berbew | 4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017.exe
Size

163KB
MD5

ae860eadf393e4184d1d3b4c470b4308
SHA1

6976e9a64d1bfdd3b9fce414c6c62acf0d9a0f83
SHA256

4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017
SHA512

dcf07a6464509dac8a793d623ef0c838bd969e32dfc6fea54590435806e71dddb526837e2a403ec4b7c7c6a1ba0a0242d3cd086bdf6b795fbf34dafceb44f315
SSDEEP

1536:PSC4Ya6tN6CE7vcsiULJb1TIeAlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:qL6tw37CoxTxAltOrWKDBr+yJb

Score

10^/10

berbew gozi backdoor banker discovery isfb persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dedkdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofbch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olcbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipbdmaah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpjlklok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gicinj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdeoemeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifefimom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iihkpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbdolh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimekgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elbmlmml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmannhhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acnlgp32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Executes dropped EXE 64 IoCs

pid	Process
4692	Dedkdcie.exe
1536	Ekacmjgl.exe
1472	Ehedfo32.exe
212	Eamhodmf.exe
4460	Elbmlmml.exe
5008	Ecmeig32.exe
2836	Ehimanbq.exe
4916	Ecoangbg.exe
4868	Ehljfnpn.exe
3528	Eofbch32.exe
4656	Ehnglm32.exe
1604	Fkmchi32.exe
4944	Febgea32.exe
756	Fhqcam32.exe
4404	Fcfhof32.exe
4064	Flnlhk32.exe
880	Fchddejl.exe
1796	Fdialn32.exe
4732	Fkciihgg.exe
2368	Ffimfqgm.exe
2636	Flceckoj.exe
2188	Ffkjlp32.exe
2420	Glebhjlg.exe
4668	Gbbkaako.exe
1052	Gofkje32.exe
4664	Gdcdbl32.exe
4496	Gkmlofol.exe
1124	Gfbploob.exe
208	Gokdeeec.exe
884	Gbiaapdf.exe
1612	Gicinj32.exe
4744	Gomakdcp.exe
1468	Gdjjckag.exe
1964	Hmabdibj.exe
3224	Hckjacjg.exe
592	Helfik32.exe
2192	Hkfoeega.exe
1288	Hbpgbo32.exe
2740	Heocnk32.exe
4628	Hodgkc32.exe
1524	Hbbdholl.exe
428	Hmhhehlb.exe
3012	Hofdacke.exe
4420	Hbeqmoji.exe
2988	Hmjdjgjo.exe
3416	Hoiafcic.exe
4544	Hfcicmqp.exe
5112	Iefioj32.exe
3908	Ipknlb32.exe
4716	Ifefimom.exe
4808	Iicbehnq.exe
5032	Iblfnn32.exe
3576	Iifokh32.exe
4516	Imakkfdg.exe
4128	Ibnccmbo.exe
3572	Iihkpg32.exe
2708	Ipbdmaah.exe
4708	Icplcpgo.exe
4612	Jimekgff.exe
2796	Jcbihpel.exe
1128	Jfaedkdp.exe
1636	Jlnnmb32.exe
4224	Jfcbjk32.exe
4592	Jmmjgejj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Hbpgbo32.exe	Hkfoeega.exe
File created	C:\Windows\SysWOW64\Lebkhc32.exe	Lbdolh32.exe
File created	C:\Windows\SysWOW64\Aepefb32.exe	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Ngpccdlj.exe	Ndaggimg.exe
File opened for modification	C:\Windows\SysWOW64\Ndcdmikd.exe	Nnjlpo32.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Ajckij32.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Fhqcam32.exe	Febgea32.exe
File opened for modification	C:\Windows\SysWOW64\Hbbdholl.exe	Hodgkc32.exe
File opened for modification	C:\Windows\SysWOW64\Iihkpg32.exe	Ibnccmbo.exe
File created	C:\Windows\SysWOW64\Phkjck32.dll	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Qmkadgpo.exe	Qnhahj32.exe
File opened for modification	C:\Windows\SysWOW64\Qfcfml32.exe	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Ampkof32.exe	Ajanck32.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File opened for modification	C:\Windows\SysWOW64\Fdialn32.exe	Fchddejl.exe
File created	C:\Windows\SysWOW64\Gpiaib32.dll	Gbbkaako.exe
File opened for modification	C:\Windows\SysWOW64\Gicinj32.exe	Gbiaapdf.exe
File created	C:\Windows\SysWOW64\Gcgnkd32.dll	Njciko32.exe
File created	C:\Windows\SysWOW64\Qnjnnj32.exe	Qfcfml32.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Hbpgbo32.exe	Hkfoeega.exe
File opened for modification	C:\Windows\SysWOW64\Lpcfkm32.exe	Lenamdem.exe
File created	C:\Windows\SysWOW64\Mpjlklok.exe	Mlopkm32.exe
File opened for modification	C:\Windows\SysWOW64\Kdeoemeg.exe	Kedoge32.exe
File opened for modification	C:\Windows\SysWOW64\Lenamdem.exe	Lboeaifi.exe
File opened for modification	C:\Windows\SysWOW64\Opdghh32.exe	Ojjolnaq.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Ajckij32.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bjddphlq.exe
File opened for modification	C:\Windows\SysWOW64\Iefioj32.exe	Hfcicmqp.exe
File created	C:\Windows\SysWOW64\Jfcbjk32.exe	Jlnnmb32.exe
File created	C:\Windows\SysWOW64\Ndqgbjkm.dll	Jblpek32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Kpeiioac.exe	Kikame32.exe
File created	C:\Windows\SysWOW64\Lpcfkm32.exe	Lenamdem.exe
File created	C:\Windows\SysWOW64\Gjeieojj.dll	Lbdolh32.exe
File opened for modification	C:\Windows\SysWOW64\Fcfhof32.exe	Fhqcam32.exe
File created	C:\Windows\SysWOW64\Iicbehnq.exe	Ifefimom.exe
File created	C:\Windows\SysWOW64\Ghkmacoj.dll	Jehokgge.exe
File created	C:\Windows\SysWOW64\Ogkcpbam.exe	Ocpgod32.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Cibifp32.dll	Hoiafcic.exe
File created	C:\Windows\SysWOW64\Lmppcbjd.exe	Lffhfh32.exe
File opened for modification	C:\Windows\SysWOW64\Mlopkm32.exe	Medgncoe.exe
File opened for modification	C:\Windows\SysWOW64\Kpeiioac.exe	Kikame32.exe
File created	C:\Windows\SysWOW64\Lbmhlihl.exe	Lmppcbjd.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Acbmpm32.dll	Ecmeig32.exe
File created	C:\Windows\SysWOW64\Jgbcdnbb.dll	Gbiaapdf.exe
File created	C:\Windows\SysWOW64\Adopjh32.dll	Ibnccmbo.exe
File opened for modification	C:\Windows\SysWOW64\Hmhhehlb.exe	Hbbdholl.exe
File created	C:\Windows\SysWOW64\Bhaomhld.dll	Kpbmco32.exe
File opened for modification	C:\Windows\SysWOW64\Ampkof32.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Qoqbfpfe.dll	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Amddjegd.exe	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Pjkolmml.dll	Fchddejl.exe
File opened for modification	C:\Windows\SysWOW64\Fkciihgg.exe	Fdialn32.exe
File created	C:\Windows\SysWOW64\Chdfonda.dll	Gdjjckag.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7660	7512	WerFault.exe	320

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmppcbjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdcdbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iblfnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnakhkol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecoangbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flceckoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkmlofol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iihkpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipbdmaah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fchddejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jimekgff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nngokoej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgbfocc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkciihgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbaipkbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmjdjgjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipknlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfoafi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqdqof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dedkdcie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gokdeeec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfcbjk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpebpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojjolnaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfcfml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nloiakho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoahijl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmkadgpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lboeaifi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcmabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmannhhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imakkfdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kimnbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lekehdgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgmngglp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mchhggno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menjdbgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngbpidjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmmjgejj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcgbco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffimfqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdeoemeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbaipkbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flfelggh.dll"	Mdhdajea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfjnoma.dll"	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehnglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gomakdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Baicac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhclbphg.dll"	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phaedfje.dll"	Jimekgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbaipkbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjdgn32.dll"	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdialn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mibpda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmbfpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkenegog.dll"	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjqkei32.dll"	Iicbehnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qamhhedg.dll"	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcnha32.dll"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qddina32.dll"	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gokgpogl.dll"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papbpdoi.dll"	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Collmj32.dll"	Ehljfnpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckhindhb.dll"	Flceckoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmpgldhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npcoakfp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 4692	2668	4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017.exe	84
PID 2668 wrote to memory of 4692	2668	4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017.exe	84
PID 2668 wrote to memory of 4692	2668	4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017.exe	84
PID 4692 wrote to memory of 1536	4692	Dedkdcie.exe	85
PID 4692 wrote to memory of 1536	4692	Dedkdcie.exe	85
PID 4692 wrote to memory of 1536	4692	Dedkdcie.exe	85
PID 1536 wrote to memory of 1472	1536	Ekacmjgl.exe	86
PID 1536 wrote to memory of 1472	1536	Ekacmjgl.exe	86
PID 1536 wrote to memory of 1472	1536	Ekacmjgl.exe	86
PID 1472 wrote to memory of 212	1472	Ehedfo32.exe	87
PID 1472 wrote to memory of 212	1472	Ehedfo32.exe	87
PID 1472 wrote to memory of 212	1472	Ehedfo32.exe	87
PID 212 wrote to memory of 4460	212	Eamhodmf.exe	88
PID 212 wrote to memory of 4460	212	Eamhodmf.exe	88
PID 212 wrote to memory of 4460	212	Eamhodmf.exe	88
PID 4460 wrote to memory of 5008	4460	Elbmlmml.exe	89
PID 4460 wrote to memory of 5008	4460	Elbmlmml.exe	89
PID 4460 wrote to memory of 5008	4460	Elbmlmml.exe	89
PID 5008 wrote to memory of 2836	5008	Ecmeig32.exe	90
PID 5008 wrote to memory of 2836	5008	Ecmeig32.exe	90
PID 5008 wrote to memory of 2836	5008	Ecmeig32.exe	90
PID 2836 wrote to memory of 4916	2836	Ehimanbq.exe	91
PID 2836 wrote to memory of 4916	2836	Ehimanbq.exe	91
PID 2836 wrote to memory of 4916	2836	Ehimanbq.exe	91
PID 4916 wrote to memory of 4868	4916	Ecoangbg.exe	92
PID 4916 wrote to memory of 4868	4916	Ecoangbg.exe	92
PID 4916 wrote to memory of 4868	4916	Ecoangbg.exe	92
PID 4868 wrote to memory of 3528	4868	Ehljfnpn.exe	93
PID 4868 wrote to memory of 3528	4868	Ehljfnpn.exe	93
PID 4868 wrote to memory of 3528	4868	Ehljfnpn.exe	93
PID 3528 wrote to memory of 4656	3528	Eofbch32.exe	94
PID 3528 wrote to memory of 4656	3528	Eofbch32.exe	94
PID 3528 wrote to memory of 4656	3528	Eofbch32.exe	94
PID 4656 wrote to memory of 1604	4656	Ehnglm32.exe	95
PID 4656 wrote to memory of 1604	4656	Ehnglm32.exe	95
PID 4656 wrote to memory of 1604	4656	Ehnglm32.exe	95
PID 1604 wrote to memory of 4944	1604	Fkmchi32.exe	97
PID 1604 wrote to memory of 4944	1604	Fkmchi32.exe	97
PID 1604 wrote to memory of 4944	1604	Fkmchi32.exe	97
PID 4944 wrote to memory of 756	4944	Febgea32.exe	98
PID 4944 wrote to memory of 756	4944	Febgea32.exe	98
PID 4944 wrote to memory of 756	4944	Febgea32.exe	98
PID 756 wrote to memory of 4404	756	Fhqcam32.exe	99
PID 756 wrote to memory of 4404	756	Fhqcam32.exe	99
PID 756 wrote to memory of 4404	756	Fhqcam32.exe	99
PID 4404 wrote to memory of 4064	4404	Fcfhof32.exe	100
PID 4404 wrote to memory of 4064	4404	Fcfhof32.exe	100
PID 4404 wrote to memory of 4064	4404	Fcfhof32.exe	100
PID 4064 wrote to memory of 880	4064	Flnlhk32.exe	101
PID 4064 wrote to memory of 880	4064	Flnlhk32.exe	101
PID 4064 wrote to memory of 880	4064	Flnlhk32.exe	101
PID 880 wrote to memory of 1796	880	Fchddejl.exe	102
PID 880 wrote to memory of 1796	880	Fchddejl.exe	102
PID 880 wrote to memory of 1796	880	Fchddejl.exe	102
PID 1796 wrote to memory of 4732	1796	Fdialn32.exe	104
PID 1796 wrote to memory of 4732	1796	Fdialn32.exe	104
PID 1796 wrote to memory of 4732	1796	Fdialn32.exe	104
PID 4732 wrote to memory of 2368	4732	Fkciihgg.exe	105
PID 4732 wrote to memory of 2368	4732	Fkciihgg.exe	105
PID 4732 wrote to memory of 2368	4732	Fkciihgg.exe	105
PID 2368 wrote to memory of 2636	2368	Ffimfqgm.exe	106
PID 2368 wrote to memory of 2636	2368	Ffimfqgm.exe	106
PID 2368 wrote to memory of 2636	2368	Ffimfqgm.exe	106
PID 2636 wrote to memory of 2188	2636	Flceckoj.exe	107

C:\Users\Admin\AppData\Local\Temp\4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017.exe
"C:\Users\Admin\AppData\Local\Temp\4641a4d885f9b3f96808cbc10e24e7a81d2ebca9e80be4c9300f5d986d108017.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\Dedkdcie.exe
  C:\Windows\system32\Dedkdcie.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\Ekacmjgl.exe
    C:\Windows\system32\Ekacmjgl.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\SysWOW64\Ehedfo32.exe
      C:\Windows\system32\Ehedfo32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:212
      - C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2188
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2420
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4668
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        26⤵
        Executes dropped EXE
        
        PID:1052
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        29⤵
        Executes dropped EXE
        
        PID:1124
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:208
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:884
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4744
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1468
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        35⤵
        Executes dropped EXE
        
        PID:1964
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        36⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        37⤵
        Executes dropped EXE
        
        PID:592
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2192
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        39⤵
        Executes dropped EXE
        
        PID:1288
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2740
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4628
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1524
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        43⤵
        Executes dropped EXE
        
        PID:428
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3012
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        45⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3416
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4544
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        49⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4716
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        54⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4128
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3572
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        59⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4612
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        62⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1636
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        66⤵
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        68⤵
        Modifies registry class
        
        PID:2196
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        70⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        71⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1756
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        73⤵
        Drops file in System32 directory
        
        PID:1944
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        74⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        75⤵
        Drops file in System32 directory
        
        PID:3356
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        76⤵
        Modifies registry class
        
        PID:4728
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:1072
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        79⤵
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        80⤵
        Drops file in System32 directory
        
        PID:4776
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        82⤵
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        83⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        86⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        88⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        89⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        90⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        93⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        94⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        97⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        98⤵
        Drops file in System32 directory
        
        PID:5780
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        99⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        100⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        101⤵
        Drops file in System32 directory
        
        PID:5908
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        102⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        105⤵
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        106⤵
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        107⤵
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        108⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        109⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        110⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        112⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        113⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        114⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        117⤵
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        118⤵
        Modifies registry class
        
        PID:1872
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        120⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        125⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        126⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        127⤵
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        129⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        132⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        134⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        136⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        138⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        139⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        141⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        142⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        143⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        144⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6492
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6536
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        149⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        150⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        152⤵
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        153⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        155⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        156⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        157⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        158⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        159⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7112
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        164⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        165⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        166⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        167⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6604
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6668
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        171⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6840
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        178⤵
        Drops file in System32 directory
        
        PID:6248
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        181⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6708
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        183⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        184⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        187⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6640
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        190⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        194⤵
        Drops file in System32 directory
        
        PID:6816
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        195⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7064
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6524
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        197⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        198⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6376
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        200⤵
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        201⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        202⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        203⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:7344
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        205⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7424
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        208⤵
        Drops file in System32 directory
        
        PID:7504
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        210⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:7624
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:7664
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        213⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7744
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        215⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        216⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        217⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        218⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7952
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        220⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7992
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8032
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8072
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        225⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        226⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7296
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:7368
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        229⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7444
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        230⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7512 -s 404
        231⤵
        Program crash
        
        PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7512 -ip 7512
1⤵
PID:7612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
163KB

MD5
065153e004277839011e3014ff3c921d

SHA1
bcff92f3a71f055296ba77afaf630008c24a908f

SHA256
0321fc5d80448f101df15d7c242881e41fc2e586986e501dcd317a1fb7becc80

SHA512
3ffb77f342ba9cc11d89e7b26ba1dcaa40e64e978b1b9cb9ff12f0ef44039cfd1c235626cb14fe545d9fe7ac6bf271775bc9a443d2da673c48028c1e6d08635f

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
163KB

MD5
f31aee9712136d90488ece8f6594d9a6

SHA1
46790bbc380ba1960a84064bdd0d5f159f24538b

SHA256
13a5542e15b5131aa6b4c8ad21023ae5a609d7e8ea27bf60004856ea75a0a211

SHA512
500beb844bd155ea4c3e8d844692f4190486418ad530454144f80ff8667709478ab3e5f9c63b0d7f3b4fef58a2e922a0064f4b415db994ab6a6c4fcfed7053ff

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
163KB

MD5
61cf7fa39f0818f148968548100dceca

SHA1
99b912589aff8296a3b1f774c1d77c093e741faa

SHA256
5f2c45f0d4590c03c63f150fa8f1e127451ce04a826d13d04d59dd2e91b61584

SHA512
eb377a2933ee81f13e5f4ef687a991e3d6623c1989c021b513775a9a2173d3925f8a8fb4f7cbc673c2a5d60a5990893790cff479d1960611f5e491ea2ce4552d

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
163KB

MD5
4984a56255b501ece94dadbd1bd11a69

SHA1
dae095e8fcf5a377a35447580572104f5c08162f

SHA256
6cecfdc266bb5ba1de79e897ecd86f367de5c333662a73780c19527c86b5364f

SHA512
23d86150034161a72220ce7a50fba572f6f9c0480fc348cf8c3a08700d1104376aa08e6ff6e0b9e2a2e2cd9dac67913397ecf094047c5daa0063d9ea24b9b27c

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
163KB

MD5
cc488a6478e4d858ec83906b0136c199

SHA1
c94ea3880a337bc0fc8cbbf82644726bada7711b

SHA256
a32892fb6f011d0e913143bb9d13cba119ecdf59923e6d73299ee135d68ffbdb

SHA512
e5734c8fa13c89640365463eedcb214db59c3bd9ba2d93ffe76807d5d9d21572be82107fa03552b389e664448eca0b1c221ab03d8e7e7b53d751687f8cf05ab7

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
163KB

MD5
59ae59e036b9560ac4095229a387e288

SHA1
045f3e9f7b84104c0fa0c8bdd2b7e38d14a4bfa8

SHA256
351b57176cceb9134198cd2517350fd49c458df25f4b8a2fa165ae44fef8dcbb

SHA512
ac9795e25ed4077d3f178ce0cd32cd45fbea2f11d62c4f31043e80db6c6f3c72182e61e2c32519ad33820a44006fd4cd9c2d8c1b56c460111e2b14a21dc9dfd8

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
163KB

MD5
4a645d7cadf1f28b5d110f41a2b11ad4

SHA1
b37e62bbcb9cb630706823471cd521a6cee6e71c

SHA256
386d34fa57cab55b2d16eb0bdd79668584ae140cbbcd7221a652d6b51bfaf680

SHA512
9444e93a63857088d53ff010255ea82963d42e124179372c15f349973c3bc83a0fbf63e6258f1e723082f3ceb625eb44cbeb9725f38d583157f44004dc10549f

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
163KB

MD5
65992d127f2d5bb0134bd7926f8ed07c

SHA1
02cded87d04c2357da0aad338f181d6b960bc4c7

SHA256
d13ae754114f417f4f54dd3adb7f7f3e364d69d26d702401378d75abf00e1f69

SHA512
399b5011a7f2aaef2236696f83a5a20243834cc86509bd2e2a5ab64070377c8b699160af5463a90d53fb043fb4393034d4f4ddfb12eec55b56a0a68c673030e3

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
163KB

MD5
b5cc895fca46fa1bc7a85f1e8d1e8fb1

SHA1
0eb28887c4ebcbd89cc128b57b4c6f4e5c5f361b

SHA256
171217c3a2b2e8ef9e439d3e82e6cf9bda79613122ddfd159f34d5edda39bd05

SHA512
2ee1dd0bd815c3580b9e78a4c129de4044e4119b0d87ef776752dd602f67bf4072fd2f1686e463e4cd5e73fbc1c1bc8bbabda037560b10a3a470c118df84dd59

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
163KB

MD5
62e0a65db95097680bd3ecd1f0131117

SHA1
8f0f6fce193e613b337d618cc03135dac7d8e97e

SHA256
66b5abf5f688295859ef061615f2b39664015ff9dd71e46e88b00348e2e311a4

SHA512
053c2b77f5c29d603fa34be25fc31e073c7a7ee0435460fcfdd972b1712a5fc8c2f143ceae532664c808d502b8c4a02aeac5219373a52ca46fa6635f02aac88e

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
163KB

MD5
b053f1354691769209ed803bc8f606e5

SHA1
b95ef7ff2e70fc24adeccbd1c13d496b5d358082

SHA256
85cc60c1c9158cdcc6743f817f56a6a3bbe7c92315596226fa9be02390b5d882

SHA512
126e58dc0a77ba0b5742947d1b1ce870a3aa474032311f163568754a4f80be88122ccf598b37edd703e215ae5320c2e9e90cdc4fd8466bb58b6a861e50fac671

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
163KB

MD5
1a5dc4132441bc0e2d4be5395bd529a2

SHA1
b34efd4f0d71b2abd20fef781e373440eaa73db6

SHA256
54c6d34e6a273dddff88b852b2a0bf52f1a692c5bf572b63b6386f041c9a1f19

SHA512
9e8237ef78b47866202121d787fa0e131b71411f497b698940d87843ae34bb701b31493642b4ac986d4774617167ee3c48300393f69d0696455c450cdcff3672

Download Submit
C:\Windows\SysWOW64\Dedkdcie.exe

Filesize
163KB

MD5
dba33a7145df5fb97cf3065d9eb4f600

SHA1
b7f8a35cb636994cf35bcde08b9dd0598d0658d0

SHA256
b8ad2d09124951ab466efb93b241b8da32365d9d869953c96cb50202ca2d15c3

SHA512
145e391a85cd8208186b6db05bac4614e5615707adee7eb37a18d716ce467d523f3bc7d23c02a9fbdd785b95981d8bc67d8493448cdd7e1dde193aa78417d198

Download Submit
C:\Windows\SysWOW64\Eamhodmf.exe

Filesize
163KB

MD5
91c6e630bc096bd74a196132a1d74ef4

SHA1
4bb1f767181e79ba52d244a5dbd6f8f7bd28fc6c

SHA256
327295cdcb220330800240f5f32b8d6e1d0fcce402ce758c9cca76072e390907

SHA512
4dfb0be2067f36a1fb838b966723b22ac8e45ff50bf05bafd7a819c54c0c822b4c95a78ffc79d8266717b9cf7d47e223a5c09ff162c739748ce856d409563242

Download Submit
C:\Windows\SysWOW64\Ecmeig32.exe

Filesize
163KB

MD5
23f4c86467444e4378360bbb7aad9ca9

SHA1
ff9a6fd5271fdc199828baccb7b18eba6250792f

SHA256
10366497588749b7aaf069e0b3e132f7f9a23d940bbc1ca7e2dfaea14fd5f8b5

SHA512
17eb6503044488da0575918659e826ca168ec5023524b4a4c37897a84435f7e7e85882bdc483f28cce5b7d96de1437a825ef0d895bea13425ebdd8ac0833d169

Download Submit
C:\Windows\SysWOW64\Ecoangbg.exe

Filesize
163KB

MD5
87339d6b652c940e4fd618428f759957

SHA1
0bfdf4a118fecc13523585bcff956e5bc9816376

SHA256
d9ce05d9e65a11f899d63f34ff5f8cbfca882f5337ca07f3337e9c24f4d3f8f9

SHA512
185fd59d07d647feb8e878fc19dd5a3af58bf0dc0fa0120ebbe80adcd09835cf0609f97a39d9b6c02a1f85e9be2a03f5742d6c92a46ed2452cb07b5c7bb864e0

Download Submit
C:\Windows\SysWOW64\Ehedfo32.exe

Filesize
163KB

MD5
6494a07c12a3047ab76318b914f22a7d

SHA1
3e1a7c8802a9bfe17c40c2a7659c28737b9a0948

SHA256
71c0dde389868a162d75e9cd5e9513debb7b7d51ab27bb76cb82e8b6fe284fd3

SHA512
c2eb75c2bc7268a4ccb5f7e5119d949a5b642a183c12eb039586d6b52ebd53121abc7973548644912b99f694ac90083566ff25dc2246aceb1e90b200caf53ae9

Download Submit
C:\Windows\SysWOW64\Ehimanbq.exe

Filesize
163KB

MD5
9f3c2470298437def359f7fa95043bd5

SHA1
f509edd946160e5fdb8645ea23a5bb38bca3014d

SHA256
e5c9dee236730dfd0eb46adfc99d56d703432e9b65704b706feb7b2739057828

SHA512
f9b9f2f8daf281df19880ccfae87ef978ea22c043c45bb8989e9e7e946c076ae722ac73ef7b823061a24578131739995a2056c44397cecc2cee1f2adffbd82ae

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
163KB

MD5
35f3eca0243e4c0eb4d8e578f4c54e46

SHA1
fb497418848020ead78f67cb57e246512d7b1b14

SHA256
062125784fa891d872f3e05deb51f8d0cc3d7fccb4e2780835d5643f7cede89a

SHA512
cf9eb8452b6d5d8ad8cbf2c42b2bdae6d36b8c6ffcd0751ae2f918961c6a5d2326d8d7646b05957a0f8bf90c144c9d648a370d7157aa62ae0839fb7020a2fb76

Download Submit
C:\Windows\SysWOW64\Ehnglm32.exe

Filesize
163KB

MD5
418369d9146908493546a76a6c50947a

SHA1
dc51c75088bdafa680c9165ee24d4a6480886c12

SHA256
7b68b113357a4b6539da2d1b9e5d9edfd3192e18f2ed354cac815818a9f9a118

SHA512
cb40497633658c248044f6a828feadefa2fee78e74b1a2c55403e699d073c02f57aa63166a4c49e222cb400350a5ac0036ce0dde9120d87af66b5c044fe38a51

Download Submit
C:\Windows\SysWOW64\Ekacmjgl.exe

Filesize
163KB

MD5
9f140e20d1366d34d05a068d3df3818c

SHA1
11f4444b3a130c41c9608d4df9657a007d3facfa

SHA256
58d0b0997d6e3f43c50751be10d78f6cff666e923baf524760643752a7aec05d

SHA512
c42d09621ba9b2d5ca3801e4f3e1d3e9e58f17b7ee4a4180085adb55c7ab21a9656bd4a0341112dd6029148d5b7a312bff8b833034c4f3ece439be12c79d5879

Download Submit
C:\Windows\SysWOW64\Elbmlmml.exe

Filesize
163KB

MD5
8584f5ab3692fea4b563d01705d7c9ea

SHA1
a6072ccba7109ee8a0ed3b7410a8713b554f23d3

SHA256
2d076440de71371edcde6634d34f1d8374ded904ef2f4dc57eca3cca3832e25e

SHA512
dce616158096158bf21337328a31e67929cf582b369786d8dbfc50e7aca1858f8c002233f9ec957cea9434d9a90ef089d9fcdd7a91005e0a236dbe73c2554c51

Download Submit
C:\Windows\SysWOW64\Eofbch32.exe

Filesize
163KB

MD5
7ed30f6a738162fc0290d47463051dc0

SHA1
9d92e39b7e72c436b770f45d2bb5bde1dc807f2e

SHA256
3af0715abf826d35c901722b8af31fcdcc8f57bb120e8283c9723ab4b9dc0c63

SHA512
09c5d76eaee14c34e84f2b0e5458843fc984717ee0dea7995ae67132d3ef0c1bacd723bd8d2bdff2ecc2960318c5baefae83ceab091015481ac56e0a9da3a1a9

Download Submit
C:\Windows\SysWOW64\Fcfhof32.exe

Filesize
163KB

MD5
c159b5eaefa42234895fd3dc2a53d9c5

SHA1
33e6249a8edf9c2d9b45e4897f0434c2e553d65b

SHA256
7b9d217ffcdb5ba5e857b795a98d8a6b198f7fc9e01bcda09cfef13af2bfe07d

SHA512
789190584a64b51d732234a86460fb4c281cf321111e6be2c2d15a519426e7bb9804ee8a8339acfbfaed43ce4afb3d19761e7a40e074759751388e1750b697f4

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
163KB

MD5
417570a409426cc65c3adc5acbc49365

SHA1
da1c94e7086dd6752651cc06f58a6e55beb6c1bf

SHA256
c1d551d29d08c00b1ea6be3ac11bd78afe200e5bf64b3482c84234735dc84479

SHA512
465008b26b05266c94ac2d6a0d631f5b0fcfecfb42ab855adbb6069100db377bd548514eee62b2599c3d8a72cff65da10664a5843858c312ed85176e447551ac

Download Submit
C:\Windows\SysWOW64\Fdialn32.exe

Filesize
163KB

MD5
d08a280e592bd5532d55e081c8f2e3f5

SHA1
c8e0967828eb94c4e6f5c57c69405125b51fc427

SHA256
68a53f4ede36e72af4276bfbc78d78e112d99681c87d4acff0375759763ce9c3

SHA512
f362b6c051dc58a5724820100cb556954fdc0267aa365dd26d4f3b7a7b7cf84052f3cd4aef6e3e706f68ef305f9d850761c5473f031aabf9cd68bac2adc1e43b

Download Submit
C:\Windows\SysWOW64\Febgea32.exe

Filesize
163KB

MD5
909ce4efa34a133705aea6e319a075b7

SHA1
741629034b5009d26312bb65e8058825c590bc35

SHA256
9a2d707eed09f7b31295316e51ff4f4ac952a514914c5f8131e58dc7a7a1c20c

SHA512
a69ba3604483205c649b571b3c05040691f09dd85b6b9ce478b2a37726410870260d7689b6b28085a14a78c36190cad33111250bdf4ab17957ea718b75ebb149

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
163KB

MD5
6fa56cd034f2ad1c07755b38e10bd7dc

SHA1
1cffd428388f55748829bc07b9ad95b69acfc5a4

SHA256
8b1be3d3da713997762cf2387c4b49f7550c878651931d7f8230d23d878650a3

SHA512
0decdac02e00a7063d4150df0d6002bbcc8f44b6c736c5fc9ce7812bf5bfc047c1cb9b9402f08b3631cbbb6944d20022720b8256a97957a4bfd9d062cc9e4fff

Download Submit
C:\Windows\SysWOW64\Ffkjlp32.exe

Filesize
163KB

MD5
f99518105bf7c6f236841403d2fe8f36

SHA1
39ae0dbf34ed416c3193861bef381344bbcf0ad7

SHA256
66827dd24d2d1daae523fe2d93a97e17dec4ad3832d461ae87bed51284b0f3e1

SHA512
21c03623afaa4d2b882860be544cd16363e80d300b92fd064e691d6b78970ad84820a8551e250d4a787f2610d521deab859aab11d7af5843eead8e3d0c4c3117

Download Submit
C:\Windows\SysWOW64\Fhqcam32.exe

Filesize
163KB

MD5
9f3faf01b7e7a55292b5c6e5a0db6c10

SHA1
be6fe2036e045ee867f259b1f73d3c865acf2ee1

SHA256
ad2b9c3e1e2e0ad4962c2b444da983f0bd3f66a89d35df3f097d321392e04285

SHA512
09bae6aad7054e2724d7f16a5e39cf1d3ce2671891b8f15e1fd2b7d5e116cb5f5dc3186d770711834fa039756ad9460ba00d445a68b7dd5086d3919d36e25dce

Download Submit
C:\Windows\SysWOW64\Fkciihgg.exe

Filesize
163KB

MD5
c8c54a2cfdba612843ce9045d63bddcb

SHA1
38237b2f89f978f80f46ef92a7f31123ec3c9d77

SHA256
1f783c24af6fd21fbb0c119f5c46bdb486bcaea971d50823fd88a4c99f05ddff

SHA512
60449303803b9e54a28aa6a43e78a8f844f5050f9ced8c44b2262b96daafe1c5fbc299c4bb02002f166956bd9dfb13ea3f7c237180038aae7f51e8ad7bf0a29e

Download Submit
C:\Windows\SysWOW64\Fkmchi32.exe

Filesize
163KB

MD5
a965212e8cbeeb8659c777d9aafc6d0e

SHA1
7aa33abc546c60a9367165d142b8ef3121caac3e

SHA256
a27a9cb218eb8c7019e34d3f9cf58aa891288cf1c6fd2d492a6c7eedc2b0b9c6

SHA512
605e5e76910b33795d1e1f09d46a93056bda0ec11d81108858c16bc749fa49afe7c8a0f7f8f7155f37c0af8037b239b5825af9005fbf96b425383c1dcd6dba19

Download Submit
C:\Windows\SysWOW64\Flceckoj.exe

Filesize
163KB

MD5
d79bfa69a31e9939d0c188ff837e6c98

SHA1
8a0ba75235e7c4bb54ca4857cf7a01bcf6c78e20

SHA256
5c67ef9dad7471973a7a22fc6fbf56693f44520d575635cc1da3d577a60a4c68

SHA512
8d7c2a44a40c0574785f600a6ce24afc54ecf54d3ac40e8f66d962fdd9b51c272434530dec124abb37213d029681707b1863cf8fc100876d3763c9a2ea574528

Download Submit
C:\Windows\SysWOW64\Flnlhk32.exe

Filesize
163KB

MD5
8111a4a328d80b8ae4453a12a2fee08d

SHA1
8c21175ad2f23720b93d4f7420ff02c970c9ccd7

SHA256
c14cedf9051e53b31b0c9dd2cd5435a9269368df5b2b4f5b6b347d24c22f2da3

SHA512
ea3093462cdd646e26966a09a7b5fbdba4fc72b9853bf97b4edc6b591beada48f35f09ea4a65817f0e9b65740491699ade6a8c99e883252c5e78cbfae83c8070

Download Submit
C:\Windows\SysWOW64\Gbbkaako.exe

Filesize
163KB

MD5
75353c3f136ec8e228c0c36fa5fe7430

SHA1
2f6ec816ee2eb49e6d832e5ad5d630c1753f9d76

SHA256
5d6f381c85bd7bfb803c41d0901b18b2eadeb00ebbb8636fe6cd3eb23eed9167

SHA512
2d406561b9f7a1d84cd77b159b486dcf280fa4227e6d1725e92c81188e1d2d119f974d0d56a49770659ad4db7d2680b772119dceda991689bd804fc5fd5ec359

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
163KB

MD5
49478219136b84da9e9cb48a1347b5f2

SHA1
e25a9be6fb409d80e3b9287959a5af1a04b610f5

SHA256
5293f6dfa6101707be1d01d6fbacfc2c02b2c7d03fe028611d835c12c183228e

SHA512
3ae8dd180c9d242b97b2f8e4e3acca8dbfe9a464a6bb5a60c5eab745c985368760fca272df3b5ded21edb945dad7f836932396a74416b601993c4fe6c833233a

Download Submit
C:\Windows\SysWOW64\Gdcdbl32.exe

Filesize
163KB

MD5
e4bd1212812927d1b7cb86dc1391d9e7

SHA1
69a0b9729b1bf26d9c6cce54aecb78fa9d11bfbb

SHA256
e581e439df6df6024f5613d2e5c03722623985cdb8e21efc2a891feaee24c2a2

SHA512
5bfc7d231a0baddba8631e8c745cdd080abce4282c2c9a56ca266c5f8d103330b8063233fe2b4103a0cd171e8a5104fc820d8a26d8078b3a35bc3c6609e8071b

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
163KB

MD5
e54fb0175efd52f1dec70f427e845033

SHA1
47a5c92996092ba632273cb8af113d2dd5f8a99e

SHA256
aeb194c23e71b7edaef6004e4a825256b0ce182e0295e28b260ecf2bdee7da9a

SHA512
8d64ddc021afb6c0e333f3659944ccfabc0af86cf261cbae69f16bebabddd3b243178757ed25325dee248f552445959b254fcda0dd3ab60949fdbf0edb980fe8

Download Submit
C:\Windows\SysWOW64\Gicinj32.exe

Filesize
163KB

MD5
cad2d6616388af0d387c31a5c179787f

SHA1
9e42e215e1fb744ef77fb4f4609915ed27c51169

SHA256
658a9204fe2759d54fdd132ebd35738260cef08fafda39271d786138308f3b3f

SHA512
3d8b9620d850463fb5de81b05d7a9f1c5f44718e404011d864f1c4c2bf13cac0672f53ee9472351f50a64e8ca8f69d8416a69c69e4ce54e6a704fb3289e91f27

Download Submit
C:\Windows\SysWOW64\Gkmlofol.exe

Filesize
163KB

MD5
09f378cd112cda951213a80f603efb43

SHA1
18e7f8847bced6ddd83ebf97bbf2e8d00e7e38db

SHA256
0816abeacaa34f7cff6489a6becef57aac9727715044d1baefe4a9697b05828d

SHA512
c9bfb56748e95f63f482fc69795358360259c24aa11ae073098d929697cb165a78e29ec387a56910210a32241cde04a7609a13f6797b469b3edc760c6b725e73

Download Submit
C:\Windows\SysWOW64\Glebhjlg.exe

Filesize
163KB

MD5
b5f167e53d7c62f8f787229ccbea6c79

SHA1
79d30fae00d96a377225347740fecd49fb90d5dc

SHA256
cadcf4eb76c617faf91afde233b6e598bb0811c837ee018f38f547c7d13ded79

SHA512
b5c8ffc5087b0b39ba6c4b9ee7616875d1683a6ac107c8a1d61fa557df599e9a63bb12fe40281d36b570863146c14b41e6b95795955bf95a67c2373d7c4b2a8e

Download Submit
C:\Windows\SysWOW64\Gofkje32.exe

Filesize
163KB

MD5
d8bea14f9e4e904f0175db9ca63c97fc

SHA1
974573deb858fc7f04ddb40cc1b4b111e86ddaaf

SHA256
4c6362bbdb470f221751f412c541964e1bdcad055da332595ba42fc3e525e628

SHA512
d6a9bac2ec16af6d9040b680f6eb7260404edf43553a7265a3d59743d078dda6331b6c8dc8c9210af64552f4b67f53c43bfdd69bf75a80f8f159c8fad754f612

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
163KB

MD5
33549d8c8d9af85c14a75443f1ba76e6

SHA1
c22edcfbd84398886e8dfa647237e0c049390c57

SHA256
dc5bffbee8268c4ba4949d0ddece647309fc59d4c4939f114b6aba848e3f95b9

SHA512
e1fcb2c722be7905e0837fc348a5f4b87cf3ed831b116e6c4f51a67847d3fe59d83163c510b2dc8193a7bf2db7cfe15df5224d44f2391288f06173d3cf0f649c

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
163KB

MD5
a502a2747e9789e7ea7283ea5023ab99

SHA1
7fd0dbfa044ecd31e44214e5bcdc57131e313cf7

SHA256
ac63a5ad7a484b79b87b682cd6063784114bc87b5af012d9b5f66fe630e7a0ed

SHA512
11efc6c027cc7ff8673784f2a2cd9282c0eac1ef106df70a0b2bbe5ab75e3639b29b193da1bf52e907e075a8a3f49a1d428215d958b7eaac4bc913bb66e80243

Download Submit
C:\Windows\SysWOW64\Heocnk32.exe

Filesize
163KB

MD5
71d3bfb358b28a52ce3ecd450389729a

SHA1
0def44d19550b07c4f08f9f747ccdf379fb41ee6

SHA256
bf5964f0a8b9a4612ccfb567eb5e936d7a915f839a87a4ea17ae752f1e8a60b4

SHA512
af4f57e8933a40da220c6eb3e545fcd6d38ca94f555bfc835d8cb5cbde79c3b914d6a1737b1f2e7576657a024f95561ea7d5ba9dda871054d5e55f4ddd73892e

Download Submit
C:\Windows\SysWOW64\Ipbdmaah.exe

Filesize
163KB

MD5
0a05fe918933e3ab0745a81dcc78338e

SHA1
b4ec82805f6da492d9b5eaf9baf39d19f4834da4

SHA256
34e2c1a06bba6b935211603b5b876337c31fe99719754727c39aeeca6eb68370

SHA512
741eb17eeec1f32e16f5294ae53e7dc91d50105c1fda3d28076a3313c6010cd9fbc81bfb53088a46c42cb83cdd53598531aad87c707bf3d4a3c9ab3bd5fd9221

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
163KB

MD5
128b449949ef7ba6322460160a74f1c8

SHA1
5e82d45e5932fa534857a31432d47f304c7c9553

SHA256
a45cd9b827995620c08e926bd752f4c5ba80db811521b3d3553e4250e42e6143

SHA512
730f19abba2aba91d29fb564fc98046eba0e0cbcbb93815f7292fe1375d1b5b167582d669ba458d84473c5da4de4cbdba9615c3a352d59a45df702ca72cb75cc

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
163KB

MD5
aa746b6002299858f23cc8d4bb10f0c5

SHA1
28104be984392af05f10595725fe3cb2e9fc678a

SHA256
4dd01ebb7c8778a9bb0ff8945ae76dfc0d0b7b5c84b180174a26e413b6e1b397

SHA512
1f79469ab3da70f2e5d35ae669625524f61b7b6113498d573d943517aee2bc61255a186812757327464f0765d459c66e0e91376442797b0e2e75ef8112754398

Download Submit
C:\Windows\SysWOW64\Jimekgff.exe

Filesize
163KB

MD5
98c54e0e5268ea5747feec038d39dbf3

SHA1
6d611e2d29a17b23f6c0097f120be8c33374f212

SHA256
b3390d3d86705290743cd6178f7c6b7d607d6edc540c72fce89db1499071bbdf

SHA512
4e28ddad1f0676942060e9fe28b94f3d3594ac3c5ccbc983e172a89f45d196f504296eb220f197ef7c33c1e327cf0bd444951fdbee19317b61fed3fe7b8cbae5

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
163KB

MD5
fa2e727a4c1163a5f7e63782ce2b735e

SHA1
96afdc422fe70b802b6ee654c72f2dad64f2e6db

SHA256
f0d926f52d1451bb03399d2682f385d9ef5af6e634cc75893750ba22664db68e

SHA512
6a38fd5c89f4a3e108801a3394efb8661fdc47cd809fc8b59708de101c8d722b2a2d3e4e04b929b57e86673da0345d51f75c35b75058f257b0beaeb5a048d32f

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
163KB

MD5
bba856018dbe7bb283ae75dd194166f2

SHA1
9c4d1a9ba757bd417f40d324bff81ea3633e6420

SHA256
596d17ba8f0ca645aa03d90bacf26ea655f22a33b7fb1ecc1b8e01e5b006cab7

SHA512
6947ed325755fb2a851ef01d163b52ebbe8bc7f4bffdadaf55eb2555ae0650d7010fb41c34e3a3f9fcbdce0e4914ceb29e2e7272e36ee616d9f6c0742134bf70

Download Submit
C:\Windows\SysWOW64\Kedoge32.exe

Filesize
163KB

MD5
47aefda78e2926c79e356dc377f4420b

SHA1
590bf4b1d65cb70a2d45202a653b2cc4a24554f0

SHA256
ef7c0e984fa6f5d9ac3bae14e0635e596d6838ebc3da052aae1d23aeded7107f

SHA512
c02c68ada12dc23abb3d59861e3df6a415d89663dd7923ca05fa8fa623781982fd549071574358900bd9d25bd68e04fa7af5675fcf96fa77099e935ae386d8d0

Download Submit
C:\Windows\SysWOW64\Lffhfh32.exe

Filesize
163KB

MD5
4ee5e6a3a14bd7068b174338d0c70de5

SHA1
14755c4a58a63df414fef0681ff3680471821015

SHA256
75920510324bc0a527bc7f0f7d7df3337f0982d26bd5bcd61b97d38f47e7ff2f

SHA512
c48990e9efb95b9dc24a98d050e7ab72efa8ba43f7607c1d9a5419b6c88234659e2a64866dfddc91e23fd651255279636454777369c139b84006109501167825

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
163KB

MD5
dd2977a1409e30469742ffd28ac7855b

SHA1
37c654bb5d6222ef9eda24cbd6485c0a0110e9ad

SHA256
beeb9cfa386199c648d165c4a6e295b6d8c748fa62bccd202775d3b08b0551ff

SHA512
66cc33a213a6a1614d72512103e02912cc41d10ea9034a65453b24ff0205545800cd7fbc75dbd5efaab68476a85038e0d92bc72345c95ec0447f2919f2731f10

Download Submit
C:\Windows\SysWOW64\Ngmgne32.exe

Filesize
163KB

MD5
e78d148ef6301923721b431053a1e450

SHA1
ca076e75856d4f9a77728f72a12c8725355f8081

SHA256
c309901242106e469d7e155a1963bdfad42c7dbe70c2204a3d0ce1c34d48093b

SHA512
069574dfa5925a08f6efd97a39519bb9d598896954c635af61d71b244ade3111058cb5c7cde93d83ce03b574abb4fa2f399c66785666f4d481a8297946282340

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
163KB

MD5
9e27431621d4abcfcc263ff7d6631ed0

SHA1
665cc3e63677c9941fc9e0350c606bb55127d638

SHA256
9a3343b27b31a1073c692cacffcf5c9069bfc4979989118535960cbf214467a1

SHA512
2d1a1c041cf91221f55ee6ee37249d17d717466b62b6afa1ab14b9ff28335fdaf424b340143b78cdc1efbcdbda51404aad6902772df462c35b9ffd29f918ef1e

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
163KB

MD5
324fae1bb3cd6942db8f2bc13fb0ebd1

SHA1
ff2f744e09f0fcac60c728fa418f8695dadef38c

SHA256
6996297a4846d8834de28fbf1cc4f56bba4b882f4bc301bb118bcf00b8e97e7f

SHA512
dfb2e3b2a42b0eb75653f44d24b96528661d83edeb98dfb906ef67e290b55ff758ce2a7e5591b2b2106a6e159bc858f6af1d56fb99cdc35e432734324415b6ec

Download Submit
C:\Windows\SysWOW64\Ojjolnaq.exe

Filesize
163KB

MD5
905fe31292feb15efd3e0be3fcb49113

SHA1
73f899e25d9b25c43f5bf687ebd8ed392b02be5b

SHA256
5fffc1dbcc126f3d735f2fdb0508029bb9487cca2ee44f8628f28ec6fa2428a5

SHA512
c7ef865e02303a171e77fb6a479b3efb8ae7351347abd818d84b0455fe66cc74698472b2da8ae0c4d8f8fce84015db4e081c279b277063fe85a104d96a961254

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
163KB

MD5
c6837e293bf4b06abb88f056579abce3

SHA1
28e997ac11f3f5a80ca7876c667df754a2b3b843

SHA256
a2e58eed31e010e599b71217882b5c79ce2545a9e75aa8bc013a5334a8d8bed2

SHA512
7944529a1ee08a41bd2180b56638ff2ecb56b82a364841424d43ceb5de3306471af697eb97c75f12e496a4a62526835e6a94762ce66161cb4fa62225af9c5bb5

Download Submit
C:\Windows\SysWOW64\Pdkcde32.exe

Filesize
163KB

MD5
34a022f45a9573e777dbcb3bc7734fe9

SHA1
75f3fd853d112e54fb3389254e62487453886931

SHA256
0c94b4f1fc8c2a9ac86023f7119a259e1e02c132d0c4fec6789f7860b255cff3

SHA512
2da75ced195b4a32af4f8ef42e125996bc1f40e179746c89e9f9066597854583bcbe9c560523b3ffaf987ebff5b5cf2ac4d770cf894ecb3de20e265fbb16e2ae

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
163KB

MD5
7dde566eb55466f2ceb736bb66c02f29

SHA1
0cc68fa11805a4c33bed457f443adcaffbfae4ae

SHA256
c7768169227567e0ef385894d414053549abb2cd32096fab5fe0bc33e1941b33

SHA512
4648d58c31d7d1bd3b040b62a066c6248a1ad8fa0e8bee11af3295e275ef57c8ce40d8b39ecfd0a1ebd619781dbe41fe80173f7f33c60f299970ed964568b265

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
163KB

MD5
1fc2dd37fff6dc71f395d173d56c44b6

SHA1
17ce954712e8d18cf72713108d13e6deb09ce6c0

SHA256
867636ead073b63ab34e028ba14894293b465d4bc45e2622f53b9066d967c2f4

SHA512
a444c85f18a361b54ad865f43babd794182a1f1207436711717462d9722a28f71aa18132f4360b0f6b19ce24c35ce9c2b784a7a54a297c5db3733d6795c0affc

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
163KB

MD5
0bde18fd2511a34c65957c20810b7a31

SHA1
7601ea524de479b7a4cebf75b98dff5437118e16

SHA256
6ac6eeb54c9ad2947825df9c376f8768e5fd4769bdeaa63f0af781153752cce9

SHA512
5b543dcb1e57ec81dc5f405c90ba8bb1c1f0e0155790dd8a1ce610ea8d15b221199cd2ca7bd0cc9ed0d61c119958787c0d85afad50d1ca52b4c2ec738066e30f

Download Submit
memory/208-1937-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/208-233-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/212-572-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/212-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/428-321-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/592-281-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/592-1923-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/756-112-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/880-136-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/884-241-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1052-200-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1072-520-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1124-1938-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1124-224-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1128-431-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1128-1873-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1288-293-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1468-263-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1472-565-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1472-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1524-311-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1536-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1536-558-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1536-1991-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1592-478-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1604-96-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1612-249-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1636-437-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1756-490-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1796-144-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1872-1761-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1944-496-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1964-1927-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1964-269-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2188-1950-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2188-181-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2192-287-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2196-466-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2368-165-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2420-185-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2636-1953-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2636-168-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2668-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/2668-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2668-538-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2704-545-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2708-407-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2740-299-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2796-1875-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2796-425-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2836-592-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2836-56-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2988-335-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3004-526-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3012-327-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3224-275-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3356-508-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3416-341-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3416-1903-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3528-80-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3572-401-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3576-383-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3576-1889-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3648-1864-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3648-459-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3908-359-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3940-1838-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3940-532-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3996-472-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4012-559-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4016-484-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4064-129-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4128-395-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4224-443-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4400-1849-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4400-502-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4404-120-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4420-329-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4428-566-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4452-573-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4460-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4460-579-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4496-216-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4516-389-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4544-1901-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4544-347-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4592-449-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4612-419-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4612-1877-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4628-305-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4656-91-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4664-208-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4668-193-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4692-551-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4692-8-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4696-552-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4708-413-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4716-365-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4728-514-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4732-1957-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4732-152-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4744-257-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4776-539-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4808-371-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4868-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4916-64-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4916-599-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4944-109-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5008-585-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5008-48-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5032-377-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5112-353-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5184-586-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5220-1759-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5232-593-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5232-1821-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5600-1807-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5764-1738-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5768-1771-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6028-1720-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6032-1737-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6052-1762-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6180-1719-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6212-1600-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6232-1657-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6356-1699-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6480-1598-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6716-1681-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6760-1680-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6812-1618-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6904-1637-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6972-1638-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7064-1594-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7136-1613-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7464-1571-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7512-1525-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7824-1549-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8032-1542-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8112-1537-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads