berbew | 0c0e2e6f78498491737eb5372df5db6f7256147c51f1089715057287f3fc7135

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c0e2e6f78498491737eb5372df5db6f7256147c51f1089715057287f3fc7135N.exe
Size

194KB
MD5

d29a2e3d3747a7c43cdc5bebf2cf68a0
SHA1

2de7bce9834930657a8b27592c1b2ef11076baf4
SHA256

0c0e2e6f78498491737eb5372df5db6f7256147c51f1089715057287f3fc7135
SHA512

a0d0eca15c68e8785bb12b91adedf60a35fde5b6f2118a7f0cb446ad84f3c37ce00c6528be4475d51e2865e2df06310f894d0d15a76f7be27df76b17d5cc5af3
SSDEEP

3072:J7jd0t1UXDHQbzNtAdmMIM/kEmMIGumMIc/1GV:J7jd0t1UXDHQ/NtAd5/pbuh/UV

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiamp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkeipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdgahag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbgqdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amfhgj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afqifo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcicjbal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cplckbmc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdapehop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nconfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obnnnc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdngpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnhbmgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llimgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llngbabj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mohbjkgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mojopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbhildae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpogkhnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdknpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iapjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfoegm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nheqnpjk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcncodki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aidomjaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bikeni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqkhda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbcedmnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mepnaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cefoni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Halaloif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhgdmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbbnbemf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abemep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qelcamcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfoegm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdlhgpag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecgodpgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkgillpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnpjlajn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llkjmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llngbabj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lolcnman.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nooikj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pehjfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aagdnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hghfnioq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kopcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldfoad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ammnhilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bimach32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmpcdfll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obidcdfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blgddd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbaehl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aalmimfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmladm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqkhda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lddble32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Janghmia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Poidhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmpcdfll.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
4464	Pmbegqjk.exe
4860	Qiiflaoo.exe
3764	Qpbnhl32.exe
116	Qjhbfd32.exe
1520	Amfobp32.exe
4240	Abfdpfaj.exe
436	Aagdnn32.exe
4876	Afcmfe32.exe
5108	Adgmoigj.exe
4844	Aalmimfd.exe
4692	Bigbmpco.exe
888	Bfkbfd32.exe
1400	Bbaclegm.exe
2260	Bdapehop.exe
4332	Bmidnm32.exe
2392	Bmladm32.exe
3952	Bbhildae.exe
4548	Cibain32.exe
4500	Cdhffg32.exe
4412	Ckbncapd.exe
8	Cpogkhnl.exe
3528	Cdjblf32.exe
3860	Cpacqg32.exe
4216	Cgklmacf.exe
3328	Ciihjmcj.exe
4020	Cgmhcaac.exe
4312	Cdaile32.exe
1820	Dmjmekgn.exe
2180	Dgbanq32.exe
4360	Dnngpj32.exe
212	Dggkipii.exe
3352	Daollh32.exe
3156	Ejjaqk32.exe
4472	Ecbeip32.exe
4228	Epffbd32.exe
3356	Ecgodpgb.exe
1404	Eqkondfl.exe
2492	Egegjn32.exe
1172	Fkcpql32.exe
1500	Fqphic32.exe
4912	Fjhmbihg.exe
1652	Fkgillpj.exe
4664	Fbaahf32.exe
4276	Fnhbmgmk.exe
2700	Fdbkja32.exe
2464	Fjocbhbo.exe
3948	Gcghkm32.exe
1116	Gnmlhf32.exe
3592	Gqkhda32.exe
224	Gkalbj32.exe
2852	Gggmgk32.exe
3208	Gqpapacd.exe
4932	Gdknpp32.exe
5032	Gqbneq32.exe
4372	Gnfooe32.exe
4280	Gbbkocid.exe
1636	Hnhkdd32.exe
1580	Hqghqpnl.exe
3264	Hjolie32.exe
2928	Hkohchko.exe
1872	Halaloif.exe
856	Hjdedepg.exe
2108	Hejjanpm.exe
2380	Hghfnioq.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cemeoh32.exe	Cdlhgpag.exe
File opened for modification	C:\Windows\SysWOW64\Ijmhkchl.exe	Icachjbb.exe
File created	C:\Windows\SysWOW64\Loemnnhe.exe	Lkiamp32.exe
File opened for modification	C:\Windows\SysWOW64\Leabphmp.exe	Lbcedmnl.exe
File opened for modification	C:\Windows\SysWOW64\Mepnaf32.exe	Moefdljc.exe
File opened for modification	C:\Windows\SysWOW64\Cpogkhnl.exe	Ckbncapd.exe
File created	C:\Windows\SysWOW64\Lddble32.exe	Leabphmp.exe
File created	C:\Windows\SysWOW64\Bejobk32.exe	Bcicjbal.exe
File opened for modification	C:\Windows\SysWOW64\Dbhlikpf.exe	Dlncla32.exe
File created	C:\Windows\SysWOW64\Cmphbcbb.dll	Bcicjbal.exe
File opened for modification	C:\Windows\SysWOW64\Ddqbbo32.exe	Ciknefmk.exe
File created	C:\Windows\SysWOW64\Higplnpb.dll	Aagdnn32.exe
File created	C:\Windows\SysWOW64\Ocdgahag.exe	Okmpqjad.exe
File created	C:\Windows\SysWOW64\Pkholi32.exe	Pdngpo32.exe
File created	C:\Windows\SysWOW64\Debnjgcp.exe	Ddqbbo32.exe
File opened for modification	C:\Windows\SysWOW64\Cbaehl32.exe	Cpcila32.exe
File opened for modification	C:\Windows\SysWOW64\Dpgbgpbe.exe	Dllffa32.exe
File opened for modification	C:\Windows\SysWOW64\Cgklmacf.exe	Cpacqg32.exe
File created	C:\Windows\SysWOW64\Cjbdmo32.dll	Leoejh32.exe
File opened for modification	C:\Windows\SysWOW64\Piolkm32.exe	Pfppoa32.exe
File created	C:\Windows\SysWOW64\Bfjllnnm.exe	Bclppboi.exe
File opened for modification	C:\Windows\SysWOW64\Epffbd32.exe	Ecbeip32.exe
File opened for modification	C:\Windows\SysWOW64\Icogcjde.exe	Iapjgo32.exe
File created	C:\Windows\SysWOW64\Gccebdmn.dll	Icogcjde.exe
File created	C:\Windows\SysWOW64\Mjdmlonn.dll	Cbjogmlf.exe
File opened for modification	C:\Windows\SysWOW64\Odbgdp32.exe	Nofoki32.exe
File opened for modification	C:\Windows\SysWOW64\Aiabhj32.exe	Almanf32.exe
File created	C:\Windows\SysWOW64\Amfobp32.exe	Qjhbfd32.exe
File created	C:\Windows\SysWOW64\Ejjaqk32.exe	Daollh32.exe
File created	C:\Windows\SysWOW64\Fkgillpj.exe	Fjhmbihg.exe
File created	C:\Windows\SysWOW64\Lifcnk32.dll	Gnmlhf32.exe
File opened for modification	C:\Windows\SysWOW64\Adgmoigj.exe	Afcmfe32.exe
File opened for modification	C:\Windows\SysWOW64\Daollh32.exe	Dggkipii.exe
File opened for modification	C:\Windows\SysWOW64\Jbppgona.exe	Jnbgaa32.exe
File created	C:\Windows\SysWOW64\Ghfqhkbn.dll	Cdjblf32.exe
File created	C:\Windows\SysWOW64\Mmccbngq.dll	Aimhmkgn.exe
File opened for modification	C:\Windows\SysWOW64\Cdlhgpag.exe	Cmbpjfij.exe
File created	C:\Windows\SysWOW64\Cmonod32.dll	Dmnpfd32.exe
File opened for modification	C:\Windows\SysWOW64\Kbnlim32.exe	Klddlckd.exe
File created	C:\Windows\SysWOW64\Cifiamoa.dll	Mohbjkgp.exe
File created	C:\Windows\SysWOW64\Eiebmbnn.dll	Nconfh32.exe
File created	C:\Windows\SysWOW64\Obidcdfo.exe	Ohqpjo32.exe
File created	C:\Windows\SysWOW64\Pjhfcm32.dll	Qiiflaoo.exe
File created	C:\Windows\SysWOW64\Adgmoigj.exe	Afcmfe32.exe
File created	C:\Windows\SysWOW64\Mgqaip32.dll	Cdaile32.exe
File created	C:\Windows\SysWOW64\Fdbkja32.exe	Fnhbmgmk.exe
File opened for modification	C:\Windows\SysWOW64\Apddce32.exe	Amfhgj32.exe
File created	C:\Windows\SysWOW64\Cemeoh32.exe	Cdlhgpag.exe
File created	C:\Windows\SysWOW64\Qagfppeh.dll	Lbcedmnl.exe
File created	C:\Windows\SysWOW64\Omclnn32.dll	Ndnnianm.exe
File created	C:\Windows\SysWOW64\Nbbnbemf.exe	Nconfh32.exe
File created	C:\Windows\SysWOW64\Gdojoeki.dll	Oloipmfd.exe
File created	C:\Windows\SysWOW64\Fldqdebb.dll	Qkfkng32.exe
File opened for modification	C:\Windows\SysWOW64\Kopcbo32.exe	Kbjbnnfg.exe
File created	C:\Windows\SysWOW64\Idjcam32.dll	Lddble32.exe
File created	C:\Windows\SysWOW64\Dqjhif32.dll	Apddce32.exe
File created	C:\Windows\SysWOW64\Obkcmi32.dll	Ammnhilb.exe
File created	C:\Windows\SysWOW64\Dbooabbb.dll	Qejfkmem.exe
File opened for modification	C:\Windows\SysWOW64\Cpcila32.exe	Cmdmpe32.exe
File created	C:\Windows\SysWOW64\Cbaehl32.exe	Cpcila32.exe
File created	C:\Windows\SysWOW64\Dccfkp32.dll	Adgmoigj.exe
File created	C:\Windows\SysWOW64\Pjpjea32.dll	Ilfodgeg.exe
File created	C:\Windows\SysWOW64\Ofnfbijk.dll	Kopcbo32.exe
File opened for modification	C:\Windows\SysWOW64\Obidcdfo.exe	Ohqpjo32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7776	7692	WerFault.exe	300

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mepnaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nconfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkdohg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmladm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbanq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hejjanpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbijgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leabphmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llkjmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afqifo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bldgoeog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpcila32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dllffa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhgdmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndnnianm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aalmimfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdjblf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjmekgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijmhkchl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ledoegkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqbneq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mahklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkfkng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ammnhilb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aidomjaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obidcdfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oloipmfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bigbmpco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnmlhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbnlim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbbnbemf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhffg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdbkja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icfmci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mohbjkgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofoki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klddlckd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llngbabj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhknhabf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpbnhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqpapacd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icachjbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibgmaqfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keceoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aimhmkgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lajokiaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obnnnc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbljoafi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqkondfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqphic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnhbmgmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdknpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdhbpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Debnjgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnngpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjhmbihg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkiamp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkklbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmdmpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacijjgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Moefdljc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mojopk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbhildae.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apocmn32.dll"	Gqkhda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pddlig32.dll"	Hkohchko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nomlek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmmeak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cplckbmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qiiflaoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llkjmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aidomjaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfoegm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpcila32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcipf32.dll"	Fnhbmgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpgfeb32.dll"	Bldgoeog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blknpdho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmidnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbaahf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cibain32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqphic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmfoj32.dll"	Gqpapacd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jakjcj32.dll"	Hghfnioq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmdlch32.dll"	Loopdmpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aagdnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anbgamkp.dll"	Bbhildae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iolgql32.dll"	Fbaahf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqbneq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnfooe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iabglnco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpmmbfem.dll"	Ibgmaqfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odehaccj.dll"	Klddlckd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfkbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmladm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbaehl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cifiamoa.dll"	Mohbjkgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhejfl32.dll"	Mddkbbfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Logicn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Leabphmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmfbakio.dll"	Nomlek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nofoki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfomcn32.dll"	Pkklbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cefnemqj.dll"	Aiabhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfbhcl32.dll"	Daollh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjocbhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bejobk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecbeip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hodcma32.dll"	Debnjgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkeipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfoegm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Loemnnhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbnjfh32.dll"	Nbbnbemf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debaqh32.dll"	Ooangh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkholi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmmeak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbooabbb.dll"	Qejfkmem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfnlgh32.dll"	Ciihjmcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcghkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmdmpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obkcmi32.dll"	Ammnhilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mapchaef.dll"	Jbijgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bochcckb.dll"	Jjgkab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Loopdmpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piolkm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4464	1492	0c0e2e6f78498491737eb5372df5db6f7256147c51f1089715057287f3fc7135N.exe	89
PID 1492 wrote to memory of 4464	1492	0c0e2e6f78498491737eb5372df5db6f7256147c51f1089715057287f3fc7135N.exe	89
PID 1492 wrote to memory of 4464	1492	0c0e2e6f78498491737eb5372df5db6f7256147c51f1089715057287f3fc7135N.exe	89
PID 4464 wrote to memory of 4860	4464	Pmbegqjk.exe	90
PID 4464 wrote to memory of 4860	4464	Pmbegqjk.exe	90
PID 4464 wrote to memory of 4860	4464	Pmbegqjk.exe	90
PID 4860 wrote to memory of 3764	4860	Qiiflaoo.exe	91
PID 4860 wrote to memory of 3764	4860	Qiiflaoo.exe	91
PID 4860 wrote to memory of 3764	4860	Qiiflaoo.exe	91
PID 3764 wrote to memory of 116	3764	Qpbnhl32.exe	92
PID 3764 wrote to memory of 116	3764	Qpbnhl32.exe	92
PID 3764 wrote to memory of 116	3764	Qpbnhl32.exe	92
PID 116 wrote to memory of 1520	116	Qjhbfd32.exe	93
PID 116 wrote to memory of 1520	116	Qjhbfd32.exe	93
PID 116 wrote to memory of 1520	116	Qjhbfd32.exe	93
PID 1520 wrote to memory of 4240	1520	Amfobp32.exe	94
PID 1520 wrote to memory of 4240	1520	Amfobp32.exe	94
PID 1520 wrote to memory of 4240	1520	Amfobp32.exe	94
PID 4240 wrote to memory of 436	4240	Abfdpfaj.exe	95
PID 4240 wrote to memory of 436	4240	Abfdpfaj.exe	95
PID 4240 wrote to memory of 436	4240	Abfdpfaj.exe	95
PID 436 wrote to memory of 4876	436	Aagdnn32.exe	96
PID 436 wrote to memory of 4876	436	Aagdnn32.exe	96
PID 436 wrote to memory of 4876	436	Aagdnn32.exe	96
PID 4876 wrote to memory of 5108	4876	Afcmfe32.exe	97
PID 4876 wrote to memory of 5108	4876	Afcmfe32.exe	97
PID 4876 wrote to memory of 5108	4876	Afcmfe32.exe	97
PID 5108 wrote to memory of 4844	5108	Adgmoigj.exe	98
PID 5108 wrote to memory of 4844	5108	Adgmoigj.exe	98
PID 5108 wrote to memory of 4844	5108	Adgmoigj.exe	98
PID 4844 wrote to memory of 4692	4844	Aalmimfd.exe	99
PID 4844 wrote to memory of 4692	4844	Aalmimfd.exe	99
PID 4844 wrote to memory of 4692	4844	Aalmimfd.exe	99
PID 4692 wrote to memory of 888	4692	Bigbmpco.exe	100
PID 4692 wrote to memory of 888	4692	Bigbmpco.exe	100
PID 4692 wrote to memory of 888	4692	Bigbmpco.exe	100
PID 888 wrote to memory of 1400	888	Bfkbfd32.exe	101
PID 888 wrote to memory of 1400	888	Bfkbfd32.exe	101
PID 888 wrote to memory of 1400	888	Bfkbfd32.exe	101
PID 1400 wrote to memory of 2260	1400	Bbaclegm.exe	102
PID 1400 wrote to memory of 2260	1400	Bbaclegm.exe	102
PID 1400 wrote to memory of 2260	1400	Bbaclegm.exe	102
PID 2260 wrote to memory of 4332	2260	Bdapehop.exe	103
PID 2260 wrote to memory of 4332	2260	Bdapehop.exe	103
PID 2260 wrote to memory of 4332	2260	Bdapehop.exe	103
PID 4332 wrote to memory of 2392	4332	Bmidnm32.exe	104
PID 4332 wrote to memory of 2392	4332	Bmidnm32.exe	104
PID 4332 wrote to memory of 2392	4332	Bmidnm32.exe	104
PID 2392 wrote to memory of 3952	2392	Bmladm32.exe	105
PID 2392 wrote to memory of 3952	2392	Bmladm32.exe	105
PID 2392 wrote to memory of 3952	2392	Bmladm32.exe	105
PID 3952 wrote to memory of 4548	3952	Bbhildae.exe	106
PID 3952 wrote to memory of 4548	3952	Bbhildae.exe	106
PID 3952 wrote to memory of 4548	3952	Bbhildae.exe	106
PID 4548 wrote to memory of 4500	4548	Cibain32.exe	107
PID 4548 wrote to memory of 4500	4548	Cibain32.exe	107
PID 4548 wrote to memory of 4500	4548	Cibain32.exe	107
PID 4500 wrote to memory of 4412	4500	Cdhffg32.exe	108
PID 4500 wrote to memory of 4412	4500	Cdhffg32.exe	108
PID 4500 wrote to memory of 4412	4500	Cdhffg32.exe	108
PID 4412 wrote to memory of 8	4412	Ckbncapd.exe	109
PID 4412 wrote to memory of 8	4412	Ckbncapd.exe	109
PID 4412 wrote to memory of 8	4412	Ckbncapd.exe	109
PID 8 wrote to memory of 3528	8	Cpogkhnl.exe	110

C:\Users\Admin\AppData\Local\Temp\0c0e2e6f78498491737eb5372df5db6f7256147c51f1089715057287f3fc7135N.exe
"C:\Users\Admin\AppData\Local\Temp\0c0e2e6f78498491737eb5372df5db6f7256147c51f1089715057287f3fc7135N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\Pmbegqjk.exe
  C:\Windows\system32\Pmbegqjk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\Qiiflaoo.exe
    C:\Windows\system32\Qiiflaoo.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\Qpbnhl32.exe
      C:\Windows\system32\Qpbnhl32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3764
    - - C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:116
      - C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3860
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        25⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3328
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        27⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4312
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1820
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2180
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:212
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        34⤵
        Executes dropped EXE
        
        PID:3156
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4472
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        36⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3356
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1404
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        39⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        40⤵
        Executes dropped EXE
        
        PID:1172
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1500
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4912
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4276
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2700
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2464
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3592
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        51⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        52⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\Gqpapacd.exe
        
        C:\Windows\system32\Gqpapacd.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3208
        
        C:\Windows\SysWOW64\Gdknpp32.exe
        
        C:\Windows\system32\Gdknpp32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Windows\SysWOW64\Gqbneq32.exe
        
        C:\Windows\system32\Gqbneq32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Gnfooe32.exe
        
        C:\Windows\system32\Gnfooe32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        57⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Hnhkdd32.exe
        
        C:\Windows\system32\Hnhkdd32.exe
        58⤵
        Executes dropped EXE
        
        PID:1636
        
        C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        59⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        60⤵
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Hkohchko.exe
        
        C:\Windows\system32\Hkohchko.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2928
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1872
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        63⤵
        Executes dropped EXE
        
        PID:856
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2380
        
        C:\Windows\SysWOW64\Iapjgo32.exe
        
        C:\Windows\system32\Iapjgo32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2580
        
        C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        67⤵
        Drops file in System32 directory
        
        PID:1148
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        68⤵
        Drops file in System32 directory
        
        PID:2484
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        69⤵
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
        
        C:\Windows\SysWOW64\Ibgmaqfl.exe
        
        C:\Windows\system32\Ibgmaqfl.exe
        73⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        74⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3304
        
        C:\Windows\SysWOW64\Jhfbog32.exe
        
        C:\Windows\system32\Jhfbog32.exe
        76⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4668
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        79⤵
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Jnbgaa32.exe
        
        C:\Windows\system32\Jnbgaa32.exe
        80⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Jbppgona.exe
        
        C:\Windows\system32\Jbppgona.exe
        81⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        82⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        84⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        85⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        86⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        92⤵
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        96⤵
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        98⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        102⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5612
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        C:\Windows\SysWOW64\Loopdmpk.exe
        
        C:\Windows\system32\Loopdmpk.exe
        107⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Lhgdmb32.exe
        
        C:\Windows\system32\Lhgdmb32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Windows\SysWOW64\Maoifh32.exe
        
        C:\Windows\system32\Maoifh32.exe
        109⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Mkgmoncl.exe
        
        C:\Windows\system32\Mkgmoncl.exe
        110⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Mhknhabf.exe
        
        C:\Windows\system32\Mhknhabf.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Windows\SysWOW64\Moefdljc.exe
        
        C:\Windows\system32\Moefdljc.exe
        112⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Windows\SysWOW64\Mepnaf32.exe
        
        C:\Windows\system32\Mepnaf32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5392
        
        C:\Windows\SysWOW64\Mohbjkgp.exe
        
        C:\Windows\system32\Mohbjkgp.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        115⤵
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\Nomlek32.exe
        
        C:\Windows\system32\Nomlek32.exe
        118⤵
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Nheqnpjk.exe
        
        C:\Windows\system32\Nheqnpjk.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Ndnnianm.exe
        
        C:\Windows\system32\Ndnnianm.exe
        122⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Windows\SysWOW64\Nconfh32.exe
        
        C:\Windows\system32\Nconfh32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5952
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        125⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        126⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        127⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        128⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        130⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        132⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        133⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        134⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        135⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Obnnnc32.exe
        
        C:\Windows\system32\Obnnnc32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6304
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        137⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        138⤵
        Modifies registry class
        
        PID:6388
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        140⤵
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        141⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        142⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        143⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Pfppoa32.exe
        
        C:\Windows\system32\Pfppoa32.exe
        144⤵
        Drops file in System32 directory
        
        PID:6656
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        145⤵
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6788
        
        C:\Windows\SysWOW64\Pmmeak32.exe
        
        C:\Windows\system32\Pmmeak32.exe
        148⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        150⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        151⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        153⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7088
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:7132
        
        C:\Windows\SysWOW64\Qelcamcj.exe
        
        C:\Windows\system32\Qelcamcj.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        156⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6200
        
        C:\Windows\SysWOW64\Qcncodki.exe
        
        C:\Windows\system32\Qcncodki.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6300
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6372
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        160⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\Apgqie32.exe
        
        C:\Windows\system32\Apgqie32.exe
        161⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Abemep32.exe
        
        C:\Windows\system32\Abemep32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6728
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        164⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Almanf32.exe
        
        C:\Windows\system32\Almanf32.exe
        165⤵
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Aiabhj32.exe
        
        C:\Windows\system32\Aiabhj32.exe
        166⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        168⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        170⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Bcicjbal.exe
        
        C:\Windows\system32\Bcicjbal.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        172⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        173⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        174⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6600
        
        C:\Windows\SysWOW64\Bclppboi.exe
        
        C:\Windows\system32\Bclppboi.exe
        175⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Bfjllnnm.exe
        
        C:\Windows\system32\Bfjllnnm.exe
        176⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Blgddd32.exe
        
        C:\Windows\system32\Blgddd32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6916
        
        C:\Windows\SysWOW64\Bikeni32.exe
        
        C:\Windows\system32\Bikeni32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7044
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6288
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        181⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        182⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        183⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Cdebfago.exe
        
        C:\Windows\system32\Cdebfago.exe
        184⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Cplckbmc.exe
        
        C:\Windows\system32\Cplckbmc.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        187⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Cidgdg32.exe
        
        C:\Windows\system32\Cidgdg32.exe
        188⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Cmpcdfll.exe
        
        C:\Windows\system32\Cmpcdfll.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Clbdpc32.exe
        
        C:\Windows\system32\Clbdpc32.exe
        190⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        191⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        193⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        194⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        195⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7192
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7236
        
        C:\Windows\SysWOW64\Ciknefmk.exe
        
        C:\Windows\system32\Ciknefmk.exe
        197⤵
        Drops file in System32 directory
        
        PID:7280
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        198⤵
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        199⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        200⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7440
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        202⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7524
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        204⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        205⤵
        Drops file in System32 directory
        
        PID:7608
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        206⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        207⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7692 -s 400
        208⤵
        Program crash
        
        PID:7776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4212,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7692 -ip 7692
1⤵
PID:7752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aagdnn32.exe

Filesize
192KB

MD5
396cbf66ab1ffb118d6f8c0455e3829d

SHA1
cbc7013457b15896a11bbb85a65347d58772b0e0

SHA256
7ae026e33bc8a475f271eeee08c0024b67f42839418a5725734b4c174fd2d5aa

SHA512
37ba9950ec6b99060a84222eba84df3738e4440f2e6d28a22164851c7006cd3a09e33f7651576b764e158af631781ae9efd57f0a39da415a74a3ce19ff619916

Download Submit
C:\Windows\SysWOW64\Aagdnn32.exe

Filesize
194KB

MD5
48b29e83af25196b0d56538757283956

SHA1
f73b37c9ccb10e16d1270b4ef7ea314c99c5558a

SHA256
de9fe874481c1b3233df44b7e83727044a9b3381cfcaa6392106e273442c55f9

SHA512
2b90d8dffc64c9839b01779a76fa7f867013eb510f562e6af375e7be1b49f3fa1a8b2eb5b41546ca7aee1e5fbe201ad1570ce907bee768b4bf4fb9eaf09887f2

Download Submit
C:\Windows\SysWOW64\Aalmimfd.exe

Filesize
194KB

MD5
9cb26353ed94c2dea30493dbacf897bc

SHA1
3f852f03a751a77cce8d233ea0659c60ad2fdc03

SHA256
83b3245df2c4f1a75f2b74ccfce2a6ce5857c7b32ffb4bdcb69e093f3ac6caa5

SHA512
478aa1d4b4997b5a5290ba0c1d59e53da7f3860db5c05a0f84e5f9c7ab63ce10bc386254bd87aaa53cfacbe7ee0ed156b6b4d7186b69461b0ed7a99dbd5cfd65

Download Submit
C:\Windows\SysWOW64\Abfdpfaj.exe

Filesize
194KB

MD5
cc5947eb57ecc7b11c272ddb884f9739

SHA1
40d90a3a7a1171da0d3094f757f25c47e25de136

SHA256
70b49424105eb07f1e21fc761e5eb0170a7743df4ea3faa7f2d040892121781e

SHA512
d7e6717dbe838ee71e307797ae324f5d2f19ed93fc933bf22fcb0dc0d29459db02dbb417e6b97a266349a49f480e7345f87a95917b528dbae1245d2afe5234ef

Download Submit
C:\Windows\SysWOW64\Adgmoigj.exe

Filesize
194KB

MD5
e27647adc54c77636b93f58b4f4b8f66

SHA1
5274a10d322e166146a39eaed6559f6a50acf969

SHA256
b6d2ffd06ffd6e698b0ea1024093b6c6a24d96cb0154a0c3515ab5a5b5fe5621

SHA512
3345f9652e7e7c87f093701390db767a2d352e0d6c10ccb2fa0c27b5a44a950c251d8ff6105f21c81041e73fe1bc99ee9b1bda48de865cfa3b0d444c06562bb8

Download Submit
C:\Windows\SysWOW64\Afcmfe32.exe

Filesize
194KB

MD5
77ef9ddf6d99eb36f652ea62de6d8b06

SHA1
732c1ec3803afa07fef7c45b2d128eb44f5c6a54

SHA256
48d94abd1191f09c9f00b9f58a77e86602d8ae65e4c68227dcd748a8c9e20a4c

SHA512
876660beddcd4b5e75511b90e3f0bd60e981e5b1637adce9ee6c9552427d106985dbbb0a426f29f8138be1866aebff12ec97fca3113a5d43f95b252af16d4642

Download Submit
C:\Windows\SysWOW64\Aidomjaf.exe

Filesize
194KB

MD5
6ab8e88e3dd97b3f9e4dc55ca9ebe07e

SHA1
1a8014736b3960155d1bdd23244260ea0f561cc8

SHA256
c8149f03c68ca5d5b8a2e79d13ee1e8c22a53614097bf6b2db6be8b466057db9

SHA512
4465f0206bca39284e10a8dd4e7faaaf1c98fdf30d7d07d6d6647962c2ac59c331bfb38895b5a20e9fa4e47c6abe4bf1599c68ba67aad00c36aebf173c81f25a

Download Submit
C:\Windows\SysWOW64\Aimhmkgn.exe

Filesize
194KB

MD5
7f766faa4b15f2dd7d427453759bcffd

SHA1
42e7e73fc743a78558e64a6b8c0192da9d0ecdc6

SHA256
e0c6f9e0d0f2172056e0f0c756391b8e0b9ed74bcf066590103a45b0307ca385

SHA512
8bda46f42b7354a4f2eedb382d2cfc1756f310ab21ebb5d15ddc567668708cc3b3991577cfb1cd4d251da438568e220ab4e21e910aca1a833a0c5d3778cf3ddd

Download Submit
C:\Windows\SysWOW64\Amfhgj32.exe

Filesize
194KB

MD5
4315b759e1454768e70a9fddd1b59dea

SHA1
f44eb535612913aca8ba2a53d0748d534fcb30a9

SHA256
9afc10635aadd0e46928ac360d3594936ffd3ae98e4894af3598063f964aa692

SHA512
62374e15728a6fac594a98f3333ef2a686019d38d564cea9a93425312699ed0bb982a88403fed33f6c0da600458c7663fde3808e04d9c5fa96a36571071c66d7

Download Submit
C:\Windows\SysWOW64\Amfobp32.exe

Filesize
194KB

MD5
360b58f77d58570d9622cb9491263e27

SHA1
590e0955577f8d003f6dc1417bed32afd13daade

SHA256
898bbf64cc0c2556c0b2140d171687f016dea54bf0ac161f6379ca819a9fa7bd

SHA512
97c1cc4c46ee91915319eddc2da90a2d242f3b7b04f767ee5e58c1206321ec46bc15d654d1022f9454b4fef444539f106b4c79fb5831e0c4f7e2ea95342b70d5

Download Submit
C:\Windows\SysWOW64\Bbaclegm.exe

Filesize
194KB

MD5
529706ea152dc12e43cc5a80a6fdde54

SHA1
9799e8bcac2939aaeff158dba47b18bd1053d6de

SHA256
65b16f4cb09e03819b02fdbd2c50ae637b3eb333467a82aff172a01b037fa4af

SHA512
4e2640afd2b99d7fd1ec9668244039ee58e66940afa817c2bf01ec758f5cda502c789004513b19a78499f248cafedbdd625cff7a1760f4c371f106e6b1da3e19

Download Submit
C:\Windows\SysWOW64\Bbhildae.exe

Filesize
194KB

MD5
a802265a71fd4d2efc7c4ec2bb285f3b

SHA1
bf7e96530e1676ea97108e714a56a98b47f90b30

SHA256
58dd1a1b12f6d41051c9707ad0f8ca24ce8dead2f026f02c66fb971c723a848b

SHA512
f59bc76f3a37509a4406e9f371baeac9c1214844a3f14413cb3a8e3998813353ebe8256ddc258a951816b14abb9a80c212cc5b8bdf9465f63eba4df91d84cd5a

Download Submit
C:\Windows\SysWOW64\Bdapehop.exe

Filesize
194KB

MD5
98de56677d21110cd1444193ef71d6b3

SHA1
458107e8e09c44c97954c5cde96f29c0a277ced0

SHA256
9129ec7261e28edd16f4d4e4517a53fbae94be33086e4a62026159f964f2e95a

SHA512
69d2430002ced362aa1126c3d61948083b884d0501b12783fc2b0d85fd0ba9c84e5a1e88540021be7ae98cd2f9600262d185232bd923a207ad5844c462559d23

Download Submit
C:\Windows\SysWOW64\Bejobk32.exe

Filesize
194KB

MD5
1bfa35654f6e781b197b4c7258ae6f12

SHA1
aef4d166282d0bd9056f8cd57267ba2cbe7b7c17

SHA256
1cd7dbadda067402f24e6105bebb9664a55096f047260b9a4c3af3742db5c5f9

SHA512
66042026204ef6e56a4000b396e7a8d951997b8c5565da72d84a693531f16b6ae3ce067307a0d000ba8a06691ade6a7394fc60e9c7352a3bb25f685d3a979909

Download Submit
C:\Windows\SysWOW64\Bfkbfd32.exe

Filesize
194KB

MD5
7501b9ab7243e5505fcc19d000591627

SHA1
b772c8fcfa227f19f49122a267d4ce282e397ed9

SHA256
519846a60404c81e553f373925f84983b78df88c7f53d71e8ed8b5822dcf42ab

SHA512
fbad63e03c0fa2f5f5be2457dc603ae13fa77f88117386c4aa18c4d486369a3c7775a38cd2f1c9f9c7f4a81aab50087dd34f8411bc361950a23300b13741798c

Download Submit
C:\Windows\SysWOW64\Bfoegm32.exe

Filesize
194KB

MD5
ca0e3c65c4ad788d688c62909e6e4cd5

SHA1
89a779e96ee4d4bcdd1fe68bf65e99ddb47e9fa5

SHA256
b89102aa6dc86c9093bea96eaee3c7f046b16aeb026d1623a898221d5e42444d

SHA512
ae2a50efe9e1099c87689f5e143a602d297b460cd0d98e29424a3380548b1a687b0e149848c9ae6f281a0effd4a65f08d16e3c6614889d35e472cb662a216a95

Download Submit
C:\Windows\SysWOW64\Bigbmpco.exe

Filesize
194KB

MD5
aace8961f71dcb87623c65a970752883

SHA1
b021236ca01d600d0f72f2220a44b096653a1fd1

SHA256
c113bf039bb5cfd7b79434ce4ac806d3e1e49b0f3d65e45c86b4a0e8b487b5ee

SHA512
222780e4a5845eedc3238bd93d72b21416b2204968362150bddf961699148242050c0834bca9e4a27916345f5502768ce4fc5d2573a4a14a45afd9239ef658c9

Download Submit
C:\Windows\SysWOW64\Bmidnm32.exe

Filesize
194KB

MD5
ced5a14cc7b02ab5e9c844b54b194db0

SHA1
d812fd0c82e3223a5624f5914e776206d47d5a3b

SHA256
bb8e814acb20cbcad5698b14fc1912f27604a021d8b07f597f0e5264be182d4b

SHA512
a9aaa80d08b79345c450d14279a00dfd6a5374f4c87cb22ed747c8493625a7725865e80d8015a3ce9af7a1f432e2288a8f49b77c7eaab2841464684ba27626a5

Download Submit
C:\Windows\SysWOW64\Bmladm32.exe

Filesize
194KB

MD5
e758d8e7f859871c563f0ee735b04d2f

SHA1
c01f9f3b4ee9ee0251dcbfda5711e23fd4856dcd

SHA256
edb03e251722eb7d66cc7811ba385bb0bd3602004d26cca2964a4caa27e2d618

SHA512
97a4889c18a005adc42849efe92f8030996fa466a518bd89b25084793121bbd1e1273e235b102e0dd0804c19a782dfe6200225173d7af2d75d2688f04c0b7455

Download Submit
C:\Windows\SysWOW64\Cdaile32.exe

Filesize
194KB

MD5
b5642576997d6066f26a7786eed7c0a7

SHA1
5fddaf2154e13ecd7d1d75e2e1193bea8ab8d723

SHA256
e488558c33d850242ba91831c7283a2fb81d4f15e1b66a5ef2b0c2452cb87659

SHA512
0037bcc81294800e12b42b6837ce41bc1cd8c955345b547cce872d34ee4ee056910389acf515ffc36f33a0d857f36fefb3f371bd8dc0cdf2339dd9ce539775e6

Download Submit
C:\Windows\SysWOW64\Cdebfago.exe

Filesize
194KB

MD5
fb255c2acea4e50eface8c533d6d115a

SHA1
8f5d99bb211ca619098654dd7cdd3ee5b2971dfd

SHA256
af5be9ee565a1c4aeaba5881a2f5f6b29b5a21796a3a6c5072222f05bceb3948

SHA512
58c297fe28da94faeedb6849cc86fd477969969ee9e11737085bda997c5123fdac1e7d9e6527d24b8c69467d5c475d3496598ac98863cdf6bcd653bf10c4c549

Download Submit
C:\Windows\SysWOW64\Cdhffg32.exe

Filesize
194KB

MD5
89477e5b960f6c32af5ef264eb02cd16

SHA1
82b9001e2f51a26b542614c39b845bfcf1011f45

SHA256
2751ddfc2a597d5d2ed5177180426f86b2c1d89c365cc877501121d5a2c17820

SHA512
e01f60932f8552ae7853e0eb17d017a48614b221f4062ea112f7ac33eda5054b5bd165f1bbd97d4aa7c3e5a07a18a7d140cbfaa18f25c9512a55ad999e9f2cc8

Download Submit
C:\Windows\SysWOW64\Cdjblf32.exe

Filesize
194KB

MD5
f89430916174e71e95272323c68398bf

SHA1
f87604744961f1e7c965b350c82740fe9535dec3

SHA256
ff3a10a476ec8213e08996d5e6bfc7956ec8a1740500d4d34b8e7128dc03b002

SHA512
07fb22f510e28ff0fcad3e052fdf4e4b83c4bf722335714480cd5667c4b3078206eb819959c293d74edf4fa0613dd3a47c7ada3aa9338306c71b6f378b8f7cd9

Download Submit
C:\Windows\SysWOW64\Cdlhgpag.exe

Filesize
194KB

MD5
85171d8f02e4c051a57545a1e0106787

SHA1
20b324a3b68d9ade8d2eb32824d48c5804e939c2

SHA256
e87a036c4bffb569e32db1a28f33ddbf3582df3835fa3212162bb51423d5a705

SHA512
b374af425acfdde748be7ee7647d5bff747f9293d87f2d0a7f7be4ae06beb0836e8a2fe1fd072cbb630532f6f17e5b395d5c38ea49047d6f7d4cf6bd9b868545

Download Submit
C:\Windows\SysWOW64\Cgklmacf.exe

Filesize
194KB

MD5
865c5ad2d650323ab9682cff324852d9

SHA1
e64a03afd0510b7df8ae2138fd2a1c1716861a80

SHA256
e3cf9bc8fc2e147014c977f214a8e3273e1afd885e32d75a64549266faaca3fb

SHA512
9e5e4df38a8ec8dfda5400e26fe4c7bbde87ce11cd98df31e50474d99a9d7d68331a2675c7423d47b03c15657a7fa1c039ab7906ef667c87cd2b2bfba87d2e61

Download Submit
C:\Windows\SysWOW64\Cgmhcaac.exe

Filesize
194KB

MD5
2afdef7fc9d1ea26c3b081071441e816

SHA1
684342c3d352cf10b4e1468cfd9ae913ae55dd88

SHA256
4e23d4b5de052b40c8c933b66220f6f45a837cb1ff3fb525f08db38591b32b88

SHA512
de1d678be2d9f0bdd077ba23cf7193f8dac49c7e5504faa3fc8b5c647c4253a8aa9736d8b423e2874dc2986c9dfcb50d159f23e91201d11d0fde07ca112aa5c5

Download Submit
C:\Windows\SysWOW64\Cibain32.exe

Filesize
194KB

MD5
e20b2821f2f62236cda20ca4921c5354

SHA1
2fb32391e26990191b9cc76a4882999daaa571db

SHA256
89afd76c3a386b6b4403ee7d655ecfc2f4f51d14dd729e2d151df8b9d3469888

SHA512
f41d70e6086bb726990f359aa65666bcc7c157496b79b7df25b9d86c692b74239e529ab3201c7d878f094f3f2b265973336d2bead56ae7f4f44c6df29715cbd3

Download Submit
C:\Windows\SysWOW64\Ciihjmcj.exe

Filesize
194KB

MD5
a4549d82c8d25deafd7507a664958e1c

SHA1
f9d20338d45a53fe9737e4f9f2e40f4aba7f336c

SHA256
52dbade727270663a3684fbeb144628bd8685f5d10e2d8851258f822296d6660

SHA512
3aa058644258d5951152fdf0c23053221f90e02848294171aa7ee12cdf6c418c7e649e2dbc997a88ceff8b09ba93a51c50b4091d5ece6f402650419207f77ab9

Download Submit
C:\Windows\SysWOW64\Ciknefmk.exe

Filesize
194KB

MD5
3fbd5c7e564ef82c2dc119d15dc5a5f5

SHA1
ce3c1758d3482bceeb4339854be6a22cd10bee56

SHA256
2e097fffe31d4a0503aab3bbe502fbac1e4fed2dba9d69bc84058007be6444b0

SHA512
b0f5d1654d19d6f6d8b8257fd9567a28beeb4c2b9620c93974e31fb38e96a3438b8de5863bd4b5e51071eac1a134a11b6f1c5adaad6b8da1407c8ed335d7fcf8

Download Submit
C:\Windows\SysWOW64\Ckbncapd.exe

Filesize
194KB

MD5
b50e481b151c11102e812aa93dd23868

SHA1
5d2b30ea770b83da22ceb87425b34bf454e765e8

SHA256
b7e1b1e9f4f9a1516c46e1ce31d2d89a9d6cf01f388db795fe2aa8fc3b5e2aa6

SHA512
75b4861c5b5e6ad3dd8b0648322500c8be2b8f108cb26ffbe5e305ce07e52df5938df493d0b15c935e67d258e8a1850a2f820ed493b8a7e6e6e82a055229029c

Download Submit
C:\Windows\SysWOW64\Cpacqg32.exe

Filesize
194KB

MD5
0a52e2671bd5a66747985112c47dacfc

SHA1
d5872d8d10cabd6c4c6d2092a2ee818124280682

SHA256
1f26c68dadedb2a3b80cb045460fb309dc2d14552a1a3a0c869123857e2084e6

SHA512
f0809e87a879fcce376ff8929dcddd837be635a546d82039493953866f240a2287f006f6357fc01a86cb8eddac868245429d06f76385a539217df0193db0e61c

Download Submit
C:\Windows\SysWOW64\Cplckbmc.exe

Filesize
194KB

MD5
560dec62964c5a8d4ca6dbf13c939e17

SHA1
d8be8a73fa60cb0247f495bf0caf58b6c1579895

SHA256
0ba75125df93326b3c32501970345e5eeeca319a8a8c091ac531157d07bc0aab

SHA512
b360c8b631445abf0d18f9b1a4edd03760e03cc64fbd503911670cdf845cd58ae575abfd2375877cdf3a6090b3f5d4218b1b4aa0db1b1562220e9b3fcb6ec5d4

Download Submit
C:\Windows\SysWOW64\Cpogkhnl.exe

Filesize
194KB

MD5
6d2f47a62ddf5e4a2c144333f6bca489

SHA1
2adda9299f45c13e0d54405bf9c977dbebf98d4d

SHA256
afd7b1a572205506fdd0af4b24fe11a373ac34e49c17ee62a55a252b99f8f3a5

SHA512
7ef7d9095d1ef29f7c84917759332283acbb43edf18741763b02171db42350991ca65877b2dc291f02a14852fd7b7fb1fb292b83340fa21fcaa382384ced8aa7

Download Submit
C:\Windows\SysWOW64\Daollh32.exe

Filesize
194KB

MD5
112715283db4f344689d7a1892e1912e

SHA1
56748de48909275bc230f5e082c3ee46bd5ddb4c

SHA256
5a48ba984a129c5c576e10f5a828d7fa603a529eece64c2a585daa31c13d3e75

SHA512
02d47cb9f454c6476359aeeb37f81e8a82a53460a3a5ef7969931fff21bac0cb9d6c16fa4fbc04103063666f18dfceb7c5b99bb19c0d6e731afe34f86364f741

Download Submit
C:\Windows\SysWOW64\Debnjgcp.exe

Filesize
194KB

MD5
8898fa9fc4eddee1831dd2cd6a41acb0

SHA1
da69c283efe9b47400fbf15e8e8d7182616b8c05

SHA256
4fb9e04fbce2efd4c978cc52f6b3bdfae7d4f26351d4cc5c43c6cdc89df774b5

SHA512
b99289555befce4385e438047e4702e2a066053183581f63f9fdb2112a93db0ddafb74f7905c15a7670a7ca6453a4a2efb4b2d3da3fa13c745db6d8ca1a02af3

Download Submit
C:\Windows\SysWOW64\Dgbanq32.exe

Filesize
194KB

MD5
c10cef777dd35226b0b0a9e6c9bce00f

SHA1
d782fbb18eac2c273f112d29049c779d32bba422

SHA256
1394b172e9586ef8db497493029c0a2250cc2255c81b5c4c996876ae05b9ac4f

SHA512
9ef33ffbc008a8dfaaf78e3b8080042439e39af9c1a4e47a5d5dc4cbc2c398893267adca7e3806be3a9b46f60aeb3e68b8278833e86587e37ed4eafcc23f2d50

Download Submit
C:\Windows\SysWOW64\Dggkipii.exe

Filesize
194KB

MD5
17e787c01a719bddba10e5f24306d6f6

SHA1
0cb07b576456f98265655c9298db88f66877b60a

SHA256
23b79d89f0d63a26c7f3b482b5568a250c3e0f573e0ae41cf3000feab3766db3

SHA512
7d5cc08cf2a8bf2eeacb1efaadbf07978c98b9259ea7639048eeba677a26f15215869026386b1f389c67cfbf611ed5af0f96535cc3dfe50afbc4e39994e07d8b

Download Submit
C:\Windows\SysWOW64\Dmjmekgn.exe

Filesize
194KB

MD5
cdbc742b5b219f8e6319e5f2ce45b131

SHA1
bd0292a4452d018ea58ecc9fd498b0b52fa6ae0c

SHA256
67c33859442a532ebd5aad5a9743c9ce307fa85af3c3d3dd8b74975854ba62bd

SHA512
48f2648d94a9636e4f535cf69de52c6cfe3999d8e1741251bfec50c49260b6b6665d48fb9e7850181fdda9e3a973991b0ac5bd20675ade1e2b0062d81beb142c

Download Submit
C:\Windows\SysWOW64\Dmnpfd32.exe

Filesize
194KB

MD5
f8178e6e1675872ee0c715264f8766c0

SHA1
a555ec3079188ecd783921530628735f65e949b8

SHA256
5ba884647652503b8268c6dd0529e2088615e8c18c0958beff1a249a0f9060df

SHA512
5451cc842b095433ee010b7e7bf45b1c43fd8433b11bdf8565f3f83dbd41e4465363ac07a9fa2ee8e32a37ca4e976f56efe2ef16a10fd61f1f96059323f659a9

Download Submit
C:\Windows\SysWOW64\Dnngpj32.exe

Filesize
194KB

MD5
77ca4e7a75a412daffc994840c95286a

SHA1
d1b7aedef434fd0d991fc63c2e041f64ddd7351a

SHA256
259a8af6c55af6a8344c4222e9c9f636bfcc55d90e9dc7ebfb10b88bd9bf8001

SHA512
154ab79f0d7a3f21edfbc657e98afbfdb8f6ad6264ec6ccdad18dd338d92ecdabd16573a5aeae1b084c9dfcd37f29c6988e50f2938aee00f63f2630192a1943c

Download Submit
C:\Windows\SysWOW64\Ecgodpgb.exe

Filesize
194KB

MD5
70e4dfeeeaadd8cb80d340ef2e1b2f57

SHA1
b6335c83264d2b979fa78f9a258954142ddb3733

SHA256
571b629809484739dd4ffb6dd9da5a24f1f6bf036e0ff9abb12b74a7b41d064e

SHA512
a6ad522a2030d3c1fe78f47e014a7918c34f81e491f4c5791704856692ebf7cca14b51a9b6e6d5fc11a4ac9a8dc0500312cee5ed5f3550b69d0d4e2a4c1c232d

Download Submit
C:\Windows\SysWOW64\Egegjn32.exe

Filesize
194KB

MD5
4bae78d65ecc85e20ed11a105d16d0d6

SHA1
56c1ec66168ae9af2eff588d857a519c2655bb70

SHA256
b6e0caf67fda6cc19f8870ca861315972d888a1e2604682bb443dec82f196289

SHA512
1e96b69be8aaf1c1a6c1f120addd551210fcb2419554edc61a01b34e9b13debcff5d308cc0418c88cdf8cef1ccb960969d5ba0f203a14478af165850d170fdc3

Download Submit
C:\Windows\SysWOW64\Fjocbhbo.exe

Filesize
194KB

MD5
8827195b037c773339eeae22222bccb4

SHA1
f1399f52b903f4ae6c55146a43090e60ab0bc9e7

SHA256
3ea342fe73cf42989c4e45b7fed6e0d5a9a9dead4f16fa40ff7c000a25f968bb

SHA512
70e6ad078a01d116ac7a2bc715c89f133919125f8854e6bf4f54143543456971ed023b3a5dc306da8b320c6d15a58b628c4c107190da0df2f581957a7fced038

Download Submit
C:\Windows\SysWOW64\Gggmgk32.exe

Filesize
194KB

MD5
f5d39544f6d45184f00b3b6cb0bb6eb3

SHA1
b700b54f4dd7d975a926ba96a76ab13d24de9186

SHA256
70ee7e0566200e369dafc318cac3c8aa057e3213abaf3752a942e3904a48407f

SHA512
a9b7db2fa40743af3a6758d267c81334548cbeb217634fba4e16f118e79cb4313d58252e35142c2060244a08335600223e3fca69533f5af8fd9afc066d1021bb

Download Submit
C:\Windows\SysWOW64\Gqbneq32.exe

Filesize
194KB

MD5
3ec320f61bdd03edbf345799fa78e014

SHA1
e11f58af1f9f2337d92254342b67289b798a980c

SHA256
e226f1da2b812f821611fe4c3928a9d6dcfd73632def8ca8ad3a5845f7e9d049

SHA512
12be6e2c2c1c570333b96bfae8db13fa7beeaef1e79794367b83582f88ab0aefc3642042ed28bf74c20e3b27a1c631bdf9c898245e931ca5d16c7069a8bbe507

Download Submit
C:\Windows\SysWOW64\Halaloif.exe

Filesize
194KB

MD5
30d0b7acf9e1f8a9287e0242e7c0ebd1

SHA1
74370da7cad3fe922625fe3448dfca03deecddcf

SHA256
842f9590b4e633aba6b8a5c6462c490a422c50bee3b28d7762db4753b7e3d10a

SHA512
e9ec14c03b480e610f60c03edd52baccda8e7acbe1c36369728bc10d0515eb8b969686b0e8d892f3276f2cf1f89a43278c0d46a5878aad2fb85ec682cc4fbfe6

Download Submit
C:\Windows\SysWOW64\Hjolie32.exe

Filesize
194KB

MD5
ee4daf7a302c50886f9402d21991d4c5

SHA1
6c7f35055d3a0ec2452a059fe733ee767614e34d

SHA256
d81204dc029113f305554dccd5743c979fe74030646f148e2b66eb7502162593

SHA512
cd1f7b3d58340d2705e04f5d1d867b909e15b7af4f0132b4a60859f8517fe2e495dfcb5dc0fa2ce9a2f8ea380922b234e949f6c473f68e9ad6986942ea573920

Download Submit
C:\Windows\SysWOW64\Jbppgona.exe

Filesize
194KB

MD5
9706097160d072ed2298e759320db838

SHA1
19b1b86a878e9c739331d16e231eaeaa415bedd5

SHA256
00802c08c3018dbb16c1a2ccedff59329740026d743dacc355b77634a9d77514

SHA512
a941110ad3343bbedbbb67af170c54a704b38eede000d1e0e5893409f47a567333ac6f89ad046d6e28392164ff66fcfcc0efdb09fbcae86cce00a8d74b11acaf

Download Submit
C:\Windows\SysWOW64\Kopcbo32.exe

Filesize
194KB

MD5
5d2655b1c4b3925655096fd4d7366b39

SHA1
26c6cdb8757b864483fc4845da9ca632b3a0c3ba

SHA256
7c2d5aade82506b5c4d5987dfeb04a72d868d1d994a1a98dbb61ea72debe307b

SHA512
88502c3bf9bd864d54ddee91f8f2e36cd22610805aeff1ce7d8bca0a9dfb9b9f52c3e80d6e362cc67bd28a3a0f3f50352c4ecb7c6fb815ddbc02c656fee246f0

Download Submit
C:\Windows\SysWOW64\Llkjmb32.exe

Filesize
194KB

MD5
e6fec92a6d8aa3c7967a083e2aec938f

SHA1
bae3519f01aae40f825e714dc25a85ca188797f1

SHA256
13910451cd712dffa464b196c27fe7b86df5793e43f97f9284c0150305ecfa39

SHA512
3dc4b6189d4077a01c8ad1d9f81a87e047162f57044afaa77aa2547eb655f13ea4a393d48f5d86c7f2fc1e428399649205a0d06ef015540fb9529ff58a9e3201

Download Submit
C:\Windows\SysWOW64\Llngbabj.exe

Filesize
194KB

MD5
6cbf46ef4d97009cf00c79675095bc3d

SHA1
484bd310ead1e39eab974a682b1f835b9aa08e5d

SHA256
e661b17a7a87f99d83ac917a51339c26bc57cb34e278db39483f5a210dff6432

SHA512
c7a5e11e1c55908c5b5f8a3d440fc3d71f7462175c3186aebbd2216eeb346d062299e150a5a2cb6ac128d6599cf01e7c2d20659da8f9a6d179df1472a461f020

Download Submit
C:\Windows\SysWOW64\Loopdmpk.exe

Filesize
194KB

MD5
7180b926546b3db1674eb724dadf0bca

SHA1
198a0b81655bc2939126c85dad935eb317a3afdf

SHA256
e8734f64869e0e0f4a0928556049682af5ff2940280df46715320d413ffb799a

SHA512
d288e148edc585e4fd2b47ed4067336fc9bfd88e570d55893542f1adb8a45626adcf914c7c2a10be5be1be0cbf68e72eb69343709a7e0e050e7c0b7c16beae1a

Download Submit
C:\Windows\SysWOW64\Mahklf32.exe

Filesize
194KB

MD5
ed0be8154034903379ac3d17d8d92b96

SHA1
4c9d2355eac07a2f023203b8bb4e1685bede9d0a

SHA256
2e8ab668ad6d931af728ca5a01b263556232ab4d25e0bcd03e21897a0bb82a70

SHA512
2958635012ff47f47ddfd32c86cae0e9697f7ec50d8d18a82788830ee73a291b33bd3d61fdef3cd45468f4479585261b6ec7aa7f2e6f2635b0c6de65cd8d28c2

Download Submit
C:\Windows\SysWOW64\Maoifh32.exe

Filesize
194KB

MD5
02300f687f66303c2956f59ba83fe1ad

SHA1
0349a403afe47f97e3d967e9cf4dcf2c7e4189c3

SHA256
f456405d65940594068c5d84f4c3238fc44a8168a6b627bd009cb912db999425

SHA512
f76ae2026c862073e268ac871e74162954211b246f0ba2f59a5d2e0b0dff98831ce1582c896bba6c510703e1d8e073bc9490029447e97129f3d494cfc4f413d6

Download Submit
C:\Windows\SysWOW64\Mhknhabf.exe

Filesize
194KB

MD5
94e50389d6db1b0f95d71a300a2f69fd

SHA1
b48733fb699fe93c5676417bd098a8426f7ec9a4

SHA256
c0e1102726c7c81931bab0b63ca808c9a636c0c8a6678db97cdb76658641ba8b

SHA512
fdd6f427126249209f31fceea931b72d8f80a51fac824fce8e9aa955b98a6bf983575c08e4b0a33a5050f04b6e932e674101c2a5185de2dfd6995ef6b5fb83bb

Download Submit
C:\Windows\SysWOW64\Nbbnbemf.exe

Filesize
194KB

MD5
ea8ea564f4cb0decdb40235a28166347

SHA1
1b3ed73334796e7fe3ed1ae867c0ec0da0677bf3

SHA256
eedecbbbd3e3d40731e534a278f686bd4d2e809d61f65cfa3a2d255a105c3551

SHA512
778e7e5901bd82346703e77a675553be685cbefb7176d4c9642c7bb046337b5a5cbbd51827da87198c014cf13dd9caf07015ea2e1343d1f87b76e5a88c0d4e48

Download Submit
C:\Windows\SysWOW64\Nheqnpjk.exe

Filesize
194KB

MD5
a5f3dfc94ffa0c68d123fdddbe037a92

SHA1
83cebd303a7867282ebb1fcf3a97243043b6da7f

SHA256
2ba153a5ce282c5a69ea22cceebe897ba423260aae3c4a87bf64f7642bf400ac

SHA512
e2720a5b71db9541aec3e842282a07efba3afa5b522f03a67980ee20e9dc1d8de163cd36acd1af05549ff0d4f9bbf757ed9e274f5ed180379228adccddf3a1e6

Download Submit
C:\Windows\SysWOW64\Nkeipk32.exe

Filesize
194KB

MD5
33af3cceb23118fd66387164e9670372

SHA1
0eb75ede2ab2ed7570bc535e849cdb755765e1ba

SHA256
72e9473ec84957906a501f0dec1ebc1cccd5f5df3b7dbd453d3f02e3d345ca26

SHA512
8878f06ea5fcc2a5ed19d957e3ba47f4b39a6fc7aee68d65077e89b41a910a7f7f1201e11e86ca72d3b492e160ca65d1235d09f2b100447d17a7da5d5a0003d8

Download Submit
C:\Windows\SysWOW64\Ofgmib32.exe

Filesize
194KB

MD5
d1fc7ddc8f1a01fa1be8a665fca3c678

SHA1
b5b6c2d597de3d068c921d0649732844379f692e

SHA256
efd87032cb9b67a75bc55bb1b1a1ef4d6721742775072af42d84ddec8e666b5b

SHA512
5076dc0cc26e4acff06607d0aa164aaeaf2155347ca34efa1f03b9f4efa4775cf89d0c61b7e9478e81fcbce200a815fc6c064ce6fdd7d70948fe20fa420edc6f

Download Submit
C:\Windows\SysWOW64\Ohqpjo32.exe

Filesize
194KB

MD5
b356f38b4f200dd5e0664a0f08567790

SHA1
4e88facf1963a5776f763f4f1c0df1c08255bb44

SHA256
4977e7eabfe579902cc320158395834968171a538f7282bbb1956492b9276366

SHA512
15dbe5ed262a9e1ac7619c934ec13d7b2dcea8185bd9ec32a2200c88981249de398b7e577772f2606965de80127a926fb6450303226069a682dd6286a1ea4fdc

Download Submit
C:\Windows\SysWOW64\Oloipmfd.exe

Filesize
192KB

MD5
7a991db37f0cb4416fc58669bae4a107

SHA1
3e5b72174ce348b22afc30868793dbde0f256f4e

SHA256
5c497c3410397f906e8addd91a2f7c5eff0f951a5d0e8386f5c0b1c2015e48f9

SHA512
b56d83f0cd4cb79461d2058c3768fab74c0da728c7793aa1a84763d2cbdaf0515e756ce584446809a1c17ab0c781d3e5ec47ae22ec58464bee03195f8bb192eb

Download Submit
C:\Windows\SysWOW64\Pdngpo32.exe

Filesize
194KB

MD5
80b8819596d24cf1b64f116ef336a811

SHA1
b9de561260d91f30e9d4526a6bf1a02e4876f3a7

SHA256
5fbfd7d45588dbea8ad67183704dcd99701727bf76f369ce592951459f278418

SHA512
6674889ba378a8b2b52490ac3b532e2fbec840ccfef2ad5777f1473324ef50f006f531ccaa37f3e54999a9596bbf2a826f67f78005800a2a338ab024c52ff1bf

Download Submit
C:\Windows\SysWOW64\Pkklbh32.exe

Filesize
194KB

MD5
309cd8ca2c447d42ab1c8f1ea2daf8ae

SHA1
9bd1bc757b45474fe4a51d3a0dfd13bb66908c1b

SHA256
66e30cb672acb39ee1d173cf851da3d03f2df564f4654adaea10cb12be91d650

SHA512
80e1b15446c219f6bf6d9418b961ee7cfaa038b6e88dd220c3feba444e185b10ba2fe0282d9c23e0aa670f4ac3bd451ff23e92cf6f0c71f0c81c4e36bc5dc5f4

Download Submit
C:\Windows\SysWOW64\Pmbegqjk.exe

Filesize
194KB

MD5
ab0b821738638f3988cdc725fd0e8133

SHA1
321e25d9e3a71991bdc247ee614eb217254f9349

SHA256
4c99c7d2bf7071861f2a0d0dd9608540dc36d4f7aa9dffc8fc36891a848450c3

SHA512
99e4049d94124f1fd6fa790ee272928b1d5790d3de0ab278688332d4284477efe7f4b1d46b9c56f5c9687eb8edcadf24c37907c84ce0f746975bc06ba7049d16

Download Submit
C:\Windows\SysWOW64\Pmmeak32.exe

Filesize
194KB

MD5
860cf6a315d0088a6692a13873b13e7e

SHA1
304c987ee4afe33bc956efe0618930cffd2baa5f

SHA256
c18b00f83ab7c1eac87067d3eca9d1c83bcf9e7ce4a753f66da901d7b858a6d1

SHA512
893b83cdea1a8a89f85d8dfbccc3b766f1aaa7a269c9eeead4921aa908fc9ae0e5abacb1e341ab1fe8295d5b8faacaa74bf07e89b4b038a57f8a24ab73325e24

Download Submit
C:\Windows\SysWOW64\Qelcamcj.exe

Filesize
194KB

MD5
77f4d2775ae063623a2977f4d393f3f6

SHA1
7dcf05b7e4d4442cfc4e86fa58dbb77fb80e06fa

SHA256
c2e648829dde7d67da7099f6218ae6bab6d85615a1b555964f24486f2d2e521e

SHA512
12ae27d4da09708abc15e5ac5bf8c3a99d43b9bbabfef648553f97f50b50f668e75c3316f6c54a397d3b7142dd125dc50d8aaabc712639c2036b111e2cdbb1ae

Download Submit
C:\Windows\SysWOW64\Qiiflaoo.exe

Filesize
194KB

MD5
47830d18cce3f7c54f9f1277a8292755

SHA1
41682925bdbbc2696c01ec208b8bc1158ac37a65

SHA256
163faded95a25919a0deb14466baa14ce69790fc7b2ca62fe8123935c908266a

SHA512
71e8bd64fce3ae1dda2512996c962830f211ff56f4f3d7d8224bec9dca4559d30e73ab44ab1275fcf4f122ab3e9bde8cc00f135a7cdc46c7dde481b2b69e8348

Download Submit
C:\Windows\SysWOW64\Qjhbfd32.exe

Filesize
194KB

MD5
4ea327c435a5f80b1c311d5747557502

SHA1
de5bd2023aaabdbe6a943fed57404100ac150086

SHA256
13c935ef978ef1eba80f0ba4b94ce33b15f85699e86c2bd12b1a8eba874155f7

SHA512
e24e042fad9361cf9a4c1ad6aa94618be221e2c07f8911b24e4e9e244062d3ef78e53173632041e16ef6aa9ef81bc86d2460e4b7493515e20ab8a1395dc3fd73

Download Submit
C:\Windows\SysWOW64\Qpbnhl32.exe

Filesize
194KB

MD5
323a4cef967da2fe3372f964a44d92fd

SHA1
21cddfd5606f1534645d897769e1c94ccd71ef31

SHA256
786028fea2f31aa709e72d1b5cfd52a75a3ba3588f67bdcedea782a8aa0c43f5

SHA512
0eefd34df735a5e8c660c764ddd54c7386ed27c0a4956115a168feffc1f2d86885b63723906cc9ff3d6210dc30294f31210234e07eab898a144def0ddb72c9d0

Download Submit
memory/8-173-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/116-572-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/116-32-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/212-247-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/224-364-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/436-56-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/436-593-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/856-436-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/888-96-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1116-352-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1148-460-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1172-298-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1400-103-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1404-286-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1492-544-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1492-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1500-304-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1520-39-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1520-579-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1580-412-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1636-406-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1652-316-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1712-484-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1808-514-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1820-224-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1872-430-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2108-442-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2180-231-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2260-111-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2380-448-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2392-128-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2408-478-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2464-340-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2484-466-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2492-292-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2580-459-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2700-334-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2852-370-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2928-424-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3124-472-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3156-262-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3208-378-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3264-418-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3304-508-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3308-502-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3328-200-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3352-256-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3356-280-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3528-175-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3592-362-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3764-24-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3764-565-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3860-186-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3948-346-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3952-136-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4020-208-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4216-192-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4228-274-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4240-586-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4240-48-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4276-328-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4280-400-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4312-216-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4332-120-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4360-239-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4372-394-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4412-160-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4464-551-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4464-7-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4472-268-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4500-152-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4548-143-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4664-322-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4668-520-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4692-87-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4820-494-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4844-79-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4860-15-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4860-558-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4876-64-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-310-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4932-382-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5032-388-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5104-496-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5108-71-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5140-526-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5188-532-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5232-538-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5272-545-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5320-552-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5336-1613-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5364-559-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5408-566-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5452-573-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5496-580-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5540-587-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5592-594-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6324-1472-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/6432-1471-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads