berbew | 3ab146ffd7fb5cdd0bfe9d45244f2a012bcebf7936a27a3d28f4650443b173cd

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ab146ffd7fb5cdd0bfe9d45244f2a012bcebf7936a27a3d28f4650443b173cd.exe
Size

364KB
MD5

e5e30808344ba21aacf7805cb3e0a2b3
SHA1

c48b33919489a93f0cf7085cc1022244dab0ecc8
SHA256

3ab146ffd7fb5cdd0bfe9d45244f2a012bcebf7936a27a3d28f4650443b173cd
SHA512

dba5beeb7ee58ec587517fb5271c1fa2470584a50a1c23911c6a815cb4b98be578a0ad394d13c7e3ebc0c814747385f374c84a52b01fd1d261d98a056fbf852e
SSDEEP

6144:NnhQituuu+qsFj5tT3sFxHnkO/ACmLksFj5tT3sFO:1as15tLs/EO/ACmgs15tLsQ

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdqejn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifefimom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfaedkdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdlnbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdina32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojllan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfqlnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imoneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olmeci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfeopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ageolo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojgbfocc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojoign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iemppiab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kefkme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdqgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcbihpel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iemppiab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llemdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lepncd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmidog32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
644	Eekaebcm.exe
3000	Eocenh32.exe
4180	Fdegandp.exe
1376	Fllpbldb.exe
2420	Fhcpgmjf.exe
1304	Ffgqqaip.exe
3016	Flqimk32.exe
2324	Fdlnbm32.exe
772	Fcmnpe32.exe
4800	Glebhjlg.exe
4904	Glhonj32.exe
3344	Gofkje32.exe
716	Gdcdbl32.exe
1424	Gohhpe32.exe
3528	Gbgdlq32.exe
1752	Gmlhii32.exe
2132	Gokdeeec.exe
3500	Gkaejf32.exe
3724	Gfgjgo32.exe
4324	Hkdbpe32.exe
4936	Helfik32.exe
2056	Hkfoeega.exe
1292	Hflcbngh.exe
696	Hijooifk.exe
2140	Hkikkeeo.exe
1820	Hcpclbfa.exe
2376	Hmhhehlb.exe
4884	Hofdacke.exe
1776	Hbeqmoji.exe
2088	Hfqlnm32.exe
5060	Hioiji32.exe
2988	Hmjdjgjo.exe
2696	Hoiafcic.exe
2040	Hbgmcnhf.exe
2464	Hfcicmqp.exe
3296	Iiaephpc.exe
1772	Ikpaldog.exe
4616	Ipknlb32.exe
400	Ibjjhn32.exe
5104	Ifefimom.exe
452	Iicbehnq.exe
4956	Imoneg32.exe
3756	Ipnjab32.exe
2224	Icifbang.exe
1700	Ifgbnlmj.exe
2360	Iejcji32.exe
3892	Imakkfdg.exe
2480	Ildkgc32.exe
4012	Ickchq32.exe
1716	Ifjodl32.exe
3672	Iemppiab.exe
2556	Imdgqfbd.exe
1220	Ilghlc32.exe
2164	Icnpmp32.exe
4092	Ibqpimpl.exe
3980	Ipdqba32.exe
3612	Jfoiokfb.exe
4444	Jimekgff.exe
4064	Jlkagbej.exe
1804	Jcbihpel.exe
4448	Jfaedkdp.exe
4476	Jioaqfcc.exe
1068	Jlnnmb32.exe
3436	Jpijnqkp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hledan32.dll	Kemhff32.exe
File created	C:\Windows\SysWOW64\Ajanck32.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Hkdbpe32.exe	Gfgjgo32.exe
File created	C:\Windows\SysWOW64\Dmamoe32.dll	Jefbfgig.exe
File created	C:\Windows\SysWOW64\Pnonbk32.exe	Pfhfan32.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Dmjocp32.exe
File opened for modification	C:\Windows\SysWOW64\Helfik32.exe	Hkdbpe32.exe
File created	C:\Windows\SysWOW64\Flakmgga.dll	Ipdqba32.exe
File created	C:\Windows\SysWOW64\Fjegoh32.dll	Ngdmod32.exe
File created	C:\Windows\SysWOW64\Gcdmai32.dll	Ocdqjceo.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Cdfkolkf.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Mcpnhfhf.exe	Mlefklpj.exe
File opened for modification	C:\Windows\SysWOW64\Mnebeogl.exe	Mcpnhfhf.exe
File created	C:\Windows\SysWOW64\Mpnaemnl.dll	Hoiafcic.exe
File created	C:\Windows\SysWOW64\Fqplhmkl.dll	Jbhfjljd.exe
File opened for modification	C:\Windows\SysWOW64\Jifhaenk.exe	Jfhlejnh.exe
File created	C:\Windows\SysWOW64\Hdoemjgn.dll	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Ajanck32.exe	Qgcbgo32.exe
File opened for modification	C:\Windows\SysWOW64\Fdegandp.exe	Eocenh32.exe
File created	C:\Windows\SysWOW64\Hmjdjgjo.exe	Hioiji32.exe
File opened for modification	C:\Windows\SysWOW64\Hoiafcic.exe	Hmjdjgjo.exe
File created	C:\Windows\SysWOW64\Keblci32.dll	Ipknlb32.exe
File created	C:\Windows\SysWOW64\Debdld32.dll	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Pmdkch32.exe	Pnakhkol.exe
File created	C:\Windows\SysWOW64\Aadifclh.exe	Aminee32.exe
File created	C:\Windows\SysWOW64\Eekaebcm.exe	3ab146ffd7fb5cdd0bfe9d45244f2a012bcebf7936a27a3d28f4650443b173cd.exe
File created	C:\Windows\SysWOW64\Ipeomnnj.dll	Flqimk32.exe
File created	C:\Windows\SysWOW64\Fllifblf.dll	Jfaedkdp.exe
File created	C:\Windows\SysWOW64\Ojhnmh32.dll	Kmijbcpl.exe
File opened for modification	C:\Windows\SysWOW64\Nepgjaeg.exe	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Dfdjmlhn.dll	Ofqpqo32.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Fiknll32.dll	Fdegandp.exe
File created	C:\Windows\SysWOW64\Ipdqba32.exe	Ibqpimpl.exe
File created	C:\Windows\SysWOW64\Cmlihfed.dll	Mlcifmbl.exe
File opened for modification	C:\Windows\SysWOW64\Nlmllkja.exe	Npfkgjdn.exe
File created	C:\Windows\SysWOW64\Pfjcgn32.exe	Pdifoehl.exe
File created	C:\Windows\SysWOW64\Elcmjaol.dll	Pjhlml32.exe
File opened for modification	C:\Windows\SysWOW64\Acqimo32.exe	Aabmqd32.exe
File opened for modification	C:\Windows\SysWOW64\Fllpbldb.exe	Fdegandp.exe
File opened for modification	C:\Windows\SysWOW64\Gdcdbl32.exe	Gofkje32.exe
File created	C:\Windows\SysWOW64\Gnchkk32.dll	Iemppiab.exe
File created	C:\Windows\SysWOW64\Jmpgldhg.exe	Jehokgge.exe
File opened for modification	C:\Windows\SysWOW64\Olmeci32.exe	Ojoign32.exe
File created	C:\Windows\SysWOW64\Jfpbkoql.dll	Oqhacgdh.exe
File created	C:\Windows\SysWOW64\Aqncedbp.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Hkikkeeo.exe	Hijooifk.exe
File opened for modification	C:\Windows\SysWOW64\Ickchq32.exe	Ildkgc32.exe
File created	C:\Windows\SysWOW64\Phaedfje.dll	Jlkagbej.exe
File created	C:\Windows\SysWOW64\Kfckahdj.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Gjgfjhqm.dll	Pfjcgn32.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Flqimk32.exe	Ffgqqaip.exe
File created	C:\Windows\SysWOW64\Fdlnbm32.exe	Flqimk32.exe
File opened for modification	C:\Windows\SysWOW64\Ocbddc32.exe	Odocigqg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7296	7180	WerFault.exe	317

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcijeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfgjgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jehokgge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgokmgjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nloiakho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdqejn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfoafi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnakhkol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkcde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eekaebcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmmjgejj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgbfocc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifgbnlmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ildkgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jimekgff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmdqgd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcmnpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoiafcic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlnnmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmidog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkfoeega.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmdina32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfaigm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmlhii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkaejf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hflcbngh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hioiji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpijnqkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfckahdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkikkeeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnebeogl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eocenh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gofkje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepgjaeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfhlejnh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hflcbngh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfilim32.dll"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qddina32.dll"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llemdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlingkpe.dll"	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpbmco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lemphdgj.dll"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmamoe32.dll"	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfeopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoddikd.dll"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ickchq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiknll32.dll"	Fdegandp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lekehdgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llcpoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingapb32.dll"	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hledan32.dll"	Kemhff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmjdjgjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkfoeega.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfoiokfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lepncd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbdhjm32.dll"	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aainof32.dll"	Eekaebcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkikkeeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laffdj32.dll"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfgfh32.dll"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imoneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcmjaol.dll"	Pjhlml32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 644	5112	3ab146ffd7fb5cdd0bfe9d45244f2a012bcebf7936a27a3d28f4650443b173cd.exe	85
PID 5112 wrote to memory of 644	5112	3ab146ffd7fb5cdd0bfe9d45244f2a012bcebf7936a27a3d28f4650443b173cd.exe	85
PID 5112 wrote to memory of 644	5112	3ab146ffd7fb5cdd0bfe9d45244f2a012bcebf7936a27a3d28f4650443b173cd.exe	85
PID 644 wrote to memory of 3000	644	Eekaebcm.exe	86
PID 644 wrote to memory of 3000	644	Eekaebcm.exe	86
PID 644 wrote to memory of 3000	644	Eekaebcm.exe	86
PID 3000 wrote to memory of 4180	3000	Eocenh32.exe	87
PID 3000 wrote to memory of 4180	3000	Eocenh32.exe	87
PID 3000 wrote to memory of 4180	3000	Eocenh32.exe	87
PID 4180 wrote to memory of 1376	4180	Fdegandp.exe	88
PID 4180 wrote to memory of 1376	4180	Fdegandp.exe	88
PID 4180 wrote to memory of 1376	4180	Fdegandp.exe	88
PID 1376 wrote to memory of 2420	1376	Fllpbldb.exe	89
PID 1376 wrote to memory of 2420	1376	Fllpbldb.exe	89
PID 1376 wrote to memory of 2420	1376	Fllpbldb.exe	89
PID 2420 wrote to memory of 1304	2420	Fhcpgmjf.exe	90
PID 2420 wrote to memory of 1304	2420	Fhcpgmjf.exe	90
PID 2420 wrote to memory of 1304	2420	Fhcpgmjf.exe	90
PID 1304 wrote to memory of 3016	1304	Ffgqqaip.exe	91
PID 1304 wrote to memory of 3016	1304	Ffgqqaip.exe	91
PID 1304 wrote to memory of 3016	1304	Ffgqqaip.exe	91
PID 3016 wrote to memory of 2324	3016	Flqimk32.exe	92
PID 3016 wrote to memory of 2324	3016	Flqimk32.exe	92
PID 3016 wrote to memory of 2324	3016	Flqimk32.exe	92
PID 2324 wrote to memory of 772	2324	Fdlnbm32.exe	93
PID 2324 wrote to memory of 772	2324	Fdlnbm32.exe	93
PID 2324 wrote to memory of 772	2324	Fdlnbm32.exe	93
PID 772 wrote to memory of 4800	772	Fcmnpe32.exe	94
PID 772 wrote to memory of 4800	772	Fcmnpe32.exe	94
PID 772 wrote to memory of 4800	772	Fcmnpe32.exe	94
PID 4800 wrote to memory of 4904	4800	Glebhjlg.exe	95
PID 4800 wrote to memory of 4904	4800	Glebhjlg.exe	95
PID 4800 wrote to memory of 4904	4800	Glebhjlg.exe	95
PID 4904 wrote to memory of 3344	4904	Glhonj32.exe	96
PID 4904 wrote to memory of 3344	4904	Glhonj32.exe	96
PID 4904 wrote to memory of 3344	4904	Glhonj32.exe	96
PID 3344 wrote to memory of 716	3344	Gofkje32.exe	97
PID 3344 wrote to memory of 716	3344	Gofkje32.exe	97
PID 3344 wrote to memory of 716	3344	Gofkje32.exe	97
PID 716 wrote to memory of 1424	716	Gdcdbl32.exe	98
PID 716 wrote to memory of 1424	716	Gdcdbl32.exe	98
PID 716 wrote to memory of 1424	716	Gdcdbl32.exe	98
PID 1424 wrote to memory of 3528	1424	Gohhpe32.exe	99
PID 1424 wrote to memory of 3528	1424	Gohhpe32.exe	99
PID 1424 wrote to memory of 3528	1424	Gohhpe32.exe	99
PID 3528 wrote to memory of 1752	3528	Gbgdlq32.exe	100
PID 3528 wrote to memory of 1752	3528	Gbgdlq32.exe	100
PID 3528 wrote to memory of 1752	3528	Gbgdlq32.exe	100
PID 1752 wrote to memory of 2132	1752	Gmlhii32.exe	101
PID 1752 wrote to memory of 2132	1752	Gmlhii32.exe	101
PID 1752 wrote to memory of 2132	1752	Gmlhii32.exe	101
PID 2132 wrote to memory of 3500	2132	Gokdeeec.exe	102
PID 2132 wrote to memory of 3500	2132	Gokdeeec.exe	102
PID 2132 wrote to memory of 3500	2132	Gokdeeec.exe	102
PID 3500 wrote to memory of 3724	3500	Gkaejf32.exe	103
PID 3500 wrote to memory of 3724	3500	Gkaejf32.exe	103
PID 3500 wrote to memory of 3724	3500	Gkaejf32.exe	103
PID 3724 wrote to memory of 4324	3724	Gfgjgo32.exe	104
PID 3724 wrote to memory of 4324	3724	Gfgjgo32.exe	104
PID 3724 wrote to memory of 4324	3724	Gfgjgo32.exe	104
PID 4324 wrote to memory of 4936	4324	Hkdbpe32.exe	105
PID 4324 wrote to memory of 4936	4324	Hkdbpe32.exe	105
PID 4324 wrote to memory of 4936	4324	Hkdbpe32.exe	105
PID 4936 wrote to memory of 2056	4936	Helfik32.exe	106

C:\Users\Admin\AppData\Local\Temp\3ab146ffd7fb5cdd0bfe9d45244f2a012bcebf7936a27a3d28f4650443b173cd.exe
"C:\Users\Admin\AppData\Local\Temp\3ab146ffd7fb5cdd0bfe9d45244f2a012bcebf7936a27a3d28f4650443b173cd.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\Eekaebcm.exe
  C:\Windows\system32\Eekaebcm.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\Eocenh32.exe
    C:\Windows\system32\Eocenh32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Windows\SysWOW64\Fdegandp.exe
      C:\Windows\system32\Fdegandp.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1376
      - C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1292
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:696
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        27⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2376
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        30⤵
        Executes dropped EXE
        
        PID:1776
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2088
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2988
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2696
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        35⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        36⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        37⤵
        Executes dropped EXE
        
        PID:3296
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        38⤵
        Executes dropped EXE
        
        PID:1772
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4616
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        40⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        42⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4956
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        44⤵
        Executes dropped EXE
        
        PID:3756
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2224
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1700
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        47⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        48⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4012
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        51⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3672
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        53⤵
        Executes dropped EXE
        
        PID:2556
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1220
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4092
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3980
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3612
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4064
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        63⤵
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3436
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:952
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1432
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        69⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3340
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3932
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        72⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        74⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2904
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        76⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        77⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        78⤵
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5080
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        81⤵
        Modifies registry class
        
        PID:3652
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        82⤵
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        83⤵
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:2436
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        86⤵
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4852
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        88⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        89⤵
        Drops file in System32 directory
        
        PID:684
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:740
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:520
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        92⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        93⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        94⤵
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        95⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        96⤵
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1276
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2720
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        99⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        101⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4764
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        104⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        106⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        107⤵
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        108⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        110⤵
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        111⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        117⤵
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        120⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        122⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        123⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        126⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6108
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        128⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        129⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        130⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        131⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        134⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        136⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        137⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        138⤵
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        139⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        141⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        143⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        145⤵
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        146⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        147⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        149⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        152⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        153⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        157⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        158⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        159⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        161⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        162⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5500
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        164⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        165⤵
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        168⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        169⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        171⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        172⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        174⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6488
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        179⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        180⤵
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        182⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        183⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6928
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        188⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        191⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        193⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        194⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        195⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        196⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        197⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        198⤵
        Drops file in System32 directory
        
        PID:6628
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        202⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        203⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        204⤵
        Drops file in System32 directory
        
        PID:7048
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        205⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7116
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        207⤵
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        208⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        209⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        213⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        214⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        215⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        216⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        217⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        218⤵
        Drops file in System32 directory
        
        PID:6604
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:6784
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        221⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        222⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        223⤵
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        225⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        228⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        229⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        231⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7068
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        232⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        233⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7180 -s 400
        234⤵
        Program crash
        
        PID:7296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7180 -ip 7180
1⤵
PID:7244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
364KB

MD5
02668751595f862464480736b3dbc559

SHA1
042e2189e84f10ab718fc183b5daee682007b9e6

SHA256
c44b42a85951d7b9c49ac5761078e80df3fdab7add35a9091b3020d84681a0cd

SHA512
e0254e34843a78e9fa427a2789f3f0c0362e1a368e3a7a27bdcd7448b8a503b4c93ff26666036ab3bb747282eaa4b10854f578a4b9726aaeff4dd4cf6a0a999b

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
364KB

MD5
82d88add156c2a3c2b2bd1d6b3167fac

SHA1
72716ae569ae738ce20b135e9dd0c57c9056aa5a

SHA256
7c90099644023182fea7d5d3a3946ece15beb0ec3a64dbb62310965dda96451f

SHA512
657d314d442bea97a9fa4bb6b2c6f3bf09213abbf50fc6a675011a27aaf8e3afd42ce61ebd3e04c5dfc4e7f05c6c6d2996ccf345b7c89b528b1c42b410ced005

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
364KB

MD5
ec5b36f0cad104549d827adeee573010

SHA1
303be04e98dee7840efbd35facce59fe30730737

SHA256
c138671a939074b84e77aeabb297320526503cb38490ddc9b2586645b060fe1c

SHA512
2cfe08db1f826dd22c93d20815c1ec1087c3c577b29e5d8a9a1f56cfc5589cc83ab2be18c371714defe70726512f92ab6c313bf28ed08bfd22c3a342d5e60097

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
364KB

MD5
39883a0d2a2ad243fa9b765662194a01

SHA1
0a570460d201a66b1d1456baa2b68888c71feb9e

SHA256
1312069abe6e0a92c92b33d2a6f055e790941b67c47c824e79d6f460f2e5ed9f

SHA512
2c4b328089cc0031cfa1e91f4f8b234a7acefab69e6824118c2c184a63826c235ab68cb4a6c7d2ca46ea91e23f16c587cc6924d0a76b2fd52f40c6190984b385

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
364KB

MD5
45069847fe0dff17218839aea90ed410

SHA1
aa0d56144053a9bc4e0c10a13f9acc648fee383f

SHA256
322386fef90390026820961a1ca6a4a682cb8e11abbbf7af657e6c4c95ff7df9

SHA512
57500dde617702e9f6679d3886ec461dd36a3804ddfbb41c790233c18df56237a09c06ff279da47bdb49b6655ed8537ca94aa10534ba8f89196bb6915d81fcf2

Download Submit
C:\Windows\SysWOW64\Cdfkolkf.exe

Filesize
364KB

MD5
4670743ed8cdad98761b9ff47c1e7a5a

SHA1
377d6c6241443a6e85a3e01d9abfd7cc7389c4eb

SHA256
e84caa43483eff9d4461a48d6a69af2fc053fa10c5fa9f721e3f9d791afcb858

SHA512
686778d8f2dfe3594c26c00539a1092150022f1ccd34a8c07e7f0b0175e277febca51b4db2f95bec2f93a710abd722607e426149c8d41843635a6ffa04fc68b6

Download Submit
C:\Windows\SysWOW64\Eekaebcm.exe

Filesize
364KB

MD5
d0be9e365e8543dbc9cf72c87f814090

SHA1
cb054d624511531eb4df26d5a4165bb3abcb78d1

SHA256
6282c549dc067979744ca28f704ba64be58258c3d4fb7fe18318c80c0036382f

SHA512
9a588e72f799de2a3029c63da29817b5c32c6696d1672e516d95b84d49f6df04306de3ee9a355a78d13cb5728384c6ed783b0ac61e55da918d9a5fe13e961fe5

Download Submit
C:\Windows\SysWOW64\Eocenh32.exe

Filesize
364KB

MD5
b3a435f35f288e479e7051ff64918070

SHA1
22e6e1b46df7c6aa4f1d1b0c7b5eaab232c67a5c

SHA256
ced5db468b49062ac6d2e51403a13097d097ee7b73c75bbcd4782b86749cebfa

SHA512
eb3955152d4bb1e49a34305869c31f624f9c1b39880309fb85b0dd42aef1a36b4c8c530961abf1b4d4175583f7a53943900590030ea76d5d05b195fe5847c14b

Download Submit
C:\Windows\SysWOW64\Fcmnpe32.exe

Filesize
364KB

MD5
cdaf8583b69f03e283ac8d0fc63bac0e

SHA1
e20f4b24cf20d7f05d238e8909bd6795b1f98675

SHA256
10bd9530ea8c25bfa2c9d4ece5f84f46171d0338065a7cbe9bd1cce3824d6c15

SHA512
844838046630653967d9f6aa1a6706afa8a1666ce606a6db13ab1063e8f9535beb8632f9d266cc0250a246213a0bc842e9df3eecf7d71d96e70b18da081f9385

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
364KB

MD5
0e53859ba11f7e8a492d5081f6ef0926

SHA1
dd10a21658564f57f8f4c7f7bce926176b79929c

SHA256
376eaae6155dc31183a04497e342bffebaaf625ce5fc92da488ec795019ed7a0

SHA512
36da867aebf5a14f77bb375af71595322050ddd12c97242f1e314afc64b6c1daa53f02312368695c4bb8f65f6e11d7b6fb20d665de4191677a74a96ede03b11a

Download Submit
C:\Windows\SysWOW64\Fdlnbm32.exe

Filesize
364KB

MD5
3b8137ae493499ec21139e99ee9d5b80

SHA1
9ccac8035ef9d730a546f878385eccc58b3ed49e

SHA256
7109135650484690d5e3acf4336a2cbe3325acbb4d743a5335a4340e30a7cc63

SHA512
923fe4064ccb41d4f3bc33058c52ca2aeb4eb70977fe9714ee7a6146eb728aef14d30c7af45962c3cae8bf93a8eea5f344d29cbfabeccb67abeab2cb547db0ce

Download Submit
C:\Windows\SysWOW64\Ffgqqaip.exe

Filesize
364KB

MD5
3e4fc9de6199873c60818a1155840d96

SHA1
d669f184807579885e1f3a2842a7bffe51d199c3

SHA256
eedccfcd529e441dd9dc226aae5612e502816194ad6f0679b76f2584020f68ca

SHA512
d622d35431cd0dda56bcdfe611aa08d240e54afe1127a6af01899223d28f36acbf44dbf8b4558b58fd2e82e404261ff3d349e6c6cab80fa7df502d870cf5a488

Download Submit
C:\Windows\SysWOW64\Fhcpgmjf.exe

Filesize
364KB

MD5
caf1dde7137b1baf84fc3e494c679740

SHA1
0f51c7143dfad068699671e1007be9614a074f1e

SHA256
1f789ee4d2cf241e277d54bb0faa8eea57e159b96e2250ff4004bda1bda23847

SHA512
0f909cdee222da57b6ec74616bd20b7a7e99676dd17d6d71442baa3c8a0cf5b24dce23e59f1a36e1c47a3ece4887ac0a1c170784e302238d59494abcc1d4d933

Download Submit
C:\Windows\SysWOW64\Fllpbldb.exe

Filesize
364KB

MD5
2b8d8090817272579b329adfad0e2fb1

SHA1
50d03f6b42f8b3d489daabfd78c9be4f51ae297e

SHA256
30acf6caaa7f0fe1cb88e0c43177694b94eb2ab63e7461e498bf3e058ed02ad6

SHA512
5287f87483dfe289e02b97c537069726f00a1d20b65127e86f0d6bd85f961f3d23765defc750ee5be39ae436ca9f6b78db98712b3d11417090c91c5cf5f2f843

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
364KB

MD5
273489ea09f494a3ee925e9fe1312488

SHA1
626ea25d79c5462a2c638553796d985ce4150d27

SHA256
abe456d12cdf1850becb4adb05cf922cdb95216cb608eeaf10b0512f28714dac

SHA512
5698a587dd57fc663862f1bf2c6624cee26e57983e1fa2a17b15acb827d898fec92e7a0b40e8533d616d5c7979c5d6613e6f9697247f9f1cacad0ed8239dcad1

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
364KB

MD5
e315ff6ebf6371de60be80a2a28c11de

SHA1
26eb1842528c5d6813a96e9c31aff6510345750a

SHA256
3b523d5d442e1881826b25668505190bff49eef6c234d9e38bfd57c45ae5f411

SHA512
f95a07c4c0afb480d5243a1821e16161fbbabcfcb0362ed4eedce3d653059ca2927cad97e8d25e595a994020b44fb3fac8ac5780f26097e81d5a14f5b444cd14

Download Submit
C:\Windows\SysWOW64\Gdcdbl32.exe

Filesize
364KB

MD5
aec3923b434fec0e13e4151eaac066e4

SHA1
65fb93dc87fa8d6059e66e7209f2410fbc619b96

SHA256
1792c4b8264e13a998e468186bd5e312810a5ca6c858ac1e8d14b7cf30161a56

SHA512
4c529126180442692b40173b9b534e85f970a53fde561b2f1b72dc434a8abe042ac9ea4ec503e8b57a4f81cd762b2389005f7b12143b7a056f00367cfa1dec12

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
364KB

MD5
0d876a702fc877ac975fb4c2ce15d917

SHA1
ad30a8e74aa85049945132628ec8e924d0a5506b

SHA256
912e3c0d52134cc089ac07a35f19544f07ff36e38b5e0c2bf8570a57f083e3dc

SHA512
ce7e94b707dd7326834c9b312a41888aaa379ae9a2f4a8166797b70e02d684a55aabf90107218d2dad31240fab0a124dff4569f9e64dee5148814bab962ca995

Download Submit
C:\Windows\SysWOW64\Glebhjlg.exe

Filesize
364KB

MD5
93645e07da7f959e36e90a9ae47b0026

SHA1
12646962a13a3c9168d1cc0dd4451088de366d98

SHA256
2c3e915c1c4748f014a0f1ecd58d5d946b8581a4464542e599ad89ff2ee5aef2

SHA512
b9c5c10b394e44adeadb34fab58f22b193d9c1981cc7660fed0a7fb1136dd5069b1de2a913999623d18c847bd4588d65724a6457a1f93f5a2a1ff7c2add51f2f

Download Submit
C:\Windows\SysWOW64\Glhonj32.exe

Filesize
364KB

MD5
90e0c620d936175e2d46f27b7346e7d3

SHA1
8a7aaa3fbbc15fde1e62c72058c2f687af1d0972

SHA256
947a27945b20c89ff57fd4794a2a3e254a59a0571f1c67adf6bc6a6640c54cdd

SHA512
11417d66d0e9dd903cdfec6481a14fd9e06f0988a8cf1f108e4ab168fd553bce407fea00baa017c1d6033cce8b798149821000ea8a2aa24f72c9afd3e0f8caf5

Download Submit
C:\Windows\SysWOW64\Gmlhii32.exe

Filesize
364KB

MD5
6d4956136a6b809e39d5410562b2be2a

SHA1
6afacf770fe227d57b83e380254f686f5d2c3436

SHA256
9f198aedaee2c4241bdb61f915cd688511f8034938130405bcf59dc18afd8363

SHA512
a8237fb214434073940b8d3ba0281f1beaa50fc430ed098c8a552f9e92c9e483eba04c77e8d84a8270b4ae4dd38b7f0d44e0ca9b0b66b77158884b4bca7c721d

Download Submit
C:\Windows\SysWOW64\Gofkje32.exe

Filesize
364KB

MD5
824781947b10b51ef21cb4569e3fbebc

SHA1
8fab368cf911b113114c063ce8befcc96f5d9bdb

SHA256
b22203aa2eb7f0f8eea6af816878c9b3556fab400925250ea98a82590b06a398

SHA512
586866c13f2cdc9e1757791e59db87a9f4990d4fb942956d2d588dbd81537c38a1492d4053827a00a923c6cdc39f8707a5cca94e5f0a1f7464dd25da08bd3687

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
364KB

MD5
70e87bc5d2a080445a949ba34ee4571e

SHA1
3ad42ebfbb53d8187b7ea47c789cd39a4ceab594

SHA256
6741d81f3d3b6ddfab21d5ded1d776b3d7c09dfedcf7c16446cdd3068c7b38a5

SHA512
79f85a1d930b8538d9a0e77295341f8460f1742483d47ee089e7cce2df0b4d1c33a08f953044c9379c4f148e1f1299c1fcd30bacd4ba4ef1a0040ce30cd17648

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
364KB

MD5
05e32d918d7059921add1fdf63f692ed

SHA1
525fb3b79b5b39a0eecbef1fa50c16e747054587

SHA256
feb4945165d21120e48ec35d8c9b60e6e1353e4d167aff0ccf5929e70a5de19e

SHA512
26fe8003a8319f2f55a564c7f6cb9b61054f172228f0a3d80b290eef24975e98b8ee3f8fbd33728da1a103cff012b4b79f6e067bb2697577871bb37415786999

Download Submit
C:\Windows\SysWOW64\Hbeqmoji.exe

Filesize
364KB

MD5
c2e3843a8b69715c180c442891aec87d

SHA1
782f1262915bc094ffb785586ba6c036b3ae277b

SHA256
6af9b688aa36c1e437537f5d2239122a5e5f00f958fa087d739b917970121929

SHA512
18b9a019354ca5cd621efcb5d1c18b855c433f0f4dc469c89c1416e04b93d164ba97de8e7108b2653dc9f9462f0a02a9435f3bf165f5136aec9a125a71a4c4b5

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
364KB

MD5
808161a795ec58f8022a0d17f5e5ec92

SHA1
21cc15f5d8a8b131e32c26d49f56563d9f690d40

SHA256
b408043217c3236e51ca24223593319f5622bb5c6364eab2390df295fef45927

SHA512
3c7f801be973e61d05e54049ce383ac840fc727b2c426278a9da2d7179bc39fa17a94b6de4de7ab84bc8b5cbe0558905b37fa72a6b38e45c9f4a5085492ee78f

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
364KB

MD5
e6a6243f42a4a0dae83796409ebbbf02

SHA1
cf2710fb4972c045a1e4810a4eca89d37185a4a0

SHA256
591c1696264f979324ff6c99220f4663e538e9840b3f8beccb4cc48d63a98f33

SHA512
dc6a951f576c6216a0c66ea9af92ce13e3394a009148834e655ab7f37bd0747bac7d283d9ecf8f4c6268c45ab222dc8e0b10b11f3fd187e0e790f2aa2bd9f067

Download Submit
C:\Windows\SysWOW64\Hflcbngh.exe

Filesize
364KB

MD5
0accb03b99dfe7736d8e68967a51e179

SHA1
43dd409bebebdfa7acffc6a2e0884676611bedfc

SHA256
b434f782b49ebdaaf5f3d4ee90e4629186633e90713f3f4084af40e89e734331

SHA512
10f30b8f77b1dd4ba87339a3554615fb8ed3ccfa04a011eb806902f053e5b3047a8f0d1bbd8b415b33e8d2d512c47e05b4b7ecac307bf876c6e9f2d2bb0d71d0

Download Submit
C:\Windows\SysWOW64\Hfqlnm32.exe

Filesize
364KB

MD5
1b34ff705db07c956c3cadc4c0a0233f

SHA1
048a748fed5d710b9688f81906d7fc654fb7c9bb

SHA256
80855934ebc2c2ad2788aee5aada15e864d677b6714b6c1a659439c5dd62b7b1

SHA512
6434ea246bfd4f7325770f1d1e58787d875cddba3af4f763e8ea92e27395aef28497d9fc6c25cde024b08dfb9be24d063b278c312237523c35117c32c6465caa

Download Submit
C:\Windows\SysWOW64\Hijooifk.exe

Filesize
364KB

MD5
a11fec704f96537813010aff0cb1e783

SHA1
6338f3ee410d6743da53a18c3829689ee8dd3d2e

SHA256
3e693f0dca705b3e8e5c27015217c6b4b930dfc8c1d4e394d5f27314da725526

SHA512
8bab5adda40a158dedfeff594f72f34853b51e6344012f1dcf1a70e03090a4c0e633f7006a85ae162a2fd3a4599d624c368d701c7044130ac14f3033737123fb

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
364KB

MD5
f3e3660c6363bd3ebebd52363d950b03

SHA1
036bd0b902bef2e400c51b88389282b67687069b

SHA256
042b79425e3c5c12b12af4ddac09403eb99eb71d2c486821ab509c034ad0ab97

SHA512
4122569440f631d21aac03b749bf02840ebe68b5c66d5a5ec491f2de6c21776510c2ac470d3ea07666f7e2b24fb3b2c8a545c80df0a979344eb9a1a879c6f3ed

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
364KB

MD5
1cb01846b250c4131aa4993eac233bbb

SHA1
41ca99ffe3fcef6dccc05f17f45183ae47108ac7

SHA256
3ae9da748c7b050bbfe04985ac10d649f026edfb6fd5898efea3c29e3cc9a550

SHA512
4aa51860a8ce3f5bb33fba1f55a254db282ec2bc3530b7897046ff0079b1a6e62ed329981451410c7a66818498397ec0a088a7e41ace5ddedbbeb0a1a3399223

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
364KB

MD5
3c9566b723a4c210e31730b383f22632

SHA1
99bdaa112dd957329ab87c3cdf1f81a00931415d

SHA256
2f2b46d4d5f9f0f891cf7576291c78c1245c24c4c26f771b90158a699f6a40da

SHA512
40622e0b4f2abaea6622942d1c7974fe0e172f3b6c0dd209d1d073752ab8ea0139a6faf5793f2ba1c57d28cfe5cc3b29bf18cf9e14c666f83695d20b4ba7c455

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
364KB

MD5
67ac8486e22ebf63809d7bebafbf2d71

SHA1
d3481876bfc086c13f79551b420981803a9e4f35

SHA256
8385a06f9d02c8c15e9fd04e8e57eae84fe44469cf0a0476f9e79f3b7dc534e1

SHA512
8d8bc7b0a26c70553c73e467a15ed26ba9af04d452458f0ad03f8beff9697dcbeb65dcfafc2e91e1c23f660086f4afd6e9ce03421dbceebb184ec54e7fff22cc

Download Submit
C:\Windows\SysWOW64\Hkikkeeo.exe

Filesize
364KB

MD5
fd61be3bb154722cdaa884d109bc9df8

SHA1
9036db456876100a0c3adce4cd8126e440ebc3f7

SHA256
e06677c4126fd0cc3ac89de88dd0323d1cf6adaf1af3e89a4725a881b87a9a32

SHA512
03a9d4b7b1f38317bc49ada708ee56512d4e0d0df27793c4e09368e2c15968a3061dfae9f9df343a00cb20dd60dfc5fa7c3fe48103d2659b8b871de9568d7581

Download Submit
C:\Windows\SysWOW64\Hmhhehlb.exe

Filesize
364KB

MD5
12763737995b01c1efb733d70bc07d14

SHA1
85cec7c8d2ac4fa4e118bdec2b6e7d077ee41b21

SHA256
2c64f3d32e79449958a57c09f3b695249c8a53fd3d069b284b4e6fd08a9c207d

SHA512
1f14db89a99ac11ee9a5ba168d4be77569535bb4389e8fb24190b64ff75233bbd87a0c382701922e4614468845ab446302a96049a5dd274b77cfcaf51ffd312c

Download Submit
C:\Windows\SysWOW64\Hmjdjgjo.exe

Filesize
364KB

MD5
dff3a7092d5992a0ab5c489ea630cda6

SHA1
7effb289d224845bd8344d39320e0ead461283da

SHA256
deece7c53b171dc1994a9f6ae77862df45557b91583f848650ed4d40fec9ec41

SHA512
d6eeba34cf0277c386df73dd03c158cbc0559537de52aab9c65c52293486e226bc259ca956fbaebf3f456f30429feb92aa6a0a7af90e9d70d3e50bbcf52ff8da

Download Submit
C:\Windows\SysWOW64\Hofdacke.exe

Filesize
364KB

MD5
7341337d3eed6e01445bb1188670818d

SHA1
a4d0b9bbba40c055021036f62be482388dfb93ef

SHA256
4b2fccdb3edd091c65fe0618ebd3cf46a849b5af4d3185808657363be98db827

SHA512
3826e1c58f4f0826b86fa51c446df56b3f1aacd07e150ec580677b39e31c59985a7646ca865ce75f1a9725c17c0231e9e7bacb7d31afe1ebc456416c3b09c9c6

Download Submit
C:\Windows\SysWOW64\Ipdqba32.exe

Filesize
364KB

MD5
16c79bcae197e7f0aaca10d377673a69

SHA1
5bcf352a2b92ffb2bfa4ff9a3eb109242183dfaa

SHA256
60f7112cc9fb211d55202554c10ac92df8899c50692ed56f7c3134dd9a13bd36

SHA512
697956d5531f328af65adeb6c80309490aca35cdd88f486d29d3bc269f014217304e0783123c531b3a83d443ae42b4dd7aae4cace22ce352ae567e418176553c

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
364KB

MD5
69190203331fd5a6a69775c6038880ab

SHA1
9158ffb919711b5bd615b77edb71e32e0338098a

SHA256
db447641b1aa44491f0a70cdc29af4391ac8e8e4b3000d29103519e074859363

SHA512
82b184db512021e305cccfa3ebce6203861a328c4231fcb84b0cb0d2e1dee2dcdcb8edea29be375b0b7b9bfcb24f35b0f82cfa79e634470e2b601c231b93a484

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
364KB

MD5
eed216f88575d988d1fee5f104e2f12d

SHA1
f23fbbab2d3cfbdbcd04e6d086c33ec694ff6dab

SHA256
de57b599be5d764954fd3ed78b773364b8308521e9b71e8ef891270839a10a10

SHA512
6cb49e33d098cab3d1c55d203733e9e8f8048ba2a8ad3d0ed46c65e2b459b7dc4254030fae9fd677511946563d2de2c4e64f192a5c96be5d52c98dbf4f6b086e

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
364KB

MD5
078a7a58f85fe9ab3b29c59001d8d0c0

SHA1
e71a84a2b638f39765272e35ded90e69d300f6ed

SHA256
e3dd7e634492624c3750dfaa5de2ff65a902a8c5278fd1ca7d010c1ff655e7e3

SHA512
5710c2ceaf3fa8ede14305b489222e702402a6c3905294fd3de5f2c4339956cb47658c4a1449f7a0d92fdba04336ef09961056834458e66655ab9a29e5d9960d

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
364KB

MD5
d944b7f0f1b5be2daa6fe6c651859783

SHA1
cd6f98d990ed18ce00a2b9d9818e1e1329825108

SHA256
8c19a2984a306dd3a4104833ac65a6027415378456b07b00d6b43c6966b79758

SHA512
ae2ed5131796f01e06f395923633621e854f5b466ecf1ce5b41e28073b9a68f809e1dd49c6b46342b5980db699e932e0d3e57e98f10d8fb00d8d11876c543863

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
364KB

MD5
99b59e23764383ef2c9c6c79b95cb7f0

SHA1
fa1d2adc1b7ea4e517b2e74abadfd491ce53b228

SHA256
e326d513911fdf84997ce5c165634e807d5fadc5d3ac0858800363106360f193

SHA512
c13c77ff6623c9dc23b261f32398a6deb3e39cabc22ce236aa6e7f06fe2c94133ff826b8ca674e0d69cdc9107e8bbbd0b16144fc0dd63dba185176b88556fd15

Download Submit
C:\Windows\SysWOW64\Kpgfooop.exe

Filesize
364KB

MD5
3cabd3017213d7b845ca9241cc05f0c2

SHA1
fb4671337769868f0e2f59f0b0264e086d4f92c0

SHA256
1c714be63b3e9e0630a1cc47a139d7c58db9653a2ff89cd099d0478368332a25

SHA512
4a85791e261a830b41a6625b216348504e5d50ec0dbad058fa3a470b58f12c184823678aa80879991ad42f24e929e570e057d8e940a26aa44905bfb24c7ed06d

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
364KB

MD5
434b8d075f865af66896e1cb30caba1c

SHA1
29b12ad02ffee0a7b72da9237581b68d81b33708

SHA256
9f9529fe01dfd3a411d3a340f6136693ab584a7ce5b764ff9d6d51ad49ae2d60

SHA512
61df4c6481ae1fa93c8a207b271fa055b1bc10225d35cc8f5836fddd97c3393637908d71b82e2d8fb464689c3dfb3b6034e45f8bc42d2418ce68e0227da3d9f2

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
364KB

MD5
6c6a8b29a0fe00fb7ec8634673387495

SHA1
d39a631ec18cad8f7b3cfd3f88c716e9b6757879

SHA256
1451c4f1c08cc7ef95bc3b9b299b79888aa883dd3068621ce4ffb0bda8be4869

SHA512
5572e5cb4cc6ee240f2e49bf5a77b804f50840428ca48ef8ec50f1095f83b6a9788e18a9c44a2ecd3a7972441d35414528ce10f55f4b8bc89e9c30b277c0d8d3

Download Submit
C:\Windows\SysWOW64\Mlefklpj.exe

Filesize
364KB

MD5
b292d912986e90edb1a89349d032a682

SHA1
8f74f2a5059a10aa130109f23f1ef8ae48ee8361

SHA256
c8c018bdf20186bc2bf1f775ff1ee2a1323ce5fa521776d5d56c8770f09fc1c2

SHA512
82266e87b38df7f38e57c6aa84ad2d17dd04792799423e5421aa5138c5a07bfc66f6a24c62141b50c57bafd8d5ebab656f2ba3903aaba93c9c4bc3a0df39f64c

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
364KB

MD5
9586f9e8c5acf10589623c4831bf4ee3

SHA1
52476fcfca2ce739f63aaad39480ff3e4f25373e

SHA256
edf66516a5887baf6e99ebbcb2da97e8e08474f52bb44869b98d968125e7d838

SHA512
4680592d016203cd4456f4bb14de9e2927dea32d57600110d0583c30d9e8177ab7a486e5e86d9b19924b36fd3e97b0f6e2e3ace93689234a9ea7222f3205aa27

Download Submit
C:\Windows\SysWOW64\Nloiakho.exe

Filesize
364KB

MD5
a91c2afd5f56714fd7c3f9515416cca3

SHA1
674fd0120d1f1ef6f042de03a24d16eff35017b7

SHA256
2af37273fbec251b6335db5d6f2ba82cf8344f378496e38317cf5b8215c094da

SHA512
a86e6d84aa6389b2150b064d1a1aebd444683949df9024b68494f0bf27e1f6b97b3bbf883d26c1315080e2fdb0f86a2616706beed24b79eb18970131b56eecbe

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
364KB

MD5
f3fcc046ed2369cae401175a078aa895

SHA1
466d9ee3ffaadb356531f7ed2dbcfcf1add436ec

SHA256
383c3a3b660e7c238a6b7f50029e3459af968406a59c3b353966e177e4e99301

SHA512
f279f99305cd01f0dc7a970dcabb42a0ac4674af920c36741af1de2628b5f7e5c6baf1ffaa687eb5c74a1f2c5f1c25d4a3b5028be5b575e82bbfb901014470f3

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
364KB

MD5
3c7d0fa12a2db99fb3d8cc475865f522

SHA1
f3f78fc55d8ccc8bd7c9be10baf479fe6ca96e73

SHA256
caab65f1b21254cd55d67af853b90bf5419726d73edce02df3a28e4ef3a98dad

SHA512
5b8693c9159892578cd085afb907bfc0a4aef5bcd45e9709f2215a82bbaece3a3a5a8ccba4852085a4fce6c856dc25ec1d099f583e0003a4e740d11c70dcdcfa

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
364KB

MD5
59cc569c68892a5de1fd24eac699724a

SHA1
359eb8ea702270f3906d960366d1d8e00967ec1e

SHA256
99bb54c455fff51bf4ae6ca7b266fe58130b741f2f9e0e8750304be08ab2d9f0

SHA512
59b34a651238ba64b1b15f46a19220b11aadfd7b0e3a10371ff5f68b17138753f8884f770f87b9287bda53b45bce8431d200fb32c394857a5ef9b119670e7e5b

Download Submit
C:\Windows\SysWOW64\Pdifoehl.exe

Filesize
364KB

MD5
effcb670c590133eceae5c8608219731

SHA1
4ba8539de04742d19f3bbde67a00c47d6def959c

SHA256
d34e72340daeba7bf964c6233d57a792293009d8b5d67556d34ed00e9fff1485

SHA512
5b191435e9f3d91782cdc2de23f7f8b27509c742081b73aa686f03fa03df55d62700649db12bb07c68ca6e0aebce6943b86063c9cca885b15d923e64e0a00bf2

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
364KB

MD5
ed17938e7b478a0c3af3a9b6d3e5a296

SHA1
6adf589180adfc8a3fe05d79bc1986b2cf426cbb

SHA256
21c860aba48c78a23c9dbea8542c8b577491b247657c3dd85b00103e4a159505

SHA512
599b2753e9f17fc4e95d82a4dc36150c52c7eaf4b7e91595b52929f244b8752d1fa039692042247c38ee1ae1d2fe8b11c7335c69b98b7c2f2c7438f53aa29aca

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
364KB

MD5
519236fc1b1101a9fcee779db75d811b

SHA1
2411607abb03597de7eae764fedd1111023d78fd

SHA256
72de7bab43b2acc3b8caaa6d51a4556c9ad2d8a437f5dff31939314b6de451ed

SHA512
9ee432431c51471d7c00252889276c6b420d8d19888ccee19e1000984566d21ade233b7654b48e265674141ad765be2c43438ed1a9d61e1d42718f762a7eaf91

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
64KB

MD5
f265bb888a8ba1c03b39f3f4ab36b747

SHA1
a37c614d4ac45b28ec52229a0bc0a980429943d1

SHA256
9417c4c145ce4b4670e0d417dbee4704844e8ef602ba7a87af2a6c81d30bce85

SHA512
341bfacfd8004e0eb22cfd52b29650fab67a6e1daeabf05f1534b9f09115097285301c9d7023253286c2d21d02024b8ee9ca653d06e04b29dc34f9ad688dcce8

Download Submit
memory/400-302-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/452-314-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/644-551-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/644-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/696-196-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/716-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/772-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/952-454-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1068-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1220-386-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1224-514-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1292-184-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1304-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1304-586-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1376-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1376-572-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1424-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1432-466-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1700-338-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1716-368-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1752-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1772-290-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1776-236-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1804-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1820-212-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2040-272-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2056-181-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2088-244-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2132-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2140-204-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-392-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2224-332-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2284-594-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2312-566-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2324-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2360-344-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2376-220-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-579-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2436-573-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2464-278-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2480-356-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-380-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2696-266-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2904-508-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2988-260-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3000-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3000-558-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3016-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3016-593-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3020-560-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3296-284-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3340-478-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3344-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3436-448-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3500-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3528-120-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3612-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3652-545-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3672-374-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3724-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3756-326-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3892-350-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3932-484-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3980-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4012-362-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4064-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4092-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4180-559-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4180-28-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4268-472-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4324-159-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4352-520-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4416-490-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4428-580-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4444-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4448-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4476-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4616-296-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4668-552-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4672-502-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4692-526-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4800-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4852-587-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4872-538-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4884-228-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4904-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-167-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4956-320-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5012-496-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5040-460-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5060-252-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5080-532-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5104-308-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5112-544-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5112-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads