berbew | c7b2b2fc1a8c57d8cb17c98d3a81d65764ac5ade48a6df7f1643c3b4b5036204

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7b2b2fc1a8c57d8cb17c98d3a81d65764ac5ade48a6df7f1643c3b4b5036204N.exe
Size

89KB
MD5

43fcc52914e3d3fede591e53f036f0e0
SHA1

074d073dcdcfe216255f87d172235e1106640acc
SHA256

c7b2b2fc1a8c57d8cb17c98d3a81d65764ac5ade48a6df7f1643c3b4b5036204
SHA512

0928776fc174298709c31cb0b291685f7f1fadb7978207b257ef7ed0db77aa91d870fbea8ae15774c81de39c840c27d9a2a1883ba9d31549c2a3ffb7ed8ab93f
SSDEEP

1536:xqQ242tfGFMC69zhNqTQkzfd+8zQtPgLkpbMHRQOD68a+VMKKTRVGFtUhQfR1WRw:X24eGFMxvNqTQkzfd+8mAsMHeHr4MKym

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfdjinjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhgiim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eomffaag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Geldkfpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojnfihmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmiikh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdenmbkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glfmgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhhdnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Onocomdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eqncnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnlhncgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doccpcja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieagmcmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ombcji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qdaniq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egcaod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Johggfha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pccahbmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhgiim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ookoaokf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nglhld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gnblnlhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oophlo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Haodle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ookoaokf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hnibokbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loacdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnfpinmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekajec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gegkpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfccogfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnfpinmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afpjel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jahqiaeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eoepebho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbihjifh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkekjdck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bogkmgba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnakk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnbeeiji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lojmcdgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahaceo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiikpnmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pplhhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fgcjfbed.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
3068	Nfjola32.exe
4444	Nmdgikhi.exe
4640	Nflkbanj.exe
4072	Nmfcok32.exe
412	Nglhld32.exe
992	Nnfpinmi.exe
2060	Ncchae32.exe
396	Nfaemp32.exe
4876	Nnhmnn32.exe
3544	Nagiji32.exe
2032	Nfcabp32.exe
4332	Omnjojpo.exe
2092	Ogcnmc32.exe
2292	Offnhpfo.exe
3692	Onmfimga.exe
4952	Opnbae32.exe
3056	Ocjoadei.exe
760	Ogekbb32.exe
2824	Ojdgnn32.exe
508	Onocomdo.exe
1516	Ombcji32.exe
3312	Oanokhdb.exe
3320	Opqofe32.exe
1536	Oclkgccf.exe
4492	Oghghb32.exe
1656	Ojfcdnjc.exe
4524	Onapdl32.exe
2536	Oaplqh32.exe
2604	Opclldhj.exe
640	Ogjdmbil.exe
2236	Ofmdio32.exe
2420	Ojhpimhp.exe
4296	Omgmeigd.exe
2744	Oabhfg32.exe
4112	Ocaebc32.exe
1356	Ohlqcagj.exe
2724	Pjkmomfn.exe
452	Pmiikh32.exe
600	Paeelgnj.exe
3212	Pccahbmn.exe
3740	Phonha32.exe
3968	Pfandnla.exe
3464	Pnifekmd.exe
2452	Pmlfqh32.exe
1620	Pagbaglh.exe
4660	Pdenmbkk.exe
3500	Phajna32.exe
3292	Pfdjinjo.exe
1124	Pnkbkk32.exe
3220	Pmnbfhal.exe
1344	Paiogf32.exe
4892	Pdhkcb32.exe
2484	Pffgom32.exe
2952	Pjbcplpe.exe
4972	Pnmopk32.exe
2028	Palklf32.exe
2356	Ppolhcnm.exe
5020	Phfcipoo.exe
3556	Pfiddm32.exe
1880	Pjdpelnc.exe
4148	Pnplfj32.exe
2496	Panhbfep.exe
4600	Ppahmb32.exe
1928	Pdmdnadc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nnkoiaif.dll	Ocdnln32.exe
File opened for modification	C:\Windows\SysWOW64\Omdieb32.exe	Ofjqihnn.exe
File created	C:\Windows\SysWOW64\Kqkplq32.dll	Pbcncibp.exe
File opened for modification	C:\Windows\SysWOW64\Edeeci32.exe	Ebfign32.exe
File created	C:\Windows\SysWOW64\Cagdge32.dll	Ekajec32.exe
File created	C:\Windows\SysWOW64\Kamjda32.exe	Kbhmbdle.exe
File created	C:\Windows\SysWOW64\Nofefp32.exe	Njgqhicg.exe
File created	C:\Windows\SysWOW64\Oeeape32.dll	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Eghkjdoa.exe	Eqncnj32.exe
File created	C:\Windows\SysWOW64\Finnef32.exe	Fgoakc32.exe
File created	C:\Windows\SysWOW64\Odlkfe32.dll	Hiacacpg.exe
File created	C:\Windows\SysWOW64\Ogcnmc32.exe	Omnjojpo.exe
File opened for modification	C:\Windows\SysWOW64\Opnbae32.exe	Onmfimga.exe
File created	C:\Windows\SysWOW64\Bgkiaj32.exe	Agimkk32.exe
File opened for modification	C:\Windows\SysWOW64\Bdojjo32.exe	Baannc32.exe
File created	C:\Windows\SysWOW64\Ofjqihnn.exe	Oophlo32.exe
File created	C:\Windows\SysWOW64\Opbean32.exe	Omdieb32.exe
File opened for modification	C:\Windows\SysWOW64\Njgqhicg.exe	Nfldgk32.exe
File opened for modification	C:\Windows\SysWOW64\Omopjcjp.exe	Ojqcnhkl.exe
File opened for modification	C:\Windows\SysWOW64\Pcegclgp.exe	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Onahgf32.dll	Adkqoohc.exe
File opened for modification	C:\Windows\SysWOW64\Dkekjdck.exe	Ddkbmj32.exe
File created	C:\Windows\SysWOW64\Bcoaln32.dll	Eklajcmc.exe
File created	C:\Windows\SysWOW64\Ahfmjddg.dll	Kiikpnmj.exe
File created	C:\Windows\SysWOW64\Gaagdbfm.dll	Ogjdmbil.exe
File created	C:\Windows\SysWOW64\Blknem32.dll	Gacepg32.exe
File created	C:\Windows\SysWOW64\Pblajhje.exe	Ppnenlka.exe
File created	C:\Windows\SysWOW64\Ieccbbkn.exe	Iojkeh32.exe
File created	C:\Windows\SysWOW64\Jpnakk32.exe	Jhgiim32.exe
File created	C:\Windows\SysWOW64\Pjkmomfn.exe	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Pfdjinjo.exe	Phajna32.exe
File created	C:\Windows\SysWOW64\Aokkahlo.exe	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Jcknij32.dll	Dnmaea32.exe
File created	C:\Windows\SysWOW64\Jeocna32.exe	Jocnlg32.exe
File created	C:\Windows\SysWOW64\Bdlgcp32.dll	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Dmncdk32.dll	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Jibclo32.dll	Fkfcqb32.exe
File opened for modification	C:\Windows\SysWOW64\Iehmmb32.exe	Ihdldn32.exe
File opened for modification	C:\Windows\SysWOW64\Ieagmcmq.exe	Ilibdmgp.exe
File created	C:\Windows\SysWOW64\Kapfiqoj.exe	Kamjda32.exe
File created	C:\Windows\SysWOW64\Omnjojpo.exe	Nfcabp32.exe
File opened for modification	C:\Windows\SysWOW64\Ppahmb32.exe	Panhbfep.exe
File created	C:\Windows\SysWOW64\Hhblffgn.dll	Pdmdnadc.exe
File opened for modification	C:\Windows\SysWOW64\Qhjmdp32.exe	Qdoacabq.exe
File created	C:\Windows\SysWOW64\Ofkhal32.dll	Bdojjo32.exe
File opened for modification	C:\Windows\SysWOW64\Bpfkpp32.exe	Bkibgh32.exe
File created	C:\Windows\SysWOW64\Egcaod32.exe	Edeeci32.exe
File created	C:\Windows\SysWOW64\Fqeioiam.exe	Fnfmbmbi.exe
File created	C:\Windows\SysWOW64\Omgmeigd.exe	Ojhpimhp.exe
File opened for modification	C:\Windows\SysWOW64\Pmiikh32.exe	Pjkmomfn.exe
File created	C:\Windows\SysWOW64\Keiifian.dll	Qjfmkk32.exe
File created	C:\Windows\SysWOW64\Aknbkjfh.exe	Ahofoogd.exe
File created	C:\Windows\SysWOW64\Lojmcdgl.exe	Lljdai32.exe
File opened for modification	C:\Windows\SysWOW64\Mhldbh32.exe	Mpapnfhg.exe
File created	C:\Windows\SysWOW64\Bdojjo32.exe	Baannc32.exe
File created	C:\Windows\SysWOW64\Cklgfgfg.dll	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Nmjfodne.exe	Njljch32.exe
File opened for modification	C:\Windows\SysWOW64\Pmlfqh32.exe	Pnifekmd.exe
File created	C:\Windows\SysWOW64\Ogakfe32.dll	Pjbcplpe.exe
File created	C:\Windows\SysWOW64\Lpmkebjc.dll	Bgkiaj32.exe
File created	C:\Windows\SysWOW64\Gkdinefi.dll	Doccpcja.exe
File created	C:\Windows\SysWOW64\Nagiji32.exe	Nnhmnn32.exe
File opened for modification	C:\Windows\SysWOW64\Ojhpimhp.exe	Ofmdio32.exe
File opened for modification	C:\Windows\SysWOW64\Omgmeigd.exe	Ojhpimhp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7956	7364	WerFault.exe	341

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgkiaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lljdai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogcnmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfkqjmdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adkqoohc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eomffaag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppahmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foclgq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlblcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jocnlg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oanokhdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjbcplpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgoakc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnbeeiji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmjfodne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojfcdnjc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cklhcfle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmkofa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnlme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apjkcadp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cponen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnibokbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Johggfha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paiogf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bogkmgba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgbpaipl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdimqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqlfhjig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geldkfpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nglhld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkgeainn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojqcnhkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcegclgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahaceo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckbemgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dolmodpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkmjaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeapcq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7b2b2fc1a8c57d8cb17c98d3a81d65764ac5ade48a6df7f1643c3b4b5036204N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egcaod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnfmbmbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offnhpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agimkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhjmdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaenbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ganldgib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppolhcnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gacepg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omopjcjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opnbae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckebcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhifomdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokkahlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjkmomfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebfign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqeioiam.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokgcbe.dll"	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkphhgfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jocnlg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kadpdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nmjfodne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flhkmbmp.dll"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkpbai32.dll"	Haodle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jeapcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnffoibg.dll"	Omgmeigd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajdggc32.dll"	Hnlodjpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlmmnd32.dll"	Lfiokmkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gacepg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lljdai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ogjdmbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfpagon.dll"	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hpioin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpapnfhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajgdm32.dll"	Pbekii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhal32.dll"	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Giljfddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibohd32.dll"	Ojfcdnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lielhgaa.dll"	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cepjip32.dll"	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hiacacpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dndhqgbm.dll"	Jahqiaeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lfiokmkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nfaemp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gadiippo.dll"	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfandnla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Paiogf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onahgf32.dll"	Adkqoohc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdmpga32.dll"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfcfimfi.dll"	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmncdk32.dll"	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajiqfi32.dll"	Hnibokbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kiikpnmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlgcp32.dll"	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Paiogf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddkbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Geanfelc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ieagmcmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pbekii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blcnqjjo.dll"	Pmmlla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pneall32.dll"	Pfiddm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fenpmnno.dll"	Offnhpfo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 3068	3124	c7b2b2fc1a8c57d8cb17c98d3a81d65764ac5ade48a6df7f1643c3b4b5036204N.exe	89
PID 3124 wrote to memory of 3068	3124	c7b2b2fc1a8c57d8cb17c98d3a81d65764ac5ade48a6df7f1643c3b4b5036204N.exe	89
PID 3124 wrote to memory of 3068	3124	c7b2b2fc1a8c57d8cb17c98d3a81d65764ac5ade48a6df7f1643c3b4b5036204N.exe	89
PID 3068 wrote to memory of 4444	3068	Nfjola32.exe	90
PID 3068 wrote to memory of 4444	3068	Nfjola32.exe	90
PID 3068 wrote to memory of 4444	3068	Nfjola32.exe	90
PID 4444 wrote to memory of 4640	4444	Nmdgikhi.exe	91
PID 4444 wrote to memory of 4640	4444	Nmdgikhi.exe	91
PID 4444 wrote to memory of 4640	4444	Nmdgikhi.exe	91
PID 4640 wrote to memory of 4072	4640	Nflkbanj.exe	92
PID 4640 wrote to memory of 4072	4640	Nflkbanj.exe	92
PID 4640 wrote to memory of 4072	4640	Nflkbanj.exe	92
PID 4072 wrote to memory of 412	4072	Nmfcok32.exe	93
PID 4072 wrote to memory of 412	4072	Nmfcok32.exe	93
PID 4072 wrote to memory of 412	4072	Nmfcok32.exe	93
PID 412 wrote to memory of 992	412	Nglhld32.exe	94
PID 412 wrote to memory of 992	412	Nglhld32.exe	94
PID 412 wrote to memory of 992	412	Nglhld32.exe	94
PID 992 wrote to memory of 2060	992	Nnfpinmi.exe	95
PID 992 wrote to memory of 2060	992	Nnfpinmi.exe	95
PID 992 wrote to memory of 2060	992	Nnfpinmi.exe	95
PID 2060 wrote to memory of 396	2060	Ncchae32.exe	96
PID 2060 wrote to memory of 396	2060	Ncchae32.exe	96
PID 2060 wrote to memory of 396	2060	Ncchae32.exe	96
PID 396 wrote to memory of 4876	396	Nfaemp32.exe	97
PID 396 wrote to memory of 4876	396	Nfaemp32.exe	97
PID 396 wrote to memory of 4876	396	Nfaemp32.exe	97
PID 4876 wrote to memory of 3544	4876	Nnhmnn32.exe	98
PID 4876 wrote to memory of 3544	4876	Nnhmnn32.exe	98
PID 4876 wrote to memory of 3544	4876	Nnhmnn32.exe	98
PID 3544 wrote to memory of 2032	3544	Nagiji32.exe	99
PID 3544 wrote to memory of 2032	3544	Nagiji32.exe	99
PID 3544 wrote to memory of 2032	3544	Nagiji32.exe	99
PID 2032 wrote to memory of 4332	2032	Nfcabp32.exe	100
PID 2032 wrote to memory of 4332	2032	Nfcabp32.exe	100
PID 2032 wrote to memory of 4332	2032	Nfcabp32.exe	100
PID 4332 wrote to memory of 2092	4332	Omnjojpo.exe	101
PID 4332 wrote to memory of 2092	4332	Omnjojpo.exe	101
PID 4332 wrote to memory of 2092	4332	Omnjojpo.exe	101
PID 2092 wrote to memory of 2292	2092	Ogcnmc32.exe	102
PID 2092 wrote to memory of 2292	2092	Ogcnmc32.exe	102
PID 2092 wrote to memory of 2292	2092	Ogcnmc32.exe	102
PID 2292 wrote to memory of 3692	2292	Offnhpfo.exe	103
PID 2292 wrote to memory of 3692	2292	Offnhpfo.exe	103
PID 2292 wrote to memory of 3692	2292	Offnhpfo.exe	103
PID 3692 wrote to memory of 4952	3692	Onmfimga.exe	104
PID 3692 wrote to memory of 4952	3692	Onmfimga.exe	104
PID 3692 wrote to memory of 4952	3692	Onmfimga.exe	104
PID 4952 wrote to memory of 3056	4952	Opnbae32.exe	105
PID 4952 wrote to memory of 3056	4952	Opnbae32.exe	105
PID 4952 wrote to memory of 3056	4952	Opnbae32.exe	105
PID 3056 wrote to memory of 760	3056	Ocjoadei.exe	106
PID 3056 wrote to memory of 760	3056	Ocjoadei.exe	106
PID 3056 wrote to memory of 760	3056	Ocjoadei.exe	106
PID 760 wrote to memory of 2824	760	Ogekbb32.exe	107
PID 760 wrote to memory of 2824	760	Ogekbb32.exe	107
PID 760 wrote to memory of 2824	760	Ogekbb32.exe	107
PID 2824 wrote to memory of 508	2824	Ojdgnn32.exe	108
PID 2824 wrote to memory of 508	2824	Ojdgnn32.exe	108
PID 2824 wrote to memory of 508	2824	Ojdgnn32.exe	108
PID 508 wrote to memory of 1516	508	Onocomdo.exe	109
PID 508 wrote to memory of 1516	508	Onocomdo.exe	109
PID 508 wrote to memory of 1516	508	Onocomdo.exe	109
PID 1516 wrote to memory of 3312	1516	Ombcji32.exe	110

C:\Users\Admin\AppData\Local\Temp\c7b2b2fc1a8c57d8cb17c98d3a81d65764ac5ade48a6df7f1643c3b4b5036204N.exe
"C:\Users\Admin\AppData\Local\Temp\c7b2b2fc1a8c57d8cb17c98d3a81d65764ac5ade48a6df7f1643c3b4b5036204N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\Nfjola32.exe
  C:\Windows\system32\Nfjola32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\Nmdgikhi.exe
    C:\Windows\system32\Nmdgikhi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\Nflkbanj.exe
      C:\Windows\system32\Nflkbanj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4072
      - C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:508
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3312
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        24⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        25⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        26⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1656
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2536
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2604
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2420
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4296
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2744
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1356
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:452
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        40⤵
        Executes dropped EXE
        
        PID:600
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        42⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3968
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3464
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        45⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        46⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3500
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3292
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1124
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        51⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1344
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        53⤵
        Executes dropped EXE
        
        PID:4892
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        54⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        56⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        59⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3556
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        61⤵
        Executes dropped EXE
        
        PID:1880
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4148
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1928
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        67⤵
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        68⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        69⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        70⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        71⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        73⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        74⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        75⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        76⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        78⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        80⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        81⤵
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        83⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        84⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        85⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        87⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        90⤵
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        91⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        95⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        96⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        97⤵
        Modifies registry class
        
        PID:1424
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        98⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        102⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        104⤵
        Drops file in System32 directory
        
        PID:3208
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        107⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        110⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        111⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        112⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        114⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:628
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        117⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        118⤵
        Modifies registry class
        
        PID:1016
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        119⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5280
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:3812
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        125⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        126⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        127⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        128⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3424
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        131⤵
        Drops file in System32 directory
        
        PID:4680
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        132⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        134⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6060
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2416
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5700
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        138⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        139⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        140⤵
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3944
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        146⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        147⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        150⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        152⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        153⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6488
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        154⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6620
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6760
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6800
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        162⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        163⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        164⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        165⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        166⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        167⤵
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        168⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        169⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6504
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        171⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        172⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        173⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        174⤵
        Modifies registry class
        
        PID:6840
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        175⤵
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        176⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7108
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6568
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        181⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        182⤵
        Drops file in System32 directory
        
        PID:6816
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        184⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        185⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        187⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1236
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        191⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        192⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        194⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        196⤵
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        198⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        199⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        201⤵
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        202⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        204⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        205⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        206⤵
        Modifies registry class
        
        PID:7652
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7720
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        208⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        209⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        211⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        212⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7992
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        214⤵
        Drops file in System32 directory
        
        PID:8036
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        215⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8080
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        216⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        217⤵
        Drops file in System32 directory
        
        PID:8168
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        218⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7188
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        219⤵
        Drops file in System32 directory
        
        PID:7260
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        222⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        223⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7544
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7612
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        225⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        226⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        227⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        229⤵
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        230⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        231⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        232⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        233⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        234⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        235⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7592
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        237⤵
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        238⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        239⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7936
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        240⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8140
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        242⤵
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7452
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        244⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        245⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        246⤵
        Drops file in System32 directory
        
        PID:7976
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8136
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        248⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7364 -s 224
        249⤵
        Program crash
        
        PID:7956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4404,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
1⤵
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7364 -ip 7364
1⤵
PID:7756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Baannc32.exe

Filesize
89KB

MD5
45f3d4f88a0f1f7df5f6230fe3aa4c97

SHA1
ffa66ba86e5a0888e946dadafceda61f79891085

SHA256
b0e2ac9c5c25a93f2d836a15afabe210b8ab9561649a22ee0cac2fb0ab110a8c

SHA512
7ae098649630dc69691adf22e3a27b2d3f56d557f0737fdfe2a735a7c6f3165c6b0b959b13b6082ecf07949dc679fdb893eff6b27ad1937507b5ef728f17263a

Download Submit
C:\Windows\SysWOW64\Caageq32.exe

Filesize
89KB

MD5
04ac3cb5cef6943fcaa3d4bc74b02af4

SHA1
cdb5b1dff53cf047deaf1aed81f11f9dc6787424

SHA256
99f3c813167c2ecf26a452998e36e32b3a0dd5eb7688754e7b75f078f7cac36f

SHA512
0fd00eab5e78f82886143fc125a3858790b66ec14299f479553a6d86dd1614276c1c7abee47c1d75998fece46b9269acef93835011eb997cd4bb7403d31b892e

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
89KB

MD5
ac276255c86bf1b1d96ab79403ee3de9

SHA1
3ba62d1afb56d155b8883e462fcda6b990f15044

SHA256
29a2ef1877909a9fdd479a69cd32f1cce3b90f3f198184e27108bac5a786cdf9

SHA512
0a249bac1082a9815d75bb150d290c76752f933970e5b9e5a59bf54211832751910f9db811292b84dc54b3781611302eae97074a0808e8bd5d787fb3e41a7310

Download Submit
C:\Windows\SysWOW64\Doccpcja.exe

Filesize
89KB

MD5
50411d6e721d4548a42e1df918096645

SHA1
c511eb4313390ce4eabb1f1ffcb73012fc4d24a9

SHA256
9d27f74a9cb040fe7dc90d0be132e4c5998bf3e9ed1f55134f6d8826492b9624

SHA512
c7a4eb4302e9d90602109456f7bf676c5cd787d8ea2226743a512672740e78003373a90d3c464d7d0944024456c826a79c3d4eb7abb2a18e4cb9ecbad8783d95

Download Submit
C:\Windows\SysWOW64\Fkfcqb32.exe

Filesize
89KB

MD5
6c155e3e85c944d2fd8f2f3782119686

SHA1
730e615b96109a7c5708be89d8f63a2196f32a58

SHA256
d954046d2fb9a48f597dd61370c45d5bce53a88fdd69bb73fa276cfbcc242570

SHA512
d944fa18f7edc66e25ad4d7d6fee5ef3aebd3447649035aeb0ed142a09b43708fc8c01df60b679d3db346907385913a4728680001271712ee3fcd34c39d596b4

Download Submit
C:\Windows\SysWOW64\Fkmjaa32.exe

Filesize
89KB

MD5
bbad4e62b8ea43da366347437d4d63ee

SHA1
7f5194a707a4bda0d52a37413be6a6b0cb8c4aa0

SHA256
aec370d4c23e4771ac335c89b99d7734b92655a803a2248722e6993e0e1037c1

SHA512
fa7050e5c76c2704020f99648a868e14b6d2cf74dfea71a4645968c6fec1f5be2dd577672479c5a73eb04907b3330e3e637a72fe1dda05ab380ee6200ebe48dd

Download Submit
C:\Windows\SysWOW64\Ganldgib.exe

Filesize
89KB

MD5
6523dccf46961a1741d2a30d2dea7923

SHA1
dbfca76c5100f58efe3d218da495e79e91463dd8

SHA256
cdec8be43b97b4c1dfeaa34d62e12c7000c920560d74035ed2f1908fda89c47e

SHA512
fa3be64ba90cb11caa9f4b75d137a26ada88a61caf6cf3792d057653dcb432d75244397a118d08652bf6f12593dfb34f49adbe2799ee03cde2c3b189c8195034

Download Submit
C:\Windows\SysWOW64\Giljfddl.exe

Filesize
89KB

MD5
20da9a68a635f14b6befee0588dd5bb0

SHA1
18092d5e7ca9b6b21f4399c7f6dc8283ffea9af5

SHA256
db6e1ce739d7ff215e8d4dcac56910178355be67c3445f440a3b8544fdafe259

SHA512
92cdbf4e3651939e7c024b21cbbb8f1c9132edc75305ba6955f9bc2d89680ec5344c8933008986a33be92e7b6b036ac3dc695adcffba7159aa3f047c2bc8500c

Download Submit
C:\Windows\SysWOW64\Hiacacpg.exe

Filesize
89KB

MD5
0872817ffcdea0fd980734e4afa731b4

SHA1
9bdcdd9455afbfb6e4dd566a6578e56a95629e3b

SHA256
c23994710252d1b93ab4f0cb636ca4fb493a026c47a92b89aee00baa5c935582

SHA512
0adfc2d49b82afb9f08d1d01b4c00b969c5499925fada337a2d058518d7fb55ffcc3f0474c7bbe8f0a3067220de42d0899b12b7fd9808262fe153d6cbd30cf0a

Download Submit
C:\Windows\SysWOW64\Hlblcn32.exe

Filesize
89KB

MD5
230013615fbcd24b6b2256872f158b38

SHA1
59d35ab649ee9e23a4c6d214358de6f84e9aca86

SHA256
67375bdfb27a8b48713e29b8173eeac80eaad898a8229e1087261c5f50fa4324

SHA512
d5c58846a6c0c5272638d5f6dc6166d78f7317404c902112d320dfbee1547c3412c530db04c3caf4a5fe3f004c95ce5f5648bbb6bf0a062d6c0a827c57172bfe

Download Submit
C:\Windows\SysWOW64\Hnbeeiji.exe

Filesize
89KB

MD5
f73cd11b5fbb3bba8b7247b1ea7b5851

SHA1
e13785c2bb471df2f97d104730172e874d6f9e6b

SHA256
6c01cc32e750a7390e894567a093ad8182a7bbeffb5e0a26f1831ea497875613

SHA512
bfe774265483082750cd1da37a7c2a02e29972dbe6163c1e3c64a8f9d15f944b634cd2266414b15df2b17753719c061c9146b1eb54d07fcb2784b6e5b85aef2b

Download Submit
C:\Windows\SysWOW64\Ieccbbkn.exe

Filesize
89KB

MD5
bcebf9c555f5c35b96ff94d90d8672ed

SHA1
333501162457651257e61a7c25a58f1d02564671

SHA256
ad9adb698387ff74a287bc0cc6a61de8f61fff14337399e7e9fbefbb83498e6f

SHA512
fc3fc9a29e3c0fa854eba2148540c7a597e0c106188202e9d21e96da0d238ceb4d4c107677572112e7650ee95c5584ecde9916badd1db1476d505354428bd8fe

Download Submit
C:\Windows\SysWOW64\Jahqiaeb.exe

Filesize
89KB

MD5
bdd8d48781aea65fe168129d4c57fc88

SHA1
c665feab7e79c6a0c2959791bb1aa5146fb941cd

SHA256
33b55320d7d6e9dde9ba70e9944540b81981399b625245d6c20f4393f4a8b402

SHA512
c134594837369fc7b0957e9178ab94f0a0aed6bfd75ca01eea5374353e36c1bd883b8dc8dcf02c24779700a2f312d40b109ca632d9582db40a0e44ff6a5c61c5

Download Submit
C:\Windows\SysWOW64\Kiikpnmj.exe

Filesize
89KB

MD5
97e5d9126107d8d4768efb676a84e864

SHA1
fdc259c46a94dd156c4c1782e88b9e72288e5b47

SHA256
13d212c2b179a49587f9d3982d2e59813651e28bc19b786d2abecf0bd952c3b2

SHA512
fbad1d78aeb60571f9b46d014bb1099e8156e757897a0b31fac3c529aef10d71ead76008d66a7109730bdea56ed13e3b3fee50fc322dcf93032d1ad86fd99b41

Download Submit
C:\Windows\SysWOW64\Loacdc32.exe

Filesize
89KB

MD5
ad1da24c3b66b6f1bbdf4dba5a1a2f58

SHA1
b95a2c7295c57112968978d7c13b9ee02ade2a8f

SHA256
6887290c3043fe73911d1a5e78a3f35c1dd47088df122c286118dc1c38609402

SHA512
018bc3ac8dbab02a6a859f5b8bf7cbce677da42fc54ac34b2ff7d81bf8251821bffc9fb617800adde0c6ece72e5f18e995db16e0c4b6643d32455082b2b16859

Download Submit
C:\Windows\SysWOW64\Mcaipa32.exe

Filesize
89KB

MD5
1a4382d1a466ab6a5c3500b122dc1634

SHA1
b41e73d36433dcb762f0738ec9b4ced16804f0ef

SHA256
6aad42daa9004363a33ce8467cc7c90592a38533cbc4dec8f5f1ee1c2b4fe821

SHA512
e6ab495553c4aa1563c0a35157066515220bef5807429113864a02ec7d45a0eb6a25fd3580b1b5d928839bb770df820b508ae34a34728dece685f58becf07955

Download Submit
C:\Windows\SysWOW64\Nagiji32.exe

Filesize
89KB

MD5
b92bac935c305e3c3270fb19bd14e8df

SHA1
71527696ab32fe4ed0ec3b43c6b0a7c6e37ac9b9

SHA256
c9a91cabec4df0b5111aa2fca6808e646c572f01f1e28c434066b43aff2028e3

SHA512
6e617bf094af9bcb0a032967b3d14429c642f1b95b9d679e343572edb641098fd3f97137d72ed208a70cb01583272e784cdf40b4e20e005a341d344eca1c534e

Download Submit
C:\Windows\SysWOW64\Ncchae32.exe

Filesize
89KB

MD5
d6424a4270c4a3aa39ef7415e53c7bd7

SHA1
c2a0a18854b29702960159aa8f81cfebb53f95f8

SHA256
367d1effda8636bbb4d28042fdeec1dbd5d317dae86f74a8c92c170b714f35f4

SHA512
a66411ac51c347aeb6b33ea246c76f045068e0c7151ab3746b4fd31be2cfa503b08ce3b0288a8c33532effccbac52bb8d213aa11c7490eeb52212afc4f257e63

Download Submit
C:\Windows\SysWOW64\Nciopppp.exe

Filesize
89KB

MD5
58b91b195977f4e20a9e25603fa7de56

SHA1
abc3130e67af4afef9dba658ff3768f6b8a100a8

SHA256
28a654de5f251a5abac422445ebe93f60ad02dc1f8064e0a44c302957617cbe9

SHA512
05b067e9238fabf4075f6a3ac6a787e880d5f17543da8ce63228e8f2c168f738e08dc33782ad56702f77173417cbdc89a9078b583d908853dbd657df8a32fa27

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
89KB

MD5
5cc09dbf7047c36b72846b1329dbaa37

SHA1
b14de72a972ca894c2042303e487ee7f7742043e

SHA256
c360019e810d433e3a71c70afc285b25f1443c1043a4c49891b5d97243964854

SHA512
4aed6af7595a24100d9bd965196062bcba7ad9da89cf4c56c42c345a9aef6e68b47bcb695d1fcf82c7d491a193ad57abc0a595b88f4c6d1719d47e501765f149

Download Submit
C:\Windows\SysWOW64\Nfcabp32.exe

Filesize
89KB

MD5
b7a83f6ea2b73c98fae00f6c84b25a50

SHA1
d29cc51e6cc775e9c7b0ca805c347b80fb3c8057

SHA256
6464703b020b93b92ac2e9a966a99a4fa285a05de09852bcf4510549abac3267

SHA512
398a9ac7a7e2c3c88af0f6421b4d5448182f6e0c33d9abb75637ffe2ac202673c00e28e2d866a352a7c659995298fb05975b213c8fd3a5c2d4e473f90d40296a

Download Submit
C:\Windows\SysWOW64\Nfjola32.exe

Filesize
89KB

MD5
c318e7bafe94da484f690c06fd4d1403

SHA1
8f6e57f6ae04fa5052070c23eabf679b0bf908f6

SHA256
8d106635e1ed0ead7050651cdcd92fc0b42b144e3bbc23e903c5440c2fdd0f17

SHA512
a0605f9b319007ad4a3d57653b264f40bcb5b6bb135b94c90fa24313604640778691f8c87704b1163e010d7690b1ce9e761f24d5a56c7b4e0d6baecff1bbd8c7

Download Submit
C:\Windows\SysWOW64\Nflkbanj.exe

Filesize
89KB

MD5
e8cecdfac53a622ac68f369d7403d4af

SHA1
a376d08deded6d3a02facee1fe568cd1abb6ce53

SHA256
ac94391a5e06c38c8b1b75ccb776e3a88017bac84b0333c67f4efd966a042e09

SHA512
39b639aa8dd8089aeea4e91d6e3b6acc9212b95e93326620090a96aae47296e81d83a7fac0cf8dc99429ee7533e3abe76e765bb144ee3a625539db6c7ae4f14f

Download Submit
C:\Windows\SysWOW64\Nglhld32.exe

Filesize
89KB

MD5
f7504f55a9aeb6a8c647fd0c8cf38a58

SHA1
4947296b450a10cb7a1bbce3ff4a8dbc3316574a

SHA256
3fab85ab7627ce8bc2da12cd3f48cb14651af9c31967561fb437720e73ee1a3c

SHA512
c199c01446358080d4406e41e65fe131d814fe61bd23ab552e8f5d40c861e4c459fd4842b78abc49e7e19a8b28189a327f9a69a0c98ad91c422b67ffa244f493

Download Submit
C:\Windows\SysWOW64\Njgqhicg.exe

Filesize
89KB

MD5
a7fe96f49aa31d7ebbc8fa2cbe803664

SHA1
3370b38e7c4af9f0a8f949ca258500ad966afa05

SHA256
688ff01af908b1208e017cfe926fa056a99bc34bb9290ff6a2084fcd53efe291

SHA512
cb864659e598032b4d8fc74054bcd541081bbd583ce276e818ca0cf0f24bde5933f38cfaf78d7484f8552cf39c28daa70bcceac30d24370835a1d1b356cf7343

Download Submit
C:\Windows\SysWOW64\Njljch32.exe

Filesize
89KB

MD5
ccd93528a2fc9d4c8184b0d40246b86d

SHA1
cae7f19fb7f773c682a2d5ef508de7e44eb54c94

SHA256
81a4740d2e74f4f4e2ae0b1acefc149ac945d15ecb4b5fe53a6cff3553740512

SHA512
60dad4c03e5732196f5adb7fd87b1890243d13dab62d04bf6815f093d25842d49fb9fa0585bcf51e7e26258fbac2ce7cbce555ce9c4f8422916d1b7a37194a8a

Download Submit
C:\Windows\SysWOW64\Nmdgikhi.exe

Filesize
89KB

MD5
12c8aca21142505a9a29a7056ee08ab5

SHA1
f7ae754ed519f56f217023c67fe1b168ac1ce33c

SHA256
2ecb48cb5e0f103d116f72034b10d71835f861c50f002a0332bffe4d2b4d39b4

SHA512
60c6b2c6912ec77233e563b281a39d97a85c299bfdd0d1eb9ef6513d0433b11ba9687c5041f7685835cf45e13792ccec05767b8ea9f3d429568f21068e19f592

Download Submit
C:\Windows\SysWOW64\Nmfcok32.exe

Filesize
89KB

MD5
ba710ce5ade94c0b557ad9fc61614ad2

SHA1
ad46575c670a9188a70d2e0c4245f89e7a0285f4

SHA256
b9efafee7eb6dd8fa896186bc3b2b99d75dee0a0d532f48146391ebea9179646

SHA512
a11e7938ac6991fcf3f973810b3650e2fba71d2349a7ba77ff7c9b2efb7c419710b578f7da3f50222bf9c3de76ac7a535a04ccc2832bc425c97575ff80833467

Download Submit
C:\Windows\SysWOW64\Nnfpinmi.exe

Filesize
89KB

MD5
fbacd3f7f9238264a5d6b4a40e77a9e5

SHA1
7f5c5cfd1f9cf47538a5dc8ee291acd6c182d0cb

SHA256
e6bf2d8c0a67bb1c5a5951a47ddaa8bf1526f6ad11cb9767ee9f53194a5eff59

SHA512
4be9e88368d6a22ed2b6d8f3bc2b43a0f2a0309f8b12e9eb744a88f106b9bac08c5ef8ebddb0b14fa44354c6a06f2423c43285b2e81bd96f0f0a0a993dccb406

Download Submit
C:\Windows\SysWOW64\Nnhmnn32.exe

Filesize
89KB

MD5
1c3cf21440e4b3a23a8b39bbd5104d45

SHA1
a429d4bbcbcfd2fc1d29c066a898ddae69f06397

SHA256
71b36c2e1a909d8f2407afc08cd0021900faf119200ff530adaad18294baf061

SHA512
608f82ef73ca3f158445442401df4f1623366d81dd3886d436c3676988159edee9ac491115e436776f512890ed27d2a159da52f14ef07dd6886236274298339f

Download Submit
C:\Windows\SysWOW64\Oanokhdb.exe

Filesize
89KB

MD5
3f41c9c9c917ad8ddee7a104fb274b90

SHA1
ece58b1765517fa67d6edee01db472b2b9b446db

SHA256
031abff9da0cae5e8a219f327fcd7d328ec9c07fc21c81d131d043fc611b3fb4

SHA512
e99c4e08f775402e0bf1308ca8d8b917ba59aafb67176a2093091180b4823be673040f7a42fb50d1f09b7bf9167d4aa22c8678651ee0663ea9ace481eeff4cc2

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
89KB

MD5
bf6fc912bb3c9800b58fcd8178575559

SHA1
1d2d509e44416598b7f3fd2bd7c9bfc2aa651e1c

SHA256
0e21642a241c8e3211805087b6bc71b0eeea064d5b38b463fad5c00ae2271aaf

SHA512
e306f57671b716942f1b459fd0b5adab843a19a7efd9b0f4a174ffe43c4279998e36e17398de57090d6034d14a54ebf3e32bddd6e57d344bf2cc518ffe901364

Download Submit
C:\Windows\SysWOW64\Ocdnln32.exe

Filesize
89KB

MD5
8f5ff7e1bf5f845b3da6d0397129676a

SHA1
c0f701777729f39166d7dfcab239650c573ca29b

SHA256
762ec53ac2b3b8d726a87ae356348a47727e08f770deed9ba9f7dfd056df52cb

SHA512
042d7982b9301f0fde8c48cee389979dfb2bf4b0524ba945fa11e89b8e6a2fb1cf296fbb813c4ce192ca95ad9e0b899963fb9469ef19c9599e234e4f92a5ce8c

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
89KB

MD5
de8fdb89f9bc2e01e27a70fc362bbd77

SHA1
2efe3bca7d59dfea7e1f5dc5a8ac8126cd532a97

SHA256
472bb9347cf651eeca119841f3c1a09766129d2f460ae2803b6cab956dae95eb

SHA512
eb30e0a1e29dd2a43114802d990dbdecf9da1284664b062694cff91ece86a1e6b2bc0e071a76f7b4dd0096f7b7707b26ad18b99a06f1e31727dde4dff9eba3ca

Download Submit
C:\Windows\SysWOW64\Oclkgccf.exe

Filesize
89KB

MD5
d235a4c2f90bf2d06da8327ac60315d2

SHA1
9cf1a2b70b37eea5b39d66efd53afe6a1c65bb7c

SHA256
65cb22b599ef1e2892e984358f4aad57b9c81f8f7507eba77f7d3befc9e50cd4

SHA512
abfdc7c74163a442c170c69f85bac64084d8255569fb0667ba8825b8859a008fe83b9ddefaeb3cfea0874a770d9601faca281c729d0275b600fa0c7bf7b5008a

Download Submit
C:\Windows\SysWOW64\Offnhpfo.exe

Filesize
89KB

MD5
bbf6e7adc0778332fad0b1a03e7b9dbd

SHA1
3aef4647cb588ecfd29e13440e1c655f25c18d15

SHA256
b4dee85e1315af0a51b501334b07f6e5b68922eeaf32986367470fad0b98a36c

SHA512
84e1111ed8d9d468ecf2a082774d903c57a47bcea82eb82221b6d2edca754ef7bd2596d96906f8c4d1233b99b7de5f934912570fbe8bbb7633faf80c3962b3c4

Download Submit
C:\Windows\SysWOW64\Ofmdio32.exe

Filesize
89KB

MD5
32df83c832f77947787d22a315ced42f

SHA1
f7f0fe1d3f64e9a6cb4ea58874578766fa67f926

SHA256
8abd4e45de6d2188a4b314a93ec094d0b652106d30fd3c2238f0026a7a140096

SHA512
6ca038bc7730bbd511427264fb5986d8d0d68bf021e9b12254ad07c495910ff77a967a16841ac193d63bb8e0bc3326540dc9d89c6b1ee47257456a14c79ac477

Download Submit
C:\Windows\SysWOW64\Ogcnmc32.exe

Filesize
89KB

MD5
63facd160ae273aa071a423137ff2fe3

SHA1
cab64473676623c238276ecdb64753ad0e882107

SHA256
fcd466beb4032f183f8084929d2b848c72fa41ce301b668095bff5bffcdf5298

SHA512
8f84f5651031de0de4ae0dacbc1a2cb3808ab7a806816c1dd6e70cb7c9862b66bd91ca6915078ca873c6558c2df5cc8142d11982ef258ec9732e9d324c60a745

Download Submit
C:\Windows\SysWOW64\Ogekbb32.exe

Filesize
89KB

MD5
37eba6a8f62026fdfa3ef3c078d35a98

SHA1
afe82f60dc39b80adb26ff9e7e6147be98b357c1

SHA256
8f369f1bfaa03f85d57d8621095b22835fe135b886a68bb254b9a095765dc384

SHA512
e1f2169823cbaeb6a61f09e84a07b63ee80730734ab8db84cd527cb55aaaac3863fa68e175cc5d575ee8871b5aa02d13ab98c34230a7c4fdd4f95db3d9f20199

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
89KB

MD5
e95b0f7b7cf7d2ecd9a248a10fccff01

SHA1
0fb1415dedb7f093ea005b3a2b8af0063542fb3c

SHA256
272b1285a7e2af750351bc763ed34348900b4dc9254a325116f3518c9f8119c8

SHA512
8e4a718e6c113bc36bbac7a7f3b656b4b7ffb32aa1ea6a247862969e0562990b3dec655f656ac7b5ef7d6e5beaab6146c49d9849e3794af727bcc820f05e474b

Download Submit
C:\Windows\SysWOW64\Ogjdmbil.exe

Filesize
89KB

MD5
be13bee788ea203ccd576248092d8f85

SHA1
f075dd392273262ef497aa540efef494a7b97b52

SHA256
d0d7285554e1a4b35427aeb2351a3e27715230a48f41a7a1110285888a1051ee

SHA512
67d054710de99580f8bcfdb950c37c360f13022a210b5e1a90c989b4bf6b5b6a96282327dc1997042490ffab144f123d6774560c43715f6fb74369cd87eb75e4

Download Submit
C:\Windows\SysWOW64\Ojcpdg32.exe

Filesize
89KB

MD5
33f2feb9b6589415b74d7e501cf53f2d

SHA1
eb677d61816ff1d36953c10edb20b4a1de47c43f

SHA256
336106b7fdf88bda3b63a0ab417755016c6b2046f14e45451748aec0da48b35f

SHA512
4bd024ef48a7ead16345e785ba7108ff8eb544b4c62d0898aac24f498a4101c81d143c82e1037ff462991a2d6f95814f364f8521be4fb59693a7ecc356eaeb06

Download Submit
C:\Windows\SysWOW64\Ojdgnn32.exe

Filesize
89KB

MD5
12e65d7b4c8b9ecb7684d107203a336f

SHA1
8af1e9593b26cf3f365c317e7de27298e3fc7a97

SHA256
cd517391b74c283640ab9549db034d2e6d43cbb5cc789232847e8edd97ca4f52

SHA512
d3de346e19bad2148c7e4c8395607860a7bbd89e49046c82f5170bf1fb46966d1f9230f0d80ae53c9df820e6be886bd60aec6d2c210aa181fb3642f8ca9f9046

Download Submit
C:\Windows\SysWOW64\Ojfcdnjc.exe

Filesize
89KB

MD5
5233f29c1579034e818fc8fbe17d9a98

SHA1
7c698a91aa78581fd71b8184bd830e451da7fbaa

SHA256
d878b2bf7c22608137bf0f83a1f798ba26843a3f22a67e393b495cfdf843c5ba

SHA512
b5b0a29f3d92240db14bcf12ec6b41eaae73e504b3f926f4aabf8f279ede4645aaa63be1a5a2d8634325824346ff3c3e2d2a29741c670466e2eb6d8e7579f121

Download Submit
C:\Windows\SysWOW64\Ojhpimhp.exe

Filesize
89KB

MD5
1ec18450482bd6509b2c89d520619775

SHA1
8fcf71f2b7d4ff37c9e89d73a06a3cfd65648503

SHA256
975324202866021b624217911d25ee97a37869ef05a65cd645604981ff06042c

SHA512
e9a5920de46618a5d8825f38f1475efdf287fd7e8adfef1a40260a45d75aff8f90b1698231b9622b1fc301efa4e5c17c54cf49d3221e746452794042dc659c9d

Download Submit
C:\Windows\SysWOW64\Ombcji32.exe

Filesize
89KB

MD5
be12831a228d351258f3a2afa3d5b929

SHA1
2f08fd12cf1d845147561e6a1fe5e7a79f766b1d

SHA256
87d41f272123e87f683bf4abb67b83caf7eefb5df131f360556717ca7a55b37c

SHA512
3c2180180c3b098af068624c45097b54dce06e438821afcb055670259658a5d6f4a44a9565c91bbfa5de2542333531d2f20dd9573f7ad0d0c9b4534afc908427

Download Submit
C:\Windows\SysWOW64\Omdieb32.exe

Filesize
89KB

MD5
7069b3b53c7c5a31a293cc99ce5b1332

SHA1
93f89861c9ac11ac647de7e214a94ca661f632e7

SHA256
db58f7c9784be21274e338337e35736ba0e62d965c76501cd645d133f9f9570c

SHA512
dafc564d8478897399870be90aaae0bf1137b040f8e8345133bf4345238196a27e2494e76fb71fead7ecdb9e0c08de43759f2d4a837c9c200b663646462c692d

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
89KB

MD5
d4c7fcb721e209b93234b692e0dc5612

SHA1
3ce814fdb04dae626210f831c40188fd5fddef62

SHA256
9350e11167719ef8677024ca4ac12f11fcf1bd0438ada1e748369e795ec33270

SHA512
51779f23fea6fbd5eefef1b290caf5a83b27e8fa16e5c88e69ed6521f3e54de38b9fec4ead2cf198a9d9e7547f667fb22a98b041d725c7d7d0a4adcbeb1eb07a

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
89KB

MD5
ccf02992a2ead92308b7ee1980fe6c80

SHA1
b0f7f34eab419a4bc206538ea879a074fa0fadc4

SHA256
8cf9d5b1d0d01ffb094474876b6fff781437e88cf3147c3e3def825c3543c9b5

SHA512
1608a88fdaa8b52aa722ca785c24e36f9c529bf0a14e51c73d335d9d04bb201010ededc0aa01710659cf986ca03c25219c1dee6e5f6abe825644e80c68ef0d71

Download Submit
C:\Windows\SysWOW64\Onmfimga.exe

Filesize
89KB

MD5
f8f7d475c8f16cdd7bb9b62e912ec532

SHA1
498b2d085aea5f81e31d55703b525fc30f6b695f

SHA256
8633d6621eab340af0369e6a0994ecbd1eeb2c066debd32a637b31687f063c19

SHA512
19c375a3ed3b05dc14bdf472ac64dbc5589f2ea852126f9242c2b448407f84d37d873ddf9ded3b6876b98a2eb9f792e83d2328b775f3a1d680221d7912a40dad

Download Submit
C:\Windows\SysWOW64\Onocomdo.exe

Filesize
89KB

MD5
bd6ff4f5b8d59d226af232079b28c1ee

SHA1
ee2a6ed47bf4f29113335e5fd4c5bd8ce0c66e4d

SHA256
bd1f04f67fda8c56fa3570c635375192dc9e744f81382836bb70f3df16112a03

SHA512
a4c45c3e0f72eb30def3445ed8b36fed38c5760e1117b3250fe86a84fd5059f8614f02468578aff247ce9cbd65c48204d8615c867f4543d66d09fa8f57c0bf0f

Download Submit
C:\Windows\SysWOW64\Opbean32.exe

Filesize
89KB

MD5
389288f319b819c2de6c72587cef7962

SHA1
be0cacf2d64487caf6a1070ae1d4cd22b292f82d

SHA256
b2e40a5de98500a16b76451056a179c5bdec579d9c035a0b36b56b2b63a84d01

SHA512
77af8507aaba2010d267ddf42b378161fc48c856f37aaacf851033577b01df25e538c4730df1a78f1a382ed757a5ad1870e841342b105db8e44cf709809b3013

Download Submit
C:\Windows\SysWOW64\Opclldhj.exe

Filesize
89KB

MD5
435556c66b4c2e68fab68cb81c9b679e

SHA1
7dd9922b68b8b336f77afc6dd721d50f96a81d9e

SHA256
b6af8cc37cfe0c3f54229a204a8357501d7fc73ad7fd151ab28ba39cb8f2c360

SHA512
c8e0769492cdad11d158210066509005a3d2988f1d60c649d38f88b1de78de5fe6a084c78e547e44384c51490320990d1fec1faeda0482f85cea6d2ca906f72c

Download Submit
C:\Windows\SysWOW64\Opnbae32.exe

Filesize
89KB

MD5
969d00d0c1fd9dbfc5acea09730f8196

SHA1
e18cb985086c46285008e41e3f1ace67efe368ef

SHA256
3d0d6ecb639dd9213cbb1e4a15d5b834652c3e9461a546bcac32d07175b23ef8

SHA512
20038586eb70ca6b1222ab931850c3924095fcc298089a425f5602c7ff94bb27d795ff49f5b965f80ec436a5213adb1e368d4d9632b15df96e50e31cbb3def1a

Download Submit
C:\Windows\SysWOW64\Opqofe32.exe

Filesize
89KB

MD5
2df584ba8f01494e98465d967ae7369d

SHA1
0ce88ba6c02a85b6f06bbcfc933477c219e3f91f

SHA256
b1c3c4f9c24beb53c239556f59fe98aea0f4cfe11a5cab5382b84e3af981923c

SHA512
b26872ff3e70f2659f73a67f13e3dda33c467fdf1eec3d846ccc540fb50d85a16046a0769f9798ded508b2ef9d22c992a5117b542ef3e03e44390dfa668601d9

Download Submit
C:\Windows\SysWOW64\Oqmhqapg.exe

Filesize
89KB

MD5
da68921ea13198e9c8a83301344ed281

SHA1
70843d90d594ca675c039f5e83305fc9d327ff40

SHA256
0e288c40b4215350322d77d0fe1c65d4ce546936691aa39853e6f1353cf20699

SHA512
36216030707f029f9777e1a28dd0599a64b2d7df0985c9a60d69335cad54c7c0b9d019252cd18107735032187d50104d1f9ee8b3ef5567529eec1b1d86947741

Download Submit
C:\Windows\SysWOW64\Pbcncibp.exe

Filesize
89KB

MD5
b3bba54d553d02f4f43005ccbc609fb7

SHA1
34a53db67f7ebee7405c8fdfee17b80e4ab2e1ff

SHA256
eabc17dfd68270b484468aeaa81c7ac9df0a342d0a21dca4522e5d2aafbbc168

SHA512
3baaad21e99216fbe2b6ee1b572b454096b9f6de80d50202ce246354f711d422d13b02daf13f21b2b1e466160d68b560d1dbd30927124b2284ebfbf428d6b05c

Download Submit
C:\Windows\SysWOW64\Pbhafkok.dll

Filesize
7KB

MD5
55c3cba5993de69dd071a964606a5095

SHA1
bb9046a34b12699321afa78b4318932443e7f07d

SHA256
afe79acff297513f3e4e505fec3e29887cd93c20417689bccb9c09600490ca14

SHA512
b9450daff0a3a700bcde07fa0f86a7f20990e33414539d8029d6dea33991e017497192ba7a6857638a4ebc4d4dc0cf8aac293bea6c1ddc08c416466c5a7bae9f

Download Submit
C:\Windows\SysWOW64\Pififb32.exe

Filesize
64KB

MD5
94cac03fe25ea6a94899a13f623a6f12

SHA1
2e4cf5b8c7a346210c772fc596d192394a0f66d1

SHA256
ebba271d9cb1e2427a73dfd5d4960ece460394b3210c82c527a9b6a919d92fbe

SHA512
3df3f18814bc0bbceece3f77b61929a8be81898802348002d1c391b6291e6c88bc6cdc7bce79d8ff9069c7c40907b28d72a636887684f06300fc7ed60eba1e3a

Download Submit
C:\Windows\SysWOW64\Pmkofa32.exe

Filesize
89KB

MD5
29d516840fcfe98ec7364fd69d4a4701

SHA1
f1430f0d3160c92ff4c1b0d704c49ac4bff2aa05

SHA256
6db6929cc3c9aa7964686e4e71d8c44f71e68f16aa5e48114931f21a3611dd57

SHA512
e74dedbdd4309711ab40232bcbb2339169a5be4b2423c98c4bd97c076b9628475090413966c1ba061709853a23e25a3ac50edefc3212740aec8288fab767b56d

Download Submit
C:\Windows\SysWOW64\Ppgomnai.exe

Filesize
89KB

MD5
acc83cd97fc4885a2000c7b0c8e7955a

SHA1
839fe9f6e5c42835076b697a405f609f3709183c

SHA256
3f6dd37946e6b1b60f35b843ae62d4db12ca27929f2b6ed1396196084ac52286

SHA512
91960324005f643ff4213cb77d7ecbf0597b2695b969089358837421351730a6fadb2d04b88713ae089b1f910d1b3bbe2c77be1c10d0a9808d5ea5dea411359d

Download Submit
C:\Windows\SysWOW64\Ppnenlka.exe

Filesize
89KB

MD5
3212bd9efde0f0a9a9462425e23a0b69

SHA1
dfb8848016e40f6191e2571da3d02f8ee0afab39

SHA256
8209ec54f44c68482d94b1c36bacb24a527556eb0f77172fbc0ac92fa1bbdff3

SHA512
96f183dfcbedfbca054deb7e1034ae8ee28be90e13aaa3a30bf166d8319db2bdc6f6f60d1ef56c3c155c4f97ca1871c1bff7fe1907327fe24c2d4addd85a8b31

Download Submit
memory/396-155-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/396-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/412-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/412-124-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/452-310-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/508-175-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/600-316-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/640-258-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/760-156-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/992-137-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/992-47-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1124-376-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1344-388-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1356-299-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1516-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1536-209-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1620-353-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1656-227-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1880-442-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1928-466-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2028-418-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2032-89-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2032-182-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2060-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2060-146-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-111-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-201-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-266-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2292-121-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2356-425-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2420-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2452-346-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-400-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-454-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-242-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2604-251-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2724-305-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2744-287-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2824-165-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2952-407-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2968-478-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2976-472-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3056-147-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3068-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3124-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3124-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3212-322-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3220-382-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3292-371-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3312-193-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3320-202-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3464-341-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3500-364-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3544-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3544-173-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3556-436-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3692-125-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3692-217-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3740-328-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3968-334-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4072-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4072-119-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4112-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4148-448-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4296-281-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4332-191-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4332-98-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4444-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4444-96-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4492-219-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4524-234-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4600-460-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4640-106-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4640-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4644-484-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4660-358-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4876-71-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4876-164-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4892-394-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4952-138-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4972-413-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5020-430-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5136-490-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5176-497-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5208-502-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5256-509-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5288-515-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5328-521-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5368-527-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5408-533-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5448-539-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5488-544-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5536-551-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5568-557-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5608-562-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5656-569-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads