berbew | d868a5a11728e66f093a17d18226849dad7dfeebac2325537fb8c4169082806b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d868a5a11728e66f093a17d18226849dad7dfeebac2325537fb8c4169082806b.exe
Size

76KB
MD5

6c519d3982a108aa8b02e75bd3fd346d
SHA1

66d9003729f7a818ee10762cfaf64185f7e08400
SHA256

d868a5a11728e66f093a17d18226849dad7dfeebac2325537fb8c4169082806b
SHA512

e30acde5510d98ec84989723d71a7fe53889ae5881907f4a7db594ae1d256ccf8ec5b5bbdcf07be90ad73bf84a838db55705b885b41461701913643c5fedf594
SSDEEP

1536:QVEv4aYUUJ4QgqiQlljnBRH7L3HioQV+/eCeyvCQ4:WaYCGiQlljBN3Hrk+u

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foapaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jojdlfeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfbaalbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgjoif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edionhpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgoakc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkaclqkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jidinqpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfenglqf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmipdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhdbhifj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dggbcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqdpgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocjoadei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jikoopij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqdpgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpnakk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Halhfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojomcopk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbgkei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gihpkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhkbdmbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahaceo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cponen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpegkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpiqfima.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmblagmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipihpkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pblajhje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkphhgfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dggbcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Halhfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbccge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jahqiaeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klggli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phonha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehbnigjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glhimp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbhmbdle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdnhih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaclqkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kofdhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nblolm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppolhcnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jafdcbge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpbjfjci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nblolm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfmmplad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laiipofp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pimfpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgeenfog.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
752	Nggnadib.exe
1308	Nmdgikhi.exe
704	Ngjkfd32.exe
2144	Nncccnol.exe
652	Npepkf32.exe
1208	Nfohgqlg.exe
4704	Nmipdk32.exe
4024	Ngndaccj.exe
4772	Nnhmnn32.exe
2564	Npiiffqe.exe
2256	Ojomcopk.exe
3788	Omnjojpo.exe
4020	Ocgbld32.exe
2652	Offnhpfo.exe
4668	Ompfej32.exe
988	Ocjoadei.exe
2848	Onocomdo.exe
1004	Oanokhdb.exe
1676	Oghghb32.exe
2248	Omdppiif.exe
5052	Ocohmc32.exe
2488	Ondljl32.exe
2344	Pjkmomfn.exe
2736	Phonha32.exe
4180	Pmlfqh32.exe
4136	Phajna32.exe
1116	Pffgom32.exe
3172	Ppolhcnm.exe
3848	Pmblagmf.exe
3484	Qhhpop32.exe
3688	Qaqegecm.exe
2296	Qfmmplad.exe
1964	Qacameaj.exe
3580	Qdaniq32.exe
2700	Afpjel32.exe
2656	Aogbfi32.exe
4328	Amjbbfgo.exe
1556	Aphnnafb.exe
2932	Adcjop32.exe
4120	Aoioli32.exe
4656	Aagkhd32.exe
3996	Ahaceo32.exe
4960	Aokkahlo.exe
2568	Amnlme32.exe
2036	Adhdjpjf.exe
2968	Aonhghjl.exe
1696	Amqhbe32.exe
2804	Agimkk32.exe
1632	Amcehdod.exe
3108	Apaadpng.exe
4980	Bobabg32.exe
1752	Bhkfkmmg.exe
1888	Bkibgh32.exe
4012	Bdagpnbk.exe
4900	Bgpcliao.exe
1080	Bphgeo32.exe
468	Bgbpaipl.exe
1944	Bnlhncgi.exe
2756	Bhblllfo.exe
3480	Bkphhgfc.exe
4272	Boldhf32.exe
2828	Bajqda32.exe
2948	Cdimqm32.exe
3908	Cggimh32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Qedegh32.dll	Oghghb32.exe
File created	C:\Windows\SysWOW64\Pmlfqh32.exe	Phonha32.exe
File created	C:\Windows\SysWOW64\Kedlip32.exe	Jahqiaeb.exe
File created	C:\Windows\SysWOW64\Likhem32.exe	Kadpdp32.exe
File created	C:\Windows\SysWOW64\Knnele32.dll	Klbnajqc.exe
File created	C:\Windows\SysWOW64\Aepjgm32.dll	Npiiffqe.exe
File created	C:\Windows\SysWOW64\Qacameaj.exe	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Kjamidgd.dll	Adcjop32.exe
File created	C:\Windows\SysWOW64\Agimkk32.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Fgmdec32.exe	Fdnhih32.exe
File created	C:\Windows\SysWOW64\Feenjgfq.exe	Fbgbnkfm.exe
File created	C:\Windows\SysWOW64\Pjmmpa32.dll	Halhfe32.exe
File created	C:\Windows\SysWOW64\Pimfpc32.exe	Pcpnhl32.exe
File opened for modification	C:\Windows\SysWOW64\Dgeenfog.exe	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Bfcklp32.dll	Fgoakc32.exe
File opened for modification	C:\Windows\SysWOW64\Fbgbnkfm.exe	Fohfbpgi.exe
File created	C:\Windows\SysWOW64\Gedhfp32.dll	Gicgpelg.exe
File created	C:\Windows\SysWOW64\Pkffgpdd.dll	Khbiello.exe
File created	C:\Windows\SysWOW64\Jbepme32.exe	Jojdlfeo.exe
File opened for modification	C:\Windows\SysWOW64\Objkmkjj.exe	Oqhoeb32.exe
File opened for modification	C:\Windows\SysWOW64\Ngndaccj.exe	Nmipdk32.exe
File created	C:\Windows\SysWOW64\Lcfidb32.exe	Lojmcdgl.exe
File created	C:\Windows\SysWOW64\Debcil32.dll	Nhegig32.exe
File created	C:\Windows\SysWOW64\Ddnobj32.exe	Dgjoif32.exe
File opened for modification	C:\Windows\SysWOW64\Dglkoeio.exe	Ddnobj32.exe
File created	C:\Windows\SysWOW64\Foapaa32.exe	Fqppci32.exe
File created	C:\Windows\SysWOW64\Ceknlgnl.dll	Glhimp32.exe
File opened for modification	C:\Windows\SysWOW64\Jblmgf32.exe	Joqafgni.exe
File created	C:\Windows\SysWOW64\Jpegkj32.exe	Jlikkkhn.exe
File opened for modification	C:\Windows\SysWOW64\Jpegkj32.exe	Jlikkkhn.exe
File created	C:\Windows\SysWOW64\Nblolm32.exe	Nciopppp.exe
File opened for modification	C:\Windows\SysWOW64\Ojomcopk.exe	Npiiffqe.exe
File created	C:\Windows\SysWOW64\Lbpflbpa.dll	Offnhpfo.exe
File opened for modification	C:\Windows\SysWOW64\Omdppiif.exe	Oghghb32.exe
File opened for modification	C:\Windows\SysWOW64\Ocohmc32.exe	Omdppiif.exe
File created	C:\Windows\SysWOW64\Fkdjqkoj.dll	Gejhef32.exe
File created	C:\Windows\SysWOW64\Joqafgni.exe	Jpnakk32.exe
File opened for modification	C:\Windows\SysWOW64\Jhplpl32.exe	Jeapcq32.exe
File created	C:\Windows\SysWOW64\Ibmlia32.dll	Cggimh32.exe
File created	C:\Windows\SysWOW64\Fkikinpo.dll	Ddnobj32.exe
File created	C:\Windows\SysWOW64\Fohfbpgi.exe	Fkmjaa32.exe
File created	C:\Windows\SysWOW64\Lhqefjpo.exe	Lebijnak.exe
File created	C:\Windows\SysWOW64\Enalem32.dll	Ipihpkkd.exe
File created	C:\Windows\SysWOW64\Cgpfqchb.dll	Jeocna32.exe
File created	C:\Windows\SysWOW64\Phajna32.exe	Pmlfqh32.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Agimkk32.exe
File opened for modification	C:\Windows\SysWOW64\Fdnhih32.exe	Foapaa32.exe
File created	C:\Windows\SysWOW64\Fkofga32.exe	Feenjgfq.exe
File opened for modification	C:\Windows\SysWOW64\Gokbgpeg.exe	Fkofga32.exe
File created	C:\Windows\SysWOW64\Jojdlfeo.exe	Jllhpkfk.exe
File created	C:\Windows\SysWOW64\Ngckdnpn.dll	Gbkkik32.exe
File opened for modification	C:\Windows\SysWOW64\Gihpkd32.exe	Gnblnlhl.exe
File created	C:\Windows\SysWOW64\Pjlcjf32.exe	Pbekii32.exe
File created	C:\Windows\SysWOW64\Lnmodnoo.dll	Nfohgqlg.exe
File opened for modification	C:\Windows\SysWOW64\Eoepebho.exe	Eqdpgk32.exe
File created	C:\Windows\SysWOW64\Fqgedh32.exe	Fgoakc32.exe
File created	C:\Windows\SysWOW64\Mjlalkmd.exe	Mbdiknlb.exe
File opened for modification	C:\Windows\SysWOW64\Nhhdnf32.exe	Nbnlaldg.exe
File created	C:\Windows\SysWOW64\Nodiqp32.exe	Nqaiecjd.exe
File opened for modification	C:\Windows\SysWOW64\Hbgkei32.exe	Hlmchoan.exe
File created	C:\Windows\SysWOW64\Ocohmc32.exe	Omdppiif.exe
File created	C:\Windows\SysWOW64\Dggbcf32.exe	Dhdbhifj.exe
File opened for modification	C:\Windows\SysWOW64\Eqdpgk32.exe	Dglkoeio.exe
File opened for modification	C:\Windows\SysWOW64\Fgmdec32.exe	Fdnhih32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7616	7428	WerFault.exe	318

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apaadpng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coegoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaajhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcdeeq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbjddh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adcjop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cponen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Joqafgni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jojdlfeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocjoadei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laiipofp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Damfao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqaiecjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjaleemj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokkahlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpbjfjci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbepme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpiqfima.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjlcjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oanokhdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppolhcnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqpfmlce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggkqgaol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbdiknlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pimfpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaebef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lakfeodm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oghghb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agimkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhblllfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gihpkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcclncbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phajna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bobabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahmfpap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehbnigjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jihbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npepkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fohfbpgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnpphljo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipihpkkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nblolm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Objkmkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iamamcop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offnhpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ondljl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckebcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dglkoeio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkmjaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boldhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Galoohke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlbejloe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kedlip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhqefjpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdaniq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pciqnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngndaccj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnhmnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmmplad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebdlangb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbgkei32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpenlneh.dll"	Nhhdnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhhdnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojemig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkikinpo.dll"	Ddnobj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggkqgaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foniaq32.dll"	Likhem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdcajc32.dll"	Mqhfoebo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iijfhbhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debbff32.dll"	Kadpdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbjddh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cponen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjaonjaj.dll"	Ehbnigjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hclkag32.dll"	Gnblnlhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhhqamj.dll"	Nijqcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamhbhe.dll"	Caojpaij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlikkkhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jllhpkfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjmmpa32.dll"	Halhfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbnaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpegkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epoaed32.dll"	Dhdbhifj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opnaqk32.dll"	Gihpkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gaebef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnaqob32.dll"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhgbbckh.dll"	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onocomdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coffgmig.dll"	Gpaihooo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibepke32.dll"	Koonge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkmjaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahkpm32.dll"	Jidinqpb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbpflbpa.dll"	Offnhpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnkdmlfj.dll"	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dggbcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npmknd32.dll"	Jifecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eapjpi32.dll"	Paihlpfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqpfmlce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebdlangb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqgedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flinad32.dll"	Joqafgni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flmlag32.dll"	Jblmgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qckcba32.dll"	Ojemig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmipdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckbcpc32.dll"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcdeeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnkoiaif.dll"	Nbebbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dojpmiij.dll"	Jbepme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnokmj32.dll"	Nciopppp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njgqhicg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ondljl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agimkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Libmeq32.dll"	Gpolbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldjcoje.dll"	Edionhpn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 752	1608	d868a5a11728e66f093a17d18226849dad7dfeebac2325537fb8c4169082806b.exe	83
PID 1608 wrote to memory of 752	1608	d868a5a11728e66f093a17d18226849dad7dfeebac2325537fb8c4169082806b.exe	83
PID 1608 wrote to memory of 752	1608	d868a5a11728e66f093a17d18226849dad7dfeebac2325537fb8c4169082806b.exe	83
PID 752 wrote to memory of 1308	752	Nggnadib.exe	84
PID 752 wrote to memory of 1308	752	Nggnadib.exe	84
PID 752 wrote to memory of 1308	752	Nggnadib.exe	84
PID 1308 wrote to memory of 704	1308	Nmdgikhi.exe	85
PID 1308 wrote to memory of 704	1308	Nmdgikhi.exe	85
PID 1308 wrote to memory of 704	1308	Nmdgikhi.exe	85
PID 704 wrote to memory of 2144	704	Ngjkfd32.exe	86
PID 704 wrote to memory of 2144	704	Ngjkfd32.exe	86
PID 704 wrote to memory of 2144	704	Ngjkfd32.exe	86
PID 2144 wrote to memory of 652	2144	Nncccnol.exe	87
PID 2144 wrote to memory of 652	2144	Nncccnol.exe	87
PID 2144 wrote to memory of 652	2144	Nncccnol.exe	87
PID 652 wrote to memory of 1208	652	Npepkf32.exe	88
PID 652 wrote to memory of 1208	652	Npepkf32.exe	88
PID 652 wrote to memory of 1208	652	Npepkf32.exe	88
PID 1208 wrote to memory of 4704	1208	Nfohgqlg.exe	89
PID 1208 wrote to memory of 4704	1208	Nfohgqlg.exe	89
PID 1208 wrote to memory of 4704	1208	Nfohgqlg.exe	89
PID 4704 wrote to memory of 4024	4704	Nmipdk32.exe	90
PID 4704 wrote to memory of 4024	4704	Nmipdk32.exe	90
PID 4704 wrote to memory of 4024	4704	Nmipdk32.exe	90
PID 4024 wrote to memory of 4772	4024	Ngndaccj.exe	91
PID 4024 wrote to memory of 4772	4024	Ngndaccj.exe	91
PID 4024 wrote to memory of 4772	4024	Ngndaccj.exe	91
PID 4772 wrote to memory of 2564	4772	Nnhmnn32.exe	92
PID 4772 wrote to memory of 2564	4772	Nnhmnn32.exe	92
PID 4772 wrote to memory of 2564	4772	Nnhmnn32.exe	92
PID 2564 wrote to memory of 2256	2564	Npiiffqe.exe	93
PID 2564 wrote to memory of 2256	2564	Npiiffqe.exe	93
PID 2564 wrote to memory of 2256	2564	Npiiffqe.exe	93
PID 2256 wrote to memory of 3788	2256	Ojomcopk.exe	94
PID 2256 wrote to memory of 3788	2256	Ojomcopk.exe	94
PID 2256 wrote to memory of 3788	2256	Ojomcopk.exe	94
PID 3788 wrote to memory of 4020	3788	Omnjojpo.exe	95
PID 3788 wrote to memory of 4020	3788	Omnjojpo.exe	95
PID 3788 wrote to memory of 4020	3788	Omnjojpo.exe	95
PID 4020 wrote to memory of 2652	4020	Ocgbld32.exe	96
PID 4020 wrote to memory of 2652	4020	Ocgbld32.exe	96
PID 4020 wrote to memory of 2652	4020	Ocgbld32.exe	96
PID 2652 wrote to memory of 4668	2652	Offnhpfo.exe	97
PID 2652 wrote to memory of 4668	2652	Offnhpfo.exe	97
PID 2652 wrote to memory of 4668	2652	Offnhpfo.exe	97
PID 4668 wrote to memory of 988	4668	Ompfej32.exe	98
PID 4668 wrote to memory of 988	4668	Ompfej32.exe	98
PID 4668 wrote to memory of 988	4668	Ompfej32.exe	98
PID 988 wrote to memory of 2848	988	Ocjoadei.exe	99
PID 988 wrote to memory of 2848	988	Ocjoadei.exe	99
PID 988 wrote to memory of 2848	988	Ocjoadei.exe	99
PID 2848 wrote to memory of 1004	2848	Onocomdo.exe	100
PID 2848 wrote to memory of 1004	2848	Onocomdo.exe	100
PID 2848 wrote to memory of 1004	2848	Onocomdo.exe	100
PID 1004 wrote to memory of 1676	1004	Oanokhdb.exe	101
PID 1004 wrote to memory of 1676	1004	Oanokhdb.exe	101
PID 1004 wrote to memory of 1676	1004	Oanokhdb.exe	101
PID 1676 wrote to memory of 2248	1676	Oghghb32.exe	102
PID 1676 wrote to memory of 2248	1676	Oghghb32.exe	102
PID 1676 wrote to memory of 2248	1676	Oghghb32.exe	102
PID 2248 wrote to memory of 5052	2248	Omdppiif.exe	103
PID 2248 wrote to memory of 5052	2248	Omdppiif.exe	103
PID 2248 wrote to memory of 5052	2248	Omdppiif.exe	103
PID 5052 wrote to memory of 2488	5052	Ocohmc32.exe	104

C:\Users\Admin\AppData\Local\Temp\d868a5a11728e66f093a17d18226849dad7dfeebac2325537fb8c4169082806b.exe
"C:\Users\Admin\AppData\Local\Temp\d868a5a11728e66f093a17d18226849dad7dfeebac2325537fb8c4169082806b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\Nggnadib.exe
  C:\Windows\system32\Nggnadib.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\Nmdgikhi.exe
    C:\Windows\system32\Nmdgikhi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\SysWOW64\Ngjkfd32.exe
      C:\Windows\system32\Ngjkfd32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2144
      - C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:652
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        24⤵
        Executes dropped EXE
        
        PID:2344
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2736
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4180
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        28⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3172
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3848
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3688
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        34⤵
        Executes dropped EXE
        
        PID:1964
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        36⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2656
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        38⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        41⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4656
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3996
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        45⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2036
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        47⤵
        Executes dropped EXE
        
        PID:2968
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1696
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1632
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1888
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4012
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1080
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        58⤵
        Executes dropped EXE
        
        PID:468
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1944
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2756
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3480
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        63⤵
        Executes dropped EXE
        
        PID:2828
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        64⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3908
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        66⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4456
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        70⤵
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        72⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5028
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:808
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:1252
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1484
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        79⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2132
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4764
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1176
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        84⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        85⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        86⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        87⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        88⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1428
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        91⤵
        Drops file in System32 directory
        
        PID:1248
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1856
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4724
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        94⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        96⤵
        Modifies registry class
        
        PID:2508
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        97⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        98⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        99⤵
        Drops file in System32 directory
        
        PID:3312
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        100⤵
        Drops file in System32 directory
        
        PID:224
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        101⤵
        Drops file in System32 directory
        
        PID:2772
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        102⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        104⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        105⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5252
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5392
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        110⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        111⤵
        Modifies registry class
        
        PID:5540
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        114⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        115⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        116⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        117⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        119⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        120⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        121⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        122⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        123⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2512
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        126⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        127⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        128⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        129⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        130⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        131⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        132⤵
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        133⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        134⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        135⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        137⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        138⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        140⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        144⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        145⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        146⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        147⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        148⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        153⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        154⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        155⤵
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        157⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5260
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        162⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6268
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        165⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        168⤵
        Drops file in System32 directory
        
        PID:6440
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6484
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        170⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        172⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        173⤵
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        174⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6812
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        177⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        178⤵
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        179⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        180⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        184⤵
        Drops file in System32 directory
        
        PID:6216
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        185⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        188⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        189⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        190⤵
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        191⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7084
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        192⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        193⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6344
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        195⤵
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        197⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6600
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6712
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        200⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        201⤵
        Modifies registry class
        
        PID:6844
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        202⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        203⤵
        Modifies registry class
        
        PID:7116
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        204⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6292
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        205⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6476
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        207⤵
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        208⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        209⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        211⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        212⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        213⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        214⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7008
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        216⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        217⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        219⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        220⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        221⤵
        Modifies registry class
        
        PID:6176
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        222⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7180
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7224
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7328
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        227⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        228⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 408
        229⤵
        Program crash
        
        PID:7616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7428 -ip 7428
1⤵
PID:7548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amqhbe32.exe

Filesize
76KB

MD5
bc2117d73e961e0333cff4274121285c

SHA1
9aaaf11311d5c6b9bbefa8e1cb81d7785bbb40d3

SHA256
1953eb03316121907b0793ac906d6475acec56cb3b9a087f8b9def48754de703

SHA512
84876d02d8bd13b3d3303d2e772ef01d56f4a0c6f99d8a388d41a6ff54e2cf42430a7f7e10b277ad1002ec45bb6c780e06c36eab49eebb32ed099d6c12bef21f

Download Submit
C:\Windows\SysWOW64\Bobabg32.exe

Filesize
76KB

MD5
335753869f5222b3686300ce884876bb

SHA1
4cbef72b31a69d74dfe145c08ee2fd3b57877199

SHA256
6fc21d5614d564d95f393ca6c6a2fcbbfd7f06b0c3530d7fc09dd09a1f0b09fc

SHA512
d85a522d5fc112d85f9d6f54e36c8120f2edfb5f5bfa997c61ed804c583c08beb6d84d1ee90e2457257de67d050bd970e709f68b6424ebc83fbe9c5eeff7f817

Download Submit
C:\Windows\SysWOW64\Coegoe32.exe

Filesize
76KB

MD5
ccb497b6eb33da56e473606984c33b19

SHA1
dbae6759fdf122a6e62a843d551f455483dae8d2

SHA256
5b44631483ea04ddd2e8d828a169449d248a3ef66ccc961497c488354864c118

SHA512
e6c75110dfaa1f7b29f20dc8777e3a7365b4249b5ae3c0a89fcaef4e998d95932b3490932853df61eb6257c9ab5983e5d0d89a675b3b9ec8c0eeaa72d486dfec

Download Submit
C:\Windows\SysWOW64\Cponen32.exe

Filesize
76KB

MD5
5e5289295a8d12caf7760dace2ecc6df

SHA1
8308a295f6592f20411728f1bb36d15ce9be5b2d

SHA256
b6613a95519f3cb6b0e623038d9fc79cd2ced761d362fcbb126299bb3fd1c9de

SHA512
dc3dfe0e54b5f462bb645a246b5921df88cc09814131234ea966bf8adbc53c2a356543738baeb4600c2936b15fafce5c4bd4f0f3cd63ac5249a741e28ebdd50c

Download Submit
C:\Windows\SysWOW64\Ehbnigjj.exe

Filesize
76KB

MD5
2b8dc62c833eac6a056ab8591b107031

SHA1
d2ff94ad84c25f8ee66b44cff87d5eca1053ef11

SHA256
3be6f24cf06d70c05d7194cc6f90f24fab0c2a9049ec5a236cbc9e3dc7509142

SHA512
a36bec94f40dbfc9bb4fec04bc6b512e8290f5320027a4e77e929690c6dc9820dae2f8720a780db25cd5efac70f87d5b25af2ddeb606a4bcf68a7db20e5baae2

Download Submit
C:\Windows\SysWOW64\Fbgbnkfm.exe

Filesize
76KB

MD5
77463c3cbe5b4022c3f5f418ca8d3ebf

SHA1
18496465884cb7c34587c40030ca714f3d45dc3c

SHA256
62e098016c5e19c685bb3195455cfc3e650a980d82e6373f1cf0e1e829b7aed0

SHA512
210424c1a33fd1daf5c3a4745a4a85204132b1ba87afb1f0a45dd284d52f5622c66beddd29b50dd1f14a27a1f109ff77253134d6979032f6f1ed396d9b55df1c

Download Submit
C:\Windows\SysWOW64\Fqppci32.exe

Filesize
76KB

MD5
4b695b2aaabb44eeef23cd5f8ca15a8d

SHA1
6af5d93b4a500863e205a709e71f6aa76603c870

SHA256
29408dbf581521a4fd2d3d4b061addfa588eaa54601fc645ce4377f1f2d34439

SHA512
814dee5607a67dc0f87f4c39b089348b7e764ba614ff90e557e971a369645ef5434a63a6bcadbc5a9525e2ce29d45210d9c2a94e8e3462653416f463ef1b5721

Download Submit
C:\Windows\SysWOW64\Glhimp32.exe

Filesize
76KB

MD5
9aefe7f6271ad4d91253fb959c135494

SHA1
5808978abd9ba855873a906d56051fdcfd00701b

SHA256
2469a89b1f00de4c604fe938f70d5457c778d69ae9e95f5ae18636c068a5e897

SHA512
16635fd440ca53c071463be93c63533baadd3832ff9e2d5d7cefd729e097e7544ef1b4324ad5a96c26c65470cd155a91a03eb066875389bc957b04aea269c9fa

Download Submit
C:\Windows\SysWOW64\Hbnaeh32.exe

Filesize
76KB

MD5
1da1137352d89856940d2d4d5b406dc4

SHA1
378305bcbc437acbdcb44493e018d3103c3944e4

SHA256
7b8300328ad7a33876110052d56ff8b7b53a48bf957c5aca48c007c94c4d5cd7

SHA512
ce064d7c8b4eabf84994b6b05151bb981a46db75d9455fa732134f4b4e9a47b4efcfc8778c435c794d60a436493fb5f329edcfd1cd644bf373fd2d73a21b7d4f

Download Submit
C:\Windows\SysWOW64\Hlmchoan.exe

Filesize
76KB

MD5
b6133c9537165e48f67299a971ed5685

SHA1
eb4da5f43947aa7582a2b3ed68d2df349023236b

SHA256
3e1ecc3df34854e86845ef29991a21e8843c5ca2412d5963a85a809e3999cb72

SHA512
05fe1a24be9bb241bdaede47f77634b2beec24169323dd2c773679cc91764748c9f018a1aa137b964d4e2945c387b66c5ad4869bac4fb4858253bcde2f17c96b

Download Submit
C:\Windows\SysWOW64\Iamamcop.exe

Filesize
76KB

MD5
38c0b00f3b8730bf0bf70277e5d6221b

SHA1
7c87d31d8ea5b526faeb4b634930b5193a269ee6

SHA256
9b7e314d24718e66e34254fa9fdf47c16f0d2b8cc9de76edbfefc1cbbd50d330

SHA512
092f9bb382ffce26505ab6c1cd74491f98d36bb1828fe9ff315258950734dca1bf33df228e1c129419901f64b17d56b650a90edaa817c735dc8420e3a833fa57

Download Submit
C:\Windows\SysWOW64\Ilfennic.exe

Filesize
76KB

MD5
55932b2d9870c9cbbf9fc13aba550c09

SHA1
4f127b9408ca6e34d131df1491981494ba8a963a

SHA256
2221dce8e0ad0300aa36d410d20f79c38e30717df2707567ae8007d14360a5e4

SHA512
b862d7bc324c43c1ab4f86a8abee1fb92e06013f976c19d5a16b56f634e37da7a09bae6cfc5d68761a7882e044798521c913b791922e4753179c9f073427ff1a

Download Submit
C:\Windows\SysWOW64\Ipihpkkd.exe

Filesize
64KB

MD5
451a3d5714a47347b1daec05f9fa35de

SHA1
b25ea43e0ca88bc7b26397df52e35ffd2bbdf0fc

SHA256
f11cd41828e1246ef5a53ca990ca3d1ff243491255652e9947389c690c0bcc8f

SHA512
7f0e48f2dbe98b866d6b460f0cfb2584b07f7b5c9b1903fa631b16957714dc1f474a8616a5e041ac6472e5d4b9351c219cd3a22270adb8fab15cce9805e95b81

Download Submit
C:\Windows\SysWOW64\Jaajhb32.exe

Filesize
76KB

MD5
935b703d9150deb1ba608e8eea0a8d8b

SHA1
e928d1d10e3f3f0199e1796cf982859f7ab5e6e0

SHA256
0f55a9b506d3bc7ee3b103c60f088256c1b04cfd0e02dfe50d1c6826ec1de60e

SHA512
6000a6f2e559d490b95e6b08b1a736b50aea2e9dec0b7014efc80deae4f69b08bf5402c2f5ed9e1b4c2162aef375673360123b452e7798bffe771ddf6993802a

Download Submit
C:\Windows\SysWOW64\Jojdlfeo.exe

Filesize
76KB

MD5
6542361d6115960770628871e59e8973

SHA1
3084d43ba00089847bcfb292923b903b8b7faea5

SHA256
c766cbc9d4f259054b504251679901817f5c3e1921e5b8bb3a2e3465f53ec612

SHA512
be721e9d5d5d286d544a33fdaae69a1360aa3b70a850888e60f93277ed3cc584983bf938f74743a853eb3f6e932a9d6c626b0c1b8ee3ad42871622793578bad5

Download Submit
C:\Windows\SysWOW64\Khbiello.exe

Filesize
76KB

MD5
242c384b8a31308b60173b12f2a286c1

SHA1
c3cc49cc4d9a0e42ccd0d0accd722689bbe725c2

SHA256
1efb72759f896b5058c8b346018a97624345b699e182860a0d444e0857d97a73

SHA512
c7d5e297ec4d341d52d51b9fb03c2b93bfe7d33ed9cc6afa1010461a22d18914f7e9eab17d1bc542c3e3c0738987dcfa01dc6756700e39d713529d0f52886980

Download Submit
C:\Windows\SysWOW64\Laiipofp.exe

Filesize
76KB

MD5
3f7ac1a531bce999b0974cc9d4d2adeb

SHA1
d37b55c817b4dc547805a6a2b4f0dde35ecffc23

SHA256
a0725f25c4688f0e35a79b8e8407bab2c7d2bc4e236cd2a60d093a812e32b704

SHA512
288e1c17124b585bcb947552de81b1c5b5b13425fa3c684f2a581d0a784f144cbe1e2ec8f162b6cc0c6605389b697188e6e78726d8e511e9da1b3a6fe90286fa

Download Submit
C:\Windows\SysWOW64\Lpepbgbd.exe

Filesize
76KB

MD5
5f5588129e2279d169dce07c09fd50fa

SHA1
3494038c48410e78c28acc85465bcf3a685132e3

SHA256
f1cff5f31ac081079266ffa7e47b6518ddb14ff19b4ef58bdb2f1a86cade692f

SHA512
7cbac1bdcc43535fadb732a82e1a3048f70e947321a932a166221d6729a85f77119459c544ed1c16ea59c059ee118bf5702b5555085eb7b9fa2770e1f07befd9

Download Submit
C:\Windows\SysWOW64\Mbdiknlb.exe

Filesize
76KB

MD5
9ff242d324e8c8b546b6db864fb52312

SHA1
2e6f807887c6fdd9d8af4e5430ccfd89f64e441f

SHA256
8f692fd26524d6787a024ea59c7bf6b6f027a3679fd7a293aa6fdc4b15653c8f

SHA512
d36abe00ad0f0e8817b4088c364a6aecac00283f57713fd96baf162752190a85ae4d5856351093da093f8007efe9c7f64b1295d80ce4bfeafc6689fb87ea8f26

Download Submit
C:\Windows\SysWOW64\Mfbaalbi.exe

Filesize
76KB

MD5
a2f2c36117041fbcdf4577a0d1ae2e9c

SHA1
2f4c4fb1858effe3d592e3b9a9b5c13e76b29b72

SHA256
c09da6863154a793c96d00891ca5cabf9227da226c8a68ee5958867a85cf9259

SHA512
22f794ebbf3638ad7f9fa7004ab039806ae2910dd9257eccba9e075ea85039f8b031b7f3394d07f5a1785bcc7ad746542fa3210fc740b8009a23ec2d2bf65db0

Download Submit
C:\Windows\SysWOW64\Nbbeml32.exe

Filesize
76KB

MD5
9eafa71ffdfa2bb65e042718f1b738ac

SHA1
4393d37e877ea08c1cd4d13ddb2cb5c97b418279

SHA256
ffc5c240185cee114b4913dc9a868539f50790847ae4d8dfa24eb2df43e44731

SHA512
6aa2ca96c021ba8401043230f2e37489d493d5650b6baabd0de0dd7e0f9ebdd4177f58f4e29968b0e716bdcac45c338d2de130001a346dbbf145bf1512236ecc

Download Submit
C:\Windows\SysWOW64\Nfohgqlg.exe

Filesize
76KB

MD5
d982f29b7edb356df754d4b5debbc1dd

SHA1
bcce17b425d22a34f0225f304daac2ffefd6bb99

SHA256
1e18b5ab3867be4691570fbc190772dfc969be29b7ab5c3b0f9ce97244b3b1a4

SHA512
fc152608981931c3403b5efae8937dfca80c596cafcdf0cf882d937b2085e7f28cf849795a97e5eb0c095e142135d3e69f557823845d7ea7401265d1e41b5d4a

Download Submit
C:\Windows\SysWOW64\Nggnadib.exe

Filesize
76KB

MD5
7dfef3b9f9fae8b34f04627cb3a51782

SHA1
ea672a495e89ebf7eb256275edbd6b73cf621c4e

SHA256
7929b3e6863986e592c377696891d97f875ffe2e47a38958a10ce334f0384138

SHA512
dfaa50ad824130f31f803d85ea1e39aa2bdcce0fb07735373ef6f044de4c32017e45534c065805e9bb16916561da5f6859ef351d6fad504dca1162da4092acf9

Download Submit
C:\Windows\SysWOW64\Ngjkfd32.exe

Filesize
76KB

MD5
46331967021422443e0fa934745048c9

SHA1
5cb53f815bd680b4e2b1fa4e5b8ba7ecdc853173

SHA256
ded46e531dc115d2b6b76a327930ab6a1225e557f7c7862abe6f36b7a20ed701

SHA512
42e7c9b2b6a120fcc28f6e152f9903703213142aaea251c7a643342eea057e9cd8efefe133e000f91b9950f5084b8efbed2c884c130fd765b1fb4ac805c3fe74

Download Submit
C:\Windows\SysWOW64\Ngndaccj.exe

Filesize
76KB

MD5
a05fa2f535afc6618da5c3e70070d894

SHA1
5ecc42f87f6d1890ec17a62e6e6baaef30bb0836

SHA256
417f0f5ce0fca9d82635c57046a1236cbd6f125c61fc4e015ffc9d4bae72d61a

SHA512
1766f742aa6f43a45ffb1f5f80174822b3d2ab1b232b857cc3479378910a9e52ae540d905e98e83b6c56219ede9923225d8f23b0ba3e63e645f48d15e0e99f16

Download Submit
C:\Windows\SysWOW64\Nhegig32.exe

Filesize
76KB

MD5
a699c6eb6181fbe6085fd79619358849

SHA1
bb5563d82edd10975bc004d1cd25470e4f4effae

SHA256
ba85112c37e95bec39d483d261d8a137bd4e56c749069f4b4cb63cc50e7aeaf2

SHA512
b342ae11e58307ddd58179458b39c626885f5816cc1b209eba494b5a43f891a96a5e9bf7c71151a7add5afb2eef8c11b02aa5d796c109c8aa7f378372c96c70e

Download Submit
C:\Windows\SysWOW64\Nmdgikhi.exe

Filesize
76KB

MD5
fe3536d8d522efeaf579fb730a317e99

SHA1
29e8dad16e55e13e166d4708181fc0c480aa8f14

SHA256
a74650588d3e66885e568e259f2494b4aefd69d99d4b4feeb5b06ce022ab964e

SHA512
6eb99ae8948eb87d87abc3cd285fec65d257432799587a9787a5d6de935d64ca04c11284022c2d38c88aaaaa9f135d1d7af66772fd7ee31b1c5322fbbbdca5e9

Download Submit
C:\Windows\SysWOW64\Nmipdk32.exe

Filesize
76KB

MD5
890ba834d2a5bda03503f1157eb5abda

SHA1
ad2ba38bfed9f66f317eb12e969537da50a8301a

SHA256
b108bbbdfc1871b4ab674c13626d085bb82815851333ff9e9cd2017b2da377c3

SHA512
f0af0fdb55b993031e57e90e4f0281d01910ccbeec68b662eeab3512aa2343acb2aef591fd8a6097cb18ee142a7609c0e86c9b3da7f2c3c0fa9423a58bec4c61

Download Submit
C:\Windows\SysWOW64\Nncccnol.exe

Filesize
76KB

MD5
8d1425aa66473dab0943e2659c705fc4

SHA1
cea4f6859cbb2e096b30e714574f5306417c811d

SHA256
6fbcbec15b179b615ead8bd2dd96df35bfbab049d06876cc737a10479e6509e9

SHA512
436e2c5abd1fc7bb64984092d354fed4de6c9b1b645a9f4af8c4c98506013ed38939ef31ea04481aedd7f5412478cf5b3bdb60ac9be9c22f442d0dc45d6c52c7

Download Submit
C:\Windows\SysWOW64\Nnhmnn32.exe

Filesize
76KB

MD5
0bf7813854e105e5b3ef0036c4728494

SHA1
1717d9066d53567f2beb3373dec6b46d2801d62f

SHA256
1870198fa0a0aa36a542a1f255b51689dd414f2354d3a92e9161f45a02def546

SHA512
7d988a692f7911edd5c624aef61820d31634aedbe08b4a5a75817375f378ed7a0c4411888c3fcfef1927828a9d0464d15286045a36d4e2287ad91453f9080191

Download Submit
C:\Windows\SysWOW64\Npepkf32.exe

Filesize
76KB

MD5
7f6a3f82fa0be01e51a5bf17c2e1f566

SHA1
9476bc578196833931e75b098e83c3dc569405d2

SHA256
edb93588866f619205e5d54167f2d12bc05c093ebf5cf57cc6e66d39aec48485

SHA512
a71659ee90901109ebf62f1e0570bd558148c7934419edb729d4ab08d9443b19581e88e1c09bd0b61f1916430071398707c449b68f517e1398ac380a80adcb74

Download Submit
C:\Windows\SysWOW64\Npiiffqe.exe

Filesize
76KB

MD5
b921fd4e37134d92709fef929ec29078

SHA1
47299eb85d30ab91935674115076d6b3f0c0eb2e

SHA256
76f27dcce7747694296bbd4da2acddaa03d5ad097f8ad7f311a8c858ff1d5324

SHA512
3d636f80337901ef0db4616098b598876f4f401d0bd3b4589c605b753c108291fc5475aa61abcf5f8a87e6e94690d84f884ab99e4bf0b1bf6fe52cc8326b30a9

Download Submit
C:\Windows\SysWOW64\Oanokhdb.exe

Filesize
76KB

MD5
0f6c762de6b0756dec00382c47b45a0c

SHA1
152def9f8cedf42e89939e2407a1d1cd2e9d615b

SHA256
e86d1af7d4381df2408b653da0ff06ba7055d92935ca3fefa3fcf826d93bab31

SHA512
92d326a66df24f4927513a79135e9b70d2155a8a57a1c774f8940d0a556eb025dbfa3eb9493830f8d48da23e837844d46b96afc31d0423442003612933d80e40

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
76KB

MD5
4234072627c6787234527c119f73bf9e

SHA1
e56d70b9c1cd99768bd497f047d68d84aefb97e3

SHA256
d402a74fee2578909f4a425bb71f09a158ecacc03920f7def8dae8a06bd802b3

SHA512
c25da5a8cba0d8253153442186984c54b91c7ea13d88f81a2d2d2a1c7c52d2b97249606f78cdec02467c6394fcfece9a3c1cc70eeaea0c4e4c31173b794dca67

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
76KB

MD5
f4470aa2517862b1a51fdc49209905b1

SHA1
19adb884cec11c34fbedea55ee4a2fc874257716

SHA256
eefc69b527fba578c5d016d483db65364b6d4be1ac63c07828274ece9c47b0e7

SHA512
074b5437d2bfb13c9a97da97434643ce13563a02fee140f9fcb2e10ebab99499d531dcb60bfbf05c38bf915eb7e2711db1a6ba6ea52f365348644737b507e4de

Download Submit
C:\Windows\SysWOW64\Ocohmc32.exe

Filesize
76KB

MD5
1f3a34627d80d120253bce185513c9d5

SHA1
6e677ac08420bcb45fc5efa1210f3e0a04527723

SHA256
2b8be4a48bc10139958f4b37f01cf1c58a8b3aaf321e56fe7db1fb8661f0346b

SHA512
b60a1f59feb31a896128b1a097927b81e32fdc225524f52ac2ddff6abfc6dcc34e781310fbcb7d26e8934c7f69614ea1cee3dd413fff2d1215a9a09649eb326f

Download Submit
C:\Windows\SysWOW64\Offnhpfo.exe

Filesize
76KB

MD5
0b0e4824267468e450bb4b7f76b7bfc3

SHA1
7f8ed3bc9adc7d2803a2a1f07c764cd61ec76b46

SHA256
cc45ed3af3fea5111605f7643d9bb1ade9f77f4fa057870c99750165807c53c2

SHA512
0e035591fff3762fd92518973adee9fffcb4fe8e9debf0464bd4327ce1b8e8f2fb9740e4ea08646697139beb57242d851ab1f829e27115291b61c418946118b4

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
76KB

MD5
084e27fa1f4a4e248c2c0e69d774ac5e

SHA1
2ecbfaead3c7d3dc555e91d51372038b363641bb

SHA256
c8a9daa653efd26437eb578b99792d0d469c0a1f5b3169f876b640d0bd80295e

SHA512
6f78c7b6d4c6a1e47146a815f299b8de772ee088d3f0f8a6df36d5ab02fa45abd6ac911a30b2576a426105059e961ecde689bc217c28f2df87632ad027b15059

Download Submit
C:\Windows\SysWOW64\Ojomcopk.exe

Filesize
76KB

MD5
b95ea927467c2214446854d2005c17e0

SHA1
4a41cbecc3471f38d87577e76fe54976aa9f807b

SHA256
57575a506882b7af89b70e82b917d5c754cdec34c1beebe87e9dc97744c2b0b8

SHA512
7c7014c12dcf9f5bdfdf6be3fc9fc4601b7879034ba62695b140bca73369890aa76c2beb011cf073bc1797c970da8d04883a49323add405fdf9e774c7bd69ad5

Download Submit
C:\Windows\SysWOW64\Omdppiif.exe

Filesize
76KB

MD5
cfbdb02f19c7c826c2b94e9d952413f3

SHA1
a9bcf879fa1724c220932aca4c7f6cde8a9dcb92

SHA256
d36ab14d4f07e9887e112b1ba023fc7a964be4a5cb1b69db7169fc2e5b720699

SHA512
755663da6235d456dd842ce046b8966d53cac4056502d56f9e2a8d685c1ff273d6bf7ad27af78d2c0b67eebbdbcbd030299d50d4f1e0559f645a0b44e5998b6a

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
76KB

MD5
87595a0577be7c93f1de2469738eae03

SHA1
c5e1ad79c5893c7e51f192ec935b3d72ce7a54f7

SHA256
5d611ba661b79737a499c631d0f8be42c70abed81d47185da9869b30d76d4702

SHA512
2b42ace41bdb6a01b49a6e057cd65aac4abfcd506dd5bc7c14610025a7aea551a6339944299fa7188a79f2864857c087de3b1085bc6401a988d522d8711d4b53

Download Submit
C:\Windows\SysWOW64\Ompfej32.exe

Filesize
76KB

MD5
fac03c6abe7b4b4455cad215e9700082

SHA1
1b620da8111a0e5a6ac35882444e342f83e2848e

SHA256
8314b44846a77a41b9340b989b7c82bd4016d845421bf138f81d0f7a97778aa8

SHA512
1d9040f7d6e914e533055de07b443899701c31ba59af7bf844dbdfef1ce2fc5cdc85c580261cd5d1c78e4c1b8372229f0fddb972b8685b9b4965c236285f9145

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
76KB

MD5
7f9de21a4ffeb41e88d5282fa7384b0d

SHA1
06de19537affa47b492c9c1314ce2ef359c63c46

SHA256
836df78bb209f1af105913727394a2e67132d29f3f42f4708c96bef9648b7b6c

SHA512
0c44388de07b20cccb6e7dbdca1b6ee956bb6a3a18ce3616803966d5be0b2816e37750a2c5e8d73e4734788b12630ae98a89c147f1b32e62eb3f02f449b5fc14

Download Submit
C:\Windows\SysWOW64\Onocomdo.exe

Filesize
76KB

MD5
3a58a69955bd431fb83ad63ee3cf8753

SHA1
6fb0aca5640361ca243464c779c68c22c212dc95

SHA256
340bf90b87d62257e6fe73d8161cafea1c6915a30db55f1f120ea9208733cb8d

SHA512
d72241756cce4cfbe1138cb9ab95aed53360beeffd5d174e4fc60bd073dc67bab1b61843ae60c6e27707d666c7fa5f1aef74f6e3c0eb274eebeeea66bd066658

Download Submit
C:\Windows\SysWOW64\Oonlfo32.exe

Filesize
76KB

MD5
22d83368c393543310cbf424f3244e33

SHA1
e3a3dcb33bd0830338991da31efb0d0cbadbadca

SHA256
1a40d8191fc4a5b4c11fe739d8bd7bc2266fba1993cd31e3166d05645b9a0da5

SHA512
4542721cf5efe53ae02234c4d0484a43806ed87631ce5e6c1812dbdd64b1493a1e33d3d8b7a694403e71573bc611d9f6597cd0d68b88fc529fa227327feb4058

Download Submit
C:\Windows\SysWOW64\Pffgom32.exe

Filesize
76KB

MD5
9e86bcea760a79d09245058a96d1f2d6

SHA1
b0a0fbd51efc7f965995869c7e8713ac053397b4

SHA256
f6f1f22afa08c95552c1f16106683b77e37791a1c7e58e70111b22f57accf132

SHA512
44204901c937c050ba405b570209535586a992e977ebbcdf6261b4c8d8a9e9e8831f606e440a03eacb46fed5253fbc7c1c3fcd0afd19c7990e3fb602b4c19929

Download Submit
C:\Windows\SysWOW64\Phajna32.exe

Filesize
76KB

MD5
1a5857a81fceb100d144f3967eb492eb

SHA1
a4e4cd4c3699e1daf0adc90751386148fcb236a0

SHA256
fee29846c74324b815ef026e40b9f87fa0f5e832d8ec5ec7ee6a5e7595b17fd1

SHA512
0d3a43d76add34fadcf208601aeb8d0ac78df32db91b070d1434b48fd516afe10c6375e2206232e45aa57fdb503273b2b2f8aa28e358c88c416a12e7f768b00a

Download Submit
C:\Windows\SysWOW64\Phonha32.exe

Filesize
76KB

MD5
afb35eb1e3d82003cf52791222bfe5f0

SHA1
1ee02c9f651d96b21cd22b74dcc2f22129f669f2

SHA256
7a16ebf15ce111718e17ad394f641cdd1596fd6c495bdb5d3ee171b3cd89953e

SHA512
92b1969725f150edea3d79574306ddd9575ee82bdfe95e5761b0b560ff9af04580373c6eecf77c82543a0ac152638d9657388cd4a950d95eb2ea822c7ae4da36

Download Submit
C:\Windows\SysWOW64\Pjaleemj.exe

Filesize
76KB

MD5
a0cea0e4940048462bd9da970b61f7e0

SHA1
9706be5a66893b21bf8faddb72fe01472760ce54

SHA256
8862a66b1c9e06a2929dc756a403f17c10ec61264741d440aaf15046bfb46552

SHA512
022fab68944e76d3f171e54e347e42560d59e253a080b612e9680c575467ed6b39d1ebe34c3dc00cb561ca6c890b38e16ad920163399f3ba01719e4b14e6a540

Download Submit
C:\Windows\SysWOW64\Pjkmomfn.exe

Filesize
76KB

MD5
0c4ddf0539a03d60ca1bbd775bbec14c

SHA1
9ceee938d4820f417ad9dc67fc63393e150dbaea

SHA256
e779cf332e23e89704f5eeedff4769cf27b4543571a6da71babfc82784414fb1

SHA512
4eb7956c5f49d2d3e836234610027591690e782bb1953e315feca465294513028e35c2ff6a95cce40ed1a34437512b67f07ca95c2d368ff1c661c953ae4a6094

Download Submit
C:\Windows\SysWOW64\Pjlcjf32.exe

Filesize
76KB

MD5
ccf7f9639da116365f7358d8e9be3373

SHA1
079eb1a15c3448f2c3be77466f52baed68311c8a

SHA256
cfae2a6be7c01a491bb28864d779ae1ec0c0418a9107c30cfeb90967c6b68a4e

SHA512
27f5bb281189862a2002fbd72f139887a30088b2efba1b1da488a47bb51f41a4417188bc327391a1c89bd9e4642f3826b3b1b38b1e1d42b26fcd58e9c07f42c4

Download Submit
C:\Windows\SysWOW64\Pmblagmf.exe

Filesize
76KB

MD5
51ba991afc0ef3dae2f03cffbdc5b0b6

SHA1
2deb1d8224cd831a06a9affb2562ca9c2397d87a

SHA256
0c17786850c28d48f8d5bd791307833463178367110675d6c84d7df99be2d815

SHA512
9dcbb69579e3e06769ed0a76ed6538ed7e4fd3a20dab7f1584dcb8931a38048db4827c049d019112db83ec134de6e338c991fe3d6856867a7dd0f33c5f6999b1

Download Submit
C:\Windows\SysWOW64\Pmlfqh32.exe

Filesize
76KB

MD5
73e875f8b5d338a7a6b5f8d39cd07ef6

SHA1
dd1e23529e6133ee0f64d049f3c2206cc4d7875c

SHA256
a79f4eb68689e165dbe341c312ab3f974f227aee7a1d234fd26572086c9ad75a

SHA512
c6d1ea91c0a96080850ec9d076775e3eb48d116788999fd5f12cd2d74e93d2790e964c8ff11eca31820010ef689ca02efd02a69f9eee5014c77a92764fea29a3

Download Submit
C:\Windows\SysWOW64\Ppgomnai.exe

Filesize
76KB

MD5
76079564f3433ad2747ad86007599304

SHA1
43d1dd3e72066730268f308c2497e311ef8efc9a

SHA256
a0683ba9eb9acfec855c59cb04260ba40ef88a2e6cb6fbc96c6f9a1b1612476c

SHA512
a138db4295a55c1d0ce8856e012d89faafef3079ce1bfeabc2fc269d5440bec92d25d72b124907dcb63bd80229689617bfd605587b8f41f0d988d96756804c91

Download Submit
C:\Windows\SysWOW64\Ppolhcnm.exe

Filesize
76KB

MD5
f16464f434dfe816036d6ca6b3fa74c6

SHA1
ce0747ac917ed1f1d7bd3d0a65325542065ee9a7

SHA256
168861b22ab9fe4c702b28e633669665e239a372cc1299c66a9f6210ea109d70

SHA512
da4c370626aaf671b012836664a9210551ed0236f51dd95f26d4d58540911e7ebdd16b21b3aa3c3ee13c396132b8ddd49d454110cbab12f93947f672be83089d

Download Submit
C:\Windows\SysWOW64\Qaqegecm.exe

Filesize
76KB

MD5
b9618aef8812378a921ea4de1323529a

SHA1
c14c2f42615a53a2b8efcd1820139bdad422aeef

SHA256
232a0ec500bb0199a7d6347743f9db8fe5a3253c5c64ab1b6dd86f1e6e6ba708

SHA512
0f3eee972d6fa7d0fdcf22747bc10e27cd84fd34c08897ab36121b6852210dd711021b53a047804aea969866d7d8bcc7676dcbe896ec7b498ecc9440a3c70a68

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
76KB

MD5
9750bbbd19049cc78eb8def28f3e50c7

SHA1
c4b6ba9028475cbb23114bff5208eb311cb0633a

SHA256
82dcf764bd3a4d4b1642e0a3dc3b6e85c184012dc602b074eca09a2857837d77

SHA512
a6accd518105aa65035a6021d677b1f2bffd067ffa074f91f7db91b3bf1c474b6152c3781a3fc39c65a115aec6cc78cb9a227b61600090965d8cf3d532b31be3

Download Submit
C:\Windows\SysWOW64\Qhhpop32.exe

Filesize
76KB

MD5
5e890325d6e657a05ae6fa8f4b7fe735

SHA1
3d01d8ae1f7e611f64a8cc615a124c914e86c698

SHA256
d03bbcd62406794694c113aacf0b6821f790c41af9b5de738c99f28b1dd66486

SHA512
38a0f0bd14c327a73abe9bf83586af2bdda676032758c4b6d17f164831e6133b31a6cf4962f809abfcb9f731f0776f05c26e86b57898e84a4e428c6c57b8189b

Download Submit
memory/468-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/652-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/652-580-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/704-566-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/704-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/752-552-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/752-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/808-515-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/988-128-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1004-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1020-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1080-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1116-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1176-560-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1208-587-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1208-48-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1252-525-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1308-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1308-559-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1380-497-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1484-532-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1556-297-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1608-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1608-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/1608-539-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1632-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1676-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1696-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1752-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1888-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1944-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1964-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2036-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2132-540-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2144-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2144-573-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2248-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2256-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2296-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2344-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-176-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2532-537-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2656-286-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2696-572-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2700-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2736-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2756-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2796-546-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2804-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2828-441-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2840-581-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2848-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2932-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2944-574-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2948-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2968-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3108-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3172-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3480-426-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3484-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3580-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3688-248-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3688-1637-0x0000000010010000-0x0000000010037000-memory.dmp

Filesize
156KB

Download
memory/3788-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3812-495-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3848-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3908-453-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3996-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4012-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4020-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4024-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4048-509-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4120-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4136-208-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4180-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4272-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4328-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4456-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4512-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4640-485-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4656-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4668-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4704-594-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4704-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4764-553-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4772-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4900-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4908-473-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4960-328-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5028-503-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5032-588-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5052-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5060-479-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads