berbew | 3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4.exe
Size

163KB
MD5

2680219ee446f439cc7889507a210a04
SHA1

573d7d4022a26e1c8d11d0512267a7735ab3c7b1
SHA256

3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4
SHA512

209c46d1a21a2be36e8f8d9267da5372b66b07eb754a2febd1c72e0abe578b7d92f43d84ffdbc3460721b07146e32c72edab8566810e7e4f6a3d40ac48bebf0a
SSDEEP

1536:Pm1EHPVsyHbVc71flProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:OyHtsyHbW71fltOrWKDBr+yJb

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akglloai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gncchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdgged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmcjpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjeiodek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcmmhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojajin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cocacl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkfadkgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmipdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dngjff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddligq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igajal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npgmpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hehkajig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgdpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmdfonj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqafhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fijkdmhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iibccgep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnjgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npgmpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oplfkeob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnoknihb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhnikc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnoknihb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lomqcjie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnhdgpii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkhnjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifkpknp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lckiihok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adcjop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aajohjon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnahdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiokinbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngqagcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bklomh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iomoenej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngndaccj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fngcmcfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfnjpfcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafppp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akccap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jljbeali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnoaaaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhmnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfbped32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfkmkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cohkokgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddnfmqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chnlgjlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkbcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmcjpl32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3968	Aajohjon.exe
400	Akccap32.exe
1036	Anaomkdb.exe
3600	Aehgnied.exe
3276	Aekddhcb.exe
3012	Akglloai.exe
988	Bdpaeehj.exe
556	Boeebnhp.exe
3080	Bhnikc32.exe
4772	Bnkbcj32.exe
4108	Bkobmnka.exe
1572	Bdgged32.exe
3692	Bnoknihb.exe
2536	Bheplb32.exe
4820	Cnahdi32.exe
2896	Cdlqqcnl.exe
4200	Cfkmkf32.exe
3148	Ckhecmcf.exe
3472	Cocacl32.exe
3156	Cbbnpg32.exe
4308	Cfnjpfcl.exe
4340	Clgbmp32.exe
4808	Ckjbhmad.exe
4012	Cbdjeg32.exe
3848	Cohkokgj.exe
3484	Cfbcke32.exe
2564	Cdecgbfa.exe
4688	Chqogq32.exe
4700	Dokgdkeh.exe
3328	Dnmhpg32.exe
720	Dmohno32.exe
3020	Dfglfdkb.exe
1840	Dooaoj32.exe
3676	Dnbakghm.exe
2856	Ddligq32.exe
448	Dkfadkgf.exe
3908	Dndnpf32.exe
740	Ddnfmqng.exe
2996	Dkhnjk32.exe
4456	Dngjff32.exe
4204	Dfnbgc32.exe
2648	Eofgpikj.exe
1936	Eiokinbk.exe
2804	Emjgim32.exe
4824	Enkdaepb.exe
4264	Eiahnnph.exe
1996	Eokqkh32.exe
1588	Ebimgcfi.exe
1552	Eehicoel.exe
2540	Epmmqheb.exe
4556	Eblimcdf.exe
2320	Eejeiocj.exe
4348	Ekdnei32.exe
1956	Ebnfbcbc.exe
4752	Fmcjpl32.exe
1068	Fpbflg32.exe
2016	Feoodn32.exe
1776	Fijkdmhn.exe
1716	Fngcmcfe.exe
516	Fealin32.exe
2336	Flkdfh32.exe
2468	Fechomko.exe
4664	Fiodpl32.exe
4360	Flmqlg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cocacl32.exe	Ckhecmcf.exe
File created	C:\Windows\SysWOW64\Eblimcdf.exe	Epmmqheb.exe
File opened for modification	C:\Windows\SysWOW64\Ngqagcag.exe	Npiiffqe.exe
File created	C:\Windows\SysWOW64\Hockka32.dll	Qjiipk32.exe
File created	C:\Windows\SysWOW64\Ckgofgjn.dll	Aajohjon.exe
File opened for modification	C:\Windows\SysWOW64\Jedccfqg.exe	Jphkkpbp.exe
File created	C:\Windows\SysWOW64\Klhnfo32.exe	Kjjbjd32.exe
File created	C:\Windows\SysWOW64\Boihcf32.exe	Bgbpaipl.exe
File created	C:\Windows\SysWOW64\Ipjijkpg.dll	Dafppp32.exe
File opened for modification	C:\Windows\SysWOW64\Aehgnied.exe	Anaomkdb.exe
File created	C:\Windows\SysWOW64\Dfglfdkb.exe	Dmohno32.exe
File created	C:\Windows\SysWOW64\Fnadil32.dll	Enkdaepb.exe
File created	C:\Windows\SysWOW64\Lfbped32.exe	Lcdciiec.exe
File created	C:\Windows\SysWOW64\Bmjkic32.exe	Bklomh32.exe
File created	C:\Windows\SysWOW64\Oplfkeob.exe	Onkidm32.exe
File opened for modification	C:\Windows\SysWOW64\Ojajin32.exe	Ogcnmc32.exe
File created	C:\Windows\SysWOW64\Ombcji32.exe	Ocjoadei.exe
File opened for modification	C:\Windows\SysWOW64\Akccap32.exe	Aajohjon.exe
File created	C:\Windows\SysWOW64\Pfabjq32.dll	Gncchb32.exe
File opened for modification	C:\Windows\SysWOW64\Hmkigh32.exe	Hedafk32.exe
File created	C:\Windows\SysWOW64\Hefnkkkj.exe	Hmkigh32.exe
File created	C:\Windows\SysWOW64\Gkjdipap.dll	Lcimdh32.exe
File created	C:\Windows\SysWOW64\Okddnh32.dll	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Aoioli32.exe	Adcjop32.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Cacckp32.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Nnhmnn32.exe
File opened for modification	C:\Windows\SysWOW64\Ebnfbcbc.exe	Ekdnei32.exe
File created	C:\Windows\SysWOW64\Hiipmhmk.exe	Hfhgkmpj.exe
File created	C:\Windows\SysWOW64\Iomoenej.exe	Igajal32.exe
File created	C:\Windows\SysWOW64\Jmbhoeid.exe	Jghpbk32.exe
File opened for modification	C:\Windows\SysWOW64\Lflbkcll.exe	Lcnfohmi.exe
File opened for modification	C:\Windows\SysWOW64\Adcjop32.exe	Aogbfi32.exe
File created	C:\Windows\SysWOW64\Bqjoqdcl.dll	Cdlqqcnl.exe
File created	C:\Windows\SysWOW64\Heeeiopa.dll	Cfnjpfcl.exe
File opened for modification	C:\Windows\SysWOW64\Hfhgkmpj.exe	Hehkajig.exe
File created	C:\Windows\SysWOW64\Okehmlqi.dll	Mgbefe32.exe
File created	C:\Windows\SysWOW64\Qdaniq32.exe	Qacameaj.exe
File opened for modification	C:\Windows\SysWOW64\Bpfkpp32.exe	Bmhocd32.exe
File opened for modification	C:\Windows\SysWOW64\Bdgged32.exe	Bkobmnka.exe
File created	C:\Windows\SysWOW64\Ickglm32.exe	Iibccgep.exe
File created	C:\Windows\SysWOW64\Lmdnbn32.exe	Lckiihok.exe
File created	C:\Windows\SysWOW64\Lfdqcn32.dll	Pjkmomfn.exe
File opened for modification	C:\Windows\SysWOW64\Qhhpop32.exe	Ppahmb32.exe
File opened for modification	C:\Windows\SysWOW64\Pjkmomfn.exe	Ondljl32.exe
File opened for modification	C:\Windows\SysWOW64\Pmlfqh32.exe	Pjkmomfn.exe
File created	C:\Windows\SysWOW64\Dahmfpap.exe	Dafppp32.exe
File created	C:\Windows\SysWOW64\Lkhpjc32.dll	Cocacl32.exe
File created	C:\Windows\SysWOW64\Dndnpf32.exe	Dkfadkgf.exe
File opened for modification	C:\Windows\SysWOW64\Epmmqheb.exe	Eehicoel.exe
File created	C:\Windows\SysWOW64\Monjjgkb.exe	Mgbefe32.exe
File created	C:\Windows\SysWOW64\Flhkmbmp.dll	Oplfkeob.exe
File opened for modification	C:\Windows\SysWOW64\Geaepk32.exe	Gpelhd32.exe
File created	C:\Windows\SysWOW64\Lljklo32.exe	Kjlopc32.exe
File created	C:\Windows\SysWOW64\Ocohmc32.exe	Omdppiif.exe
File created	C:\Windows\SysWOW64\Bghgmioe.dll	Chnlgjlb.exe
File created	C:\Windows\SysWOW64\Kjeiodek.exe	Kpmdfonj.exe
File opened for modification	C:\Windows\SysWOW64\Qpcecb32.exe	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Cohkokgj.exe	Cbdjeg32.exe
File created	C:\Windows\SysWOW64\Bgfeip32.dll	Cfbcke32.exe
File opened for modification	C:\Windows\SysWOW64\Eokqkh32.exe	Eiahnnph.exe
File created	C:\Windows\SysWOW64\Fimhbfpl.dll	Fngcmcfe.exe
File opened for modification	C:\Windows\SysWOW64\Igfclkdj.exe	Ickglm32.exe
File created	C:\Windows\SysWOW64\Jjjojj32.dll	Nmdgikhi.exe
File created	C:\Windows\SysWOW64\Cggkemhh.dll	Qobhkjdi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7164	6260	WerFault.exe	305

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckhecmcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnbgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnjqmpgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgphpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ombcji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jebfng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feoodn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpmdfonj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jleijb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljqhkckn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhhpop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdmmeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdimqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjlopc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnhdgpii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fefedmil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nglhld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conanfli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddligq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnjgfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgnomg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lckiihok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebnfbcbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glbjggof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gifkpknp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njfkmphe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpcjgnhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkphhgfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpcal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hehkajig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgnbdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llodgnja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfeaopqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjjkaabc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgnlkfal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcdciiec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcimdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ondljl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cncnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dngjff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epmmqheb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lljklo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnfpinmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qobhkjdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfhndpol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgdpni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkobmnka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eokqkh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fealin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jghpbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boeebnhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eehicoel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdaniq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dafppp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chqogq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmlfqh32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdlqqcnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jebfng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpkbnj32.dll"	Mjjkaabc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgnlkfal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cocacl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmohno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnbakghm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgqoll32.dll"	Lnoaaaad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omdppiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkhpjc32.dll"	Cocacl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkjpda32.dll"	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckgofgjn.dll"	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cohkokgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmqmbmdf.dll"	Fmcjpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpdhj32.dll"	Gpelhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgeakekd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnfpinmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnfpinmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fimgpahk.dll"	Dnmhpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddligq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gflhoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbqdpi32.dll"	Igajal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncpgam32.dll"	Llmhaold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmphblgf.dll"	Dfglfdkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmcnoekk.dll"	Impliekg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eehicoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Impliekg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Accimdgp.dll"	Jmbhoeid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkjdipap.dll"	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imnbiq32.dll"	Mmhgmmbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eblimcdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flkdfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbdmdpjg.dll"	Jljbeali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlgcp32.dll"	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqqpck32.dll"	Fpkibf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnepna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifjfmcq.dll"	Jofalmmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmkqgckn.dll"	Lnjgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdlqqcnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbjodaqj.dll"	Fefedmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnjgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmhgmmbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngndaccj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oplfkeob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akglloai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dndnpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gifkpknp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dafppp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lippqp32.dll"	Flmqlg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3968	4380	3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4.exe	83
PID 4380 wrote to memory of 3968	4380	3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4.exe	83
PID 4380 wrote to memory of 3968	4380	3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4.exe	83
PID 3968 wrote to memory of 400	3968	Aajohjon.exe	84
PID 3968 wrote to memory of 400	3968	Aajohjon.exe	84
PID 3968 wrote to memory of 400	3968	Aajohjon.exe	84
PID 400 wrote to memory of 1036	400	Akccap32.exe	85
PID 400 wrote to memory of 1036	400	Akccap32.exe	85
PID 400 wrote to memory of 1036	400	Akccap32.exe	85
PID 1036 wrote to memory of 3600	1036	Anaomkdb.exe	86
PID 1036 wrote to memory of 3600	1036	Anaomkdb.exe	86
PID 1036 wrote to memory of 3600	1036	Anaomkdb.exe	86
PID 3600 wrote to memory of 3276	3600	Aehgnied.exe	87
PID 3600 wrote to memory of 3276	3600	Aehgnied.exe	87
PID 3600 wrote to memory of 3276	3600	Aehgnied.exe	87
PID 3276 wrote to memory of 3012	3276	Aekddhcb.exe	88
PID 3276 wrote to memory of 3012	3276	Aekddhcb.exe	88
PID 3276 wrote to memory of 3012	3276	Aekddhcb.exe	88
PID 3012 wrote to memory of 988	3012	Akglloai.exe	89
PID 3012 wrote to memory of 988	3012	Akglloai.exe	89
PID 3012 wrote to memory of 988	3012	Akglloai.exe	89
PID 988 wrote to memory of 556	988	Bdpaeehj.exe	90
PID 988 wrote to memory of 556	988	Bdpaeehj.exe	90
PID 988 wrote to memory of 556	988	Bdpaeehj.exe	90
PID 556 wrote to memory of 3080	556	Boeebnhp.exe	91
PID 556 wrote to memory of 3080	556	Boeebnhp.exe	91
PID 556 wrote to memory of 3080	556	Boeebnhp.exe	91
PID 3080 wrote to memory of 4772	3080	Bhnikc32.exe	92
PID 3080 wrote to memory of 4772	3080	Bhnikc32.exe	92
PID 3080 wrote to memory of 4772	3080	Bhnikc32.exe	92
PID 4772 wrote to memory of 4108	4772	Bnkbcj32.exe	93
PID 4772 wrote to memory of 4108	4772	Bnkbcj32.exe	93
PID 4772 wrote to memory of 4108	4772	Bnkbcj32.exe	93
PID 4108 wrote to memory of 1572	4108	Bkobmnka.exe	94
PID 4108 wrote to memory of 1572	4108	Bkobmnka.exe	94
PID 4108 wrote to memory of 1572	4108	Bkobmnka.exe	94
PID 1572 wrote to memory of 3692	1572	Bdgged32.exe	95
PID 1572 wrote to memory of 3692	1572	Bdgged32.exe	95
PID 1572 wrote to memory of 3692	1572	Bdgged32.exe	95
PID 3692 wrote to memory of 2536	3692	Bnoknihb.exe	96
PID 3692 wrote to memory of 2536	3692	Bnoknihb.exe	96
PID 3692 wrote to memory of 2536	3692	Bnoknihb.exe	96
PID 2536 wrote to memory of 4820	2536	Bheplb32.exe	97
PID 2536 wrote to memory of 4820	2536	Bheplb32.exe	97
PID 2536 wrote to memory of 4820	2536	Bheplb32.exe	97
PID 4820 wrote to memory of 2896	4820	Cnahdi32.exe	98
PID 4820 wrote to memory of 2896	4820	Cnahdi32.exe	98
PID 4820 wrote to memory of 2896	4820	Cnahdi32.exe	98
PID 2896 wrote to memory of 4200	2896	Cdlqqcnl.exe	99
PID 2896 wrote to memory of 4200	2896	Cdlqqcnl.exe	99
PID 2896 wrote to memory of 4200	2896	Cdlqqcnl.exe	99
PID 4200 wrote to memory of 3148	4200	Cfkmkf32.exe	100
PID 4200 wrote to memory of 3148	4200	Cfkmkf32.exe	100
PID 4200 wrote to memory of 3148	4200	Cfkmkf32.exe	100
PID 3148 wrote to memory of 3472	3148	Ckhecmcf.exe	101
PID 3148 wrote to memory of 3472	3148	Ckhecmcf.exe	101
PID 3148 wrote to memory of 3472	3148	Ckhecmcf.exe	101
PID 3472 wrote to memory of 3156	3472	Cocacl32.exe	102
PID 3472 wrote to memory of 3156	3472	Cocacl32.exe	102
PID 3472 wrote to memory of 3156	3472	Cocacl32.exe	102
PID 3156 wrote to memory of 4308	3156	Cbbnpg32.exe	103
PID 3156 wrote to memory of 4308	3156	Cbbnpg32.exe	103
PID 3156 wrote to memory of 4308	3156	Cbbnpg32.exe	103
PID 4308 wrote to memory of 4340	4308	Cfnjpfcl.exe	104

C:\Users\Admin\AppData\Local\Temp\3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4.exe
"C:\Users\Admin\AppData\Local\Temp\3349b46b632b556481302cad67945812ac8d83c52b2d72f35961caccc38c51c4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\Aajohjon.exe
  C:\Windows\system32\Aajohjon.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\Akccap32.exe
    C:\Windows\system32\Akccap32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Windows\SysWOW64\Anaomkdb.exe
      C:\Windows\system32\Anaomkdb.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3600
      - C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        23⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        24⤵
        Executes dropped EXE
        
        PID:4808
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4012
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3848
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        28⤵
        Executes dropped EXE
        
        PID:2564
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4688
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        30⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3328
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:720
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        34⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:448
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3908
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2648
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1936
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        45⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4824
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4264
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        49⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        53⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4348
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        57⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1776
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1716
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:516
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2336
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        63⤵
        Executes dropped EXE
        
        PID:2468
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        64⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4084
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        67⤵
        Modifies registry class
        
        PID:2228
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:628
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        73⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        74⤵
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        75⤵
        Modifies registry class
        
        PID:1140
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        77⤵
        
        PID:660
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        78⤵
        Drops file in System32 directory
        
        PID:468
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        79⤵
        Drops file in System32 directory
        
        PID:4936
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        80⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        82⤵
        Drops file in System32 directory
        
        PID:3116
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        83⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        84⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        85⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2692
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4836
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        88⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:216
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        90⤵
        Drops file in System32 directory
        
        PID:1000
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        91⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        92⤵
        Modifies registry class
        
        PID:3624
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        93⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        94⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        95⤵
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:768
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        97⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        98⤵
        Modifies registry class
        
        PID:512
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:964
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        100⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2956
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        101⤵
        Drops file in System32 directory
        
        PID:5080
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        102⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        103⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2560
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4756
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        108⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        110⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5408
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        114⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        115⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        116⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        119⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        121⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5904
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        125⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        126⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        128⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5276
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        130⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        131⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        132⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        134⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5740
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        135⤵
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        136⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        140⤵
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        142⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        143⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        144⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        146⤵
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        147⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        149⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        153⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        155⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        157⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6216
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        161⤵
        Drops file in System32 directory
        
        PID:6304
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        163⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        164⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        165⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        166⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        167⤵
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        169⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        170⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        172⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        176⤵
        Drops file in System32 directory
        
        PID:6976
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        179⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:7136
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        183⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        185⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        186⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        187⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        188⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        189⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        190⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6952
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        193⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        194⤵
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        196⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        197⤵
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        199⤵
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        200⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6960
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        205⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5344
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6624
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        209⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        213⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        214⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        215⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6260 -s 400
        216⤵
        Program crash
        
        PID:7164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6260 -ip 6260
1⤵
PID:6784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aajohjon.exe

Filesize
163KB

MD5
2ded5bf160bf4da02c9a30c834441726

SHA1
5cede2661884b5b13884672681da0e0d3d92e78c

SHA256
ca1d95231fc77908d7a6873e829edd57afaf32b3dd76c6ac48b6436be247c1e9

SHA512
7d494de8f1af2c95d50c97265a8828a8e445256cd4da423c2a48513ec0ed863fb09b9fb4d60705a2c4751ec3978555348d3016f6a099cb9f512ff44be8c645c6

Download Submit
C:\Windows\SysWOW64\Aehgnied.exe

Filesize
163KB

MD5
2616c26bcfe12c591bd256162b1a05ea

SHA1
3575dfcc00f59a49736f80f3a4615e3f1389017c

SHA256
8fc8d6dbeea13cadf8ba77b8c0a92de66799d2973a49887d0c34e8a78f5fbf09

SHA512
5b71202bbbd0b88eba18d2f7e8f8fdf88c3e77acb0df820052b9b9152d7a1b186b86597431a8f2019ae37224905e6b867f31336a0b7991182fa7c8f0b7ffc70c

Download Submit
C:\Windows\SysWOW64\Aekddhcb.exe

Filesize
163KB

MD5
4c1597f49cb14f99635f3b2ae8a32f33

SHA1
c76cf81dd9f73f3e3d901a955f1bae16a0a1bdd0

SHA256
b7dd8cef950aa4e1064083189506e37dc86f8a533c7fd864d7eca0c97be5579b

SHA512
a03148f16ae3545b3d5efe58e21a5040a6bed4767b3e16d50d450d1aa076209cad0843fad7f6ef8830636d4b5218046f33e3afd411ffed6c939b11db4859b7a5

Download Submit
C:\Windows\SysWOW64\Ahfmpnql.exe

Filesize
163KB

MD5
82cf2dc415cb96a28ae9797ad2c86cb3

SHA1
6f858bfb4ca416059f5b346e8f9953f00730ec39

SHA256
b29cd53c542e21750ccddb0e3b8a7886f67efd73921b3325a3aa2049f1f84cf0

SHA512
0d5ca15335f74a99e20d3cf47c3015293002ae960d2bc678c9390a759915d28baf134c9d3974e14f0008f988552de8a64a301a7eec0a16fb47eb24f7c7eb1424

Download Submit
C:\Windows\SysWOW64\Akccap32.exe

Filesize
163KB

MD5
a9014c2bdd2d2c49578cab661ace7397

SHA1
55e9725ff016214d3a310d5160092e16c77c21a7

SHA256
77bf9a27a10cce5604083bc6ad69e4760777ed240b539b5b6e3ab39f42947a74

SHA512
2c6487be33ce4e7224198eceeb2b23b7383642d4631b385cf250dd9f198c67685d4f8f2a7e522f38bc8991b052f6bf14660e52cdf905fa669da5fdb8370e638c

Download Submit
C:\Windows\SysWOW64\Akglloai.exe

Filesize
163KB

MD5
7ce4311d3145a816d34ede0f36ae529c

SHA1
16cfac7b4388275871f2a7c62e6d6b9d1f8d05db

SHA256
af36cabfbc69051ad86def2284dac1bb97a54cbc3be10f6db1574c4b7e530b27

SHA512
6702ae4b055bba1d0f8a39eff41a9bfd43cde9989928a3310dccb4e41788f9a094a719bde8436d5741f5623fb713697ee882664c1e932a158eda5b568edd96c9

Download Submit
C:\Windows\SysWOW64\Anaomkdb.exe

Filesize
163KB

MD5
eabf1a4672a71f75b35f020208011502

SHA1
db097ed90dfd3ecb2c1a6cc2d4ec84a2a5c405ed

SHA256
2302eb22d0e27117b1ed11fc56594e9934afcb23cf738647d8fcf7fc22df84e5

SHA512
04a6b0bd13ff51bd32aa834a2d9a6bf8792fb51b1c380f052baabcfbd39d78cf5941eef099d31528da085de25d306e77bb20f0f9b1b399962b4829d50b3327b0

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
163KB

MD5
c76f303ece672c723d42b1b5ce3c5016

SHA1
f0f8c498e92d9b57b84689127e31e1ea9a145d17

SHA256
24c33e1a10d709ebbec1d3d011cd0d92208822079e7c2676c0a4166d9a329e30

SHA512
3161ff012f82c774534520e99a56800fc0a64d5ffc7179c071d244b8f5a39b5d12514285c17c6051873d64ee6a543cff99fe4a91f7365de9e3c2f9017f144100

Download Submit
C:\Windows\SysWOW64\Bdpaeehj.exe

Filesize
163KB

MD5
41316155df27d204004679eae3357a7f

SHA1
7833ead3012a53cb6f80754381f43457d7320c4c

SHA256
2fbd892ed83cd70fe997d93b1300cff9a8cb25aae8fc78c4e9f7eb3be1e451cc

SHA512
155b3b3b9829b0351413eb9f8f52e64cf97fbac381e24531d2085737e47461959b731c536180f71c88e1d2093607591ea8edb9e740ce84ce1ae8f18cbb386c73

Download Submit
C:\Windows\SysWOW64\Bheplb32.exe

Filesize
163KB

MD5
b1b6ef600e2d9cce3cdf195006973c16

SHA1
8fc97a750442de911577859e6e08ec5e89b879a1

SHA256
a2b061c9d6543fd2d7fa49b94513cf662c59be4fe53bbce4691eaea4b1f822c7

SHA512
27040157f1b305e7b5110be8c1408d43c9f3e81dd03d96956dfa9b5e7dbc8e616366f7da833809250bc21a671b4205416ce22a3126c6840310c6dbe6b34b9fbb

Download Submit
C:\Windows\SysWOW64\Bhnikc32.exe

Filesize
163KB

MD5
d93e1bd0c7fcc040c74398f1ca8c2121

SHA1
67ed9c913317d3c486463ff06f5bf7d41938e6c6

SHA256
16b7e80a479d65fccfda3718bae51cee62058cb4ec6de7e1885440e0ff626bcc

SHA512
9a310f0125051e9e17537638c83b150719b95f3f3c14a0f9a7e2fe1ad312365600186e4e33767ba875d3f41bd843b61cccc72b5736c1e7f510f73dae420c51de

Download Submit
C:\Windows\SysWOW64\Bklomh32.exe

Filesize
163KB

MD5
8ab7e91eceb36502e7b1121e1cb845c8

SHA1
580ebbc68bcbe16ca980534c72fccbb275ffbd87

SHA256
f9ae5387fa2767837c445342a810cd09cfbe056077fed2f3f6b67b824b705cbf

SHA512
e6c6417cfa4aab3152db1e19b74db68bfbc4468cb66dfa94b7c253ac0566c47ef3ae19f41019f40d924c0820368f2920fee9ccffaa8926c68ac5405b181f304d

Download Submit
C:\Windows\SysWOW64\Bkobmnka.exe

Filesize
163KB

MD5
f4424aa7976322bfad30a1a999bb08fb

SHA1
ab9dc6ff52592cb867927f14b6522ef8947b3bbe

SHA256
b34c83f37d892ee71ec477eb97688ec9c6fc45aded8284c26d2f1706cbcf198e

SHA512
cd2509c9354f3bd4774b9b06df36af2cda0f847207ef5a2194c0a403c6f76c01aa08e5c16948fed70888e17d0677c9cef36a2b325eadcd9f5cd5e0597a5bb1fb

Download Submit
C:\Windows\SysWOW64\Bkphhgfc.exe

Filesize
163KB

MD5
4f64777d50d0fc5a06c305aa2e5c03b7

SHA1
e73388ad70ab6411beb6891d0fcfc70bf1dd521a

SHA256
757128b2c0e862b9c8d3cf7830eaea6f0be65c12cc0cc223040ae76a03e4976a

SHA512
a0e7783e4c1ede66e534d6a376b65c77b88802ee5f6758d79135bbb04c2b00cdee6fee8d9c0813bfd00c315305109809f051c2083cbee298f9cea49ad69da9ce

Download Submit
C:\Windows\SysWOW64\Bmhocd32.exe

Filesize
163KB

MD5
a433ba4044a7f1f4ba680120f0e90468

SHA1
4a0ef41ef8102d9a9d79b77f0b4b32961a311f44

SHA256
0f9032669c3dd8fdf612b936dfd625142ac08d2dcf94ba4688c5ec1bd26b681e

SHA512
5bed5f8c6709424ac427a09ff39861c959cd277324ec847aaff74b1f0a77cfae33d144942189502c4468f96d6712f5824ecd19b3f6fb817cc31db064c0aaed7f

Download Submit
C:\Windows\SysWOW64\Bnkbcj32.exe

Filesize
163KB

MD5
4b917673f12940b0b02ab8a0098a4c54

SHA1
02b70fe26e8ccc9ac07309061a41dc78fece472c

SHA256
aca57a5dbde154fd9e2837c3ed0a4e55b054c12ce91b88d1b977bf5ea3aef0ce

SHA512
00616ba8621043d712b5c00de90284f478c4ad1cb7a42a97e7d10c0b0845600700b4402e1471cb0519abe9f622fbe58f3ba26df8eb661300f205caf0945c92db

Download Submit
C:\Windows\SysWOW64\Bnoknihb.exe

Filesize
163KB

MD5
5d8c58743357930c6f62cd5ce18d65c8

SHA1
0f8044a4905fc3af7a5a6b10cae783c6bdf85622

SHA256
43900f9afeb5a4a3e481bc1503fbdc0e64d7d11c54acb67735f15cbf113c80f8

SHA512
4829b238f8f41f0fd1b9a82a27ef70bfa9922f77e73427948374f7e37fc465232f3f09fa382ca01f8e7f5c7b5f326adb1ec880f933a3feb27a4c7d3054fb51be

Download Submit
C:\Windows\SysWOW64\Boeebnhp.exe

Filesize
163KB

MD5
19537cc2454348b5e546388f1d1cb72f

SHA1
4ea7ea41e5d585f92f268a77ff39ac546b6ec7dd

SHA256
dd07ab38f8fc8fcf2fd73daf4fc5021a32578d57b5309b77eb77c7bbc3c0fc76

SHA512
42a12a5395d5ae93d54b8548ae1bd662bab3b5ba2868b98f53009a48c14128b9ca4ee89d01c99b860441173fedbba4e42191fd7706717abef74481736de892ed

Download Submit
C:\Windows\SysWOW64\Boihcf32.exe

Filesize
163KB

MD5
ede2cef98003498edc11e120abd68a8a

SHA1
eb1cdb2bc129b0f31665e6373d1d7780861b8e8e

SHA256
5adf7f354c63290ac891d741804042c9ff1427605c9fcd951fd98c9ad2f08e2c

SHA512
b564d69e45bec2f0d5b7d54ce363997228722f57e7bf1b7372ccbc4f138c73a9e4659a0c68b575057490bf3170df1e73dfbf2e10257f4280930920e0ef3aac51

Download Submit
C:\Windows\SysWOW64\Bpdnjple.exe

Filesize
163KB

MD5
9ea7fcf464907315ebd60dbb5978292c

SHA1
bf9bccb9f16d8466bd9e739494afa16188e02882

SHA256
ca2d61bea834b58d3c3def04e6a0a2f33df2fff3130cf02baa35805bad23c451

SHA512
bd95b73a91aade567fa1e0a2aed5001d22406aaeb8028f9245f3a600026e2f78522904c20331bd2aca9c722882d5c1770a203655c22ce331ab0233999561cedf

Download Submit
C:\Windows\SysWOW64\Cbbnpg32.exe

Filesize
163KB

MD5
ab8b67e0ebcc9eae4fe28011abdf018a

SHA1
cfc1823550eea4f741a474e63973d3ef4ed47fd4

SHA256
3d60dfee964ef828474baa955d5a853ae174064aec7d25763c26c199b2c477d6

SHA512
7681f0a4edc7ea4046388cbebd407fba7f02e374c6f1689cf57fc9172c459240fa56b0e8a1394b7a600f9dec11f2dd16bb34ab1c931121a625653d8d6f0925b3

Download Submit
C:\Windows\SysWOW64\Cbdjeg32.exe

Filesize
163KB

MD5
07e3e2e9c63cd8b61c29dad4adfdb409

SHA1
1aeb97b805c7301df8335624b4c5605c6f5e5454

SHA256
707f7cd420531d0205137af7498e50a142dad8f0d2a30b57c00fabb685b23795

SHA512
b8e7d4339821d0c2c746d5cf3f74dfaf33d110a1a86d2980d76351f9c42490de8b84e46052ddbdd62378cccdf826ba16a94329afa2c1a04464970ddfede330fc

Download Submit
C:\Windows\SysWOW64\Cdecgbfa.exe

Filesize
163KB

MD5
59ddbe73a7e06c92091dc4adb7500dab

SHA1
5989a9546fef20c8eb6bc3fc62320f327aa94a5d

SHA256
6b27233e9782e46216eb9aeb18bc553fd8e3ca09064714c359176ffe8ed801d3

SHA512
115b3a3f9d8d5a1d1a1681bbf18e626883e424cc3bcaed755ebf05cf9e778b07d6a6616b8d3d61d6dc1cea8c4900805555f822c638411630fa90202f1bc86c8d

Download Submit
C:\Windows\SysWOW64\Cdlqqcnl.exe

Filesize
163KB

MD5
d5e1a773e7ef52a01adf236275965fe0

SHA1
a10bd8dcb4d49a27227e806ab79221deaaba509b

SHA256
829fa042e8e9ec07610599f8dda649dca63625ae27c2445632f8d692f4509d82

SHA512
db8b75b1af6f3e19250374226aa4742ba17bed905b23521f270968f868d6c975961780583f8fcec56810ddc74e06050a78131c62783e7dfe3fd07d20bd158ad0

Download Submit
C:\Windows\SysWOW64\Cfbcke32.exe

Filesize
163KB

MD5
461fe9352bd60623c361a70ba54c7831

SHA1
b0530d781c105339dbd7d24a32c6774e3c634fb6

SHA256
8809072f8f8b39e7e26946699669eab25f3e63fe16ae75aabf071f23e800e63d

SHA512
581fed14f93b7d2297b1df85d102d0231d9f677bdfe4841f946ccd8f59875db15e99e8148e38bcac55dea5e36c82290f291a78e1e6dd047ffa6dc99a2666fda5

Download Submit
C:\Windows\SysWOW64\Cfkmkf32.exe

Filesize
163KB

MD5
8c9b63c520d03ef1beb9b5c6bb880bf4

SHA1
611e5ac09c42df76ac4a3a3e7c6d915d51b09bd3

SHA256
c4f7230a0d29079428f316cb633abb7bcda92fba6bde480ea1cb7b3131bd7637

SHA512
9f7fbbdac574123ac8b6c4ee340729e9d7bd17e5852ea5729d096135c008cf2b880f409626d0ae6f3f192b22a07afe83e414913ed22abd898435d0a9548f85b7

Download Submit
C:\Windows\SysWOW64\Cfnjpfcl.exe

Filesize
163KB

MD5
023dab5e21d1f7e1d20b5a1056cf0250

SHA1
eb9bb22671b9d8fd10193863a9eebbcabeb86764

SHA256
cfc5bdce3b1589d10d681dabfc4e3aeb288d446403a887c2343939b575e5d896

SHA512
74b2e9ced2687b13d531e18048101b3215155a7beda1bc75731878b478c31a0bd6ecfa2d5731e1140af1a4d959c08105b904d7e4e7fb22758e62b671a1a51eef

Download Submit
C:\Windows\SysWOW64\Chqogq32.exe

Filesize
163KB

MD5
d935ef34f94d56f90ab458e5b78d4613

SHA1
d72da8ed725236a2f1ce5096335cc9273e9e4739

SHA256
3ce598c09567c99c41dfa82041f970f0c3d0b3a9d749689e53e983af6146d7a7

SHA512
b635497b5c25144619181a23d925945dd872514f7a971cddc087249b8767db8a87ec4de14f134cb6a9eb13a44800d3a41cc2acc257b196e8d67bb10597e7cf39

Download Submit
C:\Windows\SysWOW64\Ckhecmcf.exe

Filesize
163KB

MD5
37679e71ebcbdb2a776ffbf0e042ba27

SHA1
9ac297d3dea2d5be040df54c0de320d77e7d68ec

SHA256
503816836b47393c11de0a277aedcb4eb1fd5783c5040ac759c94f0bb62fd1df

SHA512
80cb8438dada634b5bfe9e52aa9d7548b576ef934fd69a30776f11cf0763f741126a2d10afbd2e207950f24a528e7ccb0e512cdbf18f693080ccddbfb89391ee

Download Submit
C:\Windows\SysWOW64\Ckjbhmad.exe

Filesize
163KB

MD5
1048346c242174aa3850f398f537c914

SHA1
4037426b5834bcbef3a996c24a30a5ba06c4e61c

SHA256
931285e3949b0ab50f34326925bf2f2b2c1452407e8ad8ac0d0dabaf7f7ee8c1

SHA512
8624ab333cbaf441f1725dc1c3dd143f201307d0970aafe1ca346d94c359584b263616ed2b0e381139128d09d3d34216cff9134d4a2dac556760a26c2bbfb708

Download Submit
C:\Windows\SysWOW64\Clgbmp32.exe

Filesize
163KB

MD5
a2a6bf803a2b8da32679c8cf653c60b8

SHA1
eed49b25bbdad7eb46f4c022d818aa1c3ab98821

SHA256
54b7fa307a342b9434fb7138873ec4f33e92dd6448137384eaf1a158493e19e9

SHA512
a79452aea633db81f9b0444312c3840ccaa079d1fb55e353e85d2ed2d28b5316b33129608eb0bd802abcb1a471fcf62dd00b9353422f86f864fd10bde31f1caf

Download Submit
C:\Windows\SysWOW64\Cnahdi32.exe

Filesize
163KB

MD5
d2f70eed71a1892c319f00daec20b113

SHA1
e562003543516c5f53265c7399838e62e06f0120

SHA256
fa377e21c93724cdc0c44f6c8b6e4170ad403d6b37ac94f6ac65274a5d4e2fe8

SHA512
9f486811c28705a1fd00ae3e89a1a2b657b9c2395d541d953e71e3fc1879f1bc7d81819f37d3e6f29e1038d122f1d240cdcd8d565881956bf1ad870d8fdf89b0

Download Submit
C:\Windows\SysWOW64\Cocacl32.exe

Filesize
163KB

MD5
196e5b31f974d0df3e647c6265d4e26b

SHA1
9793a3a9d804879d7871c8bef035262b889fd4e0

SHA256
c898278195d93443e08ce1c91b76df9430eab4f4387b6dd46c2280e456d70126

SHA512
87607ca12746b3e5eab9bc866ee280fe044439b2d1a0387bd3fa92521eb2194d8bce9358bdee5243c3858adff44388ec0bb42124019933a6338267e5bbc7f6e0

Download Submit
C:\Windows\SysWOW64\Cocjiehd.exe

Filesize
163KB

MD5
7c23f88f2eb41b2fcda8292eaa0bc019

SHA1
cd2213e797e59f05f26d8b6978206bc917d136cb

SHA256
1d392c408c7ebf1e169ec8d4887e666b4ce81441a65e03d17c6835528e03bc7e

SHA512
effaa9f9a57a5fa32fced9b15113d534062f6f2ec871ca3f75b9030132241e485dd5292d8c499f3db90a48d8f8739423ff8824479abe4eff2f15f1794568973f

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
163KB

MD5
92f5efece4d9b30f4e6b977d660a70c2

SHA1
5a7d0fba3ad8bf4dbced839bcdc3947fae859f57

SHA256
b4b5278e7663dfce750cf28bac98c28f4cc5bf222997abf09d710383c59d6c27

SHA512
6f0775b9fb8cca5f6efe739a704337d2f2ed4b3ab080539ed44594b94e1613037458687ae85b1a2d354a51fae3817d45c7decdea8396763f046df4068e1ea90f

Download Submit
C:\Windows\SysWOW64\Dafppp32.exe

Filesize
163KB

MD5
8603415da0b7be26379c0ee14dd1e359

SHA1
0fe7707e19138f9760fede3774fa9d753de04cb0

SHA256
7b1c2d46e34364beddf67d69f53a140dde6b807758176ffbd25eb58eddef056e

SHA512
14a92bd19a8bb9bce7b8c2f512cee1329e8789de94454bfd13ab721c14fa5962d806ce83aa55e893714beb4f2058c2645b0502bb1f87672871b224be1e15b07d

Download Submit
C:\Windows\SysWOW64\Ddnfmqng.exe

Filesize
163KB

MD5
413a83fd06fd7b7418b848b307a97f8f

SHA1
655f5d831a7105be193ae1cdebff380e148a721a

SHA256
fcef0dc9253104a55f5e851623cd4b5ddd9baccf1ea133e8b58aa5febe4d6def

SHA512
76789a6aba76c4f79ba165ec4070890d18d6ec18ac0334ba08dc743906bb31eafafaf45cea999152bdb9df41e1612da69542b23790494ea0813dd4fd7da5c664

Download Submit
C:\Windows\SysWOW64\Dfglfdkb.exe

Filesize
163KB

MD5
7134beabf7dfff9290c2636253ddfd8d

SHA1
57df0dea18530c426056c0cd40e49d6d61ece1a1

SHA256
2e2ed905a23b2b39e5da0a1738e31e006e32d054fa0e3560357488ee30974852

SHA512
0cea5267855472636d26d66ca0f830deab5277f3b3755fe32e99daf27cb239976021076b421b11b61ca2936d0f8f3a9297c02fd367b20e3757af0d306ffefd56

Download Submit
C:\Windows\SysWOW64\Dkfadkgf.exe

Filesize
163KB

MD5
c1a6f72ce27fd848ef93ccb5bad1c393

SHA1
4c6129d6305768bf657117b02c03095900726e92

SHA256
c0cfc10c68765bc54169845c6f44edeef1a55fa3118a8bd900078341432735bc

SHA512
0096e85c19b864928940f556a69bf8b9dc6883fab0bf773b8bbbba8047d3f5cbbc966c9411fe57013b25a3d26c3958581e36a2d3582650bc52fe620f96654f3d

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
163KB

MD5
ab852e2ff24f88566a862e7053243b51

SHA1
2e5614ed1e16c0216dd0553ff55330fcce4b5b29

SHA256
65ada6cb9bc7ee8da530d10197edca7cb61840c39ddeda4d360ce3cf68bf453a

SHA512
2e54de25b39ddae1c074f4a4965ae51d1c2834f746035e836572ea8e8cc4bf4bec25fc0dc05b4395adcee70643bd3ea597652ed90cc98a282f54a34957562c00

Download Submit
C:\Windows\SysWOW64\Dnmhpg32.exe

Filesize
163KB

MD5
392276991a0e37557b0d4dbc87afe4b4

SHA1
c6e695dab1203eb222779ff600122f0719a2cae2

SHA256
12e88f0c09c6d8ad44915e133062d2c84dac2e31f70d23d2790870050577c923

SHA512
d7e2a8be8c53e610033b55fefac377de4080f98622273a57fc2adc41bb4ba85e9745db9353ed8446c9fa7a61c4a53fd386f4ef03b330d3ea596b5de5a081099f

Download Submit
C:\Windows\SysWOW64\Dokgdkeh.exe

Filesize
163KB

MD5
1dd9a408dae86b0b70a62d9386e52f4f

SHA1
26fc142cfc9419789747cea3e7bfce99faf244bb

SHA256
daac42be07652ec8295eca9af5470c1144db3ecf3482204d002268d9bbd1dfac

SHA512
b03978a00aa651a73aef5c732609e3630b1f8d4d9a104220e4293ac080690f8a37ac005262f34eba1a3cd32db3e552cd91e220d14123755b9362e5f44a033b1c

Download Submit
C:\Windows\SysWOW64\Ekdnei32.exe

Filesize
163KB

MD5
05ab359dcd0c263789e2d1f8e2cc0bed

SHA1
214fd939fa9f8c956017f2373c7572596f52000c

SHA256
b70f55fb1f5c2d3ad5595ada70f4ccb8ff75212d8bc1a95edef6c6e67863463d

SHA512
729bf0a3cb6390025a995a3db6103f8887433e7850ce5c7ea97b09501faeb37b277966e549f242490afaaa04038f262b4cfd09ac8bf75d5db1c4dadd031f4b0e

Download Submit
C:\Windows\SysWOW64\Emjgim32.exe

Filesize
163KB

MD5
1831a851ba27b24b01e11e54f291db16

SHA1
9b57e26524e7c82630c1c927c84108d9c3d6aaa4

SHA256
cdfa1fd22ebf29343035ab3633e0bc178a912e82efc43057bb5fb86f245e6ba0

SHA512
b9bb5bbc6128fef40ae76bfd5d4653b01dc50d344cd510cfb60c3b06b3e6af66cb0d8d1cf96c3d2cd6ec5f96afbe3900f0b8cec76e12a7edd828bc88686ddc74

Download Submit
C:\Windows\SysWOW64\Eofgpikj.exe

Filesize
163KB

MD5
e49530db3b3750d18d957da8a52997a6

SHA1
c2145f1e5b6a0043a0eb6c233166cfe08cd8b8b2

SHA256
4dddca9cc5f47602377000e48e49ba1f977f1aef9ab67e14b5b2b207d0adc84a

SHA512
d174995e08412ee6499603c84e5f83c1ff8afd3c07a3711d9e84d5092c6b680ffb3cd8bf1b578057eeebaf95353e4efc5c0b45c6c167724d0dd9dec4861e6553

Download Submit
C:\Windows\SysWOW64\Flmqlg32.exe

Filesize
163KB

MD5
dd7a26e24491d16be522ac57df2c26c1

SHA1
6ddf533a8c5071bb358a7f0a74ec3fad6300d592

SHA256
86f035ec70470d1f839a1aaed9c07e907b6c24ec69dae8322f62e1525134bba9

SHA512
d6e42120d5530f900ca0358bdc8d8cb1aa284f06745b75325de60a4c20f1256cb123734e810f4b1fc1cef48811a1886b94f69c1b818c9f1d1fe6ff9fd7c62d0f

Download Submit
C:\Windows\SysWOW64\Geaepk32.exe

Filesize
163KB

MD5
7cc26a0e0326b1bc8e59033857a4134a

SHA1
2962f7d75100e11ab488dc8a82b00fef8a188c00

SHA256
2c337697e9a03412f80f3526f3660ed916d45d9a7e72e92ae6442ff9c5757809

SHA512
ed08d7fe0821e21c81854f14066e61820d8216a09bbf2a169acd83d6bdb49f6bc5bb15f2023bcb32331e229f9f2c133786501ffc714a05b836f48d8acbf2839e

Download Submit
C:\Windows\SysWOW64\Gflhoo32.exe

Filesize
163KB

MD5
5e36d0881e2a0c00e9035457b9c755bf

SHA1
dfcaba44596e06fc1f643476074f6669a3f6a144

SHA256
d057ced8f1e9e56a603b08d21a93a158c8a55c0da1761cac2ca98b64aeff7360

SHA512
7c981f4e25186c56280dedede5a5ed99d08b53a28408aad9b82d2c5e1061f145f2b44fd4ddad47c696eba750c5c6d2a01503e0f8734493764adfa9b1a4b88191

Download Submit
C:\Windows\SysWOW64\Hehkajig.exe

Filesize
163KB

MD5
f0cc221a44cac4780b9b239b69fb62c0

SHA1
8ab240a5c1672e9e3f5fb1b45b7d906c00d14784

SHA256
ee1d19876a3d525ea0f9c3b30b856f9d682ad486e3cdd88c9f638f2d87e53d1b

SHA512
9edb57866234b14572cc130d64bccf838dba21cab5ac1e035758c97feb43415a55be04ce4de1a95e51e0ac607ec161520ffd6b88a0e81575bafaf230cb8a9d3f

Download Submit
C:\Windows\SysWOW64\Imiehfao.exe

Filesize
163KB

MD5
d849bf7e044f87f6952b2521d7824e48

SHA1
cbf5ec20152020a2df0551f94b23fc32ce81af14

SHA256
35789459e89a3646735b3ed249eb4babd2c37e6872588a6f51e01d9ad44f62df

SHA512
3c08779f9064f1f8b87bf53f73387e7ad03f9160edeec54d3d01eba326c8533319041f1411b6df9a8d757bc38af5fb7f864ccfdb77db5e933ad68f15b1a42c68

Download Submit
C:\Windows\SysWOW64\Jedccfqg.exe

Filesize
163KB

MD5
ebdbcc4cfdbcd950233cbfda0b81b051

SHA1
b5081059ae5f1788ea12b18c71807b02993caa66

SHA256
32fc135dc14d10e0e17e048f51d7ff309ae222ce7e39dca5f9dbc0c56187ac73

SHA512
450c73b82c313b21a485d3a79646a0c55c5bc36aa2cbadd291b9737519e195faaa29643bc72f14dc371624e78ceeba0fb5248981b730fb30ec0ed8877542cd36

Download Submit
C:\Windows\SysWOW64\Jghpbk32.exe

Filesize
163KB

MD5
6bbcde2b34d002f67ab68689b8c819f9

SHA1
38134fc97f8c9f94a389d23e258be2c9b81f2a33

SHA256
c5615b778607bd87c286fe3beb162c4317f462153ba84ff87a95d7c92799a4bc

SHA512
f08fa39c9e5969c7d76ba177c59e2b47f8101d7f038cbad57e801313141b101873191a47cfe9b5634440d790ce8f7f44a757c563b3b79f33c2ea308ab3c067d3

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
163KB

MD5
7449692224d1ab28fdf4e667a75a3530

SHA1
40266a68260369c3a27816b5867941dfa7368404

SHA256
dcb9874d13b1bdb6f34548d4430dd10d12c10d8a4e69452e03902fa5ebb84595

SHA512
7b61f1b4f5cd472751759c5fbaa3c5bc5492d47d51f3505ee3a47e92c6a1173c47555a894411991e01ea7ed00767a020fdae19eaf63492c7c82333bf5d2f4ac9

Download Submit
C:\Windows\SysWOW64\Jljbeali.exe

Filesize
163KB

MD5
8c988418a63e3b2d2eb8282e2e224836

SHA1
a7d1154d7cd2b3544f4118f1054a264de9691cca

SHA256
0557826404753669f8a636f08c0e0e9da5e876956c6d98823963e15d2618e131

SHA512
6c1f9b9f966ff396d5248df8987c78925f115ebaa3bd7154b6981e05493e033fd0ea427c78b9906a56ba86c9812e4086c53f495e09967a2f5397495ded441998

Download Submit
C:\Windows\SysWOW64\Kgdpni32.exe

Filesize
163KB

MD5
4e29a7119ce23bad5d81798c62e944c6

SHA1
ac3a95ccad699c65005f25382a9f7499f7e6cfbf

SHA256
d3b8881ef5ddce93ffa0426a4fe42bca3ce1490a1994cc529c9e58fa0e56a7b2

SHA512
4a52f8b7716e2452013d51ec155fac8fba4bd4afc8d9ca1b43688df17527280c16b1b04ccb1371a88f96014c8d3650f968a18e731c11285d7b5cc83136934796

Download Submit
C:\Windows\SysWOW64\Lflbkcll.exe

Filesize
163KB

MD5
edfd051cce195009a33384f969d099fd

SHA1
da162ad8ac6dd7d2426aae1a437f895f1561bd06

SHA256
1877a96a22438182652e99893420ce0472b1dcb74cd5f59a26e8a45b09e34e14

SHA512
cada49368a0b057c0ddb925682769c33f0b61dac1104e962dee6faa518d63e25a25186a26750446d4f029ee21f900c6847bb594c7b4e9cbdbb2c77e39b921d4e

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
163KB

MD5
712b4da34c07512b7b9a7a14b1feab82

SHA1
e4bd8086b8a41d1174a2540a3b80849a15b98910

SHA256
093340cfe3beb20d95de83c79d148b5bf0a39eafc4228f73a946cce50207cbff

SHA512
1f1bc5a0a14b28783734d1a61670dab497fc541258ae7c7232c8045529b09c68a8bb595bac9a58a4ad4701a47f9df69ea20f6492504241e7bb92d408cd24bfc8

Download Submit
C:\Windows\SysWOW64\Mgnlkfal.exe

Filesize
163KB

MD5
aa636cd00dc1f3ed582e46957f5dc257

SHA1
ad6cb6b36dc63548ca4ffbd08cd9dfc4fe5b0272

SHA256
fec641f3b0b88a14c2a0c83901ed0374f14bd3e57ec62088c23f139afe62961e

SHA512
895cf212b203d7ac706d4c7e366559737e2ce0f5b529d22574bb206534067d0005f7ff4793fdf6c4a9241a9fabc6068052e54495dacb45dfe84f41e803dd69aa

Download Submit
C:\Windows\SysWOW64\Mjjkaabc.exe

Filesize
163KB

MD5
b44e3c22f317928dec3138c76949e53a

SHA1
0378166b7350cdf3f37260e577041cc7d67db474

SHA256
1443b1898bbdc15365c5324c7d48382e6d4e10d47bae9c70daaf866e32541d3a

SHA512
106296ad130baf5dd04071a4fad29f28e4989099ca7557c99192505f259959f50070febe513943b16de787c6f448cd20a97985b4a35b498c1ff6bd47017982bb

Download Submit
C:\Windows\SysWOW64\Nmdgikhi.exe

Filesize
163KB

MD5
5e27c74de736b08d02da0513702c44c8

SHA1
000d8b31f16ec2165c0ade6e70e03550f1f6ebd5

SHA256
a43a51d621ec71ea9c00f0a0d64acd8f3f4b3b0d0733d43b4674f87b56ce227f

SHA512
c4eb258f6f052cccaac3f1992785bb0b4d477bf7a4709a10b103eb3149de6310b4a14b9920ba2d199f68134e10abd410d7e8e54ded23838c2bb5542e9080c9b4

Download Submit
C:\Windows\SysWOW64\Nnhmnn32.exe

Filesize
163KB

MD5
463a39976a31bde50e2fdb60804d5cb2

SHA1
ff1cda6d9370c2cd33b3b9a2e08fc5e0a244e73a

SHA256
2f8f0fe612fb055e9830cf5fac6da1fa28492fb9c7f50fc95532ae3d7e75186b

SHA512
eac684a60a0af407f67896e3c19ca2484a72bdabe60f3122ee153ba0f3a88b9d5a7880c445d6f844516e1e7c9a129c58e758cb4057e61045a67465ce9176dc02

Download Submit
C:\Windows\SysWOW64\Nqmfdj32.exe

Filesize
163KB

MD5
fcf07d3a4e36454e5e0c7ea468015c2a

SHA1
0185930cd093fb4dd76629fd7fec8c33dcc8ffe0

SHA256
b2741e6f9507d0eba34a5b0eb16bcc7b3363ad2bc6c8f93f7d25c8007872cc04

SHA512
41f9136fbc5887ac1652bda9ecd6a1043dd17fa8bb557529c41bcf5199b413d02d6fe96608fb2336dff402e4268d9a8f8b1a95e25d6ae980cd257f2de2e7f845

Download Submit
C:\Windows\SysWOW64\Ojajin32.exe

Filesize
163KB

MD5
766b4b2fa21c95a3421b55449cefefa9

SHA1
11b8b0a5e3aa317f2fe4acbdbf407cd021d7689c

SHA256
d8095f735189db030ed2f4d215e72522ed6a08c2e4a048d01bc69fd493e8d80a

SHA512
844469efac8c8487dc0b86e7e2747461139ed4fee3911beb0dc5e67cb22da137511c4b4fb26de7040be09d4b8bc05e5aae950e6a5efc337303597bf20aab4812

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
163KB

MD5
af7b33193de4a7e0e4ff0ad29a6a5aac

SHA1
3bcc400b3da9f04d5fea124381b43cd1c455878f

SHA256
a2ce82d9e971fcd740642a9e3fcc68d785bb617889ea6379a1070ae70be197df

SHA512
71ccbb38f6da85614b87df1f3b6910973b732f9d920c3513e9e7be15cff6b50ed9bf5f9cc1ad6920886620ae67ac8293cbdc4013f4b9d75aaaf735c6897fbb27

Download Submit
C:\Windows\SysWOW64\Onkidm32.exe

Filesize
163KB

MD5
56ea37f80c9478c0ccb1c63b9a64b709

SHA1
9f53a9034e1e37a609131198541e18378106c786

SHA256
1839d87811df227ddb2022f3d97cb09d27903a3c408096f5a1e53aabeeb2ba7e

SHA512
2394e9627574ba1a6f53d4c2ccd38244f91da0c93c196a5c43c4d22bfc45e652cd9e5a04d2bc669ac1ca5690207fbb11ed8abc66a6681dd9f3b9bc4aa103abf3

Download Submit
C:\Windows\SysWOW64\Paiogf32.exe

Filesize
163KB

MD5
368c9d3cd479d13ce7dfa6821e41e500

SHA1
dbeb95c03581d4048c25b7b8df883945b7b40b87

SHA256
b0ca28f210c83db6f782f8465c9a14566d9e7df42b070e6c4e097986e5208c6f

SHA512
e5741bbd0c4305b9a47ecc0408a9d6eadb6fa7dd3535d8a760d984957cb62b02da7416e7064a14f81e2fd8f8bcc7735662dec0ecf67d2f8d34fc8ace9d5549e3

Download Submit
C:\Windows\SysWOW64\Pmlfqh32.exe

Filesize
163KB

MD5
ff62c4af0c058c70f27307e63170c3ea

SHA1
a84e07bc0ebadc373bb596bcf5e67f86bef8b782

SHA256
121a9dad73d12f90bd4899e0bd1063c141f899c0e2e1be44a9c425019dc0cbf6

SHA512
ae63f0b0fea798f8eb54a6aceb2e5764dad342814544d6eb3fc8a83a146a59a99c478d3486b09c0cb2abecb2a7ad0464003b87bde760c4d3065d6468b4e5407f

Download Submit
memory/400-555-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/400-22-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/432-463-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/448-277-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/468-523-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/516-421-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/556-65-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/556-596-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/628-469-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/660-517-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/720-245-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/740-289-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/988-589-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/988-56-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1036-562-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1036-29-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1068-397-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1140-505-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1204-475-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1456-1665-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1552-355-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1572-96-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1580-1723-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1580-511-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1588-349-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1716-415-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1776-409-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1840-259-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1936-319-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1956-385-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1996-343-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1996-1779-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2016-403-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2032-493-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2156-590-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2228-457-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2320-373-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2336-427-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2372-487-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2468-433-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2536-113-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2540-361-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2564-218-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2616-570-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2648-313-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2692-577-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2804-325-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2856-271-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2896-128-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-295-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3012-587-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3012-48-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3020-252-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3080-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3080-602-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3116-549-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3148-149-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3156-172-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3276-41-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3276-576-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3328-237-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3468-542-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3472-153-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3600-569-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3600-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3676-265-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3692-104-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3848-198-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3908-283-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3940-481-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3968-548-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3968-8-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4084-451-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4108-614-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4108-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4200-137-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4204-307-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4264-337-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4308-173-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4340-184-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4348-379-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4360-445-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4380-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4380-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/4380-535-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4456-301-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4476-563-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4556-367-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4664-439-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4700-233-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4752-391-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4772-612-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4772-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4820-121-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4824-331-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4868-499-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4936-529-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4996-536-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5084-556-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5776-1481-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5928-1563-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6508-1543-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads