berbew | bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe
Size

207KB
MD5

d374d4629d3ae9aff260d71422ae2261
SHA1

e0ed6c09fbd1c92641021c71129265661c723770
SHA256

bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b
SHA512

c226b713af836de548829d8623e71996b99c206bd6d33fecb159b2016bd4b4f55961dbaade10e7eef3ee4bf85df2b003915c65ca612811630bbdf95948b8628f
SSDEEP

3072:qvodEp/255y/tKO3IWkWVjoSdoxx4KcWmjRrzyAyAtWgoJSWYVo2ASOvojoS:SOYz/tKmkWVjj+VPj92d62ASOwj

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdnidn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mplhql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lllcen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcefno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jioaqfcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcefno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miifeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcllonma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdnidn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klimip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefioj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miemjaci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblpek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jioaqfcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcbom32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1100	Hcmgfbhd.exe
1736	Hflcbngh.exe
4304	Heapdjlp.exe
2100	Hcbpab32.exe
3708	Hkmefd32.exe
804	Hbgmcnhf.exe
4700	Iefioj32.exe
624	Ibjjhn32.exe
4348	Iicbehnq.exe
4868	Iejcji32.exe
1028	Ippggbck.exe
396	Iihkpg32.exe
4836	Ibqpimpl.exe
3024	Ieolehop.exe
2356	Jfoiokfb.exe
2896	Jlkagbej.exe
2824	Jbeidl32.exe
4024	Jioaqfcc.exe
4780	Jcefno32.exe
984	Jianff32.exe
3276	Jlpkba32.exe
3232	Jpnchp32.exe
4672	Jblpek32.exe
4632	Jcllonma.exe
2692	Kdnidn32.exe
2888	Klimip32.exe
1628	Kfoafi32.exe
2540	Kdcbom32.exe
2384	Klngdpdd.exe
5092	Kibgmdcn.exe
4420	Lmppcbjd.exe
2696	Lfhdlh32.exe
3324	Ldleel32.exe
2940	Lmdina32.exe
2212	Lbabgh32.exe
2380	Lmgfda32.exe
5036	Lllcen32.exe
4988	Lphoelqn.exe
4496	Medgncoe.exe
4788	Megdccmb.exe
5100	Mplhql32.exe
2200	Miemjaci.exe
3108	Migjoaaf.exe
4824	Mlefklpj.exe
1020	Miifeq32.exe
4932	Ncbknfed.exe
2832	Nilcjp32.exe
3716	Npfkgjdn.exe
2000	Ncdgcf32.exe
2056	Nlmllkja.exe
3452	Nnlhfn32.exe
3312	Ngdmod32.exe
1516	Nnneknob.exe
4876	Olcbmj32.exe
2724	Oncofm32.exe
3516	Olhlhjpd.exe
2248	Odocigqg.exe
2544	Ognpebpj.exe
5044	Onhhamgg.exe
2860	Ocdqjceo.exe
4376	Ocgmpccl.exe
1920	Pnlaml32.exe
2268	Pqmjog32.exe
4260	Pggbkagp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Olcjhi32.dll	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Nnneknob.exe	Ngdmod32.exe
File created	C:\Windows\SysWOW64\Knfoif32.dll	Olcbmj32.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Migjoaaf.exe	Miemjaci.exe
File created	C:\Windows\SysWOW64\Lmgfda32.exe	Lbabgh32.exe
File opened for modification	C:\Windows\SysWOW64\Pjjhbl32.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Aminee32.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bchomn32.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Hflcbngh.exe	Hcmgfbhd.exe
File opened for modification	C:\Windows\SysWOW64\Jlkagbej.exe	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Cojlbcgp.dll	Lmppcbjd.exe
File created	C:\Windows\SysWOW64\Nilcjp32.exe	Ncbknfed.exe
File opened for modification	C:\Windows\SysWOW64\Ognpebpj.exe	Odocigqg.exe
File opened for modification	C:\Windows\SysWOW64\Hflcbngh.exe	Hcmgfbhd.exe
File opened for modification	C:\Windows\SysWOW64\Iefioj32.exe	Hbgmcnhf.exe
File opened for modification	C:\Windows\SysWOW64\Odocigqg.exe	Olhlhjpd.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Khchklef.dll	Jpnchp32.exe
File opened for modification	C:\Windows\SysWOW64\Npfkgjdn.exe	Nilcjp32.exe
File opened for modification	C:\Windows\SysWOW64\Qjoankoi.exe	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Hkmefd32.exe	Hcbpab32.exe
File opened for modification	C:\Windows\SysWOW64\Kdcbom32.exe	Kfoafi32.exe
File created	C:\Windows\SysWOW64\Miemjaci.exe	Mplhql32.exe
File opened for modification	C:\Windows\SysWOW64\Aminee32.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Jbeidl32.exe	Jlkagbej.exe
File opened for modification	C:\Windows\SysWOW64\Miemjaci.exe	Mplhql32.exe
File created	C:\Windows\SysWOW64\Mjbbkg32.dll	Nnneknob.exe
File opened for modification	C:\Windows\SysWOW64\Pfaigm32.exe	Pjjhbl32.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Hcmgfbhd.exe	bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe
File created	C:\Windows\SysWOW64\Lbabgh32.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Pggbkagp.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Ghkebndc.dll	Hflcbngh.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Hkmefd32.exe	Hcbpab32.exe
File created	C:\Windows\SysWOW64\Mjddiqoc.dll	Jcefno32.exe
File created	C:\Windows\SysWOW64\Fibbmq32.dll	Nlmllkja.exe
File created	C:\Windows\SysWOW64\Kboeke32.dll	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Nilcjp32.exe	Ncbknfed.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bnhjohkb.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Jocbigff.dll	Pggbkagp.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Kibgmdcn.exe	Klngdpdd.exe
File created	C:\Windows\SysWOW64\Nlmllkja.exe	Ncdgcf32.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Qnjnnj32.exe	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Bfddbh32.dll	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Chokikeb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5764	5548	WerFault.exe	198

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jblpek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmgfda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcbpab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iefioj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nilcjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oncofm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klngdpdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lphoelqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbgmcnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcefno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnlaml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hflcbngh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlpkba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lllcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odocigqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miifeq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olcbmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfaigm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heapdjlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdnidn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Migjoaaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibqpimpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Medgncoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfoiokfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iihkpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnneknob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieolehop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldleel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npfkgjdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jioaqfcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbabgh32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecnpbjmi.dll"	Hbgmcnhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inpocg32.dll"	Kdcbom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djkahqga.dll"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gebgohck.dll"	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjhijoaa.dll"	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmfpfmmm.dll"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciglpe32.dll"	bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajanck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfaigm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cojlbcgp.dll"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijloo32.dll"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibbmq32.dll"	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbgmcnhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jioaqfcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbinofi.dll"	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Megdccmb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olcjhi32.dll"	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbeidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhaoapj.dll"	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Mplhql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oncmnnje.dll"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaoecld.dll"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iejcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papbpdoi.dll"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jphopllo.dll"	Lmdina32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1100	2884	bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe	83
PID 2884 wrote to memory of 1100	2884	bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe	83
PID 2884 wrote to memory of 1100	2884	bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe	83
PID 1100 wrote to memory of 1736	1100	Hcmgfbhd.exe	84
PID 1100 wrote to memory of 1736	1100	Hcmgfbhd.exe	84
PID 1100 wrote to memory of 1736	1100	Hcmgfbhd.exe	84
PID 1736 wrote to memory of 4304	1736	Hflcbngh.exe	85
PID 1736 wrote to memory of 4304	1736	Hflcbngh.exe	85
PID 1736 wrote to memory of 4304	1736	Hflcbngh.exe	85
PID 4304 wrote to memory of 2100	4304	Heapdjlp.exe	86
PID 4304 wrote to memory of 2100	4304	Heapdjlp.exe	86
PID 4304 wrote to memory of 2100	4304	Heapdjlp.exe	86
PID 2100 wrote to memory of 3708	2100	Hcbpab32.exe	87
PID 2100 wrote to memory of 3708	2100	Hcbpab32.exe	87
PID 2100 wrote to memory of 3708	2100	Hcbpab32.exe	87
PID 3708 wrote to memory of 804	3708	Hkmefd32.exe	88
PID 3708 wrote to memory of 804	3708	Hkmefd32.exe	88
PID 3708 wrote to memory of 804	3708	Hkmefd32.exe	88
PID 804 wrote to memory of 4700	804	Hbgmcnhf.exe	89
PID 804 wrote to memory of 4700	804	Hbgmcnhf.exe	89
PID 804 wrote to memory of 4700	804	Hbgmcnhf.exe	89
PID 4700 wrote to memory of 624	4700	Iefioj32.exe	90
PID 4700 wrote to memory of 624	4700	Iefioj32.exe	90
PID 4700 wrote to memory of 624	4700	Iefioj32.exe	90
PID 624 wrote to memory of 4348	624	Ibjjhn32.exe	91
PID 624 wrote to memory of 4348	624	Ibjjhn32.exe	91
PID 624 wrote to memory of 4348	624	Ibjjhn32.exe	91
PID 4348 wrote to memory of 4868	4348	Iicbehnq.exe	92
PID 4348 wrote to memory of 4868	4348	Iicbehnq.exe	92
PID 4348 wrote to memory of 4868	4348	Iicbehnq.exe	92
PID 4868 wrote to memory of 1028	4868	Iejcji32.exe	93
PID 4868 wrote to memory of 1028	4868	Iejcji32.exe	93
PID 4868 wrote to memory of 1028	4868	Iejcji32.exe	93
PID 1028 wrote to memory of 396	1028	Ippggbck.exe	94
PID 1028 wrote to memory of 396	1028	Ippggbck.exe	94
PID 1028 wrote to memory of 396	1028	Ippggbck.exe	94
PID 396 wrote to memory of 4836	396	Iihkpg32.exe	95
PID 396 wrote to memory of 4836	396	Iihkpg32.exe	95
PID 396 wrote to memory of 4836	396	Iihkpg32.exe	95
PID 4836 wrote to memory of 3024	4836	Ibqpimpl.exe	96
PID 4836 wrote to memory of 3024	4836	Ibqpimpl.exe	96
PID 4836 wrote to memory of 3024	4836	Ibqpimpl.exe	96
PID 3024 wrote to memory of 2356	3024	Ieolehop.exe	97
PID 3024 wrote to memory of 2356	3024	Ieolehop.exe	97
PID 3024 wrote to memory of 2356	3024	Ieolehop.exe	97
PID 2356 wrote to memory of 2896	2356	Jfoiokfb.exe	98
PID 2356 wrote to memory of 2896	2356	Jfoiokfb.exe	98
PID 2356 wrote to memory of 2896	2356	Jfoiokfb.exe	98
PID 2896 wrote to memory of 2824	2896	Jlkagbej.exe	99
PID 2896 wrote to memory of 2824	2896	Jlkagbej.exe	99
PID 2896 wrote to memory of 2824	2896	Jlkagbej.exe	99
PID 2824 wrote to memory of 4024	2824	Jbeidl32.exe	100
PID 2824 wrote to memory of 4024	2824	Jbeidl32.exe	100
PID 2824 wrote to memory of 4024	2824	Jbeidl32.exe	100
PID 4024 wrote to memory of 4780	4024	Jioaqfcc.exe	101
PID 4024 wrote to memory of 4780	4024	Jioaqfcc.exe	101
PID 4024 wrote to memory of 4780	4024	Jioaqfcc.exe	101
PID 4780 wrote to memory of 984	4780	Jcefno32.exe	102
PID 4780 wrote to memory of 984	4780	Jcefno32.exe	102
PID 4780 wrote to memory of 984	4780	Jcefno32.exe	102
PID 984 wrote to memory of 3276	984	Jianff32.exe	103
PID 984 wrote to memory of 3276	984	Jianff32.exe	103
PID 984 wrote to memory of 3276	984	Jianff32.exe	103
PID 3276 wrote to memory of 3232	3276	Jlpkba32.exe	104

C:\Users\Admin\AppData\Local\Temp\bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe
"C:\Users\Admin\AppData\Local\Temp\bd9df0e82ed594faa0e796661d430c89a479022979c8f548614ff503cfe3174b.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\Hcmgfbhd.exe
  C:\Windows\system32\Hcmgfbhd.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\Hflcbngh.exe
    C:\Windows\system32\Hflcbngh.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\Heapdjlp.exe
      C:\Windows\system32\Heapdjlp.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3708
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:984
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3232
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2692
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2540
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2696
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3324
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2940
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4988
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1020
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4932
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2000
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        52⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3312
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3516
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2248
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        62⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1920
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4260
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1776
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        67⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        71⤵
        Drops file in System32 directory
        
        PID:3728
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2052
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4992
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4860
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4380
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        82⤵
        Modifies registry class
        
        PID:3240
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        84⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1588
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:668
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:544
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4052
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:1332
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3296
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        95⤵
        Modifies registry class
        
        PID:1768
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4856
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3532
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        99⤵
        Drops file in System32 directory
        
        PID:3524
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        100⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        102⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1536
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        107⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5236
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        108⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        109⤵
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        111⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5460
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        113⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 408
        115⤵
        Program crash
        
        PID:5764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5548 -ip 5548
1⤵
PID:5632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
207KB

MD5
6f173a6327361aee26f2b9fd782c9e7c

SHA1
e75053e99e48a5dd0c919191fea7957d4bd0e0d8

SHA256
6c6d62624ccda1388b432383e4cf5c086e3faacd602b8267ae3a04c3992d721a

SHA512
eaf075662aecbb20f1ffaed6800ea16bf54c54f5bce2b753a584bcd2eb9a25159d5618d5d95e494587d8538985b1f246d7c43b6085ecb0b2a30736c2cd4224c3

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
207KB

MD5
7d7eb0b43baf644cf9e29460a2f13d02

SHA1
8fff74c0787c98a3d4fcc183d310b2eb30a2e2e4

SHA256
b4c341cc68c25dd546be0d0c6386226efb7005a51aab0bf8a28c351f76e3a4ab

SHA512
756966363f87b7495eb81460d690e678f8212327687cb0857f0097eebb697453e17547ef12bd78e6ebb1396971821bddf42baacf203fcc659ebbfd7962825e4d

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
207KB

MD5
dc17c617556185ad17ca69edac7e005e

SHA1
e7e9fb83a1fe69c3c10f37a370079f987a521bab

SHA256
32572dd5de42df3cd9cdc9b7eed30ed2cd2577adbdad4e2576c7191ba54c77d0

SHA512
e9450aa49ee577dc75eb89fd872a38407f0c6ee4225f9a3303862b8aa05891c118ee87d941b6ecf6cbb416e4272c3edfa586997ee915fc9499dd09631c10ad0e

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
207KB

MD5
de048452036087e7a6b1ffe2d216705c

SHA1
b62de03204ce3077b30146c58ca35c3dc5309bb6

SHA256
2314204b0d49d4490afe56cd2b9f6f4a9744a3dfdf83384bf69df35f668d796d

SHA512
a7c21627a277e27ec652fa13af1a8fa692e3b2e16ee969a0a9b1651b8f4d2ff9ca1627cbcfa28d3c59a080f92caf03966fade1f9b8630e22afd6aa6d13452ce9

Download Submit
C:\Windows\SysWOW64\Bnhjohkb.exe

Filesize
207KB

MD5
709e0a2f8fa9eaacef01daa9faf541fa

SHA1
7fc39d1cad7b94c96ea52a64c2db81710f36bc64

SHA256
233641f99829d134ce769bebf257895ba04c6e382df94a436e29fee428d2bde2

SHA512
ad69c441a1f4dc27cd8d93cc69406e1c4849e0ef4ed5d3205c73a127d584031889f2f84221a3f54102709310c18b01d9970c79728338f3aa23d6ae46f01ab2e5

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
207KB

MD5
43354387d3934c438b2a5443fbdd1a52

SHA1
14546a354abe3616e0fbaf0cc453a0bb5a8823fb

SHA256
8e42de61a5e5cd04325eac5eff789f9e1a48556772e8fb878947b1480a43d249

SHA512
e5d63d0ec8a18c121c0f9baa2d1f76cc1a853089de3af242b558970dd1810bbf95f4a5353fd27e73e97a5fb7d9b9b92df930621d5d0ab8d0d81ed9e1673826c1

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
207KB

MD5
f5ee241df50e30c1ad474b076b670254

SHA1
48249b8d6a1b276b13af599a1a990caae227219c

SHA256
3480979df314eb13ee2f7d30da82570e589563fea29bbffb28cf9f33138ed498

SHA512
628ba1153f52fe2e94c9bce0959ac02825d0bbefc7c5df64dc10ee845b7924c32d9507268d79c3a34e37b492edc7d33e973ee195054ec19e3a56ce061a6c4142

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
207KB

MD5
5da949c2ef8de454fd5f4c45fa068a88

SHA1
b7e9f944b60c2a525715da31c59414b70dfd1b2e

SHA256
25d7539b9b2707bf307d5d311eb55f62de00eb3cf60e148b9745373ceb5abafe

SHA512
92557d892ca840badddd2492b2ee57dced2cb764a184157dd55b20a6cd5661fe45b83e4b449765e5b6f17dad9018f742ae5a5210df9dce4e197ea96dc99f8b1d

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
207KB

MD5
c65d153ede16accef77edcae9f086d28

SHA1
0a618d35512bd432b2f64ff1c4fd6243f709f62b

SHA256
66777cf7fd286d525d988118f84876afa0dbae8a3275a51346ae6439b01ef5cd

SHA512
92747b0b1a3e8718f1bceb1e99a5aeef5d48eaabf023aee2c89869db966cc10aea93cdcc8310403d4640b93d0f410ef5c5a98a5de2b550580229b97a73fc488a

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
207KB

MD5
ffded4300fbbb403e6f1ec7567b973bb

SHA1
fc3368a762fa9d730705ba572779b5313629bac3

SHA256
08d933aa2e92ee3821adb4837d459bd707f42098704337f7bcf6d7678c8177da

SHA512
5635bd1900550bc54676374b147692dd7e2a04f8068f118c18e3a5fab4d6273f70863b9a70748084f3e7b23b61cb4ecddeb68c2ddf52f91426039497f18ef6b6

Download Submit
C:\Windows\SysWOW64\Hbgmcnhf.exe

Filesize
207KB

MD5
b681bfe217947e8abef3e67dbe169296

SHA1
19aad10f8001799ffee909e6579eada5c1a30d33

SHA256
653a6c18b765f11db3963fe81d4b567641e15134132b77e9444c480b1c6c8647

SHA512
747479e85fb8787c9ee67046c8bef702a9192f1604a01d8aaf9959737f2702bf9d3d4d62482e8d5fe107c3db5311069257555c0d1d71d2fab70d8bf69f819d74

Download Submit
C:\Windows\SysWOW64\Hcbpab32.exe

Filesize
207KB

MD5
03cb03e76b62e0c615dd41ddd1277c97

SHA1
01c47ed2eb13dfb3b29ace85ea450bade344da19

SHA256
bd98a7514d574951f5a1380171e411377bba98db947e5fbf1e458fa002479e0d

SHA512
e32ff69d73d2308b34bffceba37a3217c75b496bfb75e45db1efdc94999cc16d6b355ee416b894323806426d3679392ae4ae7c06274fe03188009c0ea6b28696

Download Submit
C:\Windows\SysWOW64\Hcmgfbhd.exe

Filesize
207KB

MD5
04301430f3e0d1e2e0aa506a210ff4a3

SHA1
e22c9072b887d4a3bbb85de490e949282ec8bad6

SHA256
590535fcbbf1daf9f5e24c42636fd7f0417ec7e6c190e268d225b038ba0b3340

SHA512
8872a1c6ba5cae30d9f5db31beac471c1824def277dff64fe21b3c2262186c6625afcaa99dbad33d7c5897d15e6b85772f5f4b8732c0a8282d1f27cfebff4b66

Download Submit
C:\Windows\SysWOW64\Heapdjlp.exe

Filesize
207KB

MD5
23e47610d4529a465f3384055e978286

SHA1
5110c3522e494b37ebe65dbb8ccd8efbdb8634a9

SHA256
8ead945012321dd5b07e715e16be10fde568150bd7959c0d9cd2fbf3fd58a3d9

SHA512
551ee4eb82dcda1234c87da51a77c730fb926117a98a5d4e703aaf0bd93bf29292c7b41446f681e6044ab3b3c8f02218ea1c820639521f225aef24b6f1f51dcd

Download Submit
C:\Windows\SysWOW64\Hflcbngh.exe

Filesize
207KB

MD5
25f456ae18b8049bab4bc481f8601ffe

SHA1
1bcb4288d28bf35cf25e39df9974313768cb8333

SHA256
aeec2dd455d7199df44cddba226030c2f126f5c4d33cac6676ac99e653b48cdb

SHA512
eaafda16141b183960ef16247ad8c08672b54f5eb2b9ed6485b0624be741740e4dd1ac4050d5906b3264c9c48324f6c41d095a9aa2fe5654fc7c949f737537fa

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
207KB

MD5
2655dc008d8576a7ce8f034cfadb0794

SHA1
dd3c68f1ff519fec04b23e022ad181bc0bce7db8

SHA256
044e8919cac7e5fecd43b6a4942fda94a80a05ec7137e032bc7224cb7b1139fd

SHA512
59b07f1d2b3bbcdddf873ba3c5f8a23f071e9229b840063ce590922ad5844ec8a6fcc2c906076a20db863470ec507f9e29a707ac4448c0a9867d91cfd9862a17

Download Submit
C:\Windows\SysWOW64\Ibjjhn32.exe

Filesize
207KB

MD5
780333face1a4cc2b608b9a60f318043

SHA1
00a1c82fa84f6f2467680e696a2dc64b5ce246ef

SHA256
f68c04a7069d2e4c4636b0595b1f53258825901f2157fd1b4472d3f501f78ab1

SHA512
c5629f65fae894e3e885eb814617fc39b61399edfb7422d8be766d3f8a2e7e711c47344ed86db5d1553d5b0ee887056afb39557d3355bd7a96c6c7b64decd69c

Download Submit
C:\Windows\SysWOW64\Ibqpimpl.exe

Filesize
207KB

MD5
a3292ef4b2cd29cf9b0e482e3f5a5701

SHA1
bef1c422ff3c25ae9feec805bccf0fa0395f02f6

SHA256
5f7de3bb8377de6c9f1d5fcd9587ab142dade0fd500a957eba0c1c77460bb233

SHA512
8bb2662ec3b4075614b02a09618660fde759f9012bbd16b529f81828418551c5542b9216bc388fdb8c74747b4266642b01dbc653668513e08049d97d5038eca3

Download Submit
C:\Windows\SysWOW64\Ieakglmn.dll

Filesize
7KB

MD5
368acd0df31ee6d39102378f0ba83925

SHA1
3c5b1d2d062d30d32034577de7393f795c018eff

SHA256
234c3bab929818cc9eeef77445a805acd9b24668b8b695a03da22f799f5c7b05

SHA512
8c8e40ae00eca242c06d2987e151a7adfd776dd393c141601edd8c43f8c56d24230745287c2e9da2e5067fde593b9b6cafd1f62e80fc2f985f3472e033ac5921

Download Submit
C:\Windows\SysWOW64\Iefioj32.exe

Filesize
207KB

MD5
bce128b0c839cb92fbe582d58ce4f9c3

SHA1
10436481498e87d704d59dc637b16cfcfcbc1af6

SHA256
348d224e09b33062388636fbcef77052230fba1990b8370e065ffa2fff1512f5

SHA512
d2e8adbe7136820b484bc8f996cc976c6d73bec53f09bc127852f8200d469f2088e0d4ed2945ad35e231370a128dc540ab06157294fcb41ff7abf735e590f0b5

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
207KB

MD5
46cd36d7472a70a6167ce0ff8f68c393

SHA1
c0c4d4d60510fd32609fdde413e6bff242e73904

SHA256
fd1e986ce4c4f7c1697d3479779c7d9127a7e10e14aa9ac9c787a62ba68a9810

SHA512
d2ef3bdbf4bd0ba1bbcf82ef15417e0b9022a36c5f066f9539df18d919042727e050cac528c8c8abbab23cb3db1ed3d9f6617302485ae83558dc004c92a283a2

Download Submit
C:\Windows\SysWOW64\Ieolehop.exe

Filesize
207KB

MD5
9a3c45f44e94571f86cbd55165aac870

SHA1
9d844659580c20329ea227127084aa80c155fd83

SHA256
c2ab1f3b158a53760a551cb3f9e26b07d4769fa36fdf0a5fa045453ffb7c00db

SHA512
2f30e6fce266fb103b85eb1d4d6253042f2b226f8eabf10f0ff2aee8d609982655d178748ecc118359b942e635ab900661d4b44e83712bc51034dd6da529c09c

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
207KB

MD5
f578459aec64ef873741f23a54104c5c

SHA1
fe51ea53384019db5beab79bc5bbd4eefcb0d755

SHA256
b460e1e6dc8e43d4707fb0ceb060e132409a534d9659bb233a87ee41d1393a7c

SHA512
6fa3e08c980daa12c50d9e1b22ca504570faa3f366db5036e1fd87aed1fe47a33909a751922b31325259115ae342a7df2e90c418c771af12746832c0cc5bd529

Download Submit
C:\Windows\SysWOW64\Iihkpg32.exe

Filesize
207KB

MD5
fa2caa0754d2b8df9d031c9143f26a40

SHA1
ff1aaeea23b26913b2fa90c619611e96e58cb484

SHA256
1787ae5fd016b3a5c5c669109a3f89d6486cdc0c789c3e810d11478377ef0eba

SHA512
d0abe111d196e69296db63b828b58cb46ae260cf312e4cffbd8ca188c099030170f10faf486aa69fa8b9e7a32e137af5864de446b3b1b6bbbb496b97abc62d8c

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
207KB

MD5
16922dee981748db9d02e88082ac71e0

SHA1
02f3d79ab4c35a8d674eb8c71e5b0cb34ad73013

SHA256
8516fee0e11ff66cd81d0db236f9619fb5f35c19ff7ffba39166a98671df5258

SHA512
f95a3721f099dbab88d7b68c2d993e9afff6beada139ca7ef51c0a2775105850aab7913507ebd9648002d142b6e7e8ea2b7232cb3f5807fe460a047d5dbe99e2

Download Submit
C:\Windows\SysWOW64\Jbeidl32.exe

Filesize
207KB

MD5
4355957edae42d1a05ac9d2bb94ebafd

SHA1
10728ee2c5aed313a996076e66a7b8cf5635e145

SHA256
479c200dce2d111000bfc0a8a25f545203c706a767ad1beb246c10086837e632

SHA512
07ac96c084c7e82ed626a5e75c23f8dcd16ff8dd4d7c3d50ed5bf74254668fd764addd8237b2b5b9eaaabe285b9fb94b4fb3343d8d5c6f52baf0cd828cc371df

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
207KB

MD5
e751e3cf19149789108294273b2d2c36

SHA1
1c9b273d8dc43103250c78665be0277327b19538

SHA256
94df972c2a293ca2c072a1e0f7e6751990acb0ffac48468c7ab6f908bb7495b4

SHA512
7058760750b017c89e81c0d18b55fafebfdd995b837dc51e0b8bdafa8a10f76fab8a81f4625279e8d031fb66443108f3830af6ddf7f517b650e1b7ade0af58cd

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
207KB

MD5
e13cb8fa178d193fff8957d243b31d94

SHA1
c447a98bec895d2b9c47744cdec563b4cea46ef4

SHA256
0966079d16704e0845f49b84d78ae1f1d2d29f243bd1614838205e08e677f318

SHA512
50f8b2c8159033fc6b9e41ef7f61c2d15c655c394577031b90487453cdb643d886af9d1efb6b2f9d67355ceaffa86332673bde848d0e3045c71d8153030d8676

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
207KB

MD5
4d74935dde67e31a4a17203d0b9d3ea3

SHA1
58f8d0d3f3a1e192d16f0230126f0bc3d38a967b

SHA256
192b6c8264e480a6cbea7ecb4ba5f1ee2cd52670582aeaf5843616db647c013a

SHA512
7607bf61bdec0bf07ee146ecfe8a4244ef0f7ec448a501b1b58a3e3b9025a684ed729063563c012428f9d95306a0937cd896a63258f074f27553ff866888d0bc

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
207KB

MD5
7f480e9f1b476fe0857427565e8f14d6

SHA1
9bc9b1af8a7a91b7ab2bbe125092210fc39d67de

SHA256
448bbf9d880abaf4447fbfc7e92b9b29507cbd3c66f8432162c18add808c1d71

SHA512
66d9329994db733652b3551b10378ccd871636fa34763ef8d353f2b9fb35cdb88658e2ffdb928ce3133fcf935557d7e4c497c39016e773ce3cd72e19ed73f6a9

Download Submit
C:\Windows\SysWOW64\Jianff32.exe

Filesize
207KB

MD5
153b6857febe2cacc832abaeeffeb031

SHA1
6620d16ab82d4d5f331e16eeff075e1bcc2606be

SHA256
efd41d216f174defdd8fd4babcf0a105661898660be1f0e2f8d048f7b1e61389

SHA512
a2961fc3291181ffff8cdbdb4de66876ba3427782dd801f96cf4cc817735b88f2e296756a0d635e228cb5da48a6cc880999d1d50e8fa737d46e6787a3b24b1ff

Download Submit
C:\Windows\SysWOW64\Jioaqfcc.exe

Filesize
207KB

MD5
9498612f7a83a2fef2a1246979c5d5e4

SHA1
5acd05d87b7fd362970fef5e33649a1f7ccf9217

SHA256
8abac8b28437cffaf8dd403f9517da1d98fc877536037e0f5fbc6cbd50bbd71c

SHA512
25a01d20dae55a9f50c0b8434334037cb379c6806a22b7f2622b1af7cddaeb6d644dcc08df6e7019481e8f6a20e62acfff23479426029df9cad1738935cb298d

Download Submit
C:\Windows\SysWOW64\Jlkagbej.exe

Filesize
207KB

MD5
db7e5c1cb1b28ffbf2c11151c1425b7c

SHA1
53f8981b8484536992a4b074c5f8f8b01d0488a8

SHA256
0f479bda0dbe827db441e1d3970b1b201e7f97f2611df56556780030166d1ad1

SHA512
8c4851a1385a3614fc7bad60fca1e32235cad6f665806c808068924cbb65ce295fd71d09fc12082fb347a4bc18549cf239ae5bf5aef39d53cad11cd081625882

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
207KB

MD5
1f7de144bfa8f309d40f799ea417788e

SHA1
836af1d8a11bf4d7e965aa9fa142c27eb2717078

SHA256
0f7143e6fd63b2876c33c58bada9657a2bc285394c5d17f6764d5876a2f947d4

SHA512
4d57a7c4bda7e6edd801ae1320a771a5417bb217acdd2a95e8d8b7b62cd83aca27f1fe33743a594c23add88dcd32d43a37625df0dbccf473f90f23c1f4e36fc2

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
207KB

MD5
08b5181d187223bc9da9cf95ff73aa20

SHA1
23824ff75d7c5852ecc5b24b3517638c5d69f9d4

SHA256
37953cd5376d155c58e22d71846fe7fc18d470c1e844e4491ffa911958c18fe6

SHA512
7e67a4f3f4d6432f46eea0e630cc62cec3c4c02aedde45c7822d32c1d2e922c447dabb795d05c979ab5305d00d48c1a53a517cf6e5146a46e6e1071ba915bb57

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
207KB

MD5
b9363719faa7c0cd8457d602f3c7db23

SHA1
f8385ed2c7070a13e1eb2dfe33f914084060c31a

SHA256
7762e5a0760f54f7e1023842d83afdbdb3655e5e34907a334909df71aa765596

SHA512
afb9964b12f3b33a838dd3350bf29df90608553722a944e159423058916fa421cb24fdbcedae52d6ae6896baa039779f43909d93a774f672dbc65eea67630ae1

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
207KB

MD5
9362d7bf5810ec1264a164de8cb36caa

SHA1
42fa8d30767b8b1a3a6068dfa87c02062fe9c5db

SHA256
442d55f9af12ac78836db93a9c55d99d03a1d520481587b1d869fed74a38ec3e

SHA512
3137f5bc6761c7b2538aea5844e9a70fc8e9557efb658431c00bf898ffb663bf41c602510bcf48afb62df1d1782758b8c3061e2ad9de5c8b16e42eb58774596e

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
207KB

MD5
3191676167a1b642bbf454f89a9e650f

SHA1
1086585b37f7490c3dd9f98d3c81fab3596b61ed

SHA256
51b95fd9b80b05e2d7c2c9f765fbeb2bdc8cb9fba58cd763ebfcf0c3c85f27fc

SHA512
5c57b9a1495778dd5ce8460ae224ba32694fe8bcd965cc72a86dfd12a91f7c72b683e6f1c442f00dd028db92eb0a4478265ac331e7cdd697eec995013177dd64

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
207KB

MD5
750a50781ed7a67a47d8effb8432481e

SHA1
abe676152907d9bffee0d4ea2b58a6903df5c960

SHA256
559f584b5f1af28ad204be58b836b832ba9ff2972c9ba91a7ef874f7edc57edb

SHA512
54495bf3a8ab0ce336f47066645beff965f6435697ed5882bab30b31562d56d9683983eef62c4152ab22ad8b66b85090e705a175c9fa958758c2013fe15dd0f7

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
207KB

MD5
c99b0b6e0a4ae4e6d2e36e49d6b0743b

SHA1
6766d26bf88063b98924dd10c1430e0f2f909048

SHA256
17b62bf4956085a866da0d442e4e387825cb6bc3bfa5fc31a67cb576bb10c783

SHA512
119c2a5230837a5f20baeb3aecb2f16f39b7e60248610edbaed46d87f2ba772a6ad05149ece7c0eccc7e1c95cf1e9955974abc6e158ddd207385ad65b609259c

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
207KB

MD5
fc7426dc2e82981e5b1a5174b62e785b

SHA1
8b78f6fe5e2032f8fc859e3beca5b1eacbdac123

SHA256
d589772589e9e79a0955ba03844634a2181d9dc7dedff167dfc7cd4ec8a1b57d

SHA512
5ab8367451b070d6207de3839a3d42d3541d7fd146c1e6820c9f43e4f28eb3bf45050e74b26fc02276b9ae2e3a7b461ded6f1f3fee75d5d4162b38a1651481cb

Download Submit
C:\Windows\SysWOW64\Ldleel32.exe

Filesize
207KB

MD5
837ae7d4835847a4d2ac29f9c14223d8

SHA1
60a757c6418c2007f0eb5b7d6d9ed84be170e45d

SHA256
92433cd527fe2cbdbb6e5ff757e83ac8805f4b149a9a5ee333bcaae19f9911a0

SHA512
00ec9540dd0d71ff9337c875968ee90f6460298c311af81e351443433dfedef0eca67dcdf464742c140dc737fbfd535b49b682ac966d8934cb0a9bcd11610131

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
207KB

MD5
49fbcdf8ecbd34db12d827b449f0f089

SHA1
ecc4ad39b15e85b54d1b61e19a27c8407a84c12f

SHA256
79532e6f3fa696c5594b381534a5138f03cd540bba6b4ac1e86734cab6ec0e37

SHA512
ee4f68d7e90733277caa285764bdfb77582f25bef101d90bd5fbba2ce84f234d876a23d858bd56754177edf91a691151c2181362f909de6dfd6edf74a94f7d1f

Download Submit
C:\Windows\SysWOW64\Lmgfda32.exe

Filesize
207KB

MD5
b0932b876c6df976bc74572d25ac0224

SHA1
91cdecfeecedb82ae1895e6b47e0859b5754cd42

SHA256
291e2b6097b77f5bb455c45796753fe5c9665f2015d11ec49eb1fb1e893f09b5

SHA512
50cde20b9267d9bacabee9d20082eba7744f3004a16545c9aa8d096e7fd4e337c072221153b1aef653c7a52f61eb610185ca267fee08515e834050108958bf07

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
207KB

MD5
a6aef0d037af1fecdb9fc0d802e3da46

SHA1
5ca8507347c73d19f54f9d4152c0cd9a12d82dbf

SHA256
a3c626117564f65f9de1fc0edca0f3d0088e046e8be4613fb2b9497ba4e14e45

SHA512
fa4fe599ffafeb718cc1ac735171e777df85355395a30ba1e933f5d0018c5f4b0786a26aa3674f5cc1b34996bab728abff4bff09128d4b6b19b918dff0e1a030

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
207KB

MD5
85b27959cede13a7bb06a2d2da696a98

SHA1
985f475387ffd80f43ee8e94837a5ce2328f865c

SHA256
6e13cdd9af61259c6149fafb922b97960bac1834d5773244a2fd61f0659ff2a0

SHA512
881e63c0f1f88f4b9386e3547bbbb7e5263dfe6eb6a4ddee09fd390fa6c35eb99155ef5dadb3cd1ae81e71c5e4f8c79c3eb468534f75d5d02910bade6f1e9ba2

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
207KB

MD5
5152c8ef78183dde2d3d33569973271d

SHA1
eb03c703387ebc04dc983fd404a0cfe904dbe76c

SHA256
3841d4439c2ce3024a16ce07bcda82165594fe0a2ed059de907d9bbc5f13c01b

SHA512
db8f018305c957c698becb60ae1a1623b1d43e63b8df7eb2b6c12a50672705d5746d11fe90da4c60b85cf28b1f26473788c0760a894c2d88ca2b68f1682a5703

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
207KB

MD5
3be7f427e286059aa58c9d16f7e5ee5e

SHA1
b4f60cebd88c7b36abd2ee9ac71ede9a9cfb3a0a

SHA256
9e0eea2071bb50f685fe9e025cc45b433d2e5ce5bbe1342e26d44d37c69cb697

SHA512
4bf614bfe8ce62bb9bc9ffe4c17f87eae712078d9d86e0b287d1dbf688fa70ee50734bbd4c7cf0beb93386d2b7a0dfb2c19bb1e049233387b1b9d7723d15e568

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
207KB

MD5
12bd004a4f189f689ca217610b799530

SHA1
a93980f04fa4036d6e1fa7fe1c5088aab23ec5d0

SHA256
e6a4a40df981528c19ff9e7a1184036f3797532ede332755d886cde7a281abb0

SHA512
74155a76b5206bc99438bf0feb122c4a438488c65ada3287090ab05c9e0485a997ac61524f0571ad582b7479e70e53cf22418ec3b668781afa961e8553d01d1d

Download Submit
memory/396-96-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/544-587-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/624-603-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/624-63-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/668-573-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/804-48-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/804-586-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/984-160-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1020-334-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1028-88-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1100-551-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1100-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1516-382-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1588-566-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1608-526-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1628-215-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1736-558-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1736-16-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1776-454-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1920-436-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1956-580-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2000-358-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2012-559-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2052-496-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2056-364-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2088-532-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2100-32-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2100-572-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2200-316-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2212-274-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2248-406-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2268-442-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2356-119-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2380-280-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2384-231-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2484-514-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2540-223-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2544-412-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2692-199-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2696-255-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2724-394-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2824-136-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2832-346-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2860-424-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2884-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2884-544-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2888-207-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2896-128-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2940-268-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3024-112-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3108-322-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3108-912-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3232-175-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3240-552-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3276-167-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3296-811-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3312-376-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3324-262-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3452-370-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3516-400-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3544-460-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3684-494-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3708-39-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3708-579-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3716-356-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3728-484-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3916-466-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3956-549-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4024-149-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4216-502-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4244-472-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4260-448-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4304-23-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4304-565-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4348-71-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4376-430-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4380-538-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4420-248-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4476-798-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4496-298-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4544-478-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4632-191-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4672-184-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4700-598-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4700-56-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4780-152-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4788-304-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4824-328-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4836-104-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4860-520-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4868-80-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4876-388-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4932-340-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4988-292-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4992-508-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5036-286-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5044-418-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5044-881-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5092-239-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5100-310-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads