berbew | f3c3c944ca68ef8bb75bf1c91c9e6732b74f7684f03311682279f5d5201a1953

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3c3c944ca68ef8bb75bf1c91c9e6732b74f7684f03311682279f5d5201a1953.exe
Size

93KB
MD5

6be564ad42a2ba9e2370c84842729c34
SHA1

34a65260d9766f74cd26a1c1ebf837c6da11f1c7
SHA256

f3c3c944ca68ef8bb75bf1c91c9e6732b74f7684f03311682279f5d5201a1953
SHA512

6c8d9072e56f4dc552feda13b817e6f01fa52381dab499ebf5b4430b3679d90e292db4f3a7581dfca8dd8bbc6784bdf1e119a7b9edd37e330f40afc4292057be
SSDEEP

1536:JHwF4fh9h7K2y5WVy5zEnB7+VqBv3zm1DaYfMZRWuLsV+1x:dfBmBWiEBScvjmgYfc0DV+1x

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmcojh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlijfneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkoiefmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfjhkjle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkjmlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcgbco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkffog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbnjmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdjjckag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jifhaenk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dldpkoil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkhbdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddpeoafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcioiood.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dohfbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eemnjbaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkkhqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbnjmp32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
2212	Cecbmf32.exe
5108	Chbnia32.exe
4624	Ckpjfm32.exe
2452	Cefoce32.exe
5064	Cdiooblp.exe
1472	Conclk32.exe
212	Cehkhecb.exe
1592	Ckedalaj.exe
1952	Daolnf32.exe
3636	Dldpkoil.exe
1216	Dboigi32.exe
3780	Ddpeoafg.exe
1600	Dkjmlk32.exe
4060	Dadeieea.exe
5080	Dlijfneg.exe
4700	Dohfbj32.exe
1656	Dccbbhld.exe
756	Dhpjkojk.exe
4796	Dojcgi32.exe
4064	Ddgkpp32.exe
372	Ekacmjgl.exe
1240	Eaklidoi.exe
4400	Edihepnm.exe
4632	Ekcpbj32.exe
3876	Eamhodmf.exe
2636	Eeidoc32.exe
2068	Ekemhj32.exe
3916	Ecmeig32.exe
3908	Eleiam32.exe
2208	Ecoangbg.exe
1052	Eemnjbaj.exe
4808	Ekjfcipa.exe
4956	Eadopc32.exe
1156	Ehnglm32.exe
3920	Fohoigfh.exe
1204	Fllpbldb.exe
1344	Fcfhof32.exe
2444	Fkalchij.exe
4360	Ffgqqaip.exe
3640	Fooeif32.exe
2028	Fdlnbm32.exe
1300	Fkffog32.exe
1468	Fdnjgmle.exe
1964	Gkhbdg32.exe
3464	Gcojed32.exe
1936	Glhonj32.exe
3912	Gofkje32.exe
3696	Gfpcgpae.exe
4440	Ghopckpi.exe
4628	Ghaliknf.exe
3648	Gkoiefmj.exe
1284	Gcfqfc32.exe
1944	Gfembo32.exe
3080	Gicinj32.exe
1464	Gomakdcp.exe
2756	Gdjjckag.exe
4876	Hkdbpe32.exe
2732	Hbnjmp32.exe
3936	Hfifmnij.exe
2980	Hmcojh32.exe
1708	Hbpgbo32.exe
4856	Hmfkoh32.exe
1676	Hodgkc32.exe
3092	Hfnphn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gogiek32.dll	Eeidoc32.exe
File created	C:\Windows\SysWOW64\Jidklf32.exe	Jfeopj32.exe
File opened for modification	C:\Windows\SysWOW64\Lljfpnjg.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Cmlihfed.dll	Mdjagjco.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Caebma32.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Akalojih.dll	Ckpjfm32.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Fhpili32.dll	Ekjfcipa.exe
File created	C:\Windows\SysWOW64\Hmjfkopm.dll	Fdlnbm32.exe
File created	C:\Windows\SysWOW64\Jcbihpel.exe	Jmhale32.exe
File created	C:\Windows\SysWOW64\Benlnbhb.dll	Lbmhlihl.exe
File created	C:\Windows\SysWOW64\Ogibpb32.dll	Lmdina32.exe
File opened for modification	C:\Windows\SysWOW64\Mdehlk32.exe	Medgncoe.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Eleiam32.exe	Ecmeig32.exe
File created	C:\Windows\SysWOW64\Imfdff32.exe	Ieolehop.exe
File opened for modification	C:\Windows\SysWOW64\Pflplnlg.exe	Pqpgdfnp.exe
File opened for modification	C:\Windows\SysWOW64\Ieolehop.exe	Ibqpimpl.exe
File opened for modification	C:\Windows\SysWOW64\Immapg32.exe	Iefioj32.exe
File created	C:\Windows\SysWOW64\Ipdqba32.exe	Imfdff32.exe
File created	C:\Windows\SysWOW64\Nnqbanmo.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Jcpfco32.dll	Ckedalaj.exe
File opened for modification	C:\Windows\SysWOW64\Hkdbpe32.exe	Gdjjckag.exe
File opened for modification	C:\Windows\SysWOW64\Hbpgbo32.exe	Hmcojh32.exe
File created	C:\Windows\SysWOW64\Hmfkoh32.exe	Hbpgbo32.exe
File created	C:\Windows\SysWOW64\Dgdelcpg.dll	Jbhfjljd.exe
File created	C:\Windows\SysWOW64\Kfjhkjle.exe	Jcllonma.exe
File created	C:\Windows\SysWOW64\Mdehlk32.exe	Medgncoe.exe
File created	C:\Windows\SysWOW64\Gfnphnen.dll	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Ghaliknf.exe	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Ickchq32.exe	Iifokh32.exe
File opened for modification	C:\Windows\SysWOW64\Pmannhhj.exe	Pqknig32.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Cehkhecb.exe	Conclk32.exe
File created	C:\Windows\SysWOW64\Imdgqfbd.exe	Ickchq32.exe
File created	C:\Windows\SysWOW64\Klngdpdd.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Jgefkimp.dll	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Codqon32.dll	Ngmgne32.exe
File opened for modification	C:\Windows\SysWOW64\Ogifjcdp.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Qqfmde32.exe	Pdpmpdbd.exe
File opened for modification	C:\Windows\SysWOW64\Qjoankoi.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Ecoangbg.exe	Eleiam32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Fpnnia32.dll	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Gbmhofmq.dll	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Akichh32.dll	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Fdnjgmle.exe	Fkffog32.exe
File created	C:\Windows\SysWOW64\Fllpbldb.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Olpppj32.dll	Hkdbpe32.exe
File created	C:\Windows\SysWOW64\Aoohalad.dll	Kiidgeki.exe
File created	C:\Windows\SysWOW64\Aihbcp32.dll	Mlampmdo.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cnkplejl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7876	7744	WerFault.exe	318

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dldpkoil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdgdgnbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdhdajea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdnjgmle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iifokh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgimcebb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnqbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Himldi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iefioj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cecbmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dohfbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkdbpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menjdbgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eemnjbaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iicbehnq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmannhhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkalchij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hodgkc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dadeieea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dccbbhld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icgjmapi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpijnqkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfembo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogifjcdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbdjfln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlijfneg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onhhamgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibqpimpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdmnlj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflgep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmfkoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmhale32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gofkje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeaikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmdina32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdehlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcdmga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojllan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cefoce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdgljmcd.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecoangbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdlnbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hodgkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beapme32.dll"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nekfmb32.dll"	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemfincl.dll"	Nebdoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chbnia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcinbcgc.dll"	Icgjmapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knkkfojb.dll"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooojbbid.dll"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocalcppo.dll"	Ekcpbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcmfk32.dll"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckedalaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dojcgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icgjmapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jclhkbae.dll"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghaddm32.dll"	Cefoce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogiek32.dll"	Eeidoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eemnjbaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keajjc32.dll"	Hcbpab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdkkfn32.dll"	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhkngh32.dll"	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidjfdep.dll"	Cehkhecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkjmlk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekcpbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpllc32.dll"	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbagnedl.dll"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbnjmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imdgqfbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdnjgmle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijlad32.dll"	Mdehlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkmlea32.dll"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcjfkm32.dll"	Ecoangbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiknll32.dll"	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhhbcf32.dll"	Fkffog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpiaib32.dll"	Glhonj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 2212	3436	f3c3c944ca68ef8bb75bf1c91c9e6732b74f7684f03311682279f5d5201a1953.exe	83
PID 3436 wrote to memory of 2212	3436	f3c3c944ca68ef8bb75bf1c91c9e6732b74f7684f03311682279f5d5201a1953.exe	83
PID 3436 wrote to memory of 2212	3436	f3c3c944ca68ef8bb75bf1c91c9e6732b74f7684f03311682279f5d5201a1953.exe	83
PID 2212 wrote to memory of 5108	2212	Cecbmf32.exe	84
PID 2212 wrote to memory of 5108	2212	Cecbmf32.exe	84
PID 2212 wrote to memory of 5108	2212	Cecbmf32.exe	84
PID 5108 wrote to memory of 4624	5108	Chbnia32.exe	85
PID 5108 wrote to memory of 4624	5108	Chbnia32.exe	85
PID 5108 wrote to memory of 4624	5108	Chbnia32.exe	85
PID 4624 wrote to memory of 2452	4624	Ckpjfm32.exe	86
PID 4624 wrote to memory of 2452	4624	Ckpjfm32.exe	86
PID 4624 wrote to memory of 2452	4624	Ckpjfm32.exe	86
PID 2452 wrote to memory of 5064	2452	Cefoce32.exe	87
PID 2452 wrote to memory of 5064	2452	Cefoce32.exe	87
PID 2452 wrote to memory of 5064	2452	Cefoce32.exe	87
PID 5064 wrote to memory of 1472	5064	Cdiooblp.exe	88
PID 5064 wrote to memory of 1472	5064	Cdiooblp.exe	88
PID 5064 wrote to memory of 1472	5064	Cdiooblp.exe	88
PID 1472 wrote to memory of 212	1472	Conclk32.exe	89
PID 1472 wrote to memory of 212	1472	Conclk32.exe	89
PID 1472 wrote to memory of 212	1472	Conclk32.exe	89
PID 212 wrote to memory of 1592	212	Cehkhecb.exe	90
PID 212 wrote to memory of 1592	212	Cehkhecb.exe	90
PID 212 wrote to memory of 1592	212	Cehkhecb.exe	90
PID 1592 wrote to memory of 1952	1592	Ckedalaj.exe	91
PID 1592 wrote to memory of 1952	1592	Ckedalaj.exe	91
PID 1592 wrote to memory of 1952	1592	Ckedalaj.exe	91
PID 1952 wrote to memory of 3636	1952	Daolnf32.exe	92
PID 1952 wrote to memory of 3636	1952	Daolnf32.exe	92
PID 1952 wrote to memory of 3636	1952	Daolnf32.exe	92
PID 3636 wrote to memory of 1216	3636	Dldpkoil.exe	93
PID 3636 wrote to memory of 1216	3636	Dldpkoil.exe	93
PID 3636 wrote to memory of 1216	3636	Dldpkoil.exe	93
PID 1216 wrote to memory of 3780	1216	Dboigi32.exe	94
PID 1216 wrote to memory of 3780	1216	Dboigi32.exe	94
PID 1216 wrote to memory of 3780	1216	Dboigi32.exe	94
PID 3780 wrote to memory of 1600	3780	Ddpeoafg.exe	95
PID 3780 wrote to memory of 1600	3780	Ddpeoafg.exe	95
PID 3780 wrote to memory of 1600	3780	Ddpeoafg.exe	95
PID 1600 wrote to memory of 4060	1600	Dkjmlk32.exe	96
PID 1600 wrote to memory of 4060	1600	Dkjmlk32.exe	96
PID 1600 wrote to memory of 4060	1600	Dkjmlk32.exe	96
PID 4060 wrote to memory of 5080	4060	Dadeieea.exe	97
PID 4060 wrote to memory of 5080	4060	Dadeieea.exe	97
PID 4060 wrote to memory of 5080	4060	Dadeieea.exe	97
PID 5080 wrote to memory of 4700	5080	Dlijfneg.exe	98
PID 5080 wrote to memory of 4700	5080	Dlijfneg.exe	98
PID 5080 wrote to memory of 4700	5080	Dlijfneg.exe	98
PID 4700 wrote to memory of 1656	4700	Dohfbj32.exe	99
PID 4700 wrote to memory of 1656	4700	Dohfbj32.exe	99
PID 4700 wrote to memory of 1656	4700	Dohfbj32.exe	99
PID 1656 wrote to memory of 756	1656	Dccbbhld.exe	100
PID 1656 wrote to memory of 756	1656	Dccbbhld.exe	100
PID 1656 wrote to memory of 756	1656	Dccbbhld.exe	100
PID 756 wrote to memory of 4796	756	Dhpjkojk.exe	101
PID 756 wrote to memory of 4796	756	Dhpjkojk.exe	101
PID 756 wrote to memory of 4796	756	Dhpjkojk.exe	101
PID 4796 wrote to memory of 4064	4796	Dojcgi32.exe	102
PID 4796 wrote to memory of 4064	4796	Dojcgi32.exe	102
PID 4796 wrote to memory of 4064	4796	Dojcgi32.exe	102
PID 4064 wrote to memory of 372	4064	Ddgkpp32.exe	103
PID 4064 wrote to memory of 372	4064	Ddgkpp32.exe	103
PID 4064 wrote to memory of 372	4064	Ddgkpp32.exe	103
PID 372 wrote to memory of 1240	372	Ekacmjgl.exe	104

C:\Users\Admin\AppData\Local\Temp\f3c3c944ca68ef8bb75bf1c91c9e6732b74f7684f03311682279f5d5201a1953.exe
"C:\Users\Admin\AppData\Local\Temp\f3c3c944ca68ef8bb75bf1c91c9e6732b74f7684f03311682279f5d5201a1953.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\Cecbmf32.exe
  C:\Windows\system32\Cecbmf32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\Chbnia32.exe
    C:\Windows\system32\Chbnia32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\SysWOW64\Ckpjfm32.exe
      C:\Windows\system32\Ckpjfm32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4624
    - - C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2452
      - C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        23⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        24⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        26⤵
        Executes dropped EXE
        
        PID:3876
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2636
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3916
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3908
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2208
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1052
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4808
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        34⤵
        Executes dropped EXE
        
        PID:4956
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        35⤵
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3920
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1204
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        38⤵
        Executes dropped EXE
        
        PID:1344
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        42⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2028
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1300
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1468
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1964
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        47⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3912
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        50⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4440
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        52⤵
        Executes dropped EXE
        
        PID:4628
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        54⤵
        Executes dropped EXE
        
        PID:1284
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1944
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        56⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        57⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2756
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        61⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2980
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1676
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        66⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:916
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4692
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2024
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4188
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3996
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        72⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        73⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1412
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        76⤵
        Drops file in System32 directory
        
        PID:1360
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        77⤵
        Modifies registry class
        
        PID:2144
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        79⤵
        Drops file in System32 directory
        
        PID:328
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1692
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        81⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:408
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        83⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2820
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        85⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        87⤵
        Drops file in System32 directory
        
        PID:4544
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        88⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3360
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        90⤵
        Drops file in System32 directory
        
        PID:680
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        91⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        92⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3192
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1872
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1632
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        96⤵
        Drops file in System32 directory
        
        PID:4368
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4656
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        98⤵
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        99⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        100⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        101⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        102⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5264
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        104⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        106⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        107⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        108⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        112⤵
        Drops file in System32 directory
        
        PID:5656
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        113⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        115⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        116⤵
        Drops file in System32 directory
        
        PID:5832
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        117⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        119⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        121⤵
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        122⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6140
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        124⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        125⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        126⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        127⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        128⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        130⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5884
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        137⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        138⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        139⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        141⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        144⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        145⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        146⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        148⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        149⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        150⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        151⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        153⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        155⤵
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        156⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        157⤵
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        158⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        160⤵
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        161⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        162⤵
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        163⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        165⤵
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        166⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        169⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        170⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        171⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        172⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        173⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        175⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        177⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6900
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        180⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        181⤵
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7120
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        184⤵
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        185⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        189⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        190⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        191⤵
        Modifies registry class
        
        PID:6632
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6688
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        193⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        195⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6892
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        197⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        198⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        200⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6496
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        202⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        203⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        204⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        206⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        208⤵
        Drops file in System32 directory
        
        PID:6712
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:7064
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        210⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:6708
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        212⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7108
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        213⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        214⤵
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        215⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        216⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7324
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:7376
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:7428
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:7472
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7520
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        222⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        224⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        225⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7744 -s 396
        226⤵
        Program crash
        
        PID:7876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7744 -ip 7744
1⤵
PID:7816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
93KB

MD5
13242d640942ce1e0aa9bee078e18ada

SHA1
170f4b1eed23d68aede164f97746d461462f1e47

SHA256
504b09e6e7be9cecbf16f35c983f17f959d2b600b684e2d495a6b2714658f305

SHA512
ba5666957c17342fda07fd69c317c1ec02b3d596159dd9ab13a3cd1ad94bb356c7dda041e40f2b424ab0122fa2d9a004e63819c3e55bc21d13b5ff5300a5019f

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
93KB

MD5
ca050e5443751d52a60fbf9dea96f31a

SHA1
63b76a305db67386d0f70b8ff22203da2f7af240

SHA256
afd7a1bea60653f8cd886c13c25447cffb7c6d119b76fe4cdf2e921f6ce3d84e

SHA512
424134c3c34ebaa086e0128bbcb9e5f1c70c26cadd03f9c691a689f3c39943ab2613414286663bdbf50b240cc24d68b3fa39dcac9402e13a60f5f33f790676d2

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
93KB

MD5
53a8024867d1651ea9f9421d27a1689a

SHA1
9338137a44f52faf68d6159fd31ec9813ab7429e

SHA256
c7fe2a896dd2afa28970b53f9ea5002700acac9522da0dd72765aaf013de5795

SHA512
140c59d959f70a11e77202a650bfbe4fa1e333719046523c4689c9d9b34009bf235103ba4e31c43f81430515687152d63d1a7b611bdd965282d5d64908e2bc08

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
93KB

MD5
791648339aaaf9a3f726d4eee5ddf42c

SHA1
69cfb91b7831afa0f3253fdfee07b1df8dc07bf3

SHA256
d0cf75024a4de5b018a59d50be71234682ae44c182cdca77a7424985da09e276

SHA512
848f9baac9c4ce2f3b77049fc5473841fa4a0227c73f45ae0ff3931294da982231d3ab16cfd0f9b5f86c747bbf47eac76f4f97386fd72e8d62d8672054f94b72

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
93KB

MD5
75839ea6e479eb5927295ba754ecf8fc

SHA1
4362e2a0fa463a1d1de4f76ceb13847ea52ff145

SHA256
0b1c759ac12a42ff7049d0dee6e1a49d2a72d357e5cc576e5d7f23f668ed9cd5

SHA512
b5da7c2e4ac3ae0e9b1e4c8557e912275e37029c27be8f65a2b3ac3126a6d0ca784e2f797f975b3b6ae25b7e33bf30e6bc0256c89ef0d8a20dfc3c511bdd0ce0

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
93KB

MD5
a019f5512cbe01bee9183349519bc4ce

SHA1
0d4f45592164bfa47baef3b81ccff573797d9365

SHA256
032d8197ca5f8f81d0818a6269cf4c592d2d45309c705e11b0aa5e18c6abfc2c

SHA512
a7f6eb63a91f6375e1d92612d415a751947d7472ae9ece2c278485dfd6ddc7f6b57cfaf2d27add27706871cb393b5798f96e64d9cfe9f0676fe71951e8cbcc35

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
93KB

MD5
0a72ed3467620ab190f303c3176dddcf

SHA1
bf7a7214af254315091d929c5b9e2ceab0470a9e

SHA256
d69f0d490da200e14a2976dbae595f2d767057b8f2fa6fd03c3f0138ed80112a

SHA512
cfdf967fd28d24a33e6d24bc1ca6dc75d83bb38f5f9c7e829c5ace78e2bcfc73800af6a65f096d065aa562b544c4bbe0dfea01cc46d8889e7c3484e5e036a5ac

Download Submit
C:\Windows\SysWOW64\Cdiooblp.exe

Filesize
93KB

MD5
609763fc296afb4418ae6ed933e48015

SHA1
3334982276ed0a99fe4a7225a68973e0940e0402

SHA256
507c0d6a71f89b3bd232a90730013bab530226a296d305349f257f5b964cb925

SHA512
3fb4b3485bde699f7e552763c385d046e69048974031b06604e1b7d889f0ec5c7d30768156959dbac54fa1abc83305d0c088b2ebeaa126a3ce602980feb6e1fe

Download Submit
C:\Windows\SysWOW64\Cecbmf32.exe

Filesize
93KB

MD5
f12b2f9229a649c681a1c3b5cf81b051

SHA1
dfa6c43eaf7564d044201fc614b4aa665f1ba9af

SHA256
a1fba9c089f7869ff1e3ef98a6ea59087f1a00ea187844980898318124664dea

SHA512
dcd4011eb610dde0d5d1f165948947489a2cd0eca5e3b7685f21f7a7b14ead5ba81fd9fac43ce96134a37a8a8b14db21c89aec6c7ffbe86bb4ce9f1ba308480b

Download Submit
C:\Windows\SysWOW64\Cefoce32.exe

Filesize
93KB

MD5
43e95a63d6d7df6c424ecf518a275c3f

SHA1
a5ea467f42dc59cc19dcb50fd6ea87019b7d78aa

SHA256
434d35f91c669e958820c180dc1e285a61add8a9f156b9ebe42723030b37a79c

SHA512
995aa8be7820ecee06423ba7f7d648399e2e810bee498e52685689acceb0a19bb65a65af68d461fcaaad8bdb56f5348828f7999483f1d9cf25a3021040eef8c7

Download Submit
C:\Windows\SysWOW64\Cehkhecb.exe

Filesize
93KB

MD5
b95f90716d92e7c08f1a82aa08c5b7c2

SHA1
64b929bec198f36bbd89328e53b3e5b64c39ef65

SHA256
4146dad713aa79cca72cc6b7be9de971f970e6f11559dd1282a88fad8348fda6

SHA512
b362670a0f852a428b80f9811aa21feed89239931fd54e6ed86f6979e8dc0aa6789582cf18bbed892f89ae64fdab195bcfa1695ab1b2cfeecdc3494b8dd6b086

Download Submit
C:\Windows\SysWOW64\Chbnia32.exe

Filesize
93KB

MD5
d074a6e0121595a85e9cd20baff82899

SHA1
a64208d3de76e6e32583b158d0fdb17477a23043

SHA256
10ce299a70e1268a85c3bc8236ba2e96fd6427696d5405ba168c457e3b2aae42

SHA512
d3c92545fee4898ec1f0cdaa7bd5c127b97f08b8bea70449099daac5d69ecb72e0884843cecf3b12d4da71567c3dcd363eeb624719ebfccf073c2a5d8600c354

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
93KB

MD5
8c80930071b0cb747fdb24febb8705a2

SHA1
286943eba74c407c9ddac0b9c430285728066237

SHA256
cbff4115751c3849e549d1def80c6549178ffa1dfd9372e7e6976198fff7d84e

SHA512
888e18c198833ee5fcfc0d1a0c8dec7d62318fb560460585268c94b348463fd1e53da3bddddbacbec6a1f554da58ab9771ead6757045b4e378d9f9ef35301dcd

Download Submit
C:\Windows\SysWOW64\Ckpjfm32.exe

Filesize
93KB

MD5
797ab23f32550590496ed22dee55b02c

SHA1
a2b31a6a303c14c5766642cf7a90515cd6c4e44c

SHA256
8758520e9d87876dc370b489149e309e919fcba59fca095cf19bd98c32370f27

SHA512
9360fb393f641283ba59a5af29d9263cda19135978ffd6edbf0da43ea8b30022ee3136a8917c5ae26d9f0cc2be3c8b50632940d9138a155fbe4b1a015b73c1bf

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
93KB

MD5
1e50a96a00fbb2dfe6d6de945fb808d3

SHA1
83ba7f1248cc1dc0968c373bab03324e5fa81b44

SHA256
ce02c21b2ed128890fe16bf3d26c53eb9f287e728b6f6cb5bba4a26571708a7c

SHA512
9c8cca3a2a0f3e0799ed5df6959f97ecefaac9a21f3378ffb978de646774666a0e424adb583e1a01a696d5eea8ad2c3721b4e55f945acc9f1192f13fb367dd72

Download Submit
C:\Windows\SysWOW64\Conclk32.exe

Filesize
93KB

MD5
c185f8848da47a87f393c89980cb3a0f

SHA1
5268d5095cb845d3d51c9d5e27077f1109c49db9

SHA256
41a81db6071fac0ee055184e65437c34fed85df122ffdf6c6d681c60c70ddf33

SHA512
7d81ad4bdb1530665b91d6d7f4cfbdbc5dccf197b24cf1ebb8065efcb37eea0ffda1f544d1cafdf66c7189d7818e82660b1ef167fc7a675fab1b1527ad39da0f

Download Submit
C:\Windows\SysWOW64\Dadeieea.exe

Filesize
93KB

MD5
9f9621cd98e188bdf16547721ffd26d7

SHA1
b5f43cdfbd3a6f0294dcbccb6ded4a2484e2096e

SHA256
327e6ecce00dd50d3dfe0e2f0d6f01de1c569096ad6e1c8e875b4d53192be13d

SHA512
78e77fe74b1cfaac3e8cf51e2c7ca034aef39fdbe5d5836174b79b448f4f08fb0727c59997a1758fce61544b82e13baf74eb9c1d9dfc132d685509c71c96ec56

Download Submit
C:\Windows\SysWOW64\Daolnf32.exe

Filesize
93KB

MD5
9d402af706b2ba9d3e771f7d546da7d8

SHA1
ad241c02d6433dd572737de6f97ac67458ecc933

SHA256
abc27fb4004a85a982baffb75a1e9b620efcb7d369ad71cf8d23110380d91b77

SHA512
eae15b95f2b07236fa590b726b06ec2ebab800096cec003bbf617cf2a45aba1b2c40334b5bee08aa4f29d513d970cbc65e9bb4073e1be3bad44eaa1dfa2971fd

Download Submit
C:\Windows\SysWOW64\Dboigi32.exe

Filesize
93KB

MD5
233fffbd961be59ce7b728d46cefedf9

SHA1
acf0a7d576cb431b77b22de358907b5facbfa0ee

SHA256
1f2e32134c703831f3bd253e13ddf844013e640d5c319f93f8a67a38fa306cf0

SHA512
42970fa4662fc5329967ac5fc85c398ebcf977eaef9fcc1aa035595af3695aca075b5ca65a1feeedc83c644c41f5539b010b39652581bfd31034c413b436c1b7

Download Submit
C:\Windows\SysWOW64\Dccbbhld.exe

Filesize
93KB

MD5
ff07d80edcff05bc3d84110f8d15df1e

SHA1
551fe5c8163223047b99641a9166e5d5a634e69f

SHA256
ce78adcea4268f53007573d9a170fe74142cc8eb1e51d65e412f32ede44d34e3

SHA512
fae22686fc835a5a7b60fec8186047f69088ca5d52b0783e13a89bb3262b3ed4941844454dfcffcc91c3d2d186477254ad5e43be9c846fdd87080a59b47f6746

Download Submit
C:\Windows\SysWOW64\Ddgkpp32.exe

Filesize
93KB

MD5
8e172999937cd843ca4bfa4d0befc1cc

SHA1
b11b6f56516fbe183cdb3326ccba8785fbb2f6aa

SHA256
d965532b551a7e2058dd509ac5dd172746fcfe007c99af9046a38e8a5b311b42

SHA512
6975d3e1a6bac048c1ff08f798a19ff16dc0d6e5d65054291ba4e7ebfccadeb16cea6669f81c805c5689bf1e2f8a502a477a0071200947edfc8016cf438d215d

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
93KB

MD5
883e790cff1b6956b0d6be163d77e820

SHA1
f4827ca1e57479bedeaa55e7e6f966aebb298965

SHA256
8072210258ddae6137756f739c14672d9c745a484e3fb3b2ba5dd7b8cf721ef1

SHA512
fa830492e9235ca1f3011fc752a7d9d1397432ee903e05614053f870e405592b31e438b51816dfb414eb5f91a405c258ea0dce602b38c43260b1068c81ebe4a3

Download Submit
C:\Windows\SysWOW64\Ddpeoafg.exe

Filesize
93KB

MD5
922aeb4661bd3ad1021fcfe013e929fe

SHA1
ee504ce85fbc98386bd7b5784ef30615e7aca6a1

SHA256
019b9256061b2c924f87507b3600526f60b257a0baeda51040b9bd8ee80bae60

SHA512
0c1a42cd9823bc70b4ae32c1b1cfe55cb44c1c0c6136182506e4e0623be47685c54f07a044641c28fd5cdc012efde5fdcff9cb341ab5b279dfadb20abbb9bde6

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
93KB

MD5
acf53cdb9262c1c859d72efab7948e74

SHA1
1d782dc66264c24098467fb272c38b0ad2a8b463

SHA256
8e3b23002882c71c5f770ca2f587b8b11c80d94a0996f8b1e99de249b4a11df9

SHA512
8e807cede860a562e7f17821a13048fa5eeaa84d7843b51cf68399b7bea05beea4540417bdf0ed5c2e1b792f078a2c50d4222cd0c097e8be03c24e252f2d1be7

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
93KB

MD5
eddf9975a1507b431548751eb873fda7

SHA1
cca3241e6b52917f5f6a7cd01b0bb87cb4ce2ebd

SHA256
dae107f3c8f0ee8a6992d5330259ce0148500998ff0b1c12a10267839461faeb

SHA512
1c699bb94520ee013fd86eaa916701e9f18de8de7a9337b996fb478f6be9c961cb15331a8d4ae47f717d9e8052c47eef2451f0e867854c4999a6466290b75c9c

Download Submit
C:\Windows\SysWOW64\Dhpjkojk.exe

Filesize
93KB

MD5
b332d0a9e201c1e62866ea3ad618788e

SHA1
9d22da318e4829f9ec4de6596d3b114649afcc53

SHA256
67ae8d1555daacff4d7f69d16aaceb2ccd1a72bc726a4913ffb2cd7e85634cb7

SHA512
65d2ec0d9af8add4f811940511b42bf44a66f348bdacb204c15897fe26df6dd5e55b19b07ae6b4cd9279cce2c79a13d9c895a4654eb93e6855bbcd78c0ea191b

Download Submit
C:\Windows\SysWOW64\Dkjmlk32.exe

Filesize
93KB

MD5
ac1905765c9dd898c365c7d90bad05f8

SHA1
1eb9fb235d113def3d79640de2bda10189606f41

SHA256
4c83b884c5a37d555a2ffa25d218de40324748e27ab6f12096c4f694fb93ec23

SHA512
4bb8ebb28a856d9e8062a137f3d9d037fd5a2e965d38e0d0de85189d71526182288b882472beb374dbbcc9ff06322c28c2e97c3c9a483a81cab440e1d4a6e052

Download Submit
C:\Windows\SysWOW64\Dldpkoil.exe

Filesize
93KB

MD5
85b81dbeea5e930616a00e1e2cf8bf70

SHA1
5c8390a9fa743869be94e980ca2b98d5b4b9958a

SHA256
72e5e5a90f385a7d27b9153da9c39efd3db4e3bc52e3e6b909846c76fb01d03a

SHA512
a122b4fffb516978f9cf5aaf4001dbab33fcc9feb48dd9fc8d994d5d87b106b969e32afa4b1ec27caf3b931d56a9a679bb409c91f93321451a1c2c1c4a7f4ec1

Download Submit
C:\Windows\SysWOW64\Dlijfneg.exe

Filesize
93KB

MD5
b8c139c135bbda049b35ad865c5d2d5a

SHA1
fc853e9ec7bbe094ccd66261cf0820c27a1edcaf

SHA256
485cfbde7f622daf96140384169416d3cc87a3c0e3c245697c9110b9a6133f14

SHA512
7c08bc6f1e622231cb0702cf7dce4111273d46415e82e940e9a7cc9bb5ff8f66db21b19e3f680084059b60650c95b121125ec4abd4459ca2bae13c8fdd5b8022

Download Submit
C:\Windows\SysWOW64\Dohfbj32.exe

Filesize
93KB

MD5
8ba6f5d2596d34acf357476c66474c37

SHA1
e783cb9820199f28ffcbc24ff255843e78dcc690

SHA256
f6de50dd00d39b170dee5053e0e59233f9d26927cc5687af276eb6520ad544f8

SHA512
2a021adcc6d05518a0a30495a48d29edddb96c0591208983564a2494eeba63fcafaed100322d7cca9ba9d299e6f7e9fff20e91bd8d0c5a0f001d8a8e4a129c6a

Download Submit
C:\Windows\SysWOW64\Dojcgi32.exe

Filesize
93KB

MD5
7a39acca81b658ad56d6f1b2fe915248

SHA1
5c0229addafd7747ceecd59d6fa71508058658c6

SHA256
68b8e343228ad0c5489be7d3654a4ebb11453eac60b82b1fdeec5be6cdfe07ae

SHA512
a75d63cd7a6ed97647e0c1c48a85c910a84737fcc3125cd3dc7283ac668af69244894316364513dc237afec635afe2b91b0f2aa2da11e6ac5c1dc7bef22637eb

Download Submit
C:\Windows\SysWOW64\Eaklidoi.exe

Filesize
93KB

MD5
aab67f3e038acbb78eb520d42f570f4e

SHA1
5c52a0318c665ce3b91390186088c0ba0aaa892f

SHA256
79fa80b7e3dfb8213813a9cfb10c241156aafd71195ddd9f0336ef5cfe662489

SHA512
22c49ff8f377ebdcc9ccf9deaef7e65dadb6cd6c5b3ce80336b26dac783074abbc846fe83ad9aa389040856c4713df77e6135bcc949e76a8518f1b02ed4eb67f

Download Submit
C:\Windows\SysWOW64\Eamhodmf.exe

Filesize
93KB

MD5
58eb32b6f43e0dfc924707b4b81502bb

SHA1
4bdbfc58b46e935f708dc4474c8ef78a5ea9ad4c

SHA256
e0afd075aed1609d0edeb0eb3b2cc0ca876457dd542701503301cbc3f413f01e

SHA512
bdafdb9b154afc0fef370276e2aca3cb35ee95df5453103488ed2d91fc8c6156e474917445a332f3cba57d02c0f078ed843d05fb286584284ddde660b33cda50

Download Submit
C:\Windows\SysWOW64\Ecmeig32.exe

Filesize
93KB

MD5
cbedf2a7b9adeb91bdfbe8cac0d85b5b

SHA1
04323acda35f62bb79732c6accfccfdd97d3c0b9

SHA256
51c1374d97525aabc349b3813261cb54096e25e621c77fe81d75234ba4ca4655

SHA512
b9cbfbc899ab02408580316359c8e506d7fa4990f104a266d9231863f9b91f7530855c7334b6d7fbb50b643d41d38ef33b38f8c4e06711e3d78b7b4f9d21836b

Download Submit
C:\Windows\SysWOW64\Ecoangbg.exe

Filesize
93KB

MD5
0c6acf2a4236f569586099f5f9940cf1

SHA1
5ad5368347fdb36783cab93a018fb753c4711922

SHA256
90715274461f0d779d0449d2bc61050e6206325fc891b3758ac41210ffd6a58d

SHA512
1f83d3364530d66d33aa16c5c3264519fbeb0adaec4bf1ec304a1ca5e52fd636001d201105b82e862c663a53c2d3050dfeb329f10947d3bb0ab792ee0c670289

Download Submit
C:\Windows\SysWOW64\Edihepnm.exe

Filesize
93KB

MD5
3653d2f635f69e5615511f76a43944f4

SHA1
41202e1f59122c65989c1478cf5444077b0e1589

SHA256
6ab6d5701c1def35815a14c449cf6875c2b063e7b47662d00471dea06e308200

SHA512
fe3ce6643b6eac979e83bea2e9905e1e915cbb6d670de6228b5d5de6bd3a3625719047fa38670f29da82232474d70d8c4cac78a9e534b024b2a0a81e2296c7c3

Download Submit
C:\Windows\SysWOW64\Eeidoc32.exe

Filesize
93KB

MD5
c9586c185682af76a4c84c61550c7da2

SHA1
c605a8746d7c39ae2a4c38a26fe8d67ec6abc5bd

SHA256
ad28976d95226ce6027d9767f8fd4466fa6bd9d5966a62a9a34d458cab7c1d00

SHA512
d8944c7bc46ab0832014da1453e536e7c6ec628af573abe13b839ee00c5777afe2fe18c9a5940d55fb0113456fa2c6d2d9d22d473d749ea71a230b9f9ccd77ff

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
93KB

MD5
d96b3dbe7052531d280fc14719ad1d2e

SHA1
666ba9f18084cbc76e24ad5020e0fb0588c35c97

SHA256
039cec89cb2129aa1b34fa9dfde1632c50b9e70d3618038774b2d714283a0da9

SHA512
d19814de0a864a79dc1523079952e95997f7e13f632c8ac2e78ed1afeec565ff200143d044ad017a79ea336791928d536406560646c2c68fa01b9eedda53772f

Download Submit
C:\Windows\SysWOW64\Ekacmjgl.exe

Filesize
93KB

MD5
b4d8f6991e9a8c0c05634bd0330e3524

SHA1
74482cea3f96903afda00ec63b95b3546db7b291

SHA256
fcf51af86d62a1a2d1b4f08fbdccd46745b6e3b8dd42b7f56c60bf55be2542d5

SHA512
ee64426323b91f97ab86999728127550830f210de02dcc86c06ed7814c473de26cadcdd08ba4087095cfea904dded1172f98534bf3fd0e966bb1995cdf123aaa

Download Submit
C:\Windows\SysWOW64\Ekcpbj32.exe

Filesize
93KB

MD5
adce07cbf1cae1c7e6c636490400dfcb

SHA1
6bc452fe81909156ca8c47eb9fc76bf38d4dc2af

SHA256
6881c1103ebffcd486009b4ae556cbfc0194a96924d437af9b38b85c0ddc482a

SHA512
3558c978b1f0203837486d0472ae20278ad1bb2f694fa3980591dc2bd89408485b5a09266b543985b618569456c5cea14ebf0e0af49ade8a6e51a01128e68ce9

Download Submit
C:\Windows\SysWOW64\Ekemhj32.exe

Filesize
93KB

MD5
0cf6e3e7c00b6ee86059f9cea6afbaea

SHA1
0ef4cd7d4d061c7c383f05a319b902b711906e6a

SHA256
ab72a4238fe86b53d57cc2c1747668499a9782cb291006b134904a6a3b8d391c

SHA512
7e6b8d76f8580cfc1dae2e4b0269c98c320673db6a0c64e8625b1dbe38999d74221bb56211f137f5937fa58c95892469cd9f54cd060a31941ff09dff4c02db5a

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
93KB

MD5
2ada8a2db2a029b8185c9612c872ccdf

SHA1
f648dfe202083fccbf43e3d2650719c8e3c4e89b

SHA256
f69d2a1fa0d07b3f0c408e2876292e5c532b3f8ca2f9d60c5ab69eacbd498567

SHA512
760a2053b56d147943f7a54f94da7685514b67d8c93a5f76c468a465b6659412f6fc3b1ae57a230a6f8915149a8853f0430c469b6f01b40cb6d2f2e565b83def

Download Submit
C:\Windows\SysWOW64\Eleiam32.exe

Filesize
93KB

MD5
728460bba8bebf78428d0add3e6ea504

SHA1
522d78a676e7ba1188534308d09c7c1a0250cd55

SHA256
f1d13219cfb5e4065064f317fc2ab341ef67d3834cdcbe12d37718fe994c43aa

SHA512
5d1aba45916a189062a47f99e82847c1f1705cc20cf3ef4c8be55b4c47aff14e70b7db23103c6d2de6be35cf4b98bc8f50f6ac1c4ad18c87eec5aae1457e8970

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
93KB

MD5
02e051db6b5655551e96263c5c9cb68c

SHA1
79fa69ccca889d755724f7d70d5ff42fcaef7dbc

SHA256
085b6906de012836b1ee826b3eae5c1b88ff22dee7cd09792a93f27965ac3075

SHA512
21e88c75cac6d4a60d0ed843d532b28e32e6e8ebc8ad606c8e00d27f710e7340db927153d6119f45cfcc304fbdb5b959924fa3b598b006a275a6759e99a420e9

Download Submit
C:\Windows\SysWOW64\Hbpgbo32.exe

Filesize
93KB

MD5
e7183ce219b0c18805a3951387a908c4

SHA1
901027e3af27ad6f5e8be164b716ca20569fd867

SHA256
00a8e325b07a82bed04b94ea68628927a8d2b6fbc0c0fd946145d0a0713b9d0c

SHA512
f31a68716f437bb2c9cfd5a89ccf1f159fd604adc7712fc988ee81ad9370a8c0d5f12f8e62f72ff230dbc4b09c313452d6b0a08807821127788608dd62bce196

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
93KB

MD5
26659ee0a806b0a3fce96545c267c776

SHA1
d0d4824edfaf6444ca733763ddd0cafe71dab5e6

SHA256
81ec8b88a4e71b7bd7bc8ed4ab54d1beced2cf49f68a8a5d4a5a52685ee9f2fc

SHA512
f73caed7da950bceafb596d77f21a6804ca9d83dfe7c00284947f437fa85db46d41ff16603fca9be0b429453c0b574959b9cb70defaa216a89ec256008dc10a0

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
93KB

MD5
1aa3d09be05ce54f5b52b33156034b35

SHA1
9f92a92a2a2379123a59447feb0236b73d7452c6

SHA256
4e44064eda0194bc5a04a84008d787ace2428ecd7bcf40ebec60c1f29ed26f80

SHA512
4fabd67dc7a67f62d8298ad443bb3ba0d89bf39e42da76dbcf4a52ca5097e864d5dcdb419d6e6ca040cd9b2fb692108cba573ddf38f44a16cdf0c624cb2a481f

Download Submit
C:\Windows\SysWOW64\Iifokh32.exe

Filesize
93KB

MD5
65fdd4533596854675a27a6c9eef7d31

SHA1
43aa249f0aa3a6e2530f8155b5490b0761b6544a

SHA256
2cb128fbc7f849b0010305383ee8530c2af7b97cca039e117ab0b058c7e97feb

SHA512
dfbe2e5cb299c82018c849ff3d647e67ff1c1b3597df6ae634f3a6d7c3b6a0d966de6354e9de454187d6f1794dc632a17fe81c04a819cf4c64de7fde3c61542b

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
93KB

MD5
bbe457a10eb0ddba89efbceacfef2466

SHA1
245744a4811e2574c57921d2c6fd719ad9bab57d

SHA256
737f9885556de68aa4c42a1eae1dfc9f9133b2c81b0c6ad4dd48ff51f3ca02fa

SHA512
fa315a67211000a1e0030d8f0d2d4c0ea719432444be2119ddd10450e1423b24f99ff4e68576b5e01e7e8806623d4494a41870549470a1ed78cb18069dcdb185

Download Submit
C:\Windows\SysWOW64\Jfhlejnh.exe

Filesize
93KB

MD5
6163a6a1f17394089e44ff20a6e6efaa

SHA1
72280c11f49375eb0899db1498c9aed9c2314efa

SHA256
cfa70daf663c2e3ac8b9de70c68bb7dfb0b7eab5c23dccf08fd9ab0ca1ef1e9d

SHA512
04baafb02ce00ce8a5ac06cc7002dfa546a28c4055b45725c3e8d36bc187fb5c1bf45b30682472887798e53673d23c4fafee2646254cfa421dc5c7ed924a7df9

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
93KB

MD5
d4903cfd5b584361467e533bdf3e2a14

SHA1
4a27b983866790f31542ab563c008cf51efb3df3

SHA256
28f21427d3ad8c92fa4a07190cd19d8ca601586f996de9a89837c0247f34c9b9

SHA512
cd3fa8543ef194f854b4ab94da1461f05630156d31651a25d593cbcb6166cdb16d5c3b617293a9992c35c7e04c55ac2fd5440ec4995ba792316ff5f5bb251a40

Download Submit
C:\Windows\SysWOW64\Lbmhlihl.exe

Filesize
93KB

MD5
f348aba7764b168847e212b8a69a4a74

SHA1
34bed3962cd9bf23f3b544f88e030e3960786754

SHA256
3f489a6a80714bd34237316310a5eb220222e14a8a0f591fd8bbf46d50108a3d

SHA512
3420e1ce5d786254892e30784ea8d3632ff5d8908f435235a3b1b21640b6097523a2427098c9bf1a77079233ecced732821e350f8b12d94db185ef0c08e289ad

Download Submit
C:\Windows\SysWOW64\Mdehlk32.exe

Filesize
93KB

MD5
51a1c28ed0f435d3276842543e672687

SHA1
6df4486f94cf5482fc171a2d95efafb4202b7d10

SHA256
0715bddd9c4951144a323b906fbafa930d839940c6ab191f67f024aba9f10046

SHA512
a61e6f89e819a4c7b2d85abc489e06e393912bdfb15edbe2107d6910fe92fe03262d58df130ca91b3d9a1db0074e9d055b2b470a3cdb8d093aa4cf588137154c

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
93KB

MD5
50c6f79f649a05a24a0f24b7e854d0f0

SHA1
e253aebf79589979c1340356f0a873b4df764225

SHA256
d7eba86ecab446c16a8cb794a3408e8d9e151b6f220bba4edbeaf7643b6569e8

SHA512
3dbc09acb65396a084306d46988695b594063a9c10dcffc007ee2f2cdfdb95bb8dccb60a0cdfca2a5db8bb8ac5bcf75b41e0ae83b06ce59e81267daa831e46a7

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
93KB

MD5
41c158dc68175bcb2938d5345abf1800

SHA1
e2da56b7d21bdb9bc87f748a4b7e5ea606ce7388

SHA256
dc12fccdf2d2bf348679253c3668b56774a3536888e1013233bb77f2ab5acd19

SHA512
3b8fd84920bb8eb710f0a2fe295eae06a4004235af970f7c877300daa391ef9b9f0c7e9cda874554ee8b96eb48716476805fbbe58950145e4319fc231696f2b8

Download Submit
C:\Windows\SysWOW64\Mgkjhe32.exe

Filesize
93KB

MD5
dd7054f742705716f34c7b50cd7443a9

SHA1
795612a1e369624f728858aafc5d38e6c501966a

SHA256
f409ee4e70654c9c179206e7d692547fcc98401c9bee2cdd3daa5bfdc18f7b58

SHA512
fed702ecd7c7291d9cd04ca760860b6c855ac54609c56329e71214208f510a371afadb4efe8c2a6137eb74edaedbecf5c7a22a432c440e38e5653041a6a6708e

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
93KB

MD5
0aa02038758b8c13f637c5252f74c5bb

SHA1
cf61942aabc058c686b6e618ec6b2002125a25c5

SHA256
2f5550f012a087b78a0f217767aa940d6dd2b765ee9a7ebfe6327f313dba5864

SHA512
30636b3a54fdc311835a4c4899b4cf497e8580c7754e4d467822a06d5388e0a6f737c3065edeb8e38b574872387f1cece5d4d20eb3bc7a33b0e51f021b3f58cd

Download Submit
C:\Windows\SysWOW64\Ncfdie32.exe

Filesize
93KB

MD5
cd7dec0b1f7e58ec10a1337ac9510043

SHA1
8e8a3cb30320453aeabde67f747bfab2d8dd0711

SHA256
398e30f7223989b84a8199863903860fb1713f8d6398f8e88e80e10829551f8b

SHA512
59b44466c024818f6a0d2a2f63ad533e5280636f5ad2ccdba1d40b6c7a593c87279b569d5210d5915b8165d47c5c73b5c12c0ed2cd040d70dd90aa784545769f

Download Submit
C:\Windows\SysWOW64\Nfjjppmm.exe

Filesize
93KB

MD5
b4bdb108719eb169b51b1c3ae99bbbb7

SHA1
26d35680047364b8b10d62c62e6af78adc13571f

SHA256
68e9819b2969609e268c605d36a5c1b9fcac13bbc0b681d69a485c4e4c256613

SHA512
0ec9683174ac235f9eac9d65624eef8ec628e948d9f22e22a428c2404333be4a363fa5a04bfefccb463b69d9c77dfc86381673dfa4c27ab6719b9f38756a8eb8

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
93KB

MD5
f66810d962e5f93d1b43f1a2944b7ed1

SHA1
3ed55ee5b0a02e7daf33463717fcb10691735c46

SHA256
874bc38a65762fe1cedbeafd62760cf46013b8304c28babf7a4bb9e0bafb7f75

SHA512
a937f8e5be4cbaa63a612e1401170f0e0b7f204a03c431cc1e3f6f9be820c39c9cdff5122220669fc5cfa5497e5b04e6e8edd651281f7be5019d2f18c9388eb5

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
93KB

MD5
b40b15af9a24ee9053c59532928f7f90

SHA1
fffcc941dc180cc81be1f53a4d87dcac48d5b12d

SHA256
6196ea6478786b02754dfe1ef1780e2af1b2c357052d6a350330a91e78f08fd1

SHA512
676280c24f844bb5a29c6095932e09ff38231d28a24aeb34816b1b975f2e41fcdb7b368e55e32c02b925d2d0373100904dcd6a1ac6d74dc43c6bb0ecd93b5a1f

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
93KB

MD5
1ef063cc22d3172a3568aeb9e99363af

SHA1
eb9d1b3a42960f3cb1ad810bba97e52ccff59bda

SHA256
720693a226ed4553e9fe70db38f25cc2ed5b4a85b6175ed124a648008568189e

SHA512
182ad62e2a5c76046d172c9275954ee73fa742726cdf26b5769815adeb82727747c4afd335f12e83205ca02b7c9a022cc53fbe50bc57e54491727759827794f5

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
93KB

MD5
cb9a12c4c1bc0c453671f948805db368

SHA1
a0bcd75e9cc7e15a202f2bb4bf81b918031195e7

SHA256
1f38a443c851979673c52e3120fae054d7b9939c2d3f17545ddb6c911bf0a94e

SHA512
8edfa515b73f79aecf03d8ee57e0b982d29076e5d289c0ae951470ea33c71c5ed8c1c7ffaf5aa3df8786cb0e76ee774124ec674e2b4e30740077dfdacdcf2d2e

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
93KB

MD5
f7d13dcfa3986fe872795ba70d431e73

SHA1
d13488a1be0e4b9d5c39ddef8809cf12f25103a1

SHA256
69470a0163fbdd816c3862fe716eb08ca0800a05f93921d8352e78f62255defb

SHA512
469489f234ee0197a32774812ac9f9ab57a78fbf4d0eb428336a3043a14650cd3b9d36987e4fc83a9c4400786de5ce38e3996d172dbff228fbe2444c11904e93

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
93KB

MD5
bee58c31cf3a1b17d89c264fd4973fc3

SHA1
12b05542f30f885ce1f721386870909d3d9eaf52

SHA256
147b8a7a2d587dc49b5dc36c596147d05126c6e4d844a8f5de7b02abcc10cbb1

SHA512
d879b6086fce28884dfbc9954f5e2dad5b91c67325d23e7a2a5e2f9d144f96afaa476cd6835a5ae29b2ac86c74c6d1890b5140a62f390b68b7f7e5c226408f12

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
93KB

MD5
60561a608bbb4ea2049a2c2aaf45f1ca

SHA1
c6b85562c962f12c377db8411800d1c2abf21447

SHA256
cb366732b5317e91d81f67e1d2815a1ac2d666cdafff19e73b4cc45ea1744dde

SHA512
e58d8a1cb5ddceb12e5bff968146d646923921341171b3199ad3c3547a2916f41c598bbbdc5323363342ec55a997a1f2322c637f7040802adf8f55e94ecb7044

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
93KB

MD5
eb7365cc0a88f832eb8712ef57c79944

SHA1
acfc86a2cb625c75337e169c496ad9e60e68c414

SHA256
7ecb3baac13c8b053eee779587d30971b74f5e503c543126ea8504ee79620ca2

SHA512
f6932bcba9b5c897faa04b067719df9769a0d9c8bdf47daf411832c20db67972d2820880bc8b29c3e1e29cf124ee282c35eb6ba83e8c1143c9e859415242e09c

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
93KB

MD5
461fac8470d260a4b34114c132770863

SHA1
e5e27455d9c15da0d692acfea4ebfc84fddc07f1

SHA256
8c50710d2007cfad3d0a4921bcecec4c7786b13845da1825a85759003b8dbfa9

SHA512
d1bb4adaa67c3cbf4cc0a2c8839bfd7ae7e4423fd25a12376fe057e925fb6fc69ec2020f0c1e8fe5a1f0e06346b026c21ea9f4e372ca5131760cbb49faf71c78

Download Submit
C:\Windows\SysWOW64\Qjoankoi.exe

Filesize
93KB

MD5
fc3e632d166b28e74f2c690ea1d1906d

SHA1
5828817d8f0cf010c2ae57ab45bc862cd18498c1

SHA256
d11c283c25819d2f8168c2dda9d33aeacebb0e284b6e287b78c5e8841bb8f103

SHA512
1dbcd8eb88b088e7dddcb984fab946cf989e0f79b61f28c9442ca4afe7466b937c598594fa2e5fb2d62aa886aa65ccddf5debfd0069818843f4233db3f10dc71

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
93KB

MD5
92c797f3c5e9e385634eb847c1d318df

SHA1
72bf1bf2599746983a4a4d6ed0517a3477655ef2

SHA256
bde542aad3d1be81048b9c22325a0f4bfd802c1829e680e23b9962dfd4fb56f1

SHA512
24cd83421bb07d4437a7f04b939c8809f8ed64385dd7b0454e81f2d9394d73caf6de13415387e7e8ebf3bb1b12693c8e117de5f2a41e19a704c53eeb64aef3c4

Download Submit
memory/212-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/212-589-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/328-528-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/372-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/408-548-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/756-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/916-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1052-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1156-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1204-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1216-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1240-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1260-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1284-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1300-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1344-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1360-510-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1412-492-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1472-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1472-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1600-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1656-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1676-444-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1708-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1804-522-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1936-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1944-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1964-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2024-468-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2028-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2068-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2144-516-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-547-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-576-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2444-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2732-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2756-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2820-562-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2980-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3080-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3092-450-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3436-538-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3436-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3436-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3464-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3636-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3640-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3648-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3696-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3780-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3820-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3844-555-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3876-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3908-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3912-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3916-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3920-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3936-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4008-498-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4060-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4064-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4188-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-587-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4612-486-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-561-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4628-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4632-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4680-569-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-462-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4700-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4748-541-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4808-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4856-438-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4876-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4956-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-575-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-125-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-554-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-19-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6360-1615-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6892-1624-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7108-1595-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7376-1585-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7520-1581-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads