berbew | a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe
Size

304KB
MD5

9e001fd4835c64a6cefd27a2063dc520
SHA1

fb52d2799d82880a715207e7292ff9fb07cc3b3a
SHA256

a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885
SHA512

f65fed2d4c69578dcdfdf88354551e52fde80e98db9d786357e23e506efd311bf0601a64cee520ef6610ee976fb34387d55bbd66e756e22e915d6ec651b22bc8
SSDEEP

3072:7TZhadJyYBfJ8eGe4ejz+k5rD0LZSnulc0VP7SnHjg:/ZhmJvBfJ8w4EKIrD0Lu

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Amgapeea.exeBeglgani.exeDjdmffnn.exeDhmgki32.exeDogogcpo.exeAeiofcji.exeCfbkeh32.exeDanecp32.exeDoilmc32.exeDhocqigp.exeAdgbpc32.exeBfabnjjp.exeBchomn32.exeBapiabak.exeDaconoae.exeDeagdn32.exea59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exeBelebq32.exeCegdnopg.exeDhkjej32.exeBhhdil32.exeCmiflbel.exeDobfld32.exeQcgffqei.exeAnogiicl.exeAglemn32.exeBnmcjg32.exeBeihma32.exeCndikf32.exeAqppkd32.exeAgjhgngj.exeBjokdipf.exeDelnin32.exeAminee32.exeChmndlge.exeQfcfml32.exeBfhhoi32.exeBebblb32.exeDfknkg32.exeDdakjkqi.exeQddfkd32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 45 IoCs

Processes:

Qfcfml32.exeQjoankoi.exeQddfkd32.exeQcgffqei.exeAdgbpc32.exeAnogiicl.exeAeiofcji.exeAjfhnjhq.exeAqppkd32.exeAgjhgngj.exeAmgapeea.exeAglemn32.exeAminee32.exeBfabnjjp.exeBebblb32.exeBjokdipf.exeBchomn32.exeBnmcjg32.exeBeglgani.exeBfhhoi32.exeBeihma32.exeBhhdil32.exeBnbmefbg.exeBapiabak.exeBelebq32.exeCndikf32.exeChmndlge.exeCmiflbel.exeCfbkeh32.exeCegdnopg.exeDjdmffnn.exeDanecp32.exeDfknkg32.exeDobfld32.exeDelnin32.exeDhkjej32.exeDodbbdbb.exeDaconoae.exeDdakjkqi.exeDhmgki32.exeDogogcpo.exeDeagdn32.exeDhocqigp.exeDoilmc32.exeDmllipeg.exe

pid	process
2504	Qfcfml32.exe
2216	Qjoankoi.exe
4544	Qddfkd32.exe
3580	Qcgffqei.exe
3688	Adgbpc32.exe
4864	Anogiicl.exe
3152	Aeiofcji.exe
3892	Ajfhnjhq.exe
5072	Aqppkd32.exe
4188	Agjhgngj.exe
3216	Amgapeea.exe
3760	Aglemn32.exe
3564	Aminee32.exe
1448	Bfabnjjp.exe
5112	Bebblb32.exe
2636	Bjokdipf.exe
4552	Bchomn32.exe
1880	Bnmcjg32.exe
5052	Beglgani.exe
4496	Bfhhoi32.exe
736	Beihma32.exe
652	Bhhdil32.exe
4356	Bnbmefbg.exe
1528	Bapiabak.exe
1980	Belebq32.exe
2712	Cndikf32.exe
3212	Chmndlge.exe
1236	Cmiflbel.exe
532	Cfbkeh32.exe
2172	Cegdnopg.exe
228	Djdmffnn.exe
5064	Danecp32.exe
1468	Dfknkg32.exe
1184	Dobfld32.exe
4416	Delnin32.exe
3700	Dhkjej32.exe
216	Dodbbdbb.exe
3568	Daconoae.exe
936	Ddakjkqi.exe
2244	Dhmgki32.exe
464	Dogogcpo.exe
2772	Deagdn32.exe
1780	Dhocqigp.exe
1216	Doilmc32.exe
4476	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

Processes:

Delnin32.exeBebblb32.exeDhocqigp.exeQddfkd32.exeAqppkd32.exeDhkjej32.exeAjfhnjhq.exeBeihma32.exeBeglgani.exeCmiflbel.exeBelebq32.exeDdakjkqi.exeBchomn32.exeBfhhoi32.exeDhmgki32.exeDeagdn32.exeBnmcjg32.exeCegdnopg.exeDanecp32.exeDfknkg32.exeDogogcpo.exeAgjhgngj.exea59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exeAmgapeea.exeAminee32.exeBapiabak.exeQfcfml32.exeBhhdil32.exeChmndlge.exeDaconoae.exeDoilmc32.exeAglemn32.exeBjokdipf.exeCndikf32.exeDjdmffnn.exeDobfld32.exeQcgffqei.exeBnbmefbg.exeDodbbdbb.exeAeiofcji.exeAdgbpc32.exeAnogiicl.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Jdbnaa32.dll	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Ajfhnjhq.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Beihma32.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Beglgani.exe	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Agjhgngj.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Beglgani.exe
File opened for modification	C:\Windows\SysWOW64\Qfcfml32.exe	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Fjbodfcj.dll	Aminee32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Chempj32.dll	Qfcfml32.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Bfhhoi32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Jlklhm32.dll	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Amgapeea.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File opened for modification	C:\Windows\SysWOW64\Aminee32.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Qfcfml32.exe	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Adgbpc32.exe	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qddfkd32.exe
File opened for modification	C:\Windows\SysWOW64\Ajfhnjhq.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Ickfifmb.dll	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Anogiicl.exe	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Aeiofcji.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dogogcpo.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4192 4476 WerFault.exe Dmllipeg.exe

pid	pid_target	process	target process
4192	4476	WerFault.exe	Dmllipeg.exe

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Aqppkd32.exeBapiabak.exeCegdnopg.exeQcgffqei.exeAjfhnjhq.exeBebblb32.exeBeglgani.exeBelebq32.exeDanecp32.exeDoilmc32.exeAgjhgngj.exeAmgapeea.exeAglemn32.exeBnmcjg32.exeDjdmffnn.exeDobfld32.exeDhocqigp.exeQfcfml32.exeQddfkd32.exeBfabnjjp.exeBfhhoi32.exeBhhdil32.exeCndikf32.exeDhkjej32.exeDaconoae.exeDmllipeg.exea59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exeQjoankoi.exeAdgbpc32.exeAnogiicl.exeAeiofcji.exeChmndlge.exeDelnin32.exeDdakjkqi.exeBchomn32.exeBnbmefbg.exeCmiflbel.exeDfknkg32.exeDodbbdbb.exeDeagdn32.exeAminee32.exeBjokdipf.exeBeihma32.exeCfbkeh32.exeDhmgki32.exeDogogcpo.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfcfml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe

Modifies registry class 64 IoCs

Processes:

Bfhhoi32.exeCegdnopg.exeDdakjkqi.exeBchomn32.exeQcgffqei.exeAdgbpc32.exeAgjhgngj.exeBeglgani.exeCndikf32.exeCmiflbel.exeQddfkd32.exeDhkjej32.exeDaconoae.exeDjdmffnn.exeAjfhnjhq.exeDobfld32.exeDeagdn32.exeBelebq32.exeQfcfml32.exeCfbkeh32.exeDodbbdbb.exeAnogiicl.exeBjokdipf.exeDanecp32.exea59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exeBeihma32.exeQjoankoi.exeBhhdil32.exeChmndlge.exeDhocqigp.exeBapiabak.exeBnmcjg32.exeAqppkd32.exeAmgapeea.exeDelnin32.exeBfabnjjp.exeDoilmc32.exeAglemn32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlklhm32.dll"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbnaa32.dll"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Beihma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfgfh32.dll"	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Anogiicl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bhhdil32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exeQfcfml32.exeQjoankoi.exeQddfkd32.exeQcgffqei.exeAdgbpc32.exeAnogiicl.exeAeiofcji.exeAjfhnjhq.exeAqppkd32.exeAgjhgngj.exeAmgapeea.exeAglemn32.exeAminee32.exeBfabnjjp.exeBebblb32.exeBjokdipf.exeBchomn32.exeBnmcjg32.exeBeglgani.exeBfhhoi32.exeBeihma32.exe

description	pid	process	target process
PID 4884 wrote to memory of 2504	4884	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe	Qfcfml32.exe
PID 4884 wrote to memory of 2504	4884	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe	Qfcfml32.exe
PID 4884 wrote to memory of 2504	4884	a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe	Qfcfml32.exe
PID 2504 wrote to memory of 2216	2504	Qfcfml32.exe	Qjoankoi.exe
PID 2504 wrote to memory of 2216	2504	Qfcfml32.exe	Qjoankoi.exe
PID 2504 wrote to memory of 2216	2504	Qfcfml32.exe	Qjoankoi.exe
PID 2216 wrote to memory of 4544	2216	Qjoankoi.exe	Qddfkd32.exe
PID 2216 wrote to memory of 4544	2216	Qjoankoi.exe	Qddfkd32.exe
PID 2216 wrote to memory of 4544	2216	Qjoankoi.exe	Qddfkd32.exe
PID 4544 wrote to memory of 3580	4544	Qddfkd32.exe	Qcgffqei.exe
PID 4544 wrote to memory of 3580	4544	Qddfkd32.exe	Qcgffqei.exe
PID 4544 wrote to memory of 3580	4544	Qddfkd32.exe	Qcgffqei.exe
PID 3580 wrote to memory of 3688	3580	Qcgffqei.exe	Adgbpc32.exe
PID 3580 wrote to memory of 3688	3580	Qcgffqei.exe	Adgbpc32.exe
PID 3580 wrote to memory of 3688	3580	Qcgffqei.exe	Adgbpc32.exe
PID 3688 wrote to memory of 4864	3688	Adgbpc32.exe	Anogiicl.exe
PID 3688 wrote to memory of 4864	3688	Adgbpc32.exe	Anogiicl.exe
PID 3688 wrote to memory of 4864	3688	Adgbpc32.exe	Anogiicl.exe
PID 4864 wrote to memory of 3152	4864	Anogiicl.exe	Aeiofcji.exe
PID 4864 wrote to memory of 3152	4864	Anogiicl.exe	Aeiofcji.exe
PID 4864 wrote to memory of 3152	4864	Anogiicl.exe	Aeiofcji.exe
PID 3152 wrote to memory of 3892	3152	Aeiofcji.exe	Ajfhnjhq.exe
PID 3152 wrote to memory of 3892	3152	Aeiofcji.exe	Ajfhnjhq.exe
PID 3152 wrote to memory of 3892	3152	Aeiofcji.exe	Ajfhnjhq.exe
PID 3892 wrote to memory of 5072	3892	Ajfhnjhq.exe	Aqppkd32.exe
PID 3892 wrote to memory of 5072	3892	Ajfhnjhq.exe	Aqppkd32.exe
PID 3892 wrote to memory of 5072	3892	Ajfhnjhq.exe	Aqppkd32.exe
PID 5072 wrote to memory of 4188	5072	Aqppkd32.exe	Agjhgngj.exe
PID 5072 wrote to memory of 4188	5072	Aqppkd32.exe	Agjhgngj.exe
PID 5072 wrote to memory of 4188	5072	Aqppkd32.exe	Agjhgngj.exe
PID 4188 wrote to memory of 3216	4188	Agjhgngj.exe	Amgapeea.exe
PID 4188 wrote to memory of 3216	4188	Agjhgngj.exe	Amgapeea.exe
PID 4188 wrote to memory of 3216	4188	Agjhgngj.exe	Amgapeea.exe
PID 3216 wrote to memory of 3760	3216	Amgapeea.exe	Aglemn32.exe
PID 3216 wrote to memory of 3760	3216	Amgapeea.exe	Aglemn32.exe
PID 3216 wrote to memory of 3760	3216	Amgapeea.exe	Aglemn32.exe
PID 3760 wrote to memory of 3564	3760	Aglemn32.exe	Aminee32.exe
PID 3760 wrote to memory of 3564	3760	Aglemn32.exe	Aminee32.exe
PID 3760 wrote to memory of 3564	3760	Aglemn32.exe	Aminee32.exe
PID 3564 wrote to memory of 1448	3564	Aminee32.exe	Bfabnjjp.exe
PID 3564 wrote to memory of 1448	3564	Aminee32.exe	Bfabnjjp.exe
PID 3564 wrote to memory of 1448	3564	Aminee32.exe	Bfabnjjp.exe
PID 1448 wrote to memory of 5112	1448	Bfabnjjp.exe	Bebblb32.exe
PID 1448 wrote to memory of 5112	1448	Bfabnjjp.exe	Bebblb32.exe
PID 1448 wrote to memory of 5112	1448	Bfabnjjp.exe	Bebblb32.exe
PID 5112 wrote to memory of 2636	5112	Bebblb32.exe	Bjokdipf.exe
PID 5112 wrote to memory of 2636	5112	Bebblb32.exe	Bjokdipf.exe
PID 5112 wrote to memory of 2636	5112	Bebblb32.exe	Bjokdipf.exe
PID 2636 wrote to memory of 4552	2636	Bjokdipf.exe	Bchomn32.exe
PID 2636 wrote to memory of 4552	2636	Bjokdipf.exe	Bchomn32.exe
PID 2636 wrote to memory of 4552	2636	Bjokdipf.exe	Bchomn32.exe
PID 4552 wrote to memory of 1880	4552	Bchomn32.exe	Bnmcjg32.exe
PID 4552 wrote to memory of 1880	4552	Bchomn32.exe	Bnmcjg32.exe
PID 4552 wrote to memory of 1880	4552	Bchomn32.exe	Bnmcjg32.exe
PID 1880 wrote to memory of 5052	1880	Bnmcjg32.exe	Beglgani.exe
PID 1880 wrote to memory of 5052	1880	Bnmcjg32.exe	Beglgani.exe
PID 1880 wrote to memory of 5052	1880	Bnmcjg32.exe	Beglgani.exe
PID 5052 wrote to memory of 4496	5052	Beglgani.exe	Bfhhoi32.exe
PID 5052 wrote to memory of 4496	5052	Beglgani.exe	Bfhhoi32.exe
PID 5052 wrote to memory of 4496	5052	Beglgani.exe	Bfhhoi32.exe
PID 4496 wrote to memory of 736	4496	Bfhhoi32.exe	Beihma32.exe
PID 4496 wrote to memory of 736	4496	Bfhhoi32.exe	Beihma32.exe
PID 4496 wrote to memory of 736	4496	Bfhhoi32.exe	Beihma32.exe
PID 736 wrote to memory of 652	736	Beihma32.exe	Bhhdil32.exe

C:\Users\Admin\AppData\Local\Temp\a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe
"C:\Users\Admin\AppData\Local\Temp\a59d603a91ea656c05a292477c27cd251bdf0076dd3dee40918d50730fb31885N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\Qfcfml32.exe
  C:\Windows\system32\Qfcfml32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\Qjoankoi.exe
    C:\Windows\system32\Qjoankoi.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SysWOW64\Qddfkd32.exe
      C:\Windows\system32\Qddfkd32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3580
      - C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:652
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1980
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2712
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3212
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1236
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:532
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2172
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1468
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3700
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:216
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3568
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:464
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1216
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 416
        47⤵
        Program crash
        
        PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4476 -ip 4476
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
304KB

MD5
439890796d4de2f39e5f8715b7ca1d11

SHA1
a956a54022a455a00a092bfc80c48b2986372ffa

SHA256
18c33fa5b91bd830564211d301276eeda853d202a2900784bca1be565f289a38

SHA512
02e34c965aab89beebeeda89def0012291d30bf3c32574c210816355dad48f250bd46cfef5d156484c5e58b6ec4d9ab697077cc841bf8af1ae9dc778a4436e6b

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
304KB

MD5
2b9ef568e845c11b42c3c53133e3fcfd

SHA1
eda1603082ef2c4860b4330695b2985fe203dd2e

SHA256
ae0fde96ff77284cf8df97c8f8422a1a0510bee090b3bc14693529a811365c22

SHA512
be31510d3827b1097102d160d2098510bc5f305287d60ac9c18c18cb6de759a0a34703243d0486f51b611757995b471a153c04fd8e9d8268ae3133595312e888

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
304KB

MD5
424148b9e9aa0941167a48c2e84d5044

SHA1
9a37ba8d5e3c3e216a1eac10aab9f14031cd227c

SHA256
a11b7a1ea6fa83b592b4e678481453001cfa2a28a19e272f7bc7bd233bb156e6

SHA512
c973520a7a4fa21a00d739d6a4addd35d17a2e0670a7b3b89f92aee0cfacc906f9cf8acab93a0f973a89cb1936b55f5e283eed4ab4a2f34eed37c7b9f94bca53

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
304KB

MD5
0ef92b5fbeea943c57f761a3e418bec6

SHA1
7669ed9a48bf6ea461063803dc57dd5ad70b2e1f

SHA256
fb510d214b9674d6c18af37d0ddecccd515404d2ab22e1a0607efa3ff0762fa9

SHA512
4f78cb291335a3bd8c241f600aa2760fcca95d3261946a78b96163b1f0412e2e85c595086592e1f5beb2a9c2afd6d4ceb7b4bd2f054ba117a486a923a3b04289

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
304KB

MD5
a6d3aaa72cb3f1e31a412ac3ad5734bd

SHA1
6090b2c65dcd6c64a4dc200abb7c4c18e31144a9

SHA256
1d612a9495eff7c24a15c71f173b717fbc00d0cb0201279df496466a740f47e8

SHA512
ed248f7551cba51c8af17500835b5a422489f27d26ad57d2ce7000181fbba30df69646953392112f57cb8bbede0cbef7b5b95622803f5c4968630885e101c16f

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
304KB

MD5
7b4e28e68d3d5f54db95fd9bbf4f070b

SHA1
6c9634500fbc9388b82acfe8eeadb6771a7de2b4

SHA256
a3f96bf7f2ff2ff818e064dc1cf0ae404d7f359e5b6b73b8aabd62064b179374

SHA512
a170dc84a0a196457d71584c849cc5cb2c367ee2baa03e5db7270aa19775411ffa274961c5e82e3c92e3c27462b0d93fe3a4f6c7cbdaba50b5d6759a93a3b16e

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
304KB

MD5
5b0b08ad370fb62cb59a1c1a511f8f6e

SHA1
177e50506bbd7dab2f3220b5e5e0ac268797d86f

SHA256
6de057c03915f7adb0d2c4e84e5870cff52db967b6233a0a8cf7a24e5718d0b1

SHA512
9a36eee83f1fd5c3dfbe4d7ba525f0da7c993096ad140542219ac8b0ec4cdf70c96f0b71ade1880dea9366d422e64660405e693e7ba4d9a5050b337477bf7eb3

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
304KB

MD5
d97a1e9825e2078eec239adeb0caa72a

SHA1
a04448fe09cc93072b4373b04b055de5e85ce09a

SHA256
1bee3aad7285542af8e8e1fd298c6dd275a62c42967a9f13239cdb278b0bcd55

SHA512
881b9eae7c00b4bc7bf6f11f3c2403ad4be04536cc76d659bc9965c33bc1030639716be635c14fed88da9ad9c7f00081b6497be0bf26993320a75b14d08e17a1

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
304KB

MD5
c29339ccda16496714e6c2670cf17960

SHA1
17449f2701d58e80a5ff22498ec2b024e31dad7f

SHA256
a42179f455d01360d6c94a3f7885f577a749fe8f56e81580a26146893a8a8485

SHA512
c703ea80f98a240bfc100d7e97661837851bf62b73bfcf92625a4c23d4dfe08b7dbd780450903492e961156107873f6664c1d244b430ec3427467fae50f9e1c7

Download Submit
C:\Windows\SysWOW64\Baacma32.dll

Filesize
7KB

MD5
94df0421a979f54d156c28a4c96d8b44

SHA1
913fea122cf27ff74224664927e89de13024d079

SHA256
7c96cd5c6eb64fd39f93a70d0d5312c2d00f20ff47ccfc3a4d2f9844e987025b

SHA512
394395ebe5b4f048f7f2e6f5e487d59917440bcc07d4c57b6eb8c824aa6af8571baadde083449defff6722bac11452eb39251b5b217a4637bacc22af0497fef8

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
304KB

MD5
a8dcd757cd5f01b387e0c60e5e80e902

SHA1
d666080bd7a4af4ce93fae259171acc2ab2dddbb

SHA256
d9f1987e4fdc89053dde3dfae52cc558bcd8302b05332a1423000e0dc7da60f8

SHA512
360f534597af5cda0b1a9f41343e4db3a22f302935f2a2f64de888b9cf67a98e85fc793e20caac4c9b7cc643df9cd5fe747ff22b12daf1f71ec67f71c79f4893

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
304KB

MD5
fd71f0f9ae2e39b407083910e9c927af

SHA1
732f110d7ea86e8ea74542fd1a64c01ee4bcdb9c

SHA256
d045444aa312f8f36f4f33f9396f2ae0ff62795b968e3ee428376e55c53b7734

SHA512
7e579550c5d268b07e2bc17e12b337a7bc6f375ea62113d8cd4be2a83f811f8a98df28298c7f9aeab4d478be4bb3eae9db738e9de6e78f4441f9040196bfdfb2

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
304KB

MD5
152ef9ad16b4059eb5ea64d23c8af9c3

SHA1
8998edd2bc7ce44cd33b5b7b0c1ec01b3eda868b

SHA256
271e5b431f77cb2900d369ffda24e884ff1d2d91963bed3b693bc26aece9e0a0

SHA512
1619d677053039ad82fac6d8e98808de75c73748d6f2849ddacc1108050753a1e81f36ff73dd546e8f4feb7927d84237a6b4e7225687a06b963e9f798a667cc4

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
304KB

MD5
2d7afa550529f67b8f233cd5f3e52677

SHA1
45a301601d37ac8763ac1b978528f16caa1dba35

SHA256
ee66018e9e2dc7273640f811f1ec29777cd7f7177b7c9d58afe051b7c393808d

SHA512
c0cd9b1e8561f20cc5edddc818fa5eaa278cdd72a6c8948e9009496159d49d1a19bf7b108e4a7e708c9221d2ba84312f8445d5c7e0040c2b241012266d03e57a

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
304KB

MD5
f5f5fe3e8c9a4a16521a669ec5b18671

SHA1
a232f866f307610c1085053b489d5ec6f98a0fc0

SHA256
5b7c572b22e5c8ea010855dc4903a49bcdfee5bfcc44cb1c5b28f90fe2a49bbd

SHA512
f251b2511460c719dce57de0afa92ffcea17172b9f10bf93890f8ac26d40a12758d21d9aba5aa42f2f2502b8221077a122fc31c4f4f07ff520ecca3081fd2f28

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
304KB

MD5
816c3c8aca02b6f79823d060234748bc

SHA1
2eb8fc50a6117dbcb9f4c757d7047b1ef419d669

SHA256
ca1ccd84ec7efcf8c0387efd5e84746e3e5c5cde100ce77b7b9056a9b8a9aca9

SHA512
f587af2c5be1f4adde97ee15d787ec28ff1bf32fd46a12b6a9a3ae0fe78f1bdbc1453af6ca5a3edb720bfd748d4ab176231324a0ccd638a0db43cc4a231667f7

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
304KB

MD5
e015175e5697f2ff9e5cc108adee8a05

SHA1
fc44e3c5a14ea8bbbb50ca57a4accbb162567de3

SHA256
7d6b55a86d839a756baf1c00269f0f70791f5c0e1caf4ac89e7a091f1f10ffbd

SHA512
c3efeee59311b0b4ad2aae256c96a870f26c1d8cbd03c3cfadb31994148b86692038fe9521b756091e207f52f6e48f51d07534611ad97256e4a11488a18707c5

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
304KB

MD5
65c08551ed5309036675edc5a516a5af

SHA1
6e962eca8d83388e5915c28c6ecfeda417d459ad

SHA256
c04baebd5fdcec1942266c5ee51dcb5243cc1ab373468bb56f897dc9f91f923d

SHA512
4fd851994eb148f77e39880a437731b57165b2305fbcad3664e7c6e218b1e06b64722dcd0b8ce520f7c64fbf03a3f46c8a99b44b892490463c4bed4971169b4c

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
304KB

MD5
8c689cefb8acad6593ee99e5d8c81443

SHA1
3cd47e78816e49f6a30cee1075b03196c0382319

SHA256
0f98efe5b58f97bf44b391603a7405101edcf4999f22731049809a7c2f4e49ea

SHA512
16f4d7675ada4f636e72b949d83c89db06b8ed4af43bcb843e8b333f79cc84c635f717c39be9dce00c4280c57a4bfd9a15ed2e307a7ae553325b59579ccd90ad

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
304KB

MD5
80e9db10256e09940ba0df929e36d88e

SHA1
17dbe15336a134d100ae5c1d04cfe0dcc84f9071

SHA256
e4cbeb99197c19630313eaf58b27edc6645440988c49594c6fa296303cc64183

SHA512
9364257caf6569baa74fd2142ed49c20a454d90d97570cee15c54a1ea7a490a7de2fb6d5be640bd79b4e0daa4f90a1044cce5c8ea3474bb3360334069d567fc9

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
304KB

MD5
d4a38324ad120f9b90a3aeee50d9b172

SHA1
7ebc5035abdd2879057392f10255478ad93777fd

SHA256
bb8ecad7bf473c8ae64ae455b779a3d27e9a70d182f86b6ef37a23b7d129e130

SHA512
9b882b823e70f18001e46c5ca8576c44d0e617be0184780f3fa997d7383bfaf329c7457dcb4fb9485d9e2d3667534360173ebf5979e682e31f7828d3641d9aec

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
304KB

MD5
a1c892dd7ff3c78159ad669e0e079fc4

SHA1
bf743d1037c620df9493848d5f8532e028f512b9

SHA256
e1d9c307283f588da42affaa3ad22d1c7ae5e2542231467024e8ed0705c7a573

SHA512
a1f3485fef265948e277a4cab8eb2eabab52a0fff331091bd56d23f2776d998cbcf7dd2b56d0a071cac344f13c0d43ee534790d841f02982c1b702a89883f1f8

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
304KB

MD5
a746d4df77b51bcf00979704c79c348c

SHA1
82c5a84cc1220136483e1717d59e7154c92d10a8

SHA256
693500e79785365f729e52c9c056f7ae5369928bf391b084987007f3d9cc6d84

SHA512
1883556495517fafe60f41c226f07f53251f22753b5c6e4f0a95c06b3f1b128538bc8c051f8309ddbe820e808d4a3ff1235412d12c70cd337f9212a3f927eae8

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
304KB

MD5
684cbdebc7bd85c7cdd4a47970de4a00

SHA1
79e77b68a65c1472f6b488b4eadda25408351523

SHA256
df066c37d148408f15495bf323f075d409a6d8eebfb1537606d5a18fb3fced69

SHA512
63eb0f39f88abdd7e862a1edf712d22437c1281282dd1b9367024ddbf4e8928ed8d4f4a9cf5f600ae72ca70b9a4df737b4d6b3f17e9f86e7a71527ff59c3ad5b

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
304KB

MD5
5ea6a889f23a30ff5d9ff141b47f9d97

SHA1
b69ea99d1868b8892713c98cbe4051c08b070024

SHA256
f4d8cbaf99ff307248d0133fb0cd33c31a2423367a237542f3b027fa8634f096

SHA512
95b6128648af2619ce3830b2fb80d58a0f6eabb987897241da564e6e990f5a4b0a506ab49282c124cd96b80ffece56aff2bcd5fe3d9c893035e8fb604a4dedcc

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
304KB

MD5
368c757eb802b5147c86905785124281

SHA1
f155ff0f93627220142ff3e51543adde2898c2b7

SHA256
19dd39223dc46a6aaa7646719182f5a09875a069a123710391b025714cb2c455

SHA512
c193d8fe0e571ee68fcddae577eac24d69ac84152a510f5872c22149fd11867e1363db380160a1baae533b1948cc9b802bcc2e2e4e254ff680183f7c2ccdc635

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
304KB

MD5
3c2edb454d9179e8e6625e601e3eb1a3

SHA1
8f9192c3f4d638c0a3dbc6b9576f92bfc6840062

SHA256
7735dbd3d1021b429a078bb18d80aca18990487ed90ab7db30fdd8f70352f765

SHA512
0d2a0c64e7fb95951ae5bad8a7119b2ad5f0f993e3ea2de86f349d87223e657906f03ad7cad1dc03ded4b8f1e319b60e30efa0d3b3c0f1e314582b598d654e8f

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
304KB

MD5
0d9e85e17b6246155020d4aeaa47e893

SHA1
c7dbb3e2830f15b7db6f6d37d47f889a3445b8f0

SHA256
cde02cd667cd360d0910c5e3881c76cb673be12c25a160024e915de6b0bd7a56

SHA512
4d89d26b4a6402910e9fbe69c335629cf745cff866e4d88ea924b1a265b3098859c0b578f88fd3983378fc4a15cad6cd88ee87c41d6c74832b6b9379aedd0022

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
304KB

MD5
753cef6f8da82e42445f315996299958

SHA1
f0544d667c36f6acd68932d20f6c086dac1526a3

SHA256
d03265eeb99600eb7d4176067751d672243d6420ec1a298e8a88580238c4bc6e

SHA512
0d43f252382130b8689057eb6ef8f3501d490b7b199ad474b6cc8e605a9723d2fb136cba7d4eb44d2effdfdb835330447ebe50617a567d520fcd328fc92f743e

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
304KB

MD5
9dd8cb29fe47abaac7e7856ae2308b62

SHA1
3786a7d351e0a506cd6d5d909818a6998a35127b

SHA256
839db1236692c2f50b59e7c2fb7b21e46e94ddf05c3e808f0b4cfc8c8a2493e3

SHA512
942341dbb982cc549e56e6544e64a3ed9827af4e3a4c2f7c9bdbb0b0483a7e46a8ae8645a47be34e9bbf209f1b1a8091ad93055f1b452e53d27aeb7d00bb5662

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
304KB

MD5
028e83b2232d25b3cf2215e909ff70c3

SHA1
c94da1a8e68030269646ac95eea5727e1a7da183

SHA256
116118dc3d9c049ef245cf5d5adbd72c19b2bec555f979c7f797542e8899b2dd

SHA512
6f2a6854ff3ff42c95c5d05e487360b7e7591d9c49d5a6afefd6d2c4ed13c48eeb7e5e0500710b4b8e12b38d65435c1646be949e64c9d30cca6bab75cf3368ff

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
304KB

MD5
d78b3acd77cb68b5ade56b43086c10e1

SHA1
618f1789e2f66740738d3ed2593ac4ea7c324af2

SHA256
bfb5db91dfd0e4b8bbb865c2d1a5f722151146aa6de7996d3c08e9ea8d049e91

SHA512
39c0ed46bf997261841c8b39ccbca63b0c34e6d3a107951e09ea6eb8d207162ff955972b21dbaf4fa39bafd9c7e0c9202f51aa57e01703e54429ac26fe0284bc

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
304KB

MD5
a2110c198a135f93f79bdd08de375839

SHA1
0f71cfab4a2e66fdfabcf24b3a33d4f0c7d2fe11

SHA256
bc7f02ddb3f4a26ef20887c8c5fd30d74dc03e60700b68cbbeb9eda00c857f53

SHA512
b71b9b7c59df3d1fd712f427e0a73c8b6903f2f9912dc254c04ee67f8c0f894064d9606af56448dbe88471bdd50c36fb54fd46bd0bf36271c9d606f1297a5d3f

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
304KB

MD5
02759cb97a3c08609fdbfcc268e40330

SHA1
6b90b8c70033b15e5997c036948c731ff8bdaa02

SHA256
c19381386210705e7e9c76d4227fd282820ecbf019b232ff74918da06ef8a328

SHA512
45c79d425a343d1fc3cdd790f2b4f3f61b9770eca36e04c93e8173a29cca01395577123434bf38014a702cc03d9308229ff51f7dbc7c4351cafb0942526dc504

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
304KB

MD5
44bb681f6107905c2d6e625bd67621d4

SHA1
f6d28ea52d56070ee659ff521f3304cb531a4b70

SHA256
419d2f0a8df1af0567ad6e44f9a4798ca45b3cd94e350a9abfbf85791a1b2f15

SHA512
c1500a0266673764a27dc51f8395198f74d084ac41dda4153b273f768dc051c85b69b8ca653e743fd594d0138937db701af958136b98bd12f584e31e382f7793

Download Submit
C:\Windows\SysWOW64\Qjoankoi.exe

Filesize
304KB

MD5
656f60b9d0a09d6eb426d8aaea4a7845

SHA1
87d3571536cdc4affe1a05bcb06f4b7b9558e30b

SHA256
b292ab73a78bcf6e47df92b9ea1a00186d67e9bbeb94b8b0c4c3795b6135db35

SHA512
6efc36aed0651d4bc9796f5bfeca19570396e3f70d5fc23cec3cae436c18af3def217bc8176809ef1836a73988f83ca482dbd7d6070bd469a4bfdcc0bdea7b38

Download Submit
memory/216-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/216-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/228-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/228-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/532-367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/532-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/652-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/652-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/736-171-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/736-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/936-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/936-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1184-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1184-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1216-338-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1216-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1236-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1236-223-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1528-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1780-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1780-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1880-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1880-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1980-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2172-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2172-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2216-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2216-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2244-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2244-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2504-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2504-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2712-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2712-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2772-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2772-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3152-409-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3152-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3216-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3216-87-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3564-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3564-103-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3568-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3568-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3580-415-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3580-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3688-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3688-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3700-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3700-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3760-95-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3760-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3892-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3892-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4188-403-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4188-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-183-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4476-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4476-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-30-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4552-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4552-135-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4864-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4884-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4884-422-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-151-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-119-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download