berbew | 02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa

Analysis

max time kernel
138s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa.exe
Size

163KB
MD5

79e258086567274b2cf22027f3dd2f63
SHA1

ea8f9980c0d1004a188cab89995e991c233296f5
SHA256

02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa
SHA512

f5faeb61d170ddc1ca8c907323705dd5732cc22c3b9429a673873f49404ba6bead1e25decf58e02c7cff2ebe7cdb03dbc476ae900a2e097791fbdf1216ff3363
SSDEEP

1536:Pjl3oP2bQ6XUvTV+sJjngLhQBZq3ZsA0k/VKexlProNVU4qNVUrk/9QbfBr+7Gw6:RaMyjngLNsONPxltOrWKDBr+yJb

Score

10^/10

berbew gozi backdoor banker discovery isfb persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Iliinc32.exeIohejo32.exeIefgbh32.exeNqmfdj32.exeNjfkmphe.exeQobhkjdi.exeDnmhpg32.exeLgbloglj.exeMfeeabda.exePfdjinjo.exeBpkdjofm.exeDdgibkpc.exeLnjgfb32.exeFligqhga.exeMnmmboed.exeOanokhdb.exeAfbgkl32.exeBaannc32.exeEblimcdf.exeMgphpe32.exeKcbfcigf.exeKgflcifg.exeOplfkeob.exeAgdcpkll.exeGpbpbecj.exeIlqoobdd.exeImpliekg.exeJpaekqhh.exePhcgcqab.exeBoldhf32.exeCgqlcg32.exeGehbjm32.exeIebngial.exeLljklo32.exeMmfkhmdi.exeApmhiq32.exeBknlbhhe.exeKlhnfo32.exeLnldla32.exeQfmmplad.exeCogddd32.exeGeohklaa.exeLjeafb32.exeMmmqhl32.exeLgpoihnl.exeEmmdom32.exeFlmqlg32.exeGpgind32.exePpolhcnm.exeAkkffkhk.exeBhkfkmmg.exeBpfkpp32.exeDfiildio.exeJgbchj32.exeMnegbp32.exeDnmaea32.exeEfpomccg.exeLggejg32.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iliinc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iohejo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iefgbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njfkmphe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmhpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgbloglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfeeabda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfdjinjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpkdjofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnjgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnmmboed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afbgkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baannc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eblimcdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgphpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcbfcigf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgflcifg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oplfkeob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oanokhdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agdcpkll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpbpbecj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilqoobdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Impliekg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpaekqhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phcgcqab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gehbjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iebngial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lljklo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmfkhmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bknlbhhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iebngial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klhnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cogddd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geohklaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljeafb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmmqhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpoihnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emmdom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flmqlg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpgind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppolhcnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpfkpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiildio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgbchj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgflcifg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efpomccg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnmhpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lggejg32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Executes dropped EXE 64 IoCs

Processes:

Dnmhpg32.exeDkahilkl.exeDbkqfe32.exeDfiildio.exeDoaneiop.exeDdnfmqng.exeDodjjimm.exeEmhkdmlg.exeEfpomccg.exeEoideh32.exeEmmdom32.exeEokqkh32.exeEpmmqheb.exeEblimcdf.exeEfjbcakl.exeFbpchb32.exeFligqhga.exeFfnknafg.exeFpgpgfmh.exeFechomko.exeFlmqlg32.exeFefedmil.exeFlpmagqi.exeGehbjm32.exeGnqfcbnj.exeGmafajfi.exeGbnoiqdq.exeGpbpbecj.exeGeohklaa.exeGpelhd32.exeGimqajgh.exeGpgind32.exeHipmfjee.exeHpiecd32.exeHfcnpn32.exeHmmfmhll.exeHbjoeojc.exeHidgai32.exeHmpcbhji.exeHfhgkmpj.exeHpqldc32.exeHfjdqmng.exeHmdlmg32.exeIfmqfm32.exeIliinc32.exeIohejo32.exeIebngial.exeIpgbdbqb.exeIgajal32.exeImkbnf32.exeIefgbh32.exeIlqoobdd.exeIckglm32.exeImpliekg.exeJcmdaljn.exeJpaekqhh.exeJenmcggo.exeJmeede32.exeJljbeali.exeJebfng32.exeJllokajf.exeJgbchj32.exeJjpode32.exeKcidmkpq.exe

pid	Process
544	Dnmhpg32.exe
4648	Dkahilkl.exe
2232	Dbkqfe32.exe
3436	Dfiildio.exe
4344	Doaneiop.exe
3524	Ddnfmqng.exe
2064	Dodjjimm.exe
4232	Emhkdmlg.exe
1388	Efpomccg.exe
2124	Eoideh32.exe
792	Emmdom32.exe
5116	Eokqkh32.exe
700	Epmmqheb.exe
4824	Eblimcdf.exe
2284	Efjbcakl.exe
5100	Fbpchb32.exe
1588	Fligqhga.exe
3780	Ffnknafg.exe
4752	Fpgpgfmh.exe
4476	Fechomko.exe
4080	Flmqlg32.exe
644	Fefedmil.exe
3328	Flpmagqi.exe
2176	Gehbjm32.exe
4220	Gnqfcbnj.exe
4792	Gmafajfi.exe
3684	Gbnoiqdq.exe
4292	Gpbpbecj.exe
896	Geohklaa.exe
3044	Gpelhd32.exe
2340	Gimqajgh.exe
4960	Gpgind32.exe
4060	Hipmfjee.exe
4996	Hpiecd32.exe
1568	Hfcnpn32.exe
4740	Hmmfmhll.exe
2604	Hbjoeojc.exe
2220	Hidgai32.exe
4620	Hmpcbhji.exe
3216	Hfhgkmpj.exe
212	Hpqldc32.exe
2572	Hfjdqmng.exe
1116	Hmdlmg32.exe
4984	Ifmqfm32.exe
2160	Iliinc32.exe
2280	Iohejo32.exe
2196	Iebngial.exe
2772	Ipgbdbqb.exe
4244	Igajal32.exe
4900	Imkbnf32.exe
2908	Iefgbh32.exe
2960	Ilqoobdd.exe
2272	Ickglm32.exe
4968	Impliekg.exe
3836	Jcmdaljn.exe
1508	Jpaekqhh.exe
4836	Jenmcggo.exe
2760	Jmeede32.exe
1748	Jljbeali.exe
856	Jebfng32.exe
948	Jllokajf.exe
1404	Jgbchj32.exe
4260	Jjpode32.exe
748	Kcidmkpq.exe

Drops file in System32 directory 64 IoCs

Processes:

Lokdnjkg.exeMqafhl32.exeAfbgkl32.exeHpqldc32.exeIgajal32.exeJllokajf.exeLgbloglj.exeLqkqhm32.exeAmlogfel.exeCnjdpaki.exeDpiplm32.exeGbnoiqdq.exeEmhkdmlg.exeIliinc32.exePpgegd32.exePjdpelnc.exeDnmhpg32.exeNpepkf32.exePdhkcb32.exeCkebcg32.exeCpdgqmnb.exeGmafajfi.exeIohejo32.exeKgflcifg.exeMnegbp32.exeNmkmjjaa.exeApmhiq32.exeBajqda32.exeGpgind32.exeHfjdqmng.exeMgphpe32.exeNjfkmphe.exePjbcplpe.exePpolhcnm.exePnplfj32.exeAgdcpkll.exeDbkqfe32.exeAopemh32.exeBmjkic32.exeChfegk32.exeJgbchj32.exeOcjoadei.exeBklomh32.exeMgeakekd.exeMnhdgpii.exeNflkbanj.exePhonha32.exeBhhiemoj.exeDfiildio.exeHidgai32.exeBaannc32.exeGnqfcbnj.exeEfpomccg.exeHipmfjee.exeIfmqfm32.exeImkbnf32.exeBpkdjofm.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\Lgbloglj.exe	Lokdnjkg.exe
File created	C:\Windows\SysWOW64\Mcpcdg32.exe	Mqafhl32.exe
File created	C:\Windows\SysWOW64\Amlogfel.exe	Afbgkl32.exe
File opened for modification	C:\Windows\SysWOW64\Hfjdqmng.exe	Hpqldc32.exe
File created	C:\Windows\SysWOW64\Fdahdiml.dll	Igajal32.exe
File opened for modification	C:\Windows\SysWOW64\Jgbchj32.exe	Jllokajf.exe
File opened for modification	C:\Windows\SysWOW64\Lnldla32.exe	Lgbloglj.exe
File created	C:\Windows\SysWOW64\Ljceqb32.exe	Lqkqhm32.exe
File created	C:\Windows\SysWOW64\Geqnma32.dll	Amlogfel.exe
File created	C:\Windows\SysWOW64\Hcjnlmph.dll	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Mnpofk32.dll	Dpiplm32.exe
File created	C:\Windows\SysWOW64\Gpbpbecj.exe	Gbnoiqdq.exe
File created	C:\Windows\SysWOW64\Fqehjpfj.dll	Emhkdmlg.exe
File created	C:\Windows\SysWOW64\Jbklgfdh.dll	Iliinc32.exe
File created	C:\Windows\SysWOW64\Phonha32.exe	Ppgegd32.exe
File opened for modification	C:\Windows\SysWOW64\Pnplfj32.exe	Pjdpelnc.exe
File opened for modification	C:\Windows\SysWOW64\Dkahilkl.exe	Dnmhpg32.exe
File opened for modification	C:\Windows\SysWOW64\Nglhld32.exe	Npepkf32.exe
File opened for modification	C:\Windows\SysWOW64\Phcgcqab.exe	Pdhkcb32.exe
File created	C:\Windows\SysWOW64\Cocjiehd.exe	Ckebcg32.exe
File created	C:\Windows\SysWOW64\Coegoe32.exe	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Gbnoiqdq.exe	Gmafajfi.exe
File created	C:\Windows\SysWOW64\Iebngial.exe	Iohejo32.exe
File opened for modification	C:\Windows\SysWOW64\Kpoalo32.exe	Kgflcifg.exe
File opened for modification	C:\Windows\SysWOW64\Ljceqb32.exe	Lqkqhm32.exe
File opened for modification	C:\Windows\SysWOW64\Mnhdgpii.exe	Mnegbp32.exe
File opened for modification	C:\Windows\SysWOW64\Omnjojpo.exe	Nmkmjjaa.exe
File opened for modification	C:\Windows\SysWOW64\Ahdpjn32.exe	Apmhiq32.exe
File created	C:\Windows\SysWOW64\Kolfbd32.dll	Bajqda32.exe
File created	C:\Windows\SysWOW64\Iophfi32.dll	Gpgind32.exe
File created	C:\Windows\SysWOW64\Hmdlmg32.exe	Hfjdqmng.exe
File opened for modification	C:\Windows\SysWOW64\Mjodla32.exe	Mgphpe32.exe
File created	C:\Windows\SysWOW64\Ncnofeof.exe	Njfkmphe.exe
File created	C:\Windows\SysWOW64\Pmpolgoi.exe	Pjbcplpe.exe
File created	C:\Windows\SysWOW64\Hehhjm32.dll	Ppolhcnm.exe
File created	C:\Windows\SysWOW64\Enfqikef.dll	Pnplfj32.exe
File created	C:\Windows\SysWOW64\Ijikdfig.dll	Agdcpkll.exe
File opened for modification	C:\Windows\SysWOW64\Dfiildio.exe	Dbkqfe32.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Aopemh32.exe
File opened for modification	C:\Windows\SysWOW64\Bphgeo32.exe	Bmjkic32.exe
File opened for modification	C:\Windows\SysWOW64\Ckebcg32.exe	Chfegk32.exe
File opened for modification	C:\Windows\SysWOW64\Jjpode32.exe	Jgbchj32.exe
File created	C:\Windows\SysWOW64\Opcefi32.dll	Ocjoadei.exe
File opened for modification	C:\Windows\SysWOW64\Aokkahlo.exe	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Ebggoi32.dll	Bklomh32.exe
File created	C:\Windows\SysWOW64\Nnojho32.exe	Mgeakekd.exe
File created	C:\Windows\SysWOW64\Iohejo32.exe	Iliinc32.exe
File created	C:\Windows\SysWOW64\Mmkdcm32.exe	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Npepkf32.exe	Nflkbanj.exe
File created	C:\Windows\SysWOW64\Lfdqcn32.dll	Phonha32.exe
File opened for modification	C:\Windows\SysWOW64\Bobabg32.exe	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Ilchfdgp.dll	Dfiildio.exe
File created	C:\Windows\SysWOW64\Hmpcbhji.exe	Hidgai32.exe
File opened for modification	C:\Windows\SysWOW64\Ojdgnn32.exe	Ocjoadei.exe
File created	C:\Windows\SysWOW64\Fbjieo32.dll	Baannc32.exe
File created	C:\Windows\SysWOW64\Bdifpa32.dll	Gnqfcbnj.exe
File created	C:\Windows\SysWOW64\Bpmhce32.dll	Efpomccg.exe
File opened for modification	C:\Windows\SysWOW64\Hpiecd32.exe	Hipmfjee.exe
File created	C:\Windows\SysWOW64\Iliinc32.exe	Ifmqfm32.exe
File opened for modification	C:\Windows\SysWOW64\Iebngial.exe	Iohejo32.exe
File created	C:\Windows\SysWOW64\Iefgbh32.exe	Imkbnf32.exe
File created	C:\Windows\SysWOW64\Jhpicj32.dll	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Bhblllfo.exe	Bpkdjofm.exe
File opened for modification	C:\Windows\SysWOW64\Efpomccg.exe	Emhkdmlg.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
7184	6212	WerFault.exe	287

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Geohklaa.exeGpgind32.exeKpoalo32.exeKcbfcigf.exeNpepkf32.exePhfcipoo.exeAhfmpnql.exeMgphpe32.exeMmmqhl32.exeMnmmboed.exeOmnjojpo.exePjdpelnc.exeBmhocd32.exeCggimh32.exeDdgibkpc.exe02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa.exeDbkqfe32.exeImpliekg.exeNcnofeof.exeNmkmjjaa.exeAgdcpkll.exeDkqaoe32.exeDoaneiop.exeFlmqlg32.exeGpbpbecj.exeHfjdqmng.exeJcmdaljn.exeLjceqb32.exeMcpcdg32.exeOanokhdb.exeAmlogfel.exeBhkfkmmg.exeCponen32.exeGmafajfi.exeIgajal32.exeLokdnjkg.exeNglhld32.exeAopemh32.exeFbpchb32.exeFfnknafg.exePmlfqh32.exeQfmmplad.exeEblimcdf.exeHmpcbhji.exeJebfng32.exeKjblje32.exeBdmmeo32.exeCgqlcg32.exeFechomko.exeGpelhd32.exeKlhnfo32.exeCocjiehd.exeDkndie32.exeDfiildio.exeHidgai32.exeNggnadib.exeNjfkmphe.exePpgegd32.exeBphgeo32.exeBahdob32.exeCoegoe32.exeEpmmqheb.exePjbcplpe.exePnplfj32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geohklaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpgind32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpoalo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcbfcigf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npepkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phfcipoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahfmpnql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgphpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmmqhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnmmboed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omnjojpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmhocd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cggimh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkqfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Impliekg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncnofeof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkmjjaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agdcpkll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doaneiop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flmqlg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpbpbecj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfjdqmng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcmdaljn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljceqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcpcdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oanokhdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amlogfel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cponen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmafajfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igajal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokdnjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nglhld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aopemh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbpchb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffnknafg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmlfqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmmplad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eblimcdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmpcbhji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jebfng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjblje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdmmeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fechomko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpelhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klhnfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkndie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiildio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hidgai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggnadib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njfkmphe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coegoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epmmqheb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjbcplpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe

Modifies registry class 64 IoCs

Processes:

Pdenmbkk.exePnplfj32.exeQfmmplad.exeConanfli.exeIohejo32.exeKpoalo32.exeMjodla32.exeJmeede32.exeLjeafb32.exeMnmmboed.exeEmhkdmlg.exeGpelhd32.exeIckglm32.exeJenmcggo.exeMgbefe32.exePmlfqh32.exeBhhiemoj.exeFechomko.exeGeohklaa.exeHfcnpn32.exePjdpelnc.exeBoldhf32.exeMqafhl32.exeNjfkmphe.exeOjdgnn32.exeCkebcg32.exeEblimcdf.exeLggejg32.exeMfnoqc32.exeLgpoihnl.exeDdgibkpc.exeGpgind32.exeHidgai32.exeHfjdqmng.exeAmlogfel.exeAmnlme32.exeBdmmeo32.exeJljbeali.exeMgphpe32.exeAokkahlo.exeDodjjimm.exeEokqkh32.exeMmfkhmdi.exeAfbgkl32.exeAopemh32.exeCoegoe32.exeLqkqhm32.exeLgibpf32.exeOanokhdb.exePmpolgoi.exeHipmfjee.exeKncaec32.exeIpgbdbqb.exeImpliekg.exeMqfpckhm.exeQaqegecm.exeCocjiehd.exeDkahilkl.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olaafabl.dll"	Conanfli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iohejo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpoalo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjodla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmeede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljeafb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnmmboed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emhkdmlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ickglm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jenmcggo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmlfqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhhiemoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fechomko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dibkjmof.dll"	Geohklaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cklgfgfg.dll"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpolbbim.dll"	Njfkmphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojdgnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eblimcdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lggejg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfnoqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgpoihnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghien32.dll"	Ckebcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iophfi32.dll"	Gpgind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hidgai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmhgag32.dll"	Hfjdqmng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amnlme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jljbeali.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfbjdgmg.dll"	Dodjjimm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eokqkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlllhigk.dll"	Mmfkhmdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfnoqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohmnmmb.dll"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Coegoe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hidgai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jencdebl.dll"	Lgibpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphihiif.dll"	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occmjg32.dll"	Pmpolgoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckbaokim.dll"	Hipmfjee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bppgif32.dll"	Kncaec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lggejg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kghfphob.dll"	Impliekg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mqfpckhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkahilkl.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa.exeDnmhpg32.exeDkahilkl.exeDbkqfe32.exeDfiildio.exeDoaneiop.exeDdnfmqng.exeDodjjimm.exeEmhkdmlg.exeEfpomccg.exeEoideh32.exeEmmdom32.exeEokqkh32.exeEpmmqheb.exeEblimcdf.exeEfjbcakl.exeFbpchb32.exeFligqhga.exeFfnknafg.exeFpgpgfmh.exeFechomko.exeFlmqlg32.exe

description	pid	Process	procid_target
PID 1556 wrote to memory of 544	1556	02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa.exe	84
PID 1556 wrote to memory of 544	1556	02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa.exe	84
PID 1556 wrote to memory of 544	1556	02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa.exe	84
PID 544 wrote to memory of 4648	544	Dnmhpg32.exe	85
PID 544 wrote to memory of 4648	544	Dnmhpg32.exe	85
PID 544 wrote to memory of 4648	544	Dnmhpg32.exe	85
PID 4648 wrote to memory of 2232	4648	Dkahilkl.exe	86
PID 4648 wrote to memory of 2232	4648	Dkahilkl.exe	86
PID 4648 wrote to memory of 2232	4648	Dkahilkl.exe	86
PID 2232 wrote to memory of 3436	2232	Dbkqfe32.exe	87
PID 2232 wrote to memory of 3436	2232	Dbkqfe32.exe	87
PID 2232 wrote to memory of 3436	2232	Dbkqfe32.exe	87
PID 3436 wrote to memory of 4344	3436	Dfiildio.exe	88
PID 3436 wrote to memory of 4344	3436	Dfiildio.exe	88
PID 3436 wrote to memory of 4344	3436	Dfiildio.exe	88
PID 4344 wrote to memory of 3524	4344	Doaneiop.exe	89
PID 4344 wrote to memory of 3524	4344	Doaneiop.exe	89
PID 4344 wrote to memory of 3524	4344	Doaneiop.exe	89
PID 3524 wrote to memory of 2064	3524	Ddnfmqng.exe	90
PID 3524 wrote to memory of 2064	3524	Ddnfmqng.exe	90
PID 3524 wrote to memory of 2064	3524	Ddnfmqng.exe	90
PID 2064 wrote to memory of 4232	2064	Dodjjimm.exe	92
PID 2064 wrote to memory of 4232	2064	Dodjjimm.exe	92
PID 2064 wrote to memory of 4232	2064	Dodjjimm.exe	92
PID 4232 wrote to memory of 1388	4232	Emhkdmlg.exe	93
PID 4232 wrote to memory of 1388	4232	Emhkdmlg.exe	93
PID 4232 wrote to memory of 1388	4232	Emhkdmlg.exe	93
PID 1388 wrote to memory of 2124	1388	Efpomccg.exe	94
PID 1388 wrote to memory of 2124	1388	Efpomccg.exe	94
PID 1388 wrote to memory of 2124	1388	Efpomccg.exe	94
PID 2124 wrote to memory of 792	2124	Eoideh32.exe	96
PID 2124 wrote to memory of 792	2124	Eoideh32.exe	96
PID 2124 wrote to memory of 792	2124	Eoideh32.exe	96
PID 792 wrote to memory of 5116	792	Emmdom32.exe	97
PID 792 wrote to memory of 5116	792	Emmdom32.exe	97
PID 792 wrote to memory of 5116	792	Emmdom32.exe	97
PID 5116 wrote to memory of 700	5116	Eokqkh32.exe	99
PID 5116 wrote to memory of 700	5116	Eokqkh32.exe	99
PID 5116 wrote to memory of 700	5116	Eokqkh32.exe	99
PID 700 wrote to memory of 4824	700	Epmmqheb.exe	100
PID 700 wrote to memory of 4824	700	Epmmqheb.exe	100
PID 700 wrote to memory of 4824	700	Epmmqheb.exe	100
PID 4824 wrote to memory of 2284	4824	Eblimcdf.exe	101
PID 4824 wrote to memory of 2284	4824	Eblimcdf.exe	101
PID 4824 wrote to memory of 2284	4824	Eblimcdf.exe	101
PID 2284 wrote to memory of 5100	2284	Efjbcakl.exe	102
PID 2284 wrote to memory of 5100	2284	Efjbcakl.exe	102
PID 2284 wrote to memory of 5100	2284	Efjbcakl.exe	102
PID 5100 wrote to memory of 1588	5100	Fbpchb32.exe	103
PID 5100 wrote to memory of 1588	5100	Fbpchb32.exe	103
PID 5100 wrote to memory of 1588	5100	Fbpchb32.exe	103
PID 1588 wrote to memory of 3780	1588	Fligqhga.exe	104
PID 1588 wrote to memory of 3780	1588	Fligqhga.exe	104
PID 1588 wrote to memory of 3780	1588	Fligqhga.exe	104
PID 3780 wrote to memory of 4752	3780	Ffnknafg.exe	105
PID 3780 wrote to memory of 4752	3780	Ffnknafg.exe	105
PID 3780 wrote to memory of 4752	3780	Ffnknafg.exe	105
PID 4752 wrote to memory of 4476	4752	Fpgpgfmh.exe	106
PID 4752 wrote to memory of 4476	4752	Fpgpgfmh.exe	106
PID 4752 wrote to memory of 4476	4752	Fpgpgfmh.exe	106
PID 4476 wrote to memory of 4080	4476	Fechomko.exe	107
PID 4476 wrote to memory of 4080	4476	Fechomko.exe	107
PID 4476 wrote to memory of 4080	4476	Fechomko.exe	107
PID 4080 wrote to memory of 644	4080	Flmqlg32.exe	108

C:\Users\Admin\AppData\Local\Temp\02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa.exe
"C:\Users\Admin\AppData\Local\Temp\02a02f614d7c7f76b2af8d12613ea0779eed076bfbc9dcee4143e7025a3a58fa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\Dnmhpg32.exe
  C:\Windows\system32\Dnmhpg32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\Dkahilkl.exe
    C:\Windows\system32\Dkahilkl.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\SysWOW64\Dbkqfe32.exe
      C:\Windows\system32\Dbkqfe32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2232
    - - C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3436
      - C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        23⤵
        Executes dropped EXE
        
        PID:644
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        24⤵
        Executes dropped EXE
        
        PID:3328
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2176
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4220
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3684
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:896
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3044
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        32⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        35⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1568
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        37⤵
        Executes dropped EXE
        
        PID:4740
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        38⤵
        Executes dropped EXE
        
        PID:2604
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2220
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4620
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        41⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:212
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2572
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        44⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4984
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2160
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4900
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1508
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:948
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1404
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        64⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        65⤵
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:1192
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        67⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1484
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        69⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        70⤵
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        71⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        72⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:728
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4352
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3848
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2648
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:952
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:684
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        85⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        86⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        88⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        90⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        92⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        93⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        94⤵
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        96⤵
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        98⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        99⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        102⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        103⤵
        Drops file in System32 directory
        
        PID:6124
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        104⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        109⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        110⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5664
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        112⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        113⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        114⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        117⤵
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        118⤵
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        120⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        121⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        122⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        123⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        124⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        125⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        126⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        127⤵
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        131⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        132⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        135⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        136⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        137⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        138⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6156
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        140⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        141⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        143⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        144⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        146⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        147⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        148⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        150⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6672
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        151⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6760
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        153⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        154⤵
        Modifies registry class
        
        PID:6840
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        156⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        157⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        158⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        159⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        161⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        162⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        163⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        164⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        165⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        171⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        173⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6980
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:7056
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        177⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        180⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6592
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        182⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        185⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        186⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        187⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        188⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        189⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        192⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:6800
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6940
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 400
        198⤵
        Program crash
        
        PID:7184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6212 -ip 6212
1⤵
PID:7092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afbgkl32.exe

Filesize
163KB

MD5
b582368a5d722be913b5fd1e472897ef

SHA1
a5a94f4130001628e8c1aa2140572ea6fad1a377

SHA256
ff89930c0236a38ebf2d154c1af0b815942023992a53ce50c1afd091ea73518b

SHA512
9ae371974524c4476bd742fe8f5a41cef32e46f27af38a17595be83476232cde0df75c3097b4c99337f127c4c7bffeec3a105aa158599b730de5deab4abbc0e9

Download Submit
C:\Windows\SysWOW64\Baannc32.exe

Filesize
163KB

MD5
3b82e1e458b776f88eaf604e94a71d69

SHA1
a108d949b44b6961bf20a2baa741d20e1a1f252e

SHA256
33042bb1e4ef54e8b274bcd21c4300fe8bdcc4c16e1a674c3de3c95e47219839

SHA512
11d485d8a866698802f63cb507d4e3f90b8e11e7a6693f3e8d2c53971dc04d58b9f66ef7f918ea738d029be9b13a25798b7bccb60de335b1f083f1f570422325

Download Submit
C:\Windows\SysWOW64\Bknlbhhe.exe

Filesize
163KB

MD5
402bd2986dff9ef389386d40addedab0

SHA1
5eea0ec064d6ee45e3b087877c972823890dac20

SHA256
34a2733cf3698d90878384d167e049d1ab9d5345b07a61b8db258ac82269244b

SHA512
0bac47cae23b17de6865263e910334ef63769c7c22e37592ff23c41d6b24402a8b293994bade16f98b1a32f6fe5bbe29a88efcecc146944d1ce15f1e7f529891

Download Submit
C:\Windows\SysWOW64\Chfegk32.exe

Filesize
163KB

MD5
56a32964006b313c61f063521639d9dd

SHA1
aa793aa61d828c063bc81b29402243e0988674b9

SHA256
c1e3cbd086c1a02cf5de15baa4f4f4d0893fdd7caf4e51e70726ef0642a34515

SHA512
7a9260f7f33823bcff4a70c926a6eec84cff47b7bf3f96adaeb305837087ca976ea21504619ee2e4b76b2de0cae6ebdf93fd65177b66e669fcadf6e7cddf3752

Download Submit
C:\Windows\SysWOW64\Cogddd32.exe

Filesize
163KB

MD5
bab1d6b80d79b31a69ff6ca881fb5353

SHA1
a91c3990d9623d936c3da52c136e87913bc97347

SHA256
1ca777db180b63fb004e801ae8025effdeadbc932410f4d377793fa5a739478a

SHA512
214030bb15d3599c0e7bbe40771601421426da2c5d8158f422fe53bcb878fcced6a3c8401f6b63724b636cc2fbc4919f7794623b29aaf57c170071951cc2f34e

Download Submit
C:\Windows\SysWOW64\Cpdgqmnb.exe

Filesize
163KB

MD5
4701502bd951c049cd0e88d73a25c12e

SHA1
88cfe7641e7d24720c8f6ce345b144bd4e5cb279

SHA256
08155b6f43dff0c81bfa185f7553154d1409c0001a206952cdb9b9502f7f8819

SHA512
d6781d5609090b9e2c2e207522207e2b573500ba58aee57fb59f03a98830c30e27e0a0c4b73a3356555801707f982ebb071c47dcd909ca589340bcfa91dcf966

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
163KB

MD5
e3d24fda09ec501767311c2863db0492

SHA1
33ae07ecf514f1438876bca1b20ec8e6d19f731f

SHA256
6fc8a41e1ce6f520818d7b2e7431cd78a21fc7aac401c3e6478391591d434b0f

SHA512
95fecbc01251588950110fb02b7dc44e66eab06975a8f0384956a3b2b3de5f1c7a286740a4f3da08527536d0f35b10ac3dc8c9e636f8cfbeba7f5efbb531e12e

Download Submit
C:\Windows\SysWOW64\Ddnfmqng.exe

Filesize
163KB

MD5
16e4316068d2a4e23a7e0a9703230afc

SHA1
dc560cc38ff4c58ada0127e32fcdebf3d244c8f6

SHA256
a521f97cf233cd3b9a8d20bf4975414c2ee4c7d8872f672c0323fda2d080c864

SHA512
7000cf4d4ca0a4263721075cab5b0d9302ebb4933502c8a1460df4865bd24c64002a76196ec48c5bddcffce317265265314c442ea7bb5d135638b8b8408a0168

Download Submit
C:\Windows\SysWOW64\Dfiildio.exe

Filesize
163KB

MD5
3144b08c6986983a08e6da4cd9b8167b

SHA1
6683273af4c6e8d18d7b6bc5f187c17b8d95fc14

SHA256
b0aea28db9fecfe1e305304f116bbab3cdd947bf917a67bd723996982425acf5

SHA512
a0f6b1f0cafe6a64173e2ea0e96923cb265700378f6c75a9f2141daa3abdbf623a3c3653e865b8e7d2273c550dec031c55c8e4bd71d1c490ec06d0b5ccc80d74

Download Submit
C:\Windows\SysWOW64\Dkahilkl.exe

Filesize
163KB

MD5
c18857676f8bcf071a2f18efac6a7910

SHA1
bf535d3255a9103d433c0130900ae4fe6ade52df

SHA256
93f173ffaa28b3ccd762f6bb7449a28752787849e8581014b3b258fcdaa73cfd

SHA512
a4a15e91bcd37e1ea17e071f18f18e224bebba58b6ecb94fe90b201ec7801db936c4e2ff67ab9decd3f4f0208a4335f26093035784c527ecf25ebeb08b858cc4

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
163KB

MD5
6aedf0a7d182c6340a97e6afe5c5d89c

SHA1
93fbe17fa5fa8c0338976e22daad02c4d8e49116

SHA256
dc79f84b91ce54a4f77b6ed9a246648254a1abdab7f3653f477c7f2d83c32ab1

SHA512
b27301d311eb13b597908587643690559cfae38f38ad46b758fab05e12c870a304db90a539b508cb1a6a5ccd59b8e97ab38af2a77a8868c2d528be4078ddaeb1

Download Submit
C:\Windows\SysWOW64\Dnmhpg32.exe

Filesize
163KB

MD5
fbf86650edee9345568cd599d484508e

SHA1
d628cc03878f3e2bf6f1d60244b1ef3b18d6f3de

SHA256
54929d742545b29b67489b84da64953945714c293cf497045f88b1b740572f6c

SHA512
211ff1d79ba67c6574b5e778b8773a7bad0265b90d327ea87e69a11bcab8ee81002ae5cf595f39b48009fb0062b7bddffcd4166e7ed97387df09983d3acf9a08

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
163KB

MD5
3f0fe4a207bdf2cbcc42e5bf268831bc

SHA1
1cd8ffeb6ba66fd2f75e5fa3a2e74b9582110bca

SHA256
8e409303320afef9e4400bb161b3f9e62b541d38c7e820f2b38c8734c38d96eb

SHA512
bf8b2831ca68a9699bd35596d4d646e5faf5904edd259cdadb9acddb23eb8e734c24d8b43a4a8580b02a48bbcdb7cd7552a3204d544af4ee852266f57221d0cd

Download Submit
C:\Windows\SysWOW64\Dodjjimm.exe

Filesize
163KB

MD5
16355e64c9a4eeff2adc5d76b01a7cd9

SHA1
2d2aff861eecb0584d62245c3d36e07fb4b938a0

SHA256
cad0d54ac819052bc87e52b462a0bd684cc884ac959bf2e84a8b49f2859b8b57

SHA512
8cdfe088bb66093ecad81dd220deeb1fbcd390caf364f4b44568684547c1e7a1459b0095a48786eda62d11f95c2b02f8ced39f3705c7d8a2847905fbe7524167

Download Submit
C:\Windows\SysWOW64\Dpiplm32.exe

Filesize
163KB

MD5
882abc86b8d2840760f8db9b3debab4a

SHA1
5097075be98360f762c06616acb4f1db6025c32a

SHA256
71fc021890af6b687c5d6694ec3138bfddb0cadb711e569fe5901c36398385aa

SHA512
15a8c2c32d6779ae0c003f873da03138bf9c3b5548d67b605c11d64001d6453879f7bec15abc01ce42d104dd83d581ed25bcebf5e9dadb5fd77cc7f983677c45

Download Submit
C:\Windows\SysWOW64\Eblimcdf.exe

Filesize
163KB

MD5
e6e3303c21436903d6fdb37140669633

SHA1
69af473e639619090b5163bcd3628f2481462033

SHA256
b2183203ec27728ca76a5948f42bb57acd9b4df4b049b20dc7553c5d75776048

SHA512
fb32e5900d84dfbfc03a30e5ec657be282b2a3f3ac2eb3164a4b7b608ddda4c94b444758e7254b15c6b0d598920aa53117be32ea40059701caf1c0e9ffe12311

Download Submit
C:\Windows\SysWOW64\Efjbcakl.exe

Filesize
163KB

MD5
ebe69c63eb70f50b6e0e4dfabb133662

SHA1
29c63f83a9bb3edc8d157a40a1d17a6231e85e7d

SHA256
04d0d5f82631aa761996dc73fab81912341d16c85c9114460a155cc01082fed4

SHA512
4f59a9c45ad25d178c3f972315b079deee139af83f88d52d29e4b8d2a9fb826d52bd7c32086d9055e10f0de3136e2817b225c0f3e9dc3c2fd7b098bd8a79f77d

Download Submit
C:\Windows\SysWOW64\Efpomccg.exe

Filesize
163KB

MD5
6375bd23e25c9377f31b55179842b9e0

SHA1
3d4e9156cfd19bd2da9fd0e67faf8fdbe6da8cb3

SHA256
e708bc706cd5253d3c5245769eaf295351c2cc3b64120b468d2bc1f2bb77f561

SHA512
a476ee19d846f8a40a11c941e8e8fdeef982f65f9f6ace599aaebe793232dd3c8339c7a9711bd4dd53a4f4c83dbff8062a95a5854326b5946765a94af4e46b71

Download Submit
C:\Windows\SysWOW64\Emhkdmlg.exe

Filesize
163KB

MD5
a37d2a7915177a058e92af426e1c0e3d

SHA1
0fbbf4724fd74b16c386aea39a24a2978a3b71a8

SHA256
94d61065cb457130f2a6f1a7f0c6026d1d9e14ab18a383e11a987f74e8206ffc

SHA512
0c5b2dcdf7439b1fe43a088a2ab9bfbb6efd526b408d4843f8328fe2c2d99c541f5d93126c16382c8c7e3e422cb1417424e59fd47e97e6848c4a55675d5d1b4a

Download Submit
C:\Windows\SysWOW64\Emmdom32.exe

Filesize
163KB

MD5
8ba715ed4d94825414f4046ede9affd4

SHA1
a49143b77c73ec7fa30f810f4fba996b6f2d5c13

SHA256
9ba9716b58395d6b6f34a668a525e2b573faba69b7890c17cdeb47259a2ff8a1

SHA512
55bb332253ecf1c5ed866838a1b1411141a9b361f788d290e22ae713e7a8e93906855ff4a9d20a89b61dd6df05c4c23613cec16d502daa668590d6c78480204b

Download Submit
C:\Windows\SysWOW64\Eoideh32.exe

Filesize
163KB

MD5
f6fac5589cad614234d5bdbe7a83f493

SHA1
37398ec7362e3582704c480a66ed50c2ac27ea14

SHA256
326d568b8f42705c78c26985e4e4f0e98186efdb12cc08205f9bd4da6c4a948a

SHA512
7b58d08b3bef8a093e8344a4149d504810b80f9ee664babd41b11b97ebf0626b1f3755f8db7b306c9623c24a7c7acb9025d7474ded641803fcd6e50e108f513f

Download Submit
C:\Windows\SysWOW64\Eokqkh32.exe

Filesize
163KB

MD5
e15209ace18e6b744242640978a9a938

SHA1
614400b9c3b7a2e2560f91b82698d48156cfc476

SHA256
cc59058f6e28cb8db9fc205d97ff894fedecfd77c08261f0f4b99c2eb2a2c27a

SHA512
2dabb92d2a31046827493ceab76bc7e5879f274689574562fd10a932cc56d7c4ac0828b1cd8c84b1423150c0d808db3757e0366a52fefa405e4aa4a98003984f

Download Submit
C:\Windows\SysWOW64\Epmmqheb.exe

Filesize
163KB

MD5
ee95db542029a0059fc277baf7d8f982

SHA1
0332623bda1794f123d747e5190bfe3450220d34

SHA256
2043ad48a0637a7537f096c30c8215cc498c458f183cf791fd5a685cb4353615

SHA512
9d6393d05980dc47074d3d079b315fc4299506c34e412958652101e649b3fb9fdf0194cbc805e8cf54d6c255abbd31d96b4ebfd345800884bf708f4157663286

Download Submit
C:\Windows\SysWOW64\Fbpchb32.exe

Filesize
163KB

MD5
90c729f23da4b86fde97b2b4a4db43e5

SHA1
6a6c06df87c0535af7af24a7f4f0ab51efed25a5

SHA256
d8105acc1e75419759bd24bfce49d5c71de6c89a050417de06e92a7b01f67f3b

SHA512
7b8adc9cc62ca6beda9ad6508b6583aa861dc88fcbbe2bbb901550723995d0a60090b247c3f306b5b851f75b9d47d822f771a77ea702608f2c40b97b0e83a858

Download Submit
C:\Windows\SysWOW64\Fechomko.exe

Filesize
163KB

MD5
382d03c11ec49940e76e98bb42a51a65

SHA1
4e971d8af62f2e05c6518e999fee1103e63fa25c

SHA256
a6128ed3c75b95347be0fcb1b30065023ed525e4410b96e8fded822d269852f5

SHA512
dfbce7fa8b5a689be30b074e92cd5a4331936e8d7f248d8d13b4192f5f7ec0a50ecbf41501efcde922c9a6af8ed106a07067dc7177e2ae968d89a685765c697a

Download Submit
C:\Windows\SysWOW64\Fefedmil.exe

Filesize
163KB

MD5
62c4bbd8870e31725b6d48d50749e8c1

SHA1
39a23a7f2ba4daa17bf02f11f47521273b2283c4

SHA256
2f2e49d6222875a6d52a34f1bf46f28584549454bc3260ed4b9c3faf00130ff3

SHA512
26affc3b0624a9c54cd7219c2c26d7c04cd976a634238ade752191d3b9012663f63efd591eadba57797191277e8ae349df7ffd11d79f99f120c23e1e6010b859

Download Submit
C:\Windows\SysWOW64\Ffnknafg.exe

Filesize
163KB

MD5
69d29b98f237b58a7dd35695700ec0ae

SHA1
eafd42cd89d7e56919579290138599f50e075862

SHA256
22e1f4bd30281cf6d02f499ede9091ba05f69ee2225c73a53e8d4cab47136167

SHA512
172f31ac3d05df603e8fd9df24f37c929790ec6a472aa388c50c0c41a61feab9e7ae2800f856db8347ce7b236ac57b3574bef0dce41d8e04d8fd3f1266a665ab

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
163KB

MD5
3dc82e6f6878ef15e8891b726784f590

SHA1
4f0ad94d61d4245010580cf8cddd539fb73011b1

SHA256
9fd2431bd766c9ad09e242a8e44528f34007de9d2b4f45e9af87f91621f949d5

SHA512
110ea3753c9398842c873d0698f5a650753b48381344cb6302f59eeafd5a6144de62766846887a107d595443557d77a5132a4f6aa59df009af15371c54013815

Download Submit
C:\Windows\SysWOW64\Flmqlg32.exe

Filesize
163KB

MD5
263484a780bc39aa81303665f768c8f8

SHA1
56b0d805aa2bbc31dc63ab25a1924ac4ef370105

SHA256
8f2a9ea2d5a010109af1b3b3ab1c9df27f0c0fb693bc6005e0a86d937cb89498

SHA512
9a500e37f193814cba801c5539d9b1ef3929e0ef2ad1b11ad820a54563cae3b3d3449ba1014a62a61017cf9134494de71199c0b2a1cb906f01fbe7c52d1335f5

Download Submit
C:\Windows\SysWOW64\Flpmagqi.exe

Filesize
163KB

MD5
16e2b2dad78bd9f6bd6067592f37aa89

SHA1
420d3b2f2aa784dde6ffebb1d98d030d332eb3b0

SHA256
e3ed4b1227b03d1f597042eed92c86afe0e8bddd2abaa9c749d40b8b55f9978f

SHA512
015fadfc5880dcbc41bf533d3c1b52fdf8b159cc0e6f2135d9e4122673a27a7dde656fa45f498f9aaf58de1aaa190becacf3138d7eb322f32b86e2f6f846fe60

Download Submit
C:\Windows\SysWOW64\Fpgpgfmh.exe

Filesize
163KB

MD5
6e5de94f3d0a1c8746977cae927b5fa2

SHA1
f5056ed97a40a4119ffb252f955ab2403f416430

SHA256
87e7f1e9990f93f6e57929b8313471423e7929fcd8cbaa301ddae0ee34fb9ef3

SHA512
2368854002170bed2b6c05916c2ce2452ec8bb87c97222584554357edf2e119cb5edf198692040cebecf7ab440753690970c31fd4989a2b51e07b8a97b4cb65a

Download Submit
C:\Windows\SysWOW64\Gbnoiqdq.exe

Filesize
163KB

MD5
ae404cd3d668384fd4b6ca156f4457e4

SHA1
7b84394aa4cb336d89fb82d29c374ed96460579b

SHA256
5332f1ff2f73457c4aa8cf5dbe12067004891d874173e73833fc26deec0829da

SHA512
c3c4448082ad5c681bf0b5f064b18fbb53cf58aa4e1a59e9be71e1db256be36ca77a0bd0fdd46e89829f0c898382f5392e44837f67068af6bb8033e1f0f6ce2d

Download Submit
C:\Windows\SysWOW64\Gehbjm32.exe

Filesize
163KB

MD5
a32e4f9a6881981882a5fa52b6330107

SHA1
46fe5e3787452758aadeaf782cbe72ca6804483e

SHA256
4b78b49facd8a91f306cd335410a2b299459f4c2f4d4c15f57818bdb18f8edce

SHA512
42477e9e5aa45465bd2d33e26dd5326564b5dbc714a4bc7926be69ed71bdcbe1a253008cd9a52e0f4f3381dcb36ec5979ea567e5cff6c330c5f44eb00f06dc85

Download Submit
C:\Windows\SysWOW64\Geohklaa.exe

Filesize
163KB

MD5
653be2d03db64bd354071381b223c8ab

SHA1
132c063b0ef0fc427078c6f49cfd9081a896182b

SHA256
4dc70873201f62278d4af4fbc43c3103e5b7d17fb012c23e2fcc135fe258a3a0

SHA512
7befc91576ef9c828e365dc3cc06de520c3d362d6bd5c225f7f4db9cc4f95faf84983e5de638c17627b1859659a679d700d8a6207114208e6fd85d23f801a266

Download Submit
C:\Windows\SysWOW64\Gimqajgh.exe

Filesize
163KB

MD5
f582e0a72cdf3ad844eaf18d9a2b2e6a

SHA1
9aed52e8b6ba1e8e6356782e97d4e51844436baa

SHA256
a8ebe9deccf2e113c854c61cef814e106b8a2896a153443ef2162cd1f20ac8c0

SHA512
6871d76589bb003035c083cac0422ce35ab9bc1b6d47d1fda5146211c926bb5ba6eafa203c55aafc192e3662f11364bf561e626fb5313605a551b0aa59219f7b

Download Submit
C:\Windows\SysWOW64\Gmafajfi.exe

Filesize
163KB

MD5
98aae0a82073100dede987c17c1bd936

SHA1
4c34742526cbe41840121c9745101c78e7eab18d

SHA256
0f6868486052349cc6b9c28ad4a23bf0da9d05417b0ed759aba2f62c99e463ba

SHA512
98d991f292695647ec207e8b93b817611527a57a5c42806213d6c5ba9aab724202615e70a9c04fe66ecb2f638f0aeb9f040111c0b769ff15a0d679c29c874db3

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
163KB

MD5
284db7a418dc6c89eee2c2dd3e9c4c34

SHA1
b0ee51241d6ade5509bcd47ae44871748458b744

SHA256
6aef53754c919a90f0280eedea7a359b54602f266db19d34d34988884e991f21

SHA512
fee0afd57daa71319989c238b84dcd3e19ed4e66b9284a2b8068350f876047bd48b45bcc87c9a8dccbba0f18e06333acdd2f62ca75b86b42907139d3cd8e7d43

Download Submit
C:\Windows\SysWOW64\Gpbpbecj.exe

Filesize
163KB

MD5
c9cee872747ac8fc974f6cd88c41cbfd

SHA1
0a54353b11dac5caa72fd62aebef3136f20c59ac

SHA256
f4d56cdec4624a21c63511a3726650a8c2b9d5782d35d07fd2454748edf07b81

SHA512
c23cb613b230d2a73491ca119ef47b0e4724c5f5c551fc30489c4ab9fb52b3ea25232fd5e8ad1bc6e748cde7eedaeb007b4f749fece14d7481244bb60d606095

Download Submit
C:\Windows\SysWOW64\Gpelhd32.exe

Filesize
163KB

MD5
14039afb199df746781db045c3ffbaa4

SHA1
ba1801faa46b98ce2ff27b915e749773cdcd242a

SHA256
acb3d4ea7290237b35e8dfb31d6105ea363e1890ecf800e21e07ccf6f7164716

SHA512
f428df481170bab0b2d6216a97d468cb0c2dacbd084d122c8e659fb6d11011d4d96ad700e7e1c72ebd1fada95df7772370daab28bdc3ed7eef1f97e2a6317e7e

Download Submit
C:\Windows\SysWOW64\Gpgind32.exe

Filesize
163KB

MD5
d522654e385dee35166c161d1f57f05e

SHA1
231eba2c5e2f1605579ac8d3003660c5747dcf5e

SHA256
60948d5dc04683010abb0e7a927325f4774fdf2ed0d4205b999e9bccb335b31a

SHA512
8eb8433b248066fc8a37c0edd1e9c8d3240c85687a018249fafc37fd3e83637c640bbee19d08f680fdb3ff280671c8240d56fc16c0fcd28d65fe733146b465ad

Download Submit
C:\Windows\SysWOW64\Hfhgkmpj.exe

Filesize
163KB

MD5
8405906f2c28ea53f7ce178212e27907

SHA1
d8e71ac68e40f168cfe0ae3bfe3e993db3dbe623

SHA256
96864eea813eeb33386369314e524446fa78089aadf3a093e5a3e14a3b518602

SHA512
df50fc8fbae8c9def8195090e5d60e6d3a20bbb1bf07f0712fab825e862acc040dc75dae7581c10f2173f06f60269ae89e9536dafc002753f0a5ef710a59b139

Download Submit
C:\Windows\SysWOW64\Hidgai32.exe

Filesize
163KB

MD5
904dc3cf9b5c2e8fa7984345f20562d3

SHA1
29e1fe7012156c10503b3d3cb20dc4c80e9eb6d9

SHA256
412e08b80bf8474e1fbb9a7066c53c4ee1a354210718e5333300ad780b0f2cf8

SHA512
2a73666357bae92089790197542f7e0f4f4f6176d3014e71b05ccc3acd265463aad332d4ca899257e3869d5ce993b142ea0aed7035ee7de3e76ba5f2ab038c70

Download Submit
C:\Windows\SysWOW64\Hmmfmhll.exe

Filesize
163KB

MD5
3ee30419c920b65c93495ee4683dbf4c

SHA1
2c8241e6d879f5173fbc24dadd13e6abcb0f2365

SHA256
62c90c584047718ff025de2a2fe8a914510eea5e33e4b2369367b17b2d3f4446

SHA512
816d15db90b74aa2632585d833a688fdfe9b33487cc0f3a6be511431788f114760592cf14221bc170ba596f3f19b6105abf19af3a58bf98967c9c2874dd1e7dc

Download Submit
C:\Windows\SysWOW64\Jljbeali.exe

Filesize
163KB

MD5
9522f83ac7660bb584a8d46c45318247

SHA1
a603a440cb0c1710cd80b9d8fe39b92c352127ea

SHA256
b645e3236991238e2dd63e5da4cecbbfafe555abe40aef8f462b38af78773ae1

SHA512
dbefa33f1f877aea5c1ec5915e3706f9099cc971e69e2211d6728f379eeecce40e40f99df16272ef44d46addbe19c117cdb585761848c1956e6a4e03ca15d57c

Download Submit
C:\Windows\SysWOW64\Jpaekqhh.exe

Filesize
163KB

MD5
94e6618818b4e679842fc16f3d242595

SHA1
592ed1b58c0081fed8a715f4988d5a70010377a2

SHA256
8f038e710c76ded157fe8e7d216bf1d20be87d4a9fc998c7f8fce776abcd0290

SHA512
8f8992b60529fe606a93339b1c53ecd543c1132d7a5c5aad1a1d6be5fe6699ab8376d9119f75579ec7cf77e3d3ca29caf3d62cadbd1c45762b94cd2b75b00715

Download Submit
C:\Windows\SysWOW64\Kcidmkpq.exe

Filesize
163KB

MD5
246c8d24b108ade09494e3aff84eb174

SHA1
3892c4d92165314623143c49c99294dd7eabc529

SHA256
f83bb52f26d74101f416dce1e70b9cb949ba0c14e9d6b0b6a7b311118afaaa23

SHA512
956419c71123edfc4d64bfd99fcac14e87bcae11ff1ee19d5e94a46de70e8ad3a0ce96d3becabfb683f239f65a19833601cea34b604baca69d37c28992160238

Download Submit
C:\Windows\SysWOW64\Kpoalo32.exe

Filesize
163KB

MD5
cb0bf7f7192e5d1b930dea77c0772a48

SHA1
d0c0161c269feba5371b154a300ffb46b60f2ff9

SHA256
959d421d28c963c0e9a59876c278084925a31dfae6c8c968260012dbdc55fa1a

SHA512
11c1610b1db70825e0741787987e05feb17e657e526c2f800caf7d076b1d4827204ce4bedc9a626b815cc46bac85ff8fced883514df37f1e40a0f01b43dfdf24

Download Submit
C:\Windows\SysWOW64\Njfkmphe.exe

Filesize
163KB

MD5
ddd3b9edf430510cd5162b229f9e1dbd

SHA1
77162e20f4b0dbcea7ed299ca581e5fb044d663f

SHA256
902997116f2bef6ab27964e8cb1eebb215b1e24f03a06bc24ecd455dd53fa255

SHA512
63bb191a749f7345ffc91ab964f2829dfb645f9e93da28261690c0bc20aec9fc34b9ebf7cfbb2a012c4b2482c889f197ac6539b0ccb2a1c988daf8b1290cdc78

Download Submit
C:\Windows\SysWOW64\Nnojho32.exe

Filesize
163KB

MD5
846b12c0b2142f562ec0d511bde3117b

SHA1
bc279a48ebd19c0ab247a322d4041e9b9e16cdf2

SHA256
1bfa14da3e73e273b9182c4421bd00db6596386db2eeaa3a46122f8c8e12824a

SHA512
7b2f42537a21eab1f0a7bf541c56088c92f82e68cbb71a22cda37653c4b4c53150637a6d0bdb39276e5430c802199c0b19d99c9d84f52d8109391cc8564233a6

Download Submit
C:\Windows\SysWOW64\Npepkf32.exe

Filesize
163KB

MD5
c247a170bca908f7001f317f9640aeeb

SHA1
ec55f217e7c046c0009c42b3f838b1051f9a53f3

SHA256
4956536fb404e726e23acb9aceab385ee202dee349e86d05e93faf788463d080

SHA512
39885d590979ace4577d049e9b495ecb30a14c88210bd61c90f8fe4d0bd9eca80b4e3064e89c41f144e3120667da6d7665edb60d642ad945c7c6664ebf2e4eb7

Download Submit
C:\Windows\SysWOW64\Ojdgnn32.exe

Filesize
163KB

MD5
dc75fada92a482a1fb2a608f163e26dc

SHA1
48eadb901c8a2849e78e9d45e95cc04db5bc89c2

SHA256
6b64db4a6960ee320e134c0577c9f0695650a356048ca40659793bde0918e459

SHA512
57d0f5c8db2f338d78df2bbe6566fb76a9841db2100c56eb7967fc9bf63a57c17bf6706404061117105e65e1c4eb9f4611f9ca7f118d14a2898495b2d95301d5

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
163KB

MD5
a50c331c0cbe6b8e0b419445192a5134

SHA1
7c8959ee59bd21245d7057fe11eae57d6768c279

SHA256
77708ece7a16a1e834bcba4b49a93b0838c4255a3020962ec717ce79d8a67c41

SHA512
f9bde902c0c469a97c56e2f1b51fad5d46cb94d56f7c1ad7d0489f90d42afbcdd4181dbc2f0e4d884982ee7c837d5ac4240bb18002f774f9d33f0b6b53da85de

Download Submit
C:\Windows\SysWOW64\Opclldhj.exe

Filesize
163KB

MD5
684d0fc63c43fd7412eae6d448f3c2c7

SHA1
cf9f32827d33dc812635e380267d72f2f1bb07c6

SHA256
be35989579adbed1b129085a760686227e14e4dbec683d3501adf558685dfa78

SHA512
2bbab0fc8b5117b175f3644343b9ec29ec61e4580ee9dc2c608272a84d0394fdb1ca9d3b2d4250f414868cabb1ac819a8ad34daf00de7d3b98055725008b5191

Download Submit
C:\Windows\SysWOW64\Phonha32.exe

Filesize
163KB

MD5
6a5d9a68696efd8e4900cfb69a3710d8

SHA1
f2c5681e3ccb22ffcf04862a61f96173fa0f2abc

SHA256
0405a833a35eaf29e8cc672ce3493e4ec3e5da0ad2acb41cb3d58a2b922fbf56

SHA512
b485e5cb0295b9c5b19c5a4fd4730915779c952eabdb6191cd52f4da0b5627cc3bedcf704d0538097c54e724a9af81f3bca50a8e89cb8c6b67409cf5ad2af1cb

Download Submit
C:\Windows\SysWOW64\Qpeahb32.exe

Filesize
163KB

MD5
46e1119548f8dc0301107970bde1a7a5

SHA1
3613aac161256064dbe145b99dbcfac12747534f

SHA256
6b7b2506c50580c403a6a0e64b6a05b404c4944268150e071f768ee6f4ab6722

SHA512
77df3687ec2ca9aff15bf6825f5375bffb9a28517650249fae1c78ec77f3e42980b73b591074241b377169447f19ed1a4b9d1cf987ddaa5ac581398d2e0ed142

Download Submit
memory/212-311-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/212-1630-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/544-551-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/544-8-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/644-177-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/700-105-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/728-497-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/748-453-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/792-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/856-425-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/896-232-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/948-431-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/952-533-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1116-323-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1128-552-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1192-1583-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1192-455-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1388-604-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1388-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1404-437-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1484-1579-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1484-467-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1508-401-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1556-539-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1556-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1556-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/1568-275-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1588-137-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1748-419-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2008-527-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2064-57-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2064-591-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2124-80-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2160-335-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2176-192-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2196-347-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2220-1637-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2220-293-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2232-565-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2232-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2272-388-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2280-341-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2284-121-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2340-248-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2572-317-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2604-287-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2648-521-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2760-413-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2772-353-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2908-371-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2960-377-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3044-241-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3052-473-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3076-545-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3216-305-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3328-185-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3408-491-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3436-571-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3436-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3524-584-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3524-48-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3604-485-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3684-216-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3780-144-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3836-1602-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3836-395-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3848-515-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3856-503-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3856-1565-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3988-479-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4060-263-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4080-169-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4220-200-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4232-64-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4232-598-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4244-359-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4260-443-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4292-225-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4344-577-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4344-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4352-509-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4468-461-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4476-160-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4620-299-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4648-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4648-558-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4740-281-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4752-152-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4792-209-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4824-112-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4836-407-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4900-365-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4960-256-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4968-389-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4984-329-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4996-269-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5100-128-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5116-96-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5156-559-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5244-1545-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5288-1463-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5312-578-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5364-589-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5412-592-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5420-1475-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5772-1492-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5908-1519-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6028-1485-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6124-1509-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6152-1361-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6288-1431-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6708-1375-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6792-1348-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6800-1326-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7096-1342-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7132-1331-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download