB

MD5
96165a2cce8c77a7b4edb782e0cb1ba4

SHA1
ecb669126964467f48e183968bfc8c3b59f9f2e8

SHA256
36591bc68970dccd54ab319934c3640b652930b45991c4a93bbf49054d773ec7

SHA512
9947642cab3382cf2b3a07ec8641604e1a1da0e38e474a839f2063f44b679883f4818ee68dff9276555537a23eadee97af6573a9e33c05128b44c6e77a3a1b37

Download Submit
C:\Windows\SysWOW64\Dahmfpap.exe

Filesize
391KB

MD5
5cbaf326d4da52fe22b649f6e2a726ee

SHA1
07955434f0639cca871109388a73ac8656081e13

SHA256
0e32e0a8b56a9ed47d74333e542d1bf540cf8aba34ecce71bef2957d0507442f

SHA512
ef8c378558556eb562a35d9c213e36a4b57b82710986b0f4f7185cfdc1ecb2676f633003d2d0a1243c9ad2c3c87c1397141aead6eab72a5a6c5ea4d763ebd23a

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
391KB

MD5
97c5d2d8fb50108e74a3344c079f25a8

SHA1
21556f6f411f4f2848fa190989b5d0257929b64f

SHA256
57389974a3f1445425b3e3ba5b048cd6f8f293a4d4bfc8d61b16e39c0aead7c5

SHA512
ad5c1ffa36db87824af5aa03410f4719c2d7c8c639e1aa5d7ca7ad9026cfdb37fa4e66facc91a5563d91f51bcc56ed75522bd9a208e7b36a3be4a522425ba36c

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
391KB

MD5
32b0f27cf5b5bdfb29398fc3f7d58e58

SHA1
0e16d9707253f795475c97a0bb412aca4258856f

SHA256
e882d3a5b89dc59c7e26732ea38cb29e6d199df6b7771e61c3c19c04ab19fda4

SHA512
7703935d6b1aee278c888c3606a9d6d117074dd7ebf32b68548783e72031291456c7e35dd3b207feebde2655cef0d8e4fb269e234e96768c2777cde0708fb20f

Download Submit
C:\Windows\SysWOW64\Dbnmke32.exe

Filesize
391KB

MD5
2ac0667b3fb653a9e0257c913c00d0d5

SHA1
f17509a20e264a200d32832757e6af575fb58c7e

SHA256
6cd1f568245cb7aaf12db3b911755f043463be92d93f7677d31a36b87588c805

SHA512
40aad16d289c875566cea3cb38abed11fe1169be1bbd4174a815c1904c5bfea99d1d3bf5c571c0fbbbca07f2a574185993159c7d034fcb9d54de7c9afa4d7025

Download Submit
C:\Windows\SysWOW64\Dbpjaeoc.exe

Filesize
391KB

MD5
de9a8b5cc14d9f2dda8655b20f2c2f0f

SHA1
9b68e9497331e3d56486c4d9f1d3c0a84946686d

SHA256
e7d4f60a62f47d915744d3589bbe6553af0d15b4e9e4beed71324cc69d68ced2

SHA512
083d14e194f213311417ce455d0ef8d97777bf29bb33c4cc75e00bf682724638d6d40567bf2883d793a428a984f5aea372f7be7b284926db7a7a4dec0001a153

Download Submit
C:\Windows\SysWOW64\Ddligq32.exe

Filesize
391KB

MD5
cc04af443eaa2a332727db687ecc1de1

SHA1
fa43d60c6360842faa69b745e27875945c605d05

SHA256
0b313092a442a62594b8bccc5d8c1cc0c6a778a5cda84fbc233c033cef7e394b

SHA512
f4d5c2e4fac4a5b640822aa4897cbeef4ac0f077a6eea8e1aca0d31e0a95a455064330cf7fa703168277ee97eb87326e128043302e18e013bcbe71765f78677c

Download Submit
C:\Windows\SysWOW64\Ddnfmqng.exe

Filesize
391KB

MD5
17e3d3e188af5daef630308b52ed4512

SHA1
ee8d1279a8101d31b457b11a369d4f3036fccd6e

SHA256
a27b93df9acc013f4f68cd2f29f606cd74c76f70268d4bb87120794e31414f39

SHA512
8fc9d0f71e2cbfc3e736c335b2213741e2128ddb7c1d8d48837c6cf07ccb7110b4973401320a661becb1ebc4bbba2fe34400dd22894b72071b020f2743da8feb

Download Submit
C:\Windows\SysWOW64\Deqcbpld.exe

Filesize
391KB

MD5
24253ff5749826f582f13524cd86548f

SHA1
3a0a608c892429bdbf8101f25bbe222cdea84faf

SHA256
bb3c669c68b7d9ba0e081a70e988b14f577d35beb19fb32b76fd07660af01509

SHA512
d254080ca8d737e5410cd5cf4991b8c2a5b5bcc5f5b6bd234520bef5d7fb91676101b3f687d7ab1f0d14cc7c6b5b211106c9c85a042419ff4080e300e1343d44

Download Submit
C:\Windows\SysWOW64\Dfglfdkb.exe

Filesize
391KB

MD5
79bbaccb899e86cb7b7f0f3b83eba7a0

SHA1
b1e68a6250e30253b7c8afc3c41d5a7efc816af0

SHA256
21d72279b5789021ae20769b5d0738a39c4b1e4ef038d9b1b0d5ffcacf6c5a45

SHA512
8c6d7d2555d8be294fd9d77939266f1f8e2a41c6b7c505ba1e456c43caf9441947ab53ab5028b407efdb5e73adf41492b71e9ac9a9f5d92a749e913c53c23834

Download Submit
C:\Windows\SysWOW64\Dflfac32.exe

Filesize
391KB

MD5
b866e8401867cf86b6dc834552de566c

SHA1
32f35f55de9a777492aa2b1e0ba43acae46f5be8

SHA256
443c0eb313e9ae32ca6c4317c1cc2db27b12764913a4b06ffdb088be76e3e55e

SHA512
f862650a64fab9b45c60c727a79380cb8cac1542d0b9d9b254a696bb3a72677d45363d422fb25287a3816d534ec192f71a87586bf500fccf7c6e125edf777031

Download Submit
C:\Windows\SysWOW64\Dheibpje.exe

Filesize
391KB

MD5
349e9483c2a6e1f08210ec071e221cd0

SHA1
b1ca73f2285fa7ca98be3fe80e6bceafb9ff6f80

SHA256
96b60a0724ec0393eab7b18681797e74c51714d7ebdc32150ba83697ef22eab7

SHA512
66941180fc6327db86ec70cb2f2b48883bfb7041d1651f4d1cab2f6de8d3c483418954c9bd5207d739da9137705f094320d80d7c47e31341808cfd1e8c70cae7

Download Submit
C:\Windows\SysWOW64\Digehphc.exe

Filesize
391KB

MD5
67d2e96f10b271da730cfe22ddb5d053

SHA1
4308e06a899dacf9355884d1f840935888239679

SHA256
8bab8ecd87c2687636af6e83f76643a8263678cebde8de0647285c203dd007bf

SHA512
83253f127b1a154cf43a3f8565c1fcd7b88072e7e0b69a087971d2dfd17745e36a2691e83f089e13b41213174a8ed4c89d8ec48ce48f1b3b2d8d11a4a0c11ae7

Download Submit
C:\Windows\SysWOW64\Dijbno32.exe

Filesize
391KB

MD5
6b92b54772045fe56a540310e4d24f0a

SHA1
ed54ad23c552fa0d2472ddb6503229cee1b4c297

SHA256
91a00c9010a4c6ea8634f88637572def20079b077a719688d348b920ec0dc9da

SHA512
e4a2dfd53b89fc6d3d56606ac2d2b45403f8336aa549efb100b511fc05c50e9ab2c965e3678737153eced4c4f413a56d2468281eda3108f5744ee0609d98f0f4

Download Submit
C:\Windows\SysWOW64\Dkceokii.exe

Filesize
391KB

MD5
52d4e7aeda6543289f70e555cbe97661

SHA1
9409c9a717984f4e836d653acdf9906b704201bc

SHA256
71026ad8724122ad5370b750ff38e47a90ba7e7364d89491186e0e124e228dda

SHA512
0aec3a8ea49690fe4e408b207de182be377fe4a87e124538976c86da0a94769a8d231bd0f2e53f29962159e1f50332d6281e2ab7a5d00212445ccd44a8154257

Download Submit
C:\Windows\SysWOW64\Dkfadkgf.exe

Filesize
391KB

MD5
11ca948a2cdc95155934b90177caae67

SHA1
ba985cccf64678394767fe8605a2647a066232d6

SHA256
42ae68554fbf01da8ff1e0802d42d52000bb547a47c83e2f42fb7c1704d9b07c

SHA512
4bff383ca1d2655337273d4d5f2fa38e791e37ef3db058a7954601902e0e26f6f6a30e66afe2893d9bde9057f3430cb657687404269f9a89a95145e8fff28407

Download Submit
C:\Windows\SysWOW64\Dkhnjk32.exe

Filesize
391KB

MD5
d9ad586de87cca3d168481ab1b3813f3

SHA1
e215a5264e23b535240cb80417f1572737b5232a

SHA256
8759869be270e783becae59b385033bdf9dad6a1df63dd1dd3bd8dcb092ba268

SHA512
323d80d78ff53183bcf241ffee468c1fd5edb0a22176d315c3ff9beb092c797f43721374acc87636b48eeec20a505959f9465d10b072db50576a0a2ad154a0bc

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
391KB

MD5
454b40a9238f5cb91ed5c00d4188a837

SHA1
76f0381c4d41303fd3cd6580f99e17b9d86d9274

SHA256
c7dc284d61016a4c5d6cdce00f5bfc8ed7a60743c85ece348e95e26b13c9838c

SHA512
1a1f3d942cae4626ac2f9bb7e5faf4ae57addb45e025de2aa10b92ec1bc96775631c13c3f5d8cdd3f88a16d1036a89dfbb28b0c3950057c8d8fc97994bec0761

Download Submit
C:\Windows\SysWOW64\Dodjjimm.exe

Filesize
391KB

MD5
7ba47aec9bbcceca2d9a68317755730c

SHA1
f9c60c5fa0425a2b8bc2d410d2aab6fd9fda17b6

SHA256
a580ebe274d505e560c69d4c7dae807e837bc47fde2159070a1e9c6ca146d6e7

SHA512
4ce5be97e33125c5f3dece4cd2901efe4da7a32b20c0c9de3a274f7b54b1a0122c7df2f5ef0fa12cd91ca4b9ecbc6312e47fb5a8984b7436ea43b07028565a3b

Download Submit
C:\Windows\SysWOW64\Domdjj32.exe

Filesize
391KB

MD5
546ecb1cb5812cbe03fc5b38ca6a0ba9

SHA1
69ce8dced97817d8212d08eec8253672c6075981

SHA256
771a73c955750649e75318e15d9f55c6da6e55350fe3999dadeecccf7b0b26a4

SHA512
50f65a713c4894431415d8dbf16b864fd4664711b7518434e0cafe04552eaa4519852140242ecade7b7db350ced6a338439a6c0ccb23ad3eca7a678613205ec3

Download Submit
C:\Windows\SysWOW64\Ebgpad32.exe

Filesize
391KB

MD5
ae8d40a53fba0f5fcd3b923f10e50019

SHA1
806c2f3acab2f8917a27c0543b1a425297692c58

SHA256
48d66eff9533adc229a4c7a82b6b79853c6f64acaea540fbce023a98143ff1fa

SHA512
a3acb7889c2e4779f417b13b82287a3d9810a8da11d673cedc0935af7267fd5acfb2bfde641002308ef52c38e83f515d4717f53c0bcfc8851bbb098366b09ed2

Download Submit
C:\Windows\SysWOW64\Efblbbqd.exe

Filesize
391KB

MD5
eaa98407533362c67920ee5d3bbfdbde

SHA1
c13366bca73a44354b349f1af42e7b669b489f94

SHA256
5d94f5bddeaf035f488dc4e33e6d70a89ecc2552d147dfd6cee46a8fadbc2214

SHA512
26d0d4c915fa5693f872725653de2253f6d22d40f8379d68578136fcb49aa7506e6d1b07663ff3f53540d1c4ecbd4d4db352a6268cffe316213b9e20f8075bc2

Download Submit
C:\Windows\SysWOW64\Efpomccg.exe

Filesize
391KB

MD5
8e13348a4db7182c123c731dd5e7106c

SHA1
b2d418ba8ba0c4c6e6914f4b2b533e75ada71c0a

SHA256
ec6c008aa667dee9f2e03b85913547aedf7cd7fe7c2f7891a8c82fe4d5815731

SHA512
0afdcee1491e0aadecfde51d554ac5a8f1aa691e6de2aa49329617b9f68ae75452bab3c6e2be6a7196fe025b8caf418900da6ce1b456a43640685e3ac35583ed

Download Submit
C:\Windows\SysWOW64\Eiahnnph.exe

Filesize
391KB

MD5
4e8299a378d91b65d1012e1ada9997e0

SHA1
980d5e0f38adfb910344818f09baaff03c670a05

SHA256
ce577b3cc36e9c0f38a1dd8b60d41367e19fe7dc324d5be59d98056ff6d727b9

SHA512
0f71be8c6c76111d0d204743e1a0d8f2873a352d1f523fb310b3fab8429cdcceb31726a0aa872127ad7195a034af6420f5e3513473281bd8730d1a883889e678

Download Submit
C:\Windows\SysWOW64\Eiloco32.exe

Filesize
391KB

MD5
cf577c1ef95e4aff9ee215b80886bb72

SHA1
7db215f02e08c13a91cac7ba1b19bfbf58b20b9d

SHA256
96e6f8d44cf3e19e96175922ba68c8a12932e4527af413bd054acccfdafa10f2

SHA512
1ad9b877d61bf69e99caccf7a8c433c20ac3b6e5a6b712dec5793c0e00091fb59cee352dbf96cfba23134f0c09d6f05763d382907ee9fa00246ef2e0e6a5db0a

Download Submit
C:\Windows\SysWOW64\Ekkkoj32.exe

Filesize
391KB

MD5
1dc460fae9db542dffebed666c889e81

SHA1
db22079acc77d42266cc6f73ef1bc3b9ce9c5067

SHA256
ce38c2ddd6fe0981246969a10d4f6f81b26be1ca0368d138e3b1d14f78512baf

SHA512
0761dd3424ea1fe90cd0f96b887064219a4f9ca604b4eeaab1ddb48698d24e6a6b84ae65b3e4af7d21a068ea56c6fa9c6b6f4d64eba5749210926cebdb7b6b79

Download Submit
C:\Windows\SysWOW64\Ekodjiol.exe

Filesize
391KB

MD5
0fea9db3789d64611b4cea6f67a64ee6

SHA1
47b7ab842b8b07f1f795404d2d1f0a831d313f77

SHA256
999cf5f606bbd76b5e1a3822b163334c5ba3ba95eb2ddff2aad6a7e46c882676

SHA512
ad1b2bd3fd576f0f6987dd515398dd25c676713808e067ea65f1b70ac79a74cf470768f25ebec5169b9fb9f19c0f1b67a669a029e5b83f9cfca518335a314d86

Download Submit
C:\Windows\SysWOW64\Emjgim32.exe

Filesize
391KB

MD5
c560ad4cf8c4ed1677eddfa5d7a2e3b6

SHA1
f5704ad5da6b888ce7954f7302ce9b496d3f3eb1

SHA256
430e0642796124944c973c1a2e1096dc76c3a052e267f2ae688f13f0c4184246

SHA512
13b317147360cb0fd0145521cf3f0569a2f54711a0b974021774bd6208c7ba755f6adb2046fecc15e386606ab4c8e7089a8167a518930bcbb2bbc0129863a0e0

Download Submit
C:\Windows\SysWOW64\Emmdom32.exe

Filesize
391KB

MD5
853b702446a56fd7bce55d023f8402d1

SHA1
c96a712a046c7815ff4a054cfe3f882caa251615

SHA256
a00418181e69b401dcf4ead0996b5c6449b0bcdd1ab1fefdba74211e9ee515ea

SHA512
165f26c8d0420ccb74d5c1a1e8c88dd0504abfc1aa6a997c9a3df6cb01c4e1a6ea8cc65fe11cdc25e7c7ed9d1cb51fdeabf66c58d3a690ae21d6bd5c669df8d7

Download Submit
C:\Windows\SysWOW64\Enigke32.exe

Filesize
391KB

MD5
c540f60725fd5f6b04574736ece991dd

SHA1
9e70e2738ddf9e09f8b182684b2995472d6c19df

SHA256
ab0123231b22f6b9453d21aae085eedf634d4fae787a22bc16a829016b024ee1

SHA512
bb197358b60cc6de0be20fcb0a16a277e681de95f7892fa454429b5e7d8a6fcecf772205b0e541d3ae3e071c76620590d11b0351138b6f14295ffbf7acfc5654

Download Submit
C:\Windows\SysWOW64\Enkdaepb.exe

Filesize
391KB

MD5
a38cc1d1309655db9ca674a1eacde142

SHA1
bbcee7e6fae899e365ebb0516a8731761585f07e

SHA256
951c6b45f161afd71005426f260eb1126e566d19d9fdc3c5e7ced95ddbd9300f

SHA512
9aa19d2e4ba44e687813b4f56d91475ddcb630f26560a369ceb0aad555c89d9d803719b3aadcca0e01a7bf6bc8ca3dc46b4a0fab576d7d5580c083f68ac1cdde

Download Submit
C:\Windows\SysWOW64\Ennqfenp.exe

Filesize
391KB

MD5
b9e16d544e60fe7742c0eac097e8e62c

SHA1
55084cf2ea3f32680a5470f9fd657bea20284cb9

SHA256
0fa65643244101bc02cb63b41ea9a6184a08a9c4e4a8144f1219a924466eabd8

SHA512
da820cdd181ef597b9d0f192e7046994b845345749fabe936979023a929c46b3d7a8cbd86c79be25c22bd4735dfa4598fefb6c8cdfa7ec6516824131ceed78df

Download Submit
C:\Windows\SysWOW64\Eoideh32.exe

Filesize
391KB

MD5
1be6f8acf0baf04f5005bb7c9cc94848

SHA1
ffe5a9ca831173e50796f07d4ece29013f575517

SHA256
44e66f1ebb5205e5137313d1fa019343553f439fb34c1ac0cce61274c15bdfa9

SHA512
1d5c7470d16adf71eb3e05c71cbbb2f546dd37e17d91caef255ce54e921270f2406dbe446a3f2efcb95988f3cad79a6e4772de158153edf52860bfdef68b47c9

Download Submit
C:\Windows\SysWOW64\Eokqkh32.exe

Filesize
391KB

MD5
102b1a6475833c42f37ad1edf2c48628

SHA1
e4f673d9d77dfdf2e81222ebf59168fa3dbc6bfb

SHA256
b05a8572b017d179303a342e94432befc7050fa1941025c6b53254fa5cd8d676

SHA512
c23e7197ab2c8dcd2a4935e7d6a203828b83ade016814d4e05ba99a69f1f96f87ebba786f6c8229137da94a4e1f9efbe77a261099c7da5256dfe2648fe2b14b6

Download Submit
C:\Windows\SysWOW64\Hemdlj32.exe

Filesize
391KB

MD5
7db01fde82f39c88d397b5e9c9e1ea58

SHA1
e1d3ed30c3669ae2a3afaf17caf71207ec2be306

SHA256
8d87cde126459fb0a712ea6f3e6d09dde129146f76328af1b0fa3ef4af05a737

SHA512
7aefef16bca7e323fb6ba94f35e20b81a618bdc4e1cbe9fac5e7efb0430e329c1fbda3743e7f50be52f8f7d6fd6a2469ee8ac9c4b6b3a87e067c46cc7d494b41

Download Submit
C:\Windows\SysWOW64\Hifcgion.exe

Filesize
391KB

MD5
e4c38019aacce720423b88d2856102ca

SHA1
280ad1c370aa39487cca359b47e7c59b0bd9facb

SHA256
50090f700a19085ef3a1d77693beee13b069bc150d6ed2f55199c081373931f9

SHA512
72b864169d93d3be2c5b1db70268a176780e3d861aafc255d3ce7fd79db62de420b3b3ec683f6f0bb2e3fad4cfbfd78c96e3d3ae72b917a40fc78695aa4ea553

Download Submit
C:\Windows\SysWOW64\Ibcaknbi.exe

Filesize
391KB

MD5
3b1c81aefd7697f3798fb48adbf8b400

SHA1
7d078238fe6d10af0f817eeae5c5941c0957efcc

SHA256
79423c08b7c7c041d8b346eb397303f94be518dee9cd02b5c2162432556cd8d5

SHA512
a4d83415fe48d53f233791335720b4193542ff5e292c288abc60bdf2f472958e3d47dd8f8ed8b10f914e404c1f70921cd18cb267aef4e9e18e28086f47a39610

Download Submit
C:\Windows\SysWOW64\Iikmbh32.exe

Filesize
391KB

MD5
5876f304714f16d472bfa733789ad9ae

SHA1
f41922676f13c74d8f75d9c68c25370d617aae02

SHA256
30588137a8ab6218da3de5baaf2cd57014c10bd8a055b1ef2e14c72b0d8ada7a

SHA512
85c28b04648091e443a54b49a3abde5449f7d23d6533b30a2ef9e0d5254d5a99085d02ea5452cd2bd0639d8a9dce28f301f294f5498e29022973c8060f022316

Download Submit
C:\Windows\SysWOW64\Ipgbdbqb.exe

Filesize
391KB

MD5
f49e10225ebc64c59951de07fbf0e812

SHA1
b0339462a7c9cd93eb2738c3946c10f2279a748d

SHA256
1ecdb887bf373e565f2b3589f4fa6e0529b3ede418ebe35db096e75b0866a587

SHA512
01d800a0349333eeb74d449c134ce97ed9e06dd6e61fa199ee2f39ecb07533a694558198cae5a1e83da3af7d3c0be8a1592ddd7551a906cc002f6c1411451b6d

Download Submit
C:\Windows\SysWOW64\Ipjoja32.exe

Filesize
391KB

MD5
ea8b1f4f4f70a20425db739b1bea2382

SHA1
599e5f9704fd7138015474e4bcd3ea39aed68a52

SHA256
cb1ce2585a79fd4b6b9a8582a068a104feb051e6350e163283683997f7b38cb7

SHA512
f0e396117250c71221b6a8ff8c16f13b233660f60fde382cdd89a04ec440a6c9fb9f46d05d741677caf7a78a76f8a9c9f3c5a74adcc0d00397e5f316f6c80999

Download Submit
C:\Windows\SysWOW64\Iplkpa32.exe

Filesize
391KB

MD5
117c24e4d28af3df71fd23fe4fbd6d64

SHA1
1346c5bd2da8d5b341ff421dde412aece3a649ff

SHA256
176433a6eab6a6e180a4aee17b34f04d99dc84d7842a476fc63db61e2d230611

SHA512
8b3aabd0d1a920757741a0815d58e7f9be31faff9c5ebfb47a9b52eb871917240a0cc1ab882c689939e95f6af38cdb38803aaed1c831d6f98df468ea78a16ed5

Download Submit
C:\Windows\SysWOW64\Jekqmhia.exe

Filesize
391KB

MD5
13345aa458f893e0603fbff5ed65f11a

SHA1
f64d48e4b71e872cdb59a57da3856cb80fdfea12

SHA256
e72191658b1915651c94118c22e0e44a29890cdd6f6abc33628f78a772221da6

SHA512
6c97c2987c52bed8ae76262d08e9f8bff48896811a414d2ffaba595dc4d5bd7e8a84b6d9b86aaa9ed3ffbea49ef8020aadd06cb4077eb57e0af151679e7eb2ba

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
391KB

MD5
94e167f5681235d9663e83b74fa43b1c

SHA1
83ddc903d43f5d049320de06f1163046c32c245c

SHA256
fd514f0b71a12baa623f5d22d6c6b8f1323ea3842c4195275c02c98784f00c1d

SHA512
f51bd0fae0edd70bcca93427054078361bb580a2f510a0cb05643380bfdfb9a5a29ce6506e0a74f0f3e887a31a0bdf52f3d1f111c877981ea8017828223f4996

Download Submit
C:\Windows\SysWOW64\Jgmjmjnb.exe

Filesize
391KB

MD5
9260398f3b961ff6cccd2cbd9d451caf

SHA1
cfbc13d3e70cfac9b6829e3b8e2f01ac40f4b542

SHA256
b9303eedf14136d38b150dd9e104fb2f16baa071973c946321d958a29d898e82

SHA512
a5a17d63b9e0dc55646c4ed904645c3001f3ae863f06dccaa643e9f37eb254da41ebbfe6be6b1dd099cf70ad23c5830b6a04e94b0242939a342d7f7c39ffcf1c

Download Submit
C:\Windows\SysWOW64\Jgpfbjlo.exe

Filesize
391KB

MD5
fab85787b78582f020db7b5bcd704172

SHA1
4674f75a5d886bc6b171b4053db2a01a251f7778

SHA256
6216c9bc1e92a609e2178f7fb01688d7af2c39055145010cebcd64d05d5a36f8

SHA512
85e2565665d5d117bdf76ff891d514b1ec226c554e5c0b36e0d9b8554970b16e1ccdef2f41bb3a4619eb6a9233437e5d88b4d9c201a48d40f63dcd2be929f2d9

Download Submit
C:\Windows\SysWOW64\Jjpode32.exe

Filesize
391KB

MD5
bae99a13cf132ce33c534b09c4f90b48

SHA1
bdfb24a36bf18b23d4364258ecfcc1dadd282e65

SHA256
900c18f51799c23289b525510b160905467076147fee5cb6f48989499a4bcde9

SHA512
e4e76c980e2c298cf04ce3d04577f86d3c8ad1326ed8cd43115915e2c6ac125aa7a906d1c12429e7ec14f1beaa1f76ceac1ea3dd7f3cbe1598fd547275fc3b56

Download Submit
C:\Windows\SysWOW64\Kodnmkap.exe

Filesize
391KB

MD5
38ee90e685355aeeb2961eae17f82b58

SHA1
3f1b2b351522149ac57b5f2b074a4e0e0bb7d2df

SHA256
95c67ff206748f623c1ed5862f09094412ddf657d365f3a23be723fd35596b8a

SHA512
c8b112e4835ec6230f149af743298746f62ccfe17559758b51e5c15e1ff879a287d66369ddd490c3cf9c107318663c44f554d909120f895c267d2b0a58ca7255

Download Submit
C:\Windows\SysWOW64\Llodgnja.exe

Filesize
391KB

MD5
6a15263107fda4d8f7a895d3e5615bf3

SHA1
4f37cc2b83b0dc6d1dbfe2e83396580ec69c3559

SHA256
78e5229db446b600f58b022483073ba19595602bc9ba1067da2e006de324a157

SHA512
62d7a5c7c77578baf9176a6000ded85a818403177cec97058f2d5b6417fac85808e4e5e6ecbf9c987483c818056612c35915b52cc54936bfbedb850efbccd684

Download Submit
C:\Windows\SysWOW64\Moipoh32.exe

Filesize
391KB

MD5
51ac2e2708b8b24e7343d31563c03464

SHA1
205c19b988316d985b664f26fc72d534e0e9803c

SHA256
bc2438be3d0232448d1fd4ab16319a6c8109e0dd2958d6d4e2c17cb01c66ebf3

SHA512
f48b6abb18629bd630435905859a92222314247c90f4077ec7774f7d3491db6ad2a5b508fc9b0a31f8183b82b19bdf5ef436fa0ea00c796639ba9d0fe864eee2

Download Submit
C:\Windows\SysWOW64\Mokmdh32.exe

Filesize
391KB

MD5
85aba8c4aa8dbbd3b570804ee1582e6b

SHA1
cbbaee4c4bee7e300cd6f749b810f220d5509308

SHA256
b75f41ee8e50c15bdf52adb6e64fda60d200ffa6309abb2ec5cd30a21c218c8b

SHA512
c42e51de1b7ef7d835aad4cf613e596ad870adf2b0d5f61ca4db73e0296e5d88c20a7a8f21de9047a9a84fe9dca1992d8b2993a026b14761f5e7653f328c4d97

Download Submit
C:\Windows\SysWOW64\Ncchae32.exe

Filesize
391KB

MD5
b88a4192c004e6355a24908622337b0c

SHA1
9f709316249a44ed32efb72191c421d9d107f657

SHA256
9921edd77682be29359da83f86387568dd118ea29d3330277ebba424df09067c

SHA512
5148136810bc33cb1bf61834d84a22eb6bdaf8b768d87f06966fe23ac9b06d7b9d02c0dababe9c23969876e34f799d28d3453e4e6e5d5fb61bfa89ef8256e49b

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
391KB

MD5
dbc14d8a3da75d7eb52a0b3dee2014af

SHA1
5f988e064f5c05d716b2a0470a48d58a83be345b

SHA256
d337efebe426723257c9338f52439cfa24c7f933206e7139fb6de5c967417440

SHA512
76f1a9450cccc2d52b30e36d6d0bf1c96f96fadf56d0a692cf2abf0188da66d02673902a16c0fa052862727f06f84e53aebd119f99e6fa2fa1f6a4487c8374dc

Download Submit
C:\Windows\SysWOW64\Ojhpimhp.exe

Filesize
391KB

MD5
91772117997a06ce8286152c73f625f3

SHA1
2730784effc8212e65ebd21ef0009cdf7d42977e

SHA256
8e735e8825c34dda663d7fae5165a396ab52594fb50666a8fe29079d5c4c62e1

SHA512
552a3e5813a235c705c155e3e1d412538854dfd2fb67b96a3e02481d1610111b4e83bcfbd6887b6a6478e6826004989c4c0bcbdd0a97bfc2afe3eeab9c7a5beb

Download Submit
C:\Windows\SysWOW64\Opnbae32.exe

Filesize
391KB

MD5
65c9fc934f626fab965d750ade5b3ba5

SHA1
e4ae115ee5bf9c2007cf996b95a7fe7fb5d1bf3e

SHA256
252bfd48a6993ebe1ca07c6db6ffc34f5146c9aac0110a09ddf0194676f16572

SHA512
c9515a706141fbeffc91681ca88c4534789d0bd132d7aeece69f13a3c3623913459f67c5a48dad6e2c5db2c2a1be8abd8eecee643ded02c45c070bf1c93679e6

Download Submit
C:\Windows\SysWOW64\Paeelgnj.exe

Filesize
128KB

MD5
187696e1893569885a3a5951885b300f

SHA1
70d4752c87a8af964c8a3401d35e20cbf8baca4a

SHA256
01cc1558d107c9ca3408efacd0a40a0d3f8da1ce919484614a0cedc02bbc8254

SHA512
a9bbda5ecd2508a88adf7ffa5230e1887a3dadf0cca6b8edfddf7e4791be9585b857d3d7a9ed578353f3edfa49797c2d991887f113fb069be062d4b9c6258ac2

Download Submit
C:\Windows\SysWOW64\Ppahmb32.exe

Filesize
391KB

MD5
5e35e2d3192cc1c51ff37403924a054e

SHA1
b12e283ade9e2c5aa359c0bdf3e655105b65f090

SHA256
65bf63060be5b293f1d0a977d7ed7e16ad30fa130f970aee8f2aaaa43f4b4d3e

SHA512
c62849868f221ef7dc26c311b19c268ec3a17fb1328d4e774b0b4bdebecf22014d64267d79d227542a8d4d074d8adc3202a8c756992067c2b725b1d0767834f3

Download Submit
C:\Windows\SysWOW64\Qpcecb32.exe

Filesize
391KB

MD5
e723ce55053f6746db9387812b58d106

SHA1
cec7bb07354c343b220137b8db740201f6ff328e

SHA256
46fdf07d037eb4a05ce7f07c3a3a21b1f961a0304bfc2f496c4824149ab13e91

SHA512
46a9f02b5757eae58401f4d1f9ad33b19e35297edac0bdd0851e1363e149e11ee1fd1b791f7946eeae2d6e3d9cb3f37698b2140fe98d5da1f5d758c29d0fcae8

Download Submit
memory/212-1971-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/368-2044-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/392-488-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/396-1996-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/436-695-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/452-473-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/624-583-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/632-666-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/748-517-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/836-7-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/884-1933-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/920-501-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/968-731-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1120-477-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1156-628-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1156-1899-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1196-494-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1336-660-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1352-672-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1392-1938-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1456-547-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1488-508-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1536-630-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1584-28-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1620-571-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1624-470-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1728-600-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1756-2070-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1756-468-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1784-516-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1820-487-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1908-463-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1928-472-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1940-2016-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1940-493-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1972-465-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1992-1998-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1996-495-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2224-541-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2272-594-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2272-1908-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2400-474-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2448-719-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2572-519-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2572-1935-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2584-486-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2592-510-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2688-484-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2708-485-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2916-491-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2928-707-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2956-1878-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2956-689-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3032-636-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3116-496-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3212-642-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3228-464-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3436-467-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3464-462-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3492-612-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3524-492-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3548-483-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3596-457-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3600-453-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3600-2092-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3664-471-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3688-16-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3712-1866-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3712-725-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3800-507-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3800-1990-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3848-475-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3852-654-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3904-618-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3920-683-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3960-606-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3996-577-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4188-478-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4188-2040-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4272-701-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4296-513-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4336-713-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4348-535-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4360-563-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4392-454-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4408-566-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4416-1991-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4464-469-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4488-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4528-737-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4536-456-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4608-489-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4620-2086-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4620-455-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4888-553-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4888-1924-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4908-476-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4912-648-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5096-1882-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5148-743-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5148-1861-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5156-1739-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5180-1768-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5224-758-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5260-760-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5304-766-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5344-772-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5384-778-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5384-1847-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5424-1846-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5424-785-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5496-1798-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5500-795-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5536-1751-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5540-801-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5580-811-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5616-813-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5660-819-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5688-1743-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5700-829-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5724-1759-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5772-836-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5816-842-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5856-848-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5896-858-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/6124-1810-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/6212-1637-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/6328-1636-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/6464-1720-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/6552-1633-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/6800-1653-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads