berbew | 1f1242751f0c9981a2d7facb8e0776c597ee9707e9386078b3e32901f1a855c7

Analysis

max time kernel
92s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f1242751f0c9981a2d7facb8e0776c597ee9707e9386078b3e32901f1a855c7.exe
Size

320KB
MD5

f34c3baa56f5df7f6790d9586634a2f9
SHA1

640815a283ef7c88898eed49c7c90a331ce078cc
SHA256

1f1242751f0c9981a2d7facb8e0776c597ee9707e9386078b3e32901f1a855c7
SHA512

42bb4c167cc8617fa0e911c44b6bb22f6cc38028e0fe77c97bf5eaed89de1b01f05ac6499d8c83a82f1327e135e940a6a18f85a552c08576d293483cabba4368
SSDEEP

3072:0FfcwS38StFM0PEhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0FfcwSr8hV/Ah1G/AcQ///NR5fn

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmfkoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmoeoidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpbmco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fchddejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmjlcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkmchi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lepncd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iehfdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fafkecel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nckndeni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	1f1242751f0c9981a2d7facb8e0776c597ee9707e9386078b3e32901f1a855c7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfifmnij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npfkgjdn.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3296	Eadopc32.exe
1868	Edbklofb.exe
4228	Fljcmlfd.exe
4720	Fkmchi32.exe
4916	Fohoigfh.exe
3680	Fafkecel.exe
4736	Fkalchij.exe
4684	Fchddejl.exe
2192	Flqimk32.exe
3692	Fbnafb32.exe
2364	Flceckoj.exe
4676	Ffkjlp32.exe
2788	Gkhbdg32.exe
464	Gfngap32.exe
5080	Gkkojgao.exe
4024	Gbdgfa32.exe
4844	Gmjlcj32.exe
2236	Gdeqhl32.exe
4288	Gcfqfc32.exe
2280	Gmoeoidl.exe
880	Gcimkc32.exe
4748	Hiefcj32.exe
3576	Hkdbpe32.exe
3380	Hckjacjg.exe
3984	Hfifmnij.exe
4800	Hobkfd32.exe
1032	Hmfkoh32.exe
3344	Hodgkc32.exe
3668	Himldi32.exe
2648	Hioiji32.exe
2592	Hbgmcnhf.exe
1568	Hfcicmqp.exe
3080	Ipknlb32.exe
2208	Iehfdi32.exe
2060	Ipnjab32.exe
644	Iifokh32.exe
4592	Ickchq32.exe
2960	Iihkpg32.exe
3536	Icnpmp32.exe
5044	Ilidbbgl.exe
3912	Jeaikh32.exe
1124	Jlkagbej.exe
3980	Jbeidl32.exe
5052	Jmknaell.exe
2288	Jbhfjljd.exe
3908	Jefbfgig.exe
2984	Jlpkba32.exe
4940	Jcgbco32.exe
3416	Jmpgldhg.exe
4896	Jcioiood.exe
4492	Jeklag32.exe
5000	Jlednamo.exe
2264	Jcllonma.exe
1376	Kemhff32.exe
1100	Kpbmco32.exe
2244	Kbaipkbi.exe
2196	Klimip32.exe
4352	Kdqejn32.exe
1596	Kmijbcpl.exe
2200	Kpgfooop.exe
1636	Kbfbkj32.exe
3276	Kipkhdeq.exe
456	Kpjcdn32.exe
5072	Kefkme32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hikhen32.dll	Gfngap32.exe
File created	C:\Windows\SysWOW64\Nckndeni.exe	Npmagine.exe
File opened for modification	C:\Windows\SysWOW64\Nfjjppmm.exe	Nckndeni.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Mibpda32.exe	Mdehlk32.exe
File opened for modification	C:\Windows\SysWOW64\Pcijeb32.exe	Pmoahijl.exe
File created	C:\Windows\SysWOW64\Papbpdoi.dll	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Nnlhfn32.exe	Ngbpidjh.exe
File opened for modification	C:\Windows\SysWOW64\Ojaelm32.exe	Ofeilobp.exe
File opened for modification	C:\Windows\SysWOW64\Pgefeajb.exe	Pcijeb32.exe
File created	C:\Windows\SysWOW64\Elikfp32.dll	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Bfajji32.dll	Ldleel32.exe
File created	C:\Windows\SysWOW64\Neimdg32.dll	Mdehlk32.exe
File created	C:\Windows\SysWOW64\Ngmgne32.exe	Npcoakfp.exe
File opened for modification	C:\Windows\SysWOW64\Ngbpidjh.exe	Nphhmj32.exe
File opened for modification	C:\Windows\SysWOW64\Aadifclh.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Gbdgfa32.exe	Gkkojgao.exe
File created	C:\Windows\SysWOW64\Kpgfooop.exe	Kmijbcpl.exe
File opened for modification	C:\Windows\SysWOW64\Olhlhjpd.exe	Ojjolnaq.exe
File opened for modification	C:\Windows\SysWOW64\Olmeci32.exe	Ojoign32.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pmannhhj.exe
File opened for modification	C:\Windows\SysWOW64\Klimip32.exe	Kbaipkbi.exe
File opened for modification	C:\Windows\SysWOW64\Ampkof32.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Kdqejn32.exe	Klimip32.exe
File created	C:\Windows\SysWOW64\Lenamdem.exe	Ldleel32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Gbmhofmq.dll	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Ciopbjik.dll	Pmfhig32.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Agoabn32.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Jjbedgde.dll	Jefbfgig.exe
File created	C:\Windows\SysWOW64\Eiecmmbf.dll	Llcpoo32.exe
File created	C:\Windows\SysWOW64\Bhbopgfn.dll	Npjebj32.exe
File created	C:\Windows\SysWOW64\Ocpgod32.exe	Opakbi32.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Lgepdkpo.dll	Npmagine.exe
File created	C:\Windows\SysWOW64\Pmannhhj.exe	Pjcbbmif.exe
File created	C:\Windows\SysWOW64\Ndfqbhia.exe	Npjebj32.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Ffhoqj32.dll	Kdqejn32.exe
File created	C:\Windows\SysWOW64\Kipkhdeq.exe	Kbfbkj32.exe
File created	C:\Windows\SysWOW64\Jfpbkoql.dll	Olmeci32.exe
File opened for modification	C:\Windows\SysWOW64\Pnfdcjkg.exe	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Fchddejl.exe	Fkalchij.exe
File opened for modification	C:\Windows\SysWOW64\Gkkojgao.exe	Gfngap32.exe
File created	C:\Windows\SysWOW64\Hbgmcnhf.exe	Hioiji32.exe
File opened for modification	C:\Windows\SysWOW64\Mplhql32.exe	Mibpda32.exe
File opened for modification	C:\Windows\SysWOW64\Pcncpbmd.exe	Pmdkch32.exe
File opened for modification	C:\Windows\SysWOW64\Mdmnlj32.exe	Migjoaaf.exe
File created	C:\Windows\SysWOW64\Ojoign32.exe	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Dbnamnpl.dll	Pggbkagp.exe
File opened for modification	C:\Windows\SysWOW64\Ipnjab32.exe	Iehfdi32.exe
File created	C:\Windows\SysWOW64\Jmknaell.exe	Jbeidl32.exe
File opened for modification	C:\Windows\SysWOW64\Jmpgldhg.exe	Jcgbco32.exe
File created	C:\Windows\SysWOW64\Efhaoapj.dll	Lmbmibhb.exe
File opened for modification	C:\Windows\SysWOW64\Lepncd32.exe	Lbabgh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7044	6492	WerFault.exe	301

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ickchq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llcpoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nckndeni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcimkc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpjcdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hioiji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eadopc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdehlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fafkecel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlkagbej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpijp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeaikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbfbkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kipkhdeq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmncnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pggbkagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbaipkbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkalchij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icnpmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpbmco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbdgfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflgep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klimip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmijbcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liddbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcbbmif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmjlcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmknaell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgkjhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbmka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdeqhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdqejn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngbpidjh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doilmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfcicmqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljbncc32.dll"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahioknai.dll"	Ncdgcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eadopc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbdgfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmjlcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dndgjk32.dll"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhaomhld.dll"	Kpbmco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogifjcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npjebj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adopjh32.dll"	Ickchq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdehlk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beapme32.dll"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldamee32.dll"	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfenk32.dll"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipnjab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfmbha32.dll"	Ilidbbgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngmgne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhkngh32.dll"	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jphopllo.dll"	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lingibiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkkojgao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffcnippo.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Empblm32.dll"	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcgbco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooojbbid.dll"	Anfmjhmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3296	1804	1f1242751f0c9981a2d7facb8e0776c597ee9707e9386078b3e32901f1a855c7.exe	82
PID 1804 wrote to memory of 3296	1804	1f1242751f0c9981a2d7facb8e0776c597ee9707e9386078b3e32901f1a855c7.exe	82
PID 1804 wrote to memory of 3296	1804	1f1242751f0c9981a2d7facb8e0776c597ee9707e9386078b3e32901f1a855c7.exe	82
PID 3296 wrote to memory of 1868	3296	Eadopc32.exe	83
PID 3296 wrote to memory of 1868	3296	Eadopc32.exe	83
PID 3296 wrote to memory of 1868	3296	Eadopc32.exe	83
PID 1868 wrote to memory of 4228	1868	Edbklofb.exe	84
PID 1868 wrote to memory of 4228	1868	Edbklofb.exe	84
PID 1868 wrote to memory of 4228	1868	Edbklofb.exe	84
PID 4228 wrote to memory of 4720	4228	Fljcmlfd.exe	85
PID 4228 wrote to memory of 4720	4228	Fljcmlfd.exe	85
PID 4228 wrote to memory of 4720	4228	Fljcmlfd.exe	85
PID 4720 wrote to memory of 4916	4720	Fkmchi32.exe	86
PID 4720 wrote to memory of 4916	4720	Fkmchi32.exe	86
PID 4720 wrote to memory of 4916	4720	Fkmchi32.exe	86
PID 4916 wrote to memory of 3680	4916	Fohoigfh.exe	87
PID 4916 wrote to memory of 3680	4916	Fohoigfh.exe	87
PID 4916 wrote to memory of 3680	4916	Fohoigfh.exe	87
PID 3680 wrote to memory of 4736	3680	Fafkecel.exe	88
PID 3680 wrote to memory of 4736	3680	Fafkecel.exe	88
PID 3680 wrote to memory of 4736	3680	Fafkecel.exe	88
PID 4736 wrote to memory of 4684	4736	Fkalchij.exe	89
PID 4736 wrote to memory of 4684	4736	Fkalchij.exe	89
PID 4736 wrote to memory of 4684	4736	Fkalchij.exe	89
PID 4684 wrote to memory of 2192	4684	Fchddejl.exe	90
PID 4684 wrote to memory of 2192	4684	Fchddejl.exe	90
PID 4684 wrote to memory of 2192	4684	Fchddejl.exe	90
PID 2192 wrote to memory of 3692	2192	Flqimk32.exe	91
PID 2192 wrote to memory of 3692	2192	Flqimk32.exe	91
PID 2192 wrote to memory of 3692	2192	Flqimk32.exe	91
PID 3692 wrote to memory of 2364	3692	Fbnafb32.exe	92
PID 3692 wrote to memory of 2364	3692	Fbnafb32.exe	92
PID 3692 wrote to memory of 2364	3692	Fbnafb32.exe	92
PID 2364 wrote to memory of 4676	2364	Flceckoj.exe	93
PID 2364 wrote to memory of 4676	2364	Flceckoj.exe	93
PID 2364 wrote to memory of 4676	2364	Flceckoj.exe	93
PID 4676 wrote to memory of 2788	4676	Ffkjlp32.exe	94
PID 4676 wrote to memory of 2788	4676	Ffkjlp32.exe	94
PID 4676 wrote to memory of 2788	4676	Ffkjlp32.exe	94
PID 2788 wrote to memory of 464	2788	Gkhbdg32.exe	95
PID 2788 wrote to memory of 464	2788	Gkhbdg32.exe	95
PID 2788 wrote to memory of 464	2788	Gkhbdg32.exe	95
PID 464 wrote to memory of 5080	464	Gfngap32.exe	96
PID 464 wrote to memory of 5080	464	Gfngap32.exe	96
PID 464 wrote to memory of 5080	464	Gfngap32.exe	96
PID 5080 wrote to memory of 4024	5080	Gkkojgao.exe	97
PID 5080 wrote to memory of 4024	5080	Gkkojgao.exe	97
PID 5080 wrote to memory of 4024	5080	Gkkojgao.exe	97
PID 4024 wrote to memory of 4844	4024	Gbdgfa32.exe	98
PID 4024 wrote to memory of 4844	4024	Gbdgfa32.exe	98
PID 4024 wrote to memory of 4844	4024	Gbdgfa32.exe	98
PID 4844 wrote to memory of 2236	4844	Gmjlcj32.exe	99
PID 4844 wrote to memory of 2236	4844	Gmjlcj32.exe	99
PID 4844 wrote to memory of 2236	4844	Gmjlcj32.exe	99
PID 2236 wrote to memory of 4288	2236	Gdeqhl32.exe	100
PID 2236 wrote to memory of 4288	2236	Gdeqhl32.exe	100
PID 2236 wrote to memory of 4288	2236	Gdeqhl32.exe	100
PID 4288 wrote to memory of 2280	4288	Gcfqfc32.exe	101
PID 4288 wrote to memory of 2280	4288	Gcfqfc32.exe	101
PID 4288 wrote to memory of 2280	4288	Gcfqfc32.exe	101
PID 2280 wrote to memory of 880	2280	Gmoeoidl.exe	102
PID 2280 wrote to memory of 880	2280	Gmoeoidl.exe	102
PID 2280 wrote to memory of 880	2280	Gmoeoidl.exe	102
PID 880 wrote to memory of 4748	880	Gcimkc32.exe	103

C:\Users\Admin\AppData\Local\Temp\1f1242751f0c9981a2d7facb8e0776c597ee9707e9386078b3e32901f1a855c7.exe
"C:\Users\Admin\AppData\Local\Temp\1f1242751f0c9981a2d7facb8e0776c597ee9707e9386078b3e32901f1a855c7.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\Eadopc32.exe
  C:\Windows\system32\Eadopc32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\Edbklofb.exe
    C:\Windows\system32\Edbklofb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\SysWOW64\Fljcmlfd.exe
      C:\Windows\system32\Fljcmlfd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
      - C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        24⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        25⤵
        Executes dropped EXE
        
        PID:3380
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1032
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        29⤵
        Executes dropped EXE
        
        PID:3344
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        30⤵
        Executes dropped EXE
        
        PID:3668
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        32⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1568
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3080
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2208
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        37⤵
        Executes dropped EXE
        
        PID:644
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2960
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3912
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1124
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3980
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        46⤵
        Executes dropped EXE
        
        PID:2288
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3908
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        48⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        50⤵
        Executes dropped EXE
        
        PID:3416
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        51⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        53⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        54⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1376
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1100
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2196
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        61⤵
        Executes dropped EXE
        
        PID:2200
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:456
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        65⤵
        Executes dropped EXE
        
        PID:5072
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4184
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        67⤵
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        70⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2132
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        72⤵
        Drops file in System32 directory
        
        PID:3904
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        73⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        74⤵
        Modifies registry class
        
        PID:2000
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        75⤵
        Drops file in System32 directory
        
        PID:4772
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4020
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        77⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2348
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        79⤵
        Modifies registry class
        
        PID:2336
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        80⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        81⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        82⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        83⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2472
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4380
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        87⤵
        
        PID:968
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1892
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        89⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        91⤵
        Drops file in System32 directory
        
        PID:3964
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        92⤵
        Modifies registry class
        
        PID:3512
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        93⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2528
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        95⤵
        Modifies registry class
        
        PID:5116
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        96⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        97⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        98⤵
        Drops file in System32 directory
        
        PID:2464
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        99⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3804
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        102⤵
        Modifies registry class
        
        PID:3384
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        103⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        104⤵
        Drops file in System32 directory
        
        PID:4764
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:632
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        106⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        107⤵
        Modifies registry class
        
        PID:216
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        108⤵
        Modifies registry class
        
        PID:756
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        110⤵
        Drops file in System32 directory
        
        PID:1212
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        111⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        112⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        113⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        114⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        116⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        121⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        123⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        124⤵
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        126⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        128⤵
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        129⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        134⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        136⤵
        Drops file in System32 directory
        
        PID:5168
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5320
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        140⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        142⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        145⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        146⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        147⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        148⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        151⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        154⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        155⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        157⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        158⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6124
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        160⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        161⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5716
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        164⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        165⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        168⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        169⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        173⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        174⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:6240
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        177⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6360
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6396
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6476
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6516
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        183⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        184⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6640
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        187⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        188⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6756
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        189⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        191⤵
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        193⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        194⤵
        Modifies registry class
        
        PID:7064
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        195⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        197⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        199⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        200⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6548
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        202⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        203⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6764
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7008
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        207⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7080
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        208⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        210⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        211⤵
        Drops file in System32 directory
        
        PID:6512
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        212⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6808
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        214⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        216⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        217⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6492 -s 396
        218⤵
        Program crash
        
        PID:7044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6492 -ip 6492
1⤵
PID:6860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
320KB

MD5
4aee3ba74f220afeef0234c132e4799d

SHA1
59c2d9ed16d5438bb07e13776bfbfd24485dabce

SHA256
28acc69dd7c94cde5ecd566478c06c01833e72ac93baa045a410a85989837987

SHA512
59413538100c1269ba729194d078ee221a7c1573e2501f785b201ba53d62cd79300377bf4ff4714c59f1325fcd41e7b8844fc4f2fa8a9ccbd8124338ad737745

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
320KB

MD5
61f3fd03e1c24f67b5b7777ccf7bc65e

SHA1
dfc38203e5f7f8284c0e0e01f6264db29fbe7825

SHA256
abdda2dfe3ea00860f59012c3a49410447087e27db314af88882ea6340067b60

SHA512
97bb0a2b1094360e5d7b1648d8c54282189f4110511c1259fcf5a10cc6dcd1861ff225223757fd5bd23bd7e5ea4cab184627004985e672e86bea211c3cf6f073

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
320KB

MD5
11ce1bc591eedb5dfee52c1050cebf68

SHA1
ecf5f4bd73db050a745f3ec1eb6bc3715baf03fb

SHA256
39016c8e58df3eb4df89ae1bbd830db8ac05b23a26e659df404dd040d64e4ee6

SHA512
c289ae05f7aae3ad209375a1aa602745a072a75b03612f0ecc02db3a558696eefc85ccf45b5fb2012a74b0af84f3362eb57a2f4df1b5ccd91f86300414ff909f

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
320KB

MD5
8aed80cfd8c17b945596909ffb492e82

SHA1
2ff087f960545dac7f320f07282ebe3a79ab45b9

SHA256
9c6be438347d9cc0071b31116e05d525a2879c1f95c6f94dfe962f55ace7f70a

SHA512
989357cfd7c49a99eb6829a2ddb2bb161c1e5401ae9b404f228df65322daac2fa04f1e9ad0fb3c0e7cef83ab087d5fd8651f868f3d332311554a323d854a8562

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
320KB

MD5
13736ed9e5423365f5863a8b488e3f28

SHA1
b04ca81308f78f3f4988aa48e388f9f9f568faca

SHA256
8449cec2e5eb113f05bb2bba04e821dd4fcc8346f08c1f368a63f2adb1aab759

SHA512
94191af96e2660113bdc1024d46e65630d205311ec261e7fd7e77461c0a6c20b5c2e8c8645a2caee480bdeca5e7b3c22c58227ab9d7df167c9b69807704d0cdd

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
320KB

MD5
3333cdce515b0e5e5a0da6883edb605a

SHA1
3ea12a084a3662754ded9a0156e84e71fc4075dd

SHA256
6be65037aa9050a8b14091e8c612c785faba85083b8a115c6fe523ae02cacdcd

SHA512
30a8143879993656a87788b328df2db5f0771f57e51f8e885bc5921fb59763d41991276b8e90ccadd4b4e43cf4804b1571b9ffafe8959c000bd72b33ecc025ac

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
320KB

MD5
1c419b2c5be0bd2a33ccd22fa8235343

SHA1
52f62fc9fe8b3bff52a75f74cf87dd7400d4be62

SHA256
c19460479e624fb836a8f8d882ac193a7ecd81743dadbf18693c96e4cc6c5239

SHA512
e0020751d8483cdd86d951263f34b04988a7f7625a3b244f6a0bd1c512ca5f3935dd41c37274665b517f5afe3ff994471310b2d9e1d88c27bfa678b3c43a4ff1

Download Submit
C:\Windows\SysWOW64\Bnhjohkb.exe

Filesize
320KB

MD5
38207aaccc7111f32b37482341701518

SHA1
aa237b3bca9da8f08ee464aca276053dc905f8d2

SHA256
1873f5fdb42759618b749502b433ccc64a7334953f72dd45d3f74c6d6b54f879

SHA512
1284771213e42f36863ac01a06bc2e1d41396dfc8d14c015a06a3de04ba24f7b10c48ff81316ec03470f699722ab64c0747b6a81535814e287acd2464f6799ba

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
320KB

MD5
b2bbdcaa26bc68427dfabb790614026f

SHA1
82118ff39c618db1c251070dc63dd5ba2b36decc

SHA256
23bca643d974f1512ef291111913e048c399268673c086a38d47c9e9338ffc8f

SHA512
898761c10cd7daded850fe7f5226d62d32095c7a1dbad5b6b7a63587504b32a134720d6da66d7d2c28e9bb59a56a88d52b292f61f0ce02819212ec29aeb6cb4c

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
320KB

MD5
f261b567341ac2fd8b3c631f794c7f01

SHA1
0278e715d9557b19fdb41651967d454e6fe40d01

SHA256
a31b76a00da9b084a8930a8082716696a74ab7071a4b817646d73321eb5a3490

SHA512
9d39a372c0bf197858e9dfe4be9e8a64a78f63331edbe50a160ef54edb7ae70525d35dad0bd643fcca2ae0936441ffcfdd41e8e69519c70c29f720af08962275

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
320KB

MD5
8c6dca4b8595d076b590619e65a0cf20

SHA1
94cb7527927ca5e9e7f541d77ccd99ff987f2032

SHA256
b4bc60fdd4126b46f9121f4197718accaa505d60927af0f6f78dde59a20bd851

SHA512
6237c778ec4fc263a0a3227b09bd92c0b122ddc3e65567f9378adacfbc42eede0344c8a98e64e5575fce05fc740b63f09bf9e4ee3aace87e53a77fbc11676ca0

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
320KB

MD5
2cd1cc087bdbceb5d9b2a1573c56b57a

SHA1
4331001fcf78e8bf20db98e0b997ccaecfd44ddf

SHA256
75aca1912089ff7edd0c90b02281e685a3a9228a2a7910ecaaa91144e438a68e

SHA512
532fee81817534167490425eae23bb0f62a276769bc2bd0c4219e4ce517070b521dba1255aeebe3efd5033a75b1de64f093660edc079edf6972f6eef97e9c099

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
320KB

MD5
1744fa40e4d3d49efa9e31cce83afb05

SHA1
aae7dd8655d0f441e1979cf3079c409a03d103ad

SHA256
7fa9769b93b73422d07e57ae31d31f425e7adb32ad4a48512332fec1b7418f8a

SHA512
29afe13defad55589251a76676583a2ae7b5a6ef720af5c8cc5949d43fa04075f63d7cfcc708ee4e55796cb7a9aa7b32cce18e4c52dd954548f813ff01683743

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
320KB

MD5
155e9dea8f40482b51e277689eabc041

SHA1
51d9a32b50d2ebc6f4171d6773bb94d32da9b085

SHA256
e00a9fdd899cfd63388884e0ee5624796c3cbf71fd8d1d5a1b0389bcab7a98d0

SHA512
323e82a3ad7bcc31b7c372d02a1f5678512601dec20975313991b1cf84cdd726802d9a1706ac639b4e3ef921702e91529925b8ab39ee08e9f78908eda2e8a33b

Download Submit
C:\Windows\SysWOW64\Eadopc32.exe

Filesize
320KB

MD5
de77e27dcc5690a7e8ec8aa105f19653

SHA1
82b281ba1a442a17ecb5932b602e7c064d7a8fe4

SHA256
888cdfbedaf974322eebcf8b84c0ce8e383673d9f60f9066eac44e148f13971b

SHA512
ff4eec10c66ad8f3545876164ed33e3d21719ea47020443976c8dd4fdc66f683ae99f4cb114ba39070dfb06d8af886730f87a5cb507a7116edb95a1a9c6dbb8b

Download Submit
C:\Windows\SysWOW64\Edbklofb.exe

Filesize
320KB

MD5
05c35eb94fa85982d76ca91e16cbbdc1

SHA1
09d7970c4b34580fe5c8c97d3767d4515770fe0b

SHA256
62e3d9c1c920ddb03e462c4e94222ade66bacc03431e91e7ecca91b0fe46531b

SHA512
2e4fd9b74d58cb8d39d9bdb78196a83bf2cf29ad34a75924d76df29889b03c317ea11d17e5eb41ad1189c899ab4f5c0d55c2502adda16c8e5da870d675d7f9ce

Download Submit
C:\Windows\SysWOW64\Fafkecel.exe

Filesize
320KB

MD5
fd6d0888786536369c6e02d5a9e56b21

SHA1
580af9e9894244b08541902e3e7bd8b3ee28d746

SHA256
7ecdfe3d0b7a980c3e6eeda720e442aa8e211b7c261b96f21759dce3f0b56f5d

SHA512
efc8b8633ad5de98eed6c26155c19751e314f3579580f2c59d9d1c9420e633498bafa73e02a9cc96e1f81151f4a9eb76f8cf6e223a8a18b3cd32e89021d65ca4

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
320KB

MD5
474989baa1ea2690df328eb0d071a494

SHA1
fd41e394964d0ec55f9d01b7f27cfd34499eea38

SHA256
8d42aa4cd8243cb677d5ae09a71b67cb44ee43d41f81834c869acce6ae7e3a5c

SHA512
27b745fb44031e65f9f80e56a637c0b00c452f9007610cdfdec2a2e874bffeb4ad6dcd2282f946c9415c3ebfc4727167a8384589e42bf24edd5c500ce53ff340

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
320KB

MD5
ffd2d2158ae67a79119f4b122acf54f8

SHA1
2265f1365ec3e3969f904b2b9aa612d05a3ca2ac

SHA256
b1a234e37314867aa50a5f730c9d664531961194c853856ff9607798bfbed358

SHA512
7b6354a44bf06b74dba0de218a572db32a1abfe04ba2faefc506b9c492c7b1d470d4d6e1d5b3f0d2691adb37e83608c0b024a81ebfe77cf93bced00a7cdd4bbf

Download Submit
C:\Windows\SysWOW64\Ffkjlp32.exe

Filesize
320KB

MD5
263d6836cfcc3ee9a1e311613ca41963

SHA1
f1cc08514f85d64676bad2c8f974447b1be5c073

SHA256
3707815e8afad834bb870d6150f3ba6ba0be530db266ecc78ffe88ede7d5660f

SHA512
6b185ec0ef0fe76275f96789ea2ba4339aaedab7d839cbe6d2217790519cc82523487d1a1fcd6ab91a857dfacc71a60c20e3d18e8e8825d0557f238a2573cde7

Download Submit
C:\Windows\SysWOW64\Fkalchij.exe

Filesize
320KB

MD5
1602a6316c2d137dad4a72f19eda9f3d

SHA1
e74739b7be469de88d191138ef1c41e89e71a4ae

SHA256
9f215e710dc595c29c8da90c13371432d8729c4d185db16f5869fd07317284ec

SHA512
5454c3bb536ef8e9bbad7b64199be63dbb8acd3fdc57d67e7282ead12ad40dc4e90920d750d4ed943934138f88aa4c07ee92a6493bb43f78d2f59b9bcefba051

Download Submit
C:\Windows\SysWOW64\Fkmchi32.exe

Filesize
320KB

MD5
e143f9b20a9263efefd0e5e294009e3b

SHA1
c3f045f4d9a10931dc5783e541cbe5dfe42fabfb

SHA256
b0a510f3b1bee5ad953face10bfa3e3fb3afc9656b5ec24eecc0b597ebf0a0d5

SHA512
9838965646f53dcd2baa25288cc0af3c0f7e92846a6aa1c122d08f94daec6c15a3bb235022dcd202e184a36492a430699f57e4550596437612506ed348bfeca3

Download Submit
C:\Windows\SysWOW64\Flceckoj.exe

Filesize
320KB

MD5
574c704a64339f4dfce96ff884a64b51

SHA1
4dffd7c536f4b0877215668e912ee5bab887b614

SHA256
2226c30a29b58063a1f52c92610e38e95cf3a4de841677ab2e8e9395c7e73bbc

SHA512
f1fa737fd82cd3f865c47cc446c243ecd3c4f510940d847058ecddcdf3b99a4c665f5a2cc19dd672bebbff8b2f35e25c1383139be5cc495cb414befe904b67be

Download Submit
C:\Windows\SysWOW64\Fljcmlfd.exe

Filesize
320KB

MD5
638434711186b7e965f9c51e137c57e0

SHA1
1d7e1b0e209f732853c26a49369a86449ecb3cab

SHA256
f997744cc1ddfc7b02b31fa9906bd868043c429bf39fd76a3e025d51ab3fa482

SHA512
e39381cef941f553685758faaf8c08a46d59268319cafee2cbf8a00a56316cfcc50d504b59eef95af09dde4a481a57cb986ed6a8ff2aaa275e41fc83574a7a1c

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
320KB

MD5
152037c83a3508670a789ab9e41e7af4

SHA1
3ca83de7937c869ec05e2d583de24356fc84e25d

SHA256
5bd1c9e83755ceb5d0910300050de3e2677965861a6fc4be4c185416bb642bec

SHA512
3561eb088b59cc509cb838356e82b742a54e7b23c9039107d28e7d9d0d7e2dd103dba11f3e81b6b9d33cccd44db558929415acd11b6dc98c17bf9134cf6d4301

Download Submit
C:\Windows\SysWOW64\Fohoigfh.exe

Filesize
320KB

MD5
c7cde070997e18c1b9ac94284e18d0c9

SHA1
dd8542dd7114583b6213c380940c24ea8fa99a95

SHA256
c3657e43e8c2f32e1506953974c93e708fdd22f40f0aba4433485f29c202cce8

SHA512
f6fb5914b6ecc21c73c3d36688a42f70fff4023202b2c3b3f84c5e450ae29cb2dd0a09437a79b4b8a37ad54a37d79e04592f69d71cb8ffb0477b9111a4202096

Download Submit
C:\Windows\SysWOW64\Gbdgfa32.exe

Filesize
320KB

MD5
23bcc8011af9007122b2559e9655bae0

SHA1
6c1e554fa1eee966c449b3b03b23ebf1d826b487

SHA256
14916d88c2798b596e7a36f9935ab6c06a3a0738e1fff9bc6d746e3ddc82b440

SHA512
a1860ade9a3ed926b205a957e2f1cad2d3314038fe62c3a8c49019a91e2de4f6505f77e22174449c0151b503b6cf5c47afe46f2e398511212d38835d5b0ed55e

Download Submit
C:\Windows\SysWOW64\Gcfqfc32.exe

Filesize
320KB

MD5
76bb4f2e0220502b67bf26740faa700b

SHA1
3dcb5bb542bc38048af48696528f62972bc7ef61

SHA256
a089c8b6d1600ddeba02b74e2aefd681feb8c5428a0453cd1f0cbc49e29beb22

SHA512
4dbd05589bec31d6689382cc76a9d35f226212310099c39114ca9aa05dc7f974379c2165c8df20a4004de874e79e043e9ccc13521735f8a2be6a952ab46f2931

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
320KB

MD5
dfddb83761d05723d32420d17f9ab389

SHA1
9cc0ec7bb7d510553e14707980908301b1618ee4

SHA256
ca1262558b356e62ab54963b59220692024eb729bd58799e8a59adbf3a3dcd6a

SHA512
ef8f2276b1307f18684b49beb7478567f2a5dd5c20973e094e1e57134cb7692eafccaf9b75815c9a1ba68db3c2cba43106360d0f83e37f542113ddf1ec49791b

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
320KB

MD5
e3f08d68835dd380a3b8b1ce8befc7ea

SHA1
2d2a660c8759df7877281f9816cadc7649638671

SHA256
1b05fd6e21c82eb39d39c15580d6f37f4ffe53de3044b55eed25f3515f72f9f6

SHA512
153c5aa47db1babc47824e68a794a3532f9116de326e6091e17c4e0ff16ba54b4d186dd83f2f182f664665dcb50faa596f7f9af10ad84a79e6b5aa7ac4eb7095

Download Submit
C:\Windows\SysWOW64\Gfngap32.exe

Filesize
320KB

MD5
c05b4b0764a80b3e142708dfffc0a13c

SHA1
aa86d95b7ef849e4bcc9585fc9fcbb0a32a5f26d

SHA256
837805c8a566e8490ecb28bd82f2622d1c311bc4a14d37c4d9ad4b6ee90afd90

SHA512
f604a6bc97e24552cb626a33620ee0dcdb4fbad25183751d3e1da8c218d49ab208e226680b70643613ec95ae96fc835f685369f7ca776c35406bf5405b6bd334

Download Submit
C:\Windows\SysWOW64\Gkhbdg32.exe

Filesize
320KB

MD5
225eae388c90e8bda939f8913015f032

SHA1
3e44173a6a3982de65d0a9bf496fcccfe789c697

SHA256
b950f99a8c7076f7b972a6c79f0942c8eb07f773aebe7710ba452c7c55b72aaf

SHA512
d37318398f41ea559a119c6eebfc97e19c92fbcc110af29b794b2510918fbed95b3a40d97ed7d8cb27db6fa522d021d250a35e22b3ab00720e7db1e4b0544790

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
320KB

MD5
c81c2bd8a320f9b02eaf97738acc173d

SHA1
7dd440076807df6e5a6d15615c140f7bf2b51b2d

SHA256
1605f7ffdd8223a1f400cebcd53a3b8b4a86596e2a19054f28529c5e3a450197

SHA512
7907b6042b6c4ea63976633433d56069305c48052ee562a7ee1ec37e156f651f00f9298aba2525e33b3d77edb671c508232580571bef0d9abc5f0287f3c77a10

Download Submit
C:\Windows\SysWOW64\Gmjlcj32.exe

Filesize
320KB

MD5
fc0cd1283396fb1fd3397151dc34bcfd

SHA1
98bb303d03f7dbe16b61f9bc504bb9184e46906a

SHA256
4aded9877595a07f9f1c5d0374dfccb6e06df80ed07c96c8ac066395622e9946

SHA512
ac5e5dc77cde3490f66dd56f1aee99c31b5ddea8483df94bd53c952921f48c8731543b14f58101aa5e5314df5571c3098200b1b420ea43fc52178ce402ec6ee9

Download Submit
C:\Windows\SysWOW64\Gmoeoidl.exe

Filesize
320KB

MD5
9f3d092d6b9219c89d36c90a06ca6866

SHA1
b7ad02588bfb32b5230e6c31c40626b33027f39c

SHA256
c51798a4def4a2473787d6e5a49ec8225405c03d1aa37dbd3fbb367a9d7bd0f4

SHA512
0f5e5f2de3c2e9f5068c30cfc3a724b6b00f662969016aafff15055768946e8dcfff1888fbd70e00888800179565ae3108c1c7d679b23ddd15c99b4f060c70fb

Download Submit
C:\Windows\SysWOW64\Hbgmcnhf.exe

Filesize
320KB

MD5
e04c0850f8fe9223ca290aefce78410d

SHA1
5cdbfa00aa1d95fa9a0a4e56d47e9084a754bef3

SHA256
6c0e0edbd56c7e7a395676b296482fa1ddd7e2f251dcd6f928c892e9b2155037

SHA512
19ebc80646ff0405ac3c20dd7f1b70e68339562ca959bfc05d6a7d5d7a99ace5fbaaacba698ba76f34db134fddde978140c9ff834d608030db2ee6f197ba8011

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
320KB

MD5
b90da53dc2e75a010596d2410815db44

SHA1
96231fb6d01c6385aa0cc854aaf8b32921378ab9

SHA256
f5be7dc353cae1fca76fbfb8413da075c97aceb14b460f6466c08c058e4db4e6

SHA512
6f9db8fe9ebc338b918f3c80214a7311cbdf7689720ead6c72a420ff9832cab0732e602f12e1855770c2314089cd3f07bceea704f1d8311cda068893f1787daa

Download Submit
C:\Windows\SysWOW64\Hfcicmqp.exe

Filesize
320KB

MD5
98043f5c8b3792adada1c8484a06d7dd

SHA1
b4ed444342dfbb4b4410e2e87be4fa7f594e47bb

SHA256
3daf79ceda2bb143002430fd98ef60fd3443e40e862b5a0b11da080a623a918e

SHA512
667612d1ca87f7afe358a3fd102f6fe59427a5ecd6aa2813dd9450c38bf286cf21a5b35bd9d263d23c300eb51f0536ebe18a4dfacb17b02f77cfdab86bd3ae31

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
320KB

MD5
631c9a8bac63426e00f28ea87b8d0013

SHA1
be008c483cbf65efae9fa1fa82a76ce41d298ba2

SHA256
63131990dd7b4c73c42197fef9c8eb75e4950a106f2b14491d588397d9bc626d

SHA512
9eadef06ed7707f2225f07148a6bb250079eab3b8b8cc4ae69e4644814b42988d30a7c8bb23d4f6fe7e9fcb239b9c4f507b687dce77bb9f8c269397b030f9bcf

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
320KB

MD5
8fe4aed3d449909ffdabea06dfcd5f04

SHA1
bc61b05621acf26106de2420b8cbdda106b218ee

SHA256
bae8aa959e9297bf1d95a41ac7c4f4dcb0f320fe006fdd9fe20715830fd739b5

SHA512
0ca727b39eefbe6108f562ff6ab9649ee506d54ccab54c287fc422d1849339f17c6ac7e53c5bd6dec4d50e7ccd2421bdf95cf55ba6a521af287d67a1b99921c4

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
320KB

MD5
2e68efa79631dd8b774628cd2e3f9b9f

SHA1
d1051ad6753143fc3eb3e2d174432f105ea7cbb4

SHA256
27e3ff3de8ac7d3f35605466628e67337cbf11d24c28ba369fef1bcbeeb0c7ff

SHA512
764e46f93aeae17dc9a1373c849f221090e7fbef992abfcf5143c1c2d569fea2db7589a9ddff9a42a0cdb75b66514120632c1383ae11e6660b63600dec6a0b26

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
320KB

MD5
3a23d923970e3fbdf7b39d8a86aa19cf

SHA1
31e969558b122e9b01d906cd3ec824d8d0020716

SHA256
786f6fabde023c73a1dfed99ffa7694645025b14672cecbfda37a3aec9f1b3b3

SHA512
eff65eed6baaa76abca514b6dd01ded4f8baa0adee87e7dddb7017f0545ade612c7455e41b3b5f06b0cdf8c59f856bd81b61517a404ab9e52a0762e6f7aff96f

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
320KB

MD5
a04170e027156b98a32909af9449dbf3

SHA1
50b2efbe9a5bcdb398e017a4ad75672ac4c7f56e

SHA256
187e6a8313000e9f38e3ef24a56d1943f0a7df979f37df72af74fe7989f091de

SHA512
af74c40620f8f7a9a650118245e28fd4cfd561f27201fa7901f59a8d84226b9c4c3b337c1f583866c79ec1555a2f067c06e99827ce20525d5d81bbfdc253e498

Download Submit
C:\Windows\SysWOW64\Hmfkoh32.exe

Filesize
320KB

MD5
62d20ce2fddcbe21ce1af0871e367f0b

SHA1
84ede54e1e79675f3dbee0d4ef25c45fe764dbdf

SHA256
9720d1649f0119f6c7921610a59394e65c9f92c5fe81a7b34201f07bc9424cc0

SHA512
ca91f1034a67282cf491be48a8a83da8cbb2507ca2b367356fcdc23f813a9444c94e429b37ea00e118b91799d6061110996fe87160a58c7cdcd10a91919d99c8

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
320KB

MD5
8ff75b80e607ebec1c90caf1d7d6faa8

SHA1
870334468a196c4b93c14c169388c28319d34cd7

SHA256
352d787e0e370366320fa9637b1e36baa53d9ccc7e3fb425b04cc2ede4f12bd2

SHA512
31a828be79f52a85ccc3c8f1c4dcc4a6d167357cb7351511a0b4df07ace414a07d3ecb48f81f051664f520644a9cdbc5096f3d8ac83ec8cb337b43acad5975c2

Download Submit
C:\Windows\SysWOW64\Hodgkc32.exe

Filesize
320KB

MD5
5088298cbb87590b5200c338886724fc

SHA1
171e0e2a5ba85ee29616fbda3b568a8d92437022

SHA256
8541ddb40371ad52310295facd4bcedcb87d0f4325ee7b0ce01ee489b5a0dd57

SHA512
200322e175ea5d80d603a1cf360e3283a9710bc8bef38d33af5844383a2b016dcbc962edddc2bbffdd6b5a35003f6e238d7252fee971eb144936a02e04efec11

Download Submit
C:\Windows\SysWOW64\Ilidbbgl.exe

Filesize
320KB

MD5
8ffb2132035c606b526c8fa52ca0f606

SHA1
97b8ad8bd073fabc06aa6e3757130e693f8c34f0

SHA256
e5c4f013019de58c86153f277db60ba4cd6c030313fee39cc61a41f7b0e2ce5a

SHA512
14ef9f6fd1455f84263f086ce039dca7ab23a6d1ce6d9c5287ef72fbf65e5befec2d5099ad21e0195108b6fc0ed491928516a276f460d9e2d934173ec7fe60ca

Download Submit
C:\Windows\SysWOW64\Ipnjab32.exe

Filesize
320KB

MD5
d0ba8aaf1c01dc7d56ee71807385576a

SHA1
9754f8d73fbf379182d46303ce63c8eda0af2494

SHA256
b96aa0790ba6402b4549fbabd2fd2d3ce3289485fad79a0076875b7163cd0e38

SHA512
dd17bd364f2fe41ba104102b6c7bae1cf0713e101885491aaf55e736ae37c7a0835960458f74507714806d4b54cb18749ae552ab7929684052aa8c930a133007

Download Submit
C:\Windows\SysWOW64\Jbhfjljd.exe

Filesize
320KB

MD5
5cb423c2afdd4baa308b6d512e2a71f4

SHA1
47443ea57e185ed280c1fbca8c85c26b0f609a1a

SHA256
b184dab721ef7786b88fd0f81d0aaa9e502943f8fbe00adb72e140138f618609

SHA512
337acd7f1fd2587a0cb020f346c56aa1edd71e6b82f2cc96b49ed54c24c4afbe2b80f80def67c99041b28d9e054aa7c3fbd3b05055b8e5ba70782302addd11f7

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
320KB

MD5
a346be7821996caed21101363b63e6f4

SHA1
06f88c24e7847b006a1122f0213b914224c8e4f8

SHA256
daee6639935833560d5f64382d65ff11797f188b81c99d901dd566752469522e

SHA512
5f046a753408b712ffb906611f454080f136b11c8e2f6d41fb3f0569465fa275c6c2c54d40452cbaa22da8db048ff6ef1f451195df233bc595ee592a56bdb17f

Download Submit
C:\Windows\SysWOW64\Jcioiood.exe

Filesize
320KB

MD5
c9d9442a8fa2f45ea95f69c52eac3730

SHA1
10a35e96fad851f61884813482092db585e10e38

SHA256
24b63caa433a7bde8eefe18a9051966e4c1158e4567986e60aef42d10bdebee1

SHA512
79a45c901b94ad2b3f96da61180f85c0be929aac66a0daa203608397333d41946acd7cf7866a0a88873fbe86530a3d81636f7c62602d94b021f32e0612a783e7

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
320KB

MD5
83d60675d09b8089bf4fae166835635a

SHA1
adcc1fd713336a3843ebc87b09cf47a50eb15b91

SHA256
159f05fd8c6292f53db0a5d3512aa128f8d3b71308bdc524ca49b958179a9308

SHA512
561807bd1bdb547d7cd0aadf492698ae4298b29ad2b04e6d1e47016d2e16393262d692b3f0725b373dd7296f1b980c3fbb6ac094889aaa7098cb2b4122d522e6

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
320KB

MD5
1bf98439be4b508482e36b573a644d61

SHA1
3f99c77f9a0b7a8b08958afea01cc236973b4ff4

SHA256
108152b2d021b90cb51256de19bcff468f901b7fb8777ada4575661e975ef634

SHA512
c7efc7bf8a550ffb7624780c4573864abc027fa47186aa7a040128fce43acef91a5d29051fbb365bee0cf3041e53c56c587d71ab1513e676e38b35f3c6b1b723

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
320KB

MD5
87e158ede3673dae60c140b9abbff19a

SHA1
12e49c85022d642b9e836422dccbee1731e3f3d2

SHA256
c64e5772cdfdd490bbbb961c1128a03a30177fdecdd6f070330d234572a9767a

SHA512
8f453fe396ed72943034762dce7811b59e852fbfb8c8d382fdd844207ad357f8014d67a70ad046c8fa40a6d9c3435fcd7711b01fd604fefc202292ae43dace73

Download Submit
C:\Windows\SysWOW64\Kpbmco32.exe

Filesize
320KB

MD5
b03b5d57df73105496e50e1ac0c641f4

SHA1
a99c5b9acc61b380e06a8749b2ae233d0c9a63d1

SHA256
8f7cb7adff0b065649c4aa21c9ecf0f9d0adc04bb6ecf7b45bd15c67b844fa4f

SHA512
e372b7be5c373c8b130c02b767991e7c7a6e6e8c5355fdaf6a84ec1f48a564506af92883e0af47583fe133a859f645a58d5cebfa8dddaa679db785ac0fb3c069

Download Submit
C:\Windows\SysWOW64\Lbabgh32.exe

Filesize
320KB

MD5
78b75216b83f4f5ccbfa03e403cacdb6

SHA1
6c7cc46627405865936bf07d44725290214d5999

SHA256
5922e245141ab1eab182840f1c15870f080772295712f2f98318648ecfb417f9

SHA512
2afbc0e15fabc53c77f213660c78b649d98140e7aa5aeddfe8bdcf404923a5047af96b64f442366bd5bb71aa2361e49ae7e4df9a765ab1e3639dc59fcd2053e3

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
320KB

MD5
0b7b48eb06f464f107d1690432581d01

SHA1
b01fa03b1bf4d0bb0617095339693c4b992c0020

SHA256
2347b9a14282b55c1b99fe9e92a65922287b28601243ebb83f1a001400b50bda

SHA512
62b83a886892fba13ef2adb1855892491056e5078625d7a1f91dff1614b554e64757fca9772643a881e69a7f54e7ff62361a55c991732a9481fd6be562b94c43

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
320KB

MD5
52d73e8c6459a1bfdff3a7a1b6752755

SHA1
8e00e7386313321f7f15df77269d763937ddef4f

SHA256
79220483cf21a63dbf455e95dafcabf72fb4ea271ef547f7388f4f0f58e742a3

SHA512
f7e5dac369ea50419fb540c488f4bdd88feec928faff03117b993115704ebc06a0c9d95ea11ecaabb5986262d4aab121bdc522adf9a3805e34e10c912004cd07

Download Submit
C:\Windows\SysWOW64\Lmgfda32.exe

Filesize
320KB

MD5
35c96b4a4cc47f4f8b772add0ff3ca63

SHA1
9bf479f51081140f223ac2aa0e3e70285be0fd33

SHA256
2d2388f0806998c6d62aa0085cd344e097878ab763d6e89c9f0b78a9959cc0a8

SHA512
fe5faaa748dc5cf9ebc208dfa1cd3e0bb136e79eaed5b5232da839f6d4ec79add08e5d0109890c9e1c4a8c75744bab27a3f870117fdcacad1b105062617d6840

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
320KB

MD5
98357edd87601ad0d596197ea50436c6

SHA1
06931801ab82947ed7a29c97606bfd3884457ffa

SHA256
794ca035540cc7a74240d5698be5cdffcfc39a086320468a3090bb800b7aba08

SHA512
b77c4532829fb0a3f7c6fc92c8fa97ddfd53b00ef02b1e1bf416048baafe85c949edc6bb1696aeeaa554307b2b47b6a3d4288490ef86141bf603423cd602056a

Download Submit
C:\Windows\SysWOW64\Mmpijp32.exe

Filesize
320KB

MD5
e95d2857cfae5da448dc0b3fbc415465

SHA1
4e5e6c53a1c912f59808d9f897f80b0766bf5b20

SHA256
4086f68d38d7b9f280ca9a6282425af5a5545fd43e816623020403594f79b720

SHA512
ae6616d5e91426958a3a8d62b1f7e8fd0073acf8073419625558623f62eb54d491e15b048e663d72400106eaf808f1818f1a7d35f0ae09bda66185b2268b80cc

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
320KB

MD5
c37b1ee63ec9668b79b763eaac24756f

SHA1
54d9ffce14a6ce4d3a5337db3e733dcb46c4ea67

SHA256
10889cbb7e7187d5284c1ab12526b32c98267d584c6539ccc8d5162707512d7e

SHA512
8586bfb9de44730201c031504fcb1b012fe442cc45a074af71fbfe5039f44789461108d65cca5a9a1036faa0e9a58719986387af12d1100daf7f893467201e00

Download Submit
C:\Windows\SysWOW64\Ngbpidjh.exe

Filesize
320KB

MD5
ea8b3389a52e09c7ec54b692c739082c

SHA1
e262b71e8343c4e42f78d4e101cd97fde8caee0e

SHA256
e2e6405cc36a1a7a1e3fc684e4b22eb15da18c13b6dde38d55eab82bd8ca9205

SHA512
41047c87544fe59a17210c0ec8950ae6c06bd6e278131f10812077757d94a0ce380d80e2fc38dd74b6086bc5792764d7489e8752452a22453b7828bced0df02a

Download Submit
C:\Windows\SysWOW64\Ngmgne32.exe

Filesize
320KB

MD5
e8916e49e752e9250a7aa1e99cdee6da

SHA1
1af9ba03c7dba9c005326afe2e08c1d6202b33ce

SHA256
af4417668adb3fb7b6323ba93b2d1c8b3ad3f98758f7354fe1826c3390554ded

SHA512
ac6c3a2fb94f427dcd733b3206272c1517c7147ae8963666eba59d953839f17f03de93c797828d88f4f3cce650dd33634e97a5d316e3264b64a2da5746f687b7

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
320KB

MD5
d058ea5106061830f7b1c485c6f53cfc

SHA1
c051c8a8595d25d5670d8b8b665918b012ecd49c

SHA256
9a43204536cb2559d24d375b6cb9c62479c141879e89589d3e1ded3c53b9872c

SHA512
81ee4cd6c8067eb13a617c681dae3209d51d0045884f9a6e896c56c36218472079063fc9e1f40660b65ad26fb2234d46b73296b5ad0c01913ac466c93d089ff1

Download Submit
C:\Windows\SysWOW64\Olcbmj32.exe

Filesize
320KB

MD5
f13556bbcbf77a17faaf5b344c5fa60d

SHA1
cedc974d581792cd189cf0c155f2e37fc8c25792

SHA256
73af434b9b73c64a0927751cfd474c1b654d01ebec01e38de89b6a38b7d34aef

SHA512
c9f7b5626a856d76edf25cde8c92884138a7652dae95b640b47388e468f543ef94be5a042db9fdb4a0496aa6142ccc5b49919c6a30af925cc99b4e736b327431

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
320KB

MD5
619f8cc4923d5a67a9ac077cb2b2abbf

SHA1
58015ac0a2fe7b8b97938171a2ce8b3426dbd59e

SHA256
80b5abe85bf504db6f39a86b06865d27baea03b1f34f547611693c0d0e738bfc

SHA512
18958cfe17cd0f8a071b4be4ff79d3735a3e162e58d8fcfee48ecb3527c3522c114e86c1296d4571ebaf634c218cfa9f3a5fdbc11efb2fa80d912fe2e4fd9ac1

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
320KB

MD5
38b3f0e15cbe8532237f1b16037fe029

SHA1
38f47a3000f53e021bece4c3a68c1f12790010ef

SHA256
8344749c0f12397d739bdec74edec75667c39f35aff58b2ba510d9bac349594c

SHA512
4695a7b2c4cb34483d07fb8ec81b0ecbc63df0170b042255e09b6bdf7a4f5525bcbe84beb8c8cfb14964fc5e127dfd54c370cd4493345a3d84f34f3209d6083b

Download Submit
C:\Windows\SysWOW64\Pfaigm32.exe

Filesize
320KB

MD5
a88e10915fc75e3672bf6d6c25240755

SHA1
babef814fcf050d63346c2a3bd1144a85d9f3be1

SHA256
0d3a35c865c801363d433e23618ef87aa6d0708c21d609f1c4c5482ab4ee99b4

SHA512
95e18efab97d8456dfa29914c92085bcd19660f912c1a471ba59145121a1f656a0ca72f10b6a8b6fa2447a0f26b653f6215b160d421e634f5ac5f5a14d53f3cd

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
320KB

MD5
6a93b7800b979f50aae2abe8da639c29

SHA1
716a0ceafb3a5fe39f0fde170d8da8a3ce3cd843

SHA256
5397fdbd08b2fcc706108718e7fa6477431c40956d6433ce0a00fc4b61c5eb8f

SHA512
00f8b3cf4b05586fcfa926422524f97dbb4e7dfc4b06d0e0b01cada5f01f24e7cdadaf304020a3f94104e8e1904dfad889a7a1768988fb2be8a86a4e0be1ec18

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
320KB

MD5
4d9dd8e54dc62add6a000a72c42b393f

SHA1
6c62cfc00b0bdef9495209032c1b5ceb151315f2

SHA256
1a69fd7eeea8b1b44b96e6025482dbac02541093522efcea01fa2402d418e47b

SHA512
a7b52ba9f0d4a6c0e0a74b2d369f3eb8030dc1fac6dda2766e8186628ef75cb3e40fc989594b0ec39c5c687fdb5847fbb11fc4dfdf531efc19855b3b92d40055

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
320KB

MD5
c891507db6b4bb49310305702ec13373

SHA1
c47152ccab7661e288e91dc2a636237252f9a8a3

SHA256
1ff7e38be2718008e2fa23cf2cd6c7b0e4a563a63b0141a127a8c4cce843843d

SHA512
d49f06a1d4b647ce316ac8a60ab3d7471003cdddedf49bef50e5b226cc89c74750194a4ca5df155a6d890ff2658b51f6bcc53e77d2f349fc78d051166a7aa2ff

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
320KB

MD5
65a2ead032d477874301e20856915bb2

SHA1
99d08d85eed6f4f1ee818641c18d173d26e5e430

SHA256
f89817902b9a98986030e5c3f878dfba8277aeffa26d1a4838b3ca8dc326cf84

SHA512
7b550368b8edbd9f323b64d10b45cbbbf06a4fde99f6a40dfb9cb67643e6a226b4a8bc1205c890445aa8234d8c0b810ab78811da25e7e0cfe50fd505f9e5de9a

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
320KB

MD5
d1627c15c6434d8df5ac94fc79cf7089

SHA1
53b41bf5a5cf76135ded7b3255fd7b19ff0e8f95

SHA256
6c4fe00cadcc8d33f8a30569fce1107e917f74d82912d51c04f332d94745e92f

SHA512
1c13edf194c8830be939a7c9887d1370575fa387dcf413e587472dd5aeff73727e4a495fc37c3a88135bcfb8b206a38910ed172599dd7ac54f785b9acf65db14

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
320KB

MD5
4ed98e6f1a374973e55ea63ea7f2afee

SHA1
9d4fd66289a7a7bd5bfe321f04a60c060dcb2f21

SHA256
613c0acd6d277dae8285a9bbb2c7573ea98c3e9cc38b5adc8113226ba70216b3

SHA512
3afc401f0437730b024544af1a5e89f5293ab051f26461e88cac0221f61308987162452f62e34268ba5351c7453927307eef023ee1fc4a38cf3181b861a2d65f

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
320KB

MD5
48a451a96b6ff58c477027e120566a02

SHA1
f5d610e48c3af68928642a806f7f34c33c0a7b39

SHA256
72ed309a925e8b032eadc9c356cb36307ebf8fa27c10a725a7bb398755409c2a

SHA512
63676f93f1e1a70ef9de4b7a03a445a4f6dc8aeeea291df166202e2c864c9d301c71971139b4334994137d6e8aa7a153bcf3634a63f96aeb30920a1eaf29b9ee

Download Submit
memory/316-465-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/456-441-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/456-1729-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/464-112-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/640-537-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/644-279-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/880-168-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/968-584-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1080-1663-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1100-1744-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1100-393-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1124-315-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1144-477-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1164-543-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1212-1636-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1376-387-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1568-255-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1580-459-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1596-417-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1636-429-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1804-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1804-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/1804-536-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1868-556-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1868-17-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1892-591-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2000-501-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2000-1709-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2060-273-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2132-483-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2184-1659-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2192-73-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2192-1837-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2192-603-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2196-1740-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2196-405-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2200-423-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2208-267-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2212-564-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2236-145-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2244-399-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2264-381-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2280-1814-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2280-161-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2288-333-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2336-1699-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2348-525-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2364-89-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2464-1661-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2472-558-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2592-247-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2648-238-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2788-105-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2960-291-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2984-345-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3080-261-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3276-435-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3296-8-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3296-549-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3344-223-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3416-357-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3536-297-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3576-185-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3668-230-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3680-583-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3680-49-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3692-81-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3904-489-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3908-339-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3912-309-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3932-550-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3980-321-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3984-204-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4020-513-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4024-132-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4184-457-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4228-35-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4228-557-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4288-153-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4344-604-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4352-411-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4352-1738-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4380-571-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4492-369-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4504-1644-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4580-523-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4584-495-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4592-285-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4592-1781-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4676-96-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4684-65-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4684-597-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4720-37-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4720-570-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4736-590-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4736-57-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4748-181-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4772-507-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4800-208-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4844-136-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4896-363-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4916-45-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4916-577-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4940-1759-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4940-351-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4968-471-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5000-375-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5044-303-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5052-327-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5072-447-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5080-120-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5080-1825-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5124-1556-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5320-1581-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5348-1537-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5616-1611-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5732-1569-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5792-1603-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5872-1564-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5892-1543-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6052-1590-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6164-1510-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6204-1509-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6464-1446-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6548-1443-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6616-1441-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6640-1487-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6680-1485-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/6764-1437-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads