berbew | efdf1c6c9be281642c5580b4621afa5c57f64e93caa8a46fe56f066e20c742cf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efdf1c6c9be281642c5580b4621afa5c57f64e93caa8a46fe56f066e20c742cf.exe
Size

79KB
MD5

12ab15bf427159ac3810d19b43bf1df5
SHA1

48e85f2983df20b5a67307945b234a08afc32922
SHA256

efdf1c6c9be281642c5580b4621afa5c57f64e93caa8a46fe56f066e20c742cf
SHA512

366481e10ba7c5d668f41cacbfd660057ac145245f4829e38c699d9b668a1eaaa63a0f272705fd7db419019cf235bc736b1e0200df4bfcf24319b04f83b06a77
SSDEEP

1536:bvKLrq8V6vHAn84X+0GpHenAUEaiFkSIgiItKq9v6D6:bvKLrq8V6vHAZX+XHeAUEaixtBtKq9v9

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edionhpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcoccc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkaclqkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibegfglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Momcpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afockelf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccblbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnblnlhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihbponja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kofdhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhgkgijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjggal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adgmoigj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqppci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqbliicp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lchfib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Biklho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mapppn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbekii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egened32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgoakc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpioin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qapnmopa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Giljfddl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loacdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlljnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmcpoedn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oiagde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dinael32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqbliicp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ganldgib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnnljj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pakdbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqlfhjig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajohfcpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfolacnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjlalkmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqaiecjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fijdjfdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhqefjpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqoloc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfmfefni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbaclegm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaqhjggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbdiknlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqjbddpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqeioiam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kapfiqoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baepolni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	efdf1c6c9be281642c5580b4621afa5c57f64e93caa8a46fe56f066e20c742cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhikci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfkkqmiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfqnbjfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocihgnam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpljehpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llqjbhdc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmojd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdeiqgkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gegkpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haaaaeim.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3584	Doagjc32.exe
2628	Dqbcbkab.exe
3656	Dhikci32.exe
1372	Dkhgod32.exe
3484	Eqdpgk32.exe
2108	Ekjded32.exe
1436	Ebdlangb.exe
2820	Ehndnh32.exe
4000	Enkmfolf.exe
4900	Ehpadhll.exe
4196	Ekonpckp.exe
2676	Eqlfhjig.exe
1036	Egened32.exe
5088	Enpfan32.exe
2324	Edionhpn.exe
1380	Fooclapd.exe
856	Fqppci32.exe
3712	Fkfcqb32.exe
4416	Fndpmndl.exe
3768	Fqbliicp.exe
4544	Fijdjfdb.exe
944	Fqeioiam.exe
4876	Fgoakc32.exe
3888	Fniihmpf.exe
4116	Finnef32.exe
4776	Fohfbpgi.exe
2724	Fajbjh32.exe
5040	Fiqjke32.exe
4016	Gnnccl32.exe
4992	Gegkpf32.exe
4008	Gkaclqkk.exe
4180	Ganldgib.exe
624	Gghdaa32.exe
4208	Gnblnlhl.exe
3076	Gaqhjggp.exe
2788	Ggkqgaol.exe
2500	Gndick32.exe
2912	Geoapenf.exe
4504	Gpdennml.exe
4220	Geanfelc.exe
4736	Giljfddl.exe
1324	Hbenoi32.exe
1820	Hhaggp32.exe
3212	Hpioin32.exe
2076	Heegad32.exe
2168	Hlppno32.exe
3412	Hnnljj32.exe
3080	Hehdfdek.exe
1616	Hpmhdmea.exe
4460	Hifmmb32.exe
3952	Hppeim32.exe
3504	Haaaaeim.exe
4896	Hihibbjo.exe
2880	Ilfennic.exe
3492	Ibqnkh32.exe
1740	Iijfhbhl.exe
1812	Ilibdmgp.exe
4372	Ibcjqgnm.exe
1608	Iafkld32.exe
3940	Ihpcinld.exe
5044	Ipgkjlmg.exe
2028	Ibegfglj.exe
116	Ieccbbkn.exe
4580	Ihbponja.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kapfiqoj.exe	Koajmepf.exe
File created	C:\Windows\SysWOW64\Ajhapb32.dll	Nhegig32.exe
File opened for modification	C:\Windows\SysWOW64\Njjmni32.exe	Ncpeaoih.exe
File opened for modification	C:\Windows\SysWOW64\Bmdkcnie.exe	Biiobo32.exe
File created	C:\Windows\SysWOW64\Klambq32.dll	Fqppci32.exe
File created	C:\Windows\SysWOW64\Cgkeml32.dll	Fqeioiam.exe
File created	C:\Windows\SysWOW64\Defbaa32.dll	Lhenai32.exe
File created	C:\Windows\SysWOW64\Faoiogei.dll	Mhldbh32.exe
File opened for modification	C:\Windows\SysWOW64\Adjjeieh.exe	Aalmimfd.exe
File opened for modification	C:\Windows\SysWOW64\Hifmmb32.exe	Hpmhdmea.exe
File created	C:\Windows\SysWOW64\Ieccbbkn.exe	Ibegfglj.exe
File opened for modification	C:\Windows\SysWOW64\Lpgmhg32.exe	Lhqefjpo.exe
File created	C:\Windows\SysWOW64\Mfnhfm32.exe	Mcoljagj.exe
File opened for modification	C:\Windows\SysWOW64\Mhckcgpj.exe	Mfenglqf.exe
File created	C:\Windows\SysWOW64\Cnokmj32.dll	Momcpa32.exe
File created	C:\Windows\SysWOW64\Dndfnlpc.dll	Ojcpdg32.exe
File opened for modification	C:\Windows\SysWOW64\Pakdbp32.exe	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Anhaoj32.dll	Fqbliicp.exe
File created	C:\Windows\SysWOW64\Okjpkd32.dll	Finnef32.exe
File opened for modification	C:\Windows\SysWOW64\Ganldgib.exe	Gkaclqkk.exe
File created	C:\Windows\SysWOW64\Hpceplkl.dll	Haaaaeim.exe
File created	C:\Windows\SysWOW64\Plpodked.dll	Mqhfoebo.exe
File created	C:\Windows\SysWOW64\Bboffejp.exe	Banjnm32.exe
File created	C:\Windows\SysWOW64\Ldbhiiol.dll	Biiobo32.exe
File created	C:\Windows\SysWOW64\Iocmhlca.dll	Bapgdm32.exe
File created	C:\Windows\SysWOW64\Hlqeenhm.dll	Kibeoo32.exe
File created	C:\Windows\SysWOW64\Kemooo32.exe	Kcoccc32.exe
File created	C:\Windows\SysWOW64\Pfepdg32.exe	Pplhhm32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkaiphj.exe	Cdaile32.exe
File created	C:\Windows\SysWOW64\Aoibcl32.dll	Dqbcbkab.exe
File created	C:\Windows\SysWOW64\Bgdemb32.exe	Bdeiqgkj.exe
File created	C:\Windows\SysWOW64\Gillppii.dll	Hhaggp32.exe
File created	C:\Windows\SysWOW64\Fpnkah32.dll	Ncpeaoih.exe
File opened for modification	C:\Windows\SysWOW64\Piocecgj.exe	Pjlcjf32.exe
File created	C:\Windows\SysWOW64\Abhqefpg.exe	Aagdnn32.exe
File created	C:\Windows\SysWOW64\Lalceb32.dll	Bjhkmbho.exe
File opened for modification	C:\Windows\SysWOW64\Ilibdmgp.exe	Iijfhbhl.exe
File created	C:\Windows\SysWOW64\Dpifjj32.dll	Mhoahh32.exe
File opened for modification	C:\Windows\SysWOW64\Ofckhj32.exe	Obgohklm.exe
File created	C:\Windows\SysWOW64\Cildom32.exe	Cgmhcaac.exe
File created	C:\Windows\SysWOW64\Deocpk32.dll	Iijfhbhl.exe
File created	C:\Windows\SysWOW64\Aalmimfd.exe	Aidehpea.exe
File created	C:\Windows\SysWOW64\Ogajpp32.dll	Ckbncapd.exe
File opened for modification	C:\Windows\SysWOW64\Hihibbjo.exe	Haaaaeim.exe
File opened for modification	C:\Windows\SysWOW64\Afockelf.exe	Abcgjg32.exe
File created	C:\Windows\SysWOW64\Pjcikejg.exe	Pblajhje.exe
File created	C:\Windows\SysWOW64\Qiiflaoo.exe	Qamago32.exe
File opened for modification	C:\Windows\SysWOW64\Qcnjijoe.exe	Qapnmopa.exe
File created	C:\Windows\SysWOW64\Jnblgj32.dll	Cpacqg32.exe
File created	C:\Windows\SysWOW64\Ganldgib.exe	Gkaclqkk.exe
File opened for modification	C:\Windows\SysWOW64\Mjlalkmd.exe	Mbdiknlb.exe
File opened for modification	C:\Windows\SysWOW64\Fajbjh32.exe	Fohfbpgi.exe
File created	C:\Windows\SysWOW64\Kibeoo32.exe	Kakmna32.exe
File opened for modification	C:\Windows\SysWOW64\Ofgdcipq.exe	Ocihgnam.exe
File created	C:\Windows\SysWOW64\Anbgamkp.dll	Bgdemb32.exe
File created	C:\Windows\SysWOW64\Dooaccfg.dll	Cgiohbfi.exe
File created	C:\Windows\SysWOW64\Dhikci32.exe	Dqbcbkab.exe
File created	C:\Windows\SysWOW64\Ekjded32.exe	Eqdpgk32.exe
File created	C:\Windows\SysWOW64\Gndick32.exe	Ggkqgaol.exe
File opened for modification	C:\Windows\SysWOW64\Geanfelc.exe	Gpdennml.exe
File created	C:\Windows\SysWOW64\Gaqhjggp.exe	Gnblnlhl.exe
File created	C:\Windows\SysWOW64\Jpecpo32.dll	Klbnajqc.exe
File created	C:\Windows\SysWOW64\Kcoccc32.exe	Klekfinp.exe
File created	C:\Windows\SysWOW64\Oikjkc32.exe	Obqanjdb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7976	7652	WerFault.exe	330

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fooclapd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqbliicp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfgklkoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofckhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilphdlqh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afockelf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doagjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjmni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofgdcipq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckdkhq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnnccl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geoapenf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlhqcgnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcfbkpab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqjbddpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhikci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qamago32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpacqg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iijfhbhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqcejcha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aidehpea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfolacnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaqhjggp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlppno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpeiie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Niojoeel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piocecgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfepdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qiiflaoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adjjeieh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Haaaaeim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmcpoedn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Diqnjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edionhpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gghdaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibcjqgnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njedbjej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhoeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omalpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhqefjpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhenai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loacdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mofmobmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqlfhjig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkaclqkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhegig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqmhqapg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmpjoloh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lancko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhgkgijg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkhgod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkfcqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lebijnak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lakfeodm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjoppf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abmjqe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebdlangb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iondqhpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqklkbbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qikbaaml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcgjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enpfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gndick32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mledmg32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnnccl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iijfhbhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chgnfq32.dll"	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejimf32.dll"	Ocihgnam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Defgao32.dll"	Afockelf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gpdennml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpapnfhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncpeaoih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlbkmokh.dll"	Ehpadhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gebekb32.dll"	Gnnccl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbenoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hokomfqg.dll"	Ilibdmgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhckcgpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhegig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qcnjijoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bapgdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gedhfp32.dll"	Gegkpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hifmmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibegfglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbcikkp.dll"	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obgohklm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omopjcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifcmmg32.dll"	Bfolacnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egened32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhbih32.dll"	Fohfbpgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nndbpeal.dll"	Ggkqgaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpioin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Heegad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aemghi32.dll"	Mofmobmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocgkan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aabkbono.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjpnkbfj.dll"	Lhgkgijg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llgdkbfj.dll"	Nfldgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbekii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjlcjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aagdnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkfcqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnblnlhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acccdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiahpo32.dll"	Calfpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Legben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acffllhk.dll"	Pjcikejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gghdaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pninea32.dll"	Mjnnbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icifhjkc.dll"	Aagdnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhenai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhgkgijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agolng32.dll"	Omalpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cildom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnndji32.dll"	Omopjcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocihgnam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcidlo32.dll"	Cpljehpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glqfgdpo.dll"	Mjlalkmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qapnmopa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apeknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajohfcpj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3584	4760	efdf1c6c9be281642c5580b4621afa5c57f64e93caa8a46fe56f066e20c742cf.exe	88
PID 4760 wrote to memory of 3584	4760	efdf1c6c9be281642c5580b4621afa5c57f64e93caa8a46fe56f066e20c742cf.exe	88
PID 4760 wrote to memory of 3584	4760	efdf1c6c9be281642c5580b4621afa5c57f64e93caa8a46fe56f066e20c742cf.exe	88
PID 3584 wrote to memory of 2628	3584	Doagjc32.exe	89
PID 3584 wrote to memory of 2628	3584	Doagjc32.exe	89
PID 3584 wrote to memory of 2628	3584	Doagjc32.exe	89
PID 2628 wrote to memory of 3656	2628	Dqbcbkab.exe	90
PID 2628 wrote to memory of 3656	2628	Dqbcbkab.exe	90
PID 2628 wrote to memory of 3656	2628	Dqbcbkab.exe	90
PID 3656 wrote to memory of 1372	3656	Dhikci32.exe	91
PID 3656 wrote to memory of 1372	3656	Dhikci32.exe	91
PID 3656 wrote to memory of 1372	3656	Dhikci32.exe	91
PID 1372 wrote to memory of 3484	1372	Dkhgod32.exe	92
PID 1372 wrote to memory of 3484	1372	Dkhgod32.exe	92
PID 1372 wrote to memory of 3484	1372	Dkhgod32.exe	92
PID 3484 wrote to memory of 2108	3484	Eqdpgk32.exe	93
PID 3484 wrote to memory of 2108	3484	Eqdpgk32.exe	93
PID 3484 wrote to memory of 2108	3484	Eqdpgk32.exe	93
PID 2108 wrote to memory of 1436	2108	Ekjded32.exe	94
PID 2108 wrote to memory of 1436	2108	Ekjded32.exe	94
PID 2108 wrote to memory of 1436	2108	Ekjded32.exe	94
PID 1436 wrote to memory of 2820	1436	Ebdlangb.exe	95
PID 1436 wrote to memory of 2820	1436	Ebdlangb.exe	95
PID 1436 wrote to memory of 2820	1436	Ebdlangb.exe	95
PID 2820 wrote to memory of 4000	2820	Ehndnh32.exe	96
PID 2820 wrote to memory of 4000	2820	Ehndnh32.exe	96
PID 2820 wrote to memory of 4000	2820	Ehndnh32.exe	96
PID 4000 wrote to memory of 4900	4000	Enkmfolf.exe	97
PID 4000 wrote to memory of 4900	4000	Enkmfolf.exe	97
PID 4000 wrote to memory of 4900	4000	Enkmfolf.exe	97
PID 4900 wrote to memory of 4196	4900	Ehpadhll.exe	98
PID 4900 wrote to memory of 4196	4900	Ehpadhll.exe	98
PID 4900 wrote to memory of 4196	4900	Ehpadhll.exe	98
PID 4196 wrote to memory of 2676	4196	Ekonpckp.exe	99
PID 4196 wrote to memory of 2676	4196	Ekonpckp.exe	99
PID 4196 wrote to memory of 2676	4196	Ekonpckp.exe	99
PID 2676 wrote to memory of 1036	2676	Eqlfhjig.exe	100
PID 2676 wrote to memory of 1036	2676	Eqlfhjig.exe	100
PID 2676 wrote to memory of 1036	2676	Eqlfhjig.exe	100
PID 1036 wrote to memory of 5088	1036	Egened32.exe	101
PID 1036 wrote to memory of 5088	1036	Egened32.exe	101
PID 1036 wrote to memory of 5088	1036	Egened32.exe	101
PID 5088 wrote to memory of 2324	5088	Enpfan32.exe	102
PID 5088 wrote to memory of 2324	5088	Enpfan32.exe	102
PID 5088 wrote to memory of 2324	5088	Enpfan32.exe	102
PID 2324 wrote to memory of 1380	2324	Edionhpn.exe	103
PID 2324 wrote to memory of 1380	2324	Edionhpn.exe	103
PID 2324 wrote to memory of 1380	2324	Edionhpn.exe	103
PID 1380 wrote to memory of 856	1380	Fooclapd.exe	104
PID 1380 wrote to memory of 856	1380	Fooclapd.exe	104
PID 1380 wrote to memory of 856	1380	Fooclapd.exe	104
PID 856 wrote to memory of 3712	856	Fqppci32.exe	105
PID 856 wrote to memory of 3712	856	Fqppci32.exe	105
PID 856 wrote to memory of 3712	856	Fqppci32.exe	105
PID 3712 wrote to memory of 4416	3712	Fkfcqb32.exe	106
PID 3712 wrote to memory of 4416	3712	Fkfcqb32.exe	106
PID 3712 wrote to memory of 4416	3712	Fkfcqb32.exe	106
PID 4416 wrote to memory of 3768	4416	Fndpmndl.exe	107
PID 4416 wrote to memory of 3768	4416	Fndpmndl.exe	107
PID 4416 wrote to memory of 3768	4416	Fndpmndl.exe	107
PID 3768 wrote to memory of 4544	3768	Fqbliicp.exe	108
PID 3768 wrote to memory of 4544	3768	Fqbliicp.exe	108
PID 3768 wrote to memory of 4544	3768	Fqbliicp.exe	108
PID 4544 wrote to memory of 944	4544	Fijdjfdb.exe	109

C:\Users\Admin\AppData\Local\Temp\efdf1c6c9be281642c5580b4621afa5c57f64e93caa8a46fe56f066e20c742cf.exe
"C:\Users\Admin\AppData\Local\Temp\efdf1c6c9be281642c5580b4621afa5c57f64e93caa8a46fe56f066e20c742cf.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\Doagjc32.exe
  C:\Windows\system32\Doagjc32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\Dqbcbkab.exe
    C:\Windows\system32\Dqbcbkab.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\Dhikci32.exe
      C:\Windows\system32\Dhikci32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3656
    - - C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1372
      - C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:944
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4876
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4116
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        28⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        29⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4992
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4208
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4220
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1324
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1820
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3212
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2076
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3412
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        49⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1616
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        52⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3504
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        54⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        55⤵
        Executes dropped EXE
        
        PID:2880
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        56⤵
        Executes dropped EXE
        
        PID:3492
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1740
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1812
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        60⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        61⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        62⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2028
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        64⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4580
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        66⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2580
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        70⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        71⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        72⤵
        Drops file in System32 directory
        
        PID:1944
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        73⤵
        Drops file in System32 directory
        
        PID:3060
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        74⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        75⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        76⤵
        Drops file in System32 directory
        
        PID:4384
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        77⤵
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1800
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        79⤵
        Drops file in System32 directory
        
        PID:3632
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        81⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5260
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        83⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        84⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        87⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        88⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5584
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        91⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5756
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        94⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        96⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        98⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        104⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        105⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        106⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        109⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        114⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        115⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        116⤵
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        118⤵
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        120⤵
        Drops file in System32 directory
        
        PID:5840
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        121⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        124⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        126⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6028
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        128⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        129⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6220
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6308
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        134⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        135⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6440
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        137⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        139⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        143⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        144⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        145⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6936
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:6988
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        149⤵
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        150⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        151⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        152⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:6232
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        156⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        157⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        159⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        160⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        161⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        162⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        163⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        164⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        165⤵
        Modifies registry class
        
        PID:7116
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        166⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6496
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        170⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6824
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        174⤵
        Drops file in System32 directory
        
        PID:7108
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6204
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        176⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        177⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        178⤵
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        179⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6760
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:7048
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        182⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6780
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        185⤵
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        186⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        187⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6424
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        189⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        190⤵
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        191⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        192⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        193⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7312
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        194⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        196⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        198⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7536
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        199⤵
        Drops file in System32 directory
        
        PID:7580
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:7624
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:7668
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        202⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        204⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        205⤵
        Drops file in System32 directory
        
        PID:7836
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        206⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        207⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        209⤵
        Drops file in System32 directory
        
        PID:8048
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8092
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        211⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        213⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7252
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        215⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7412
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        217⤵
        Drops file in System32 directory
        
        PID:7480
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        218⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7620
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        220⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        221⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:7820
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        223⤵
        Modifies registry class
        
        PID:7932
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        224⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:7988
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        226⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8132
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        227⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        228⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        229⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7512
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        231⤵
        Drops file in System32 directory
        
        PID:7608
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        232⤵
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        233⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        234⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        235⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        237⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        238⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        239⤵
        System Location Discovery: System Language Discovery
        
        PID:7652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 400
        240⤵
        Program crash
        
        PID:7976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 7652 -ip 7652
1⤵
PID:7888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:7740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabkbono.exe

Filesize
79KB

MD5
ff92c7e2d6fb208fc9f151414387d94d

SHA1
5195c47d4916c3bc22f904dc09e757930113d247

SHA256
a2952df5d5f95f5692b89f10d28a193a2fb54cdf5df3a6614fd4568aff7f1fe6

SHA512
d95af08e19637d75c48b9e02391308b6e5057154e3768c5e84dfcb237cf70b9adbc0db419ef9a42a2d6165b3dc78fe08cc9eff6d5fd3e244900093e127a6b747

Download Submit
C:\Windows\SysWOW64\Abhqefpg.exe

Filesize
79KB

MD5
8c63d0917b50ecd97537cdf07c47f9bd

SHA1
7bf94c0233ed23ea73514c648c376dbae7f0173d

SHA256
bfbb502b9a7abe5b0ad09de319c092d248cdec6401158426c9b30d4ea173c6ad

SHA512
9ad342ae533009641ea0cb004526796a6dbd85d20d7bf3d94b0ca3a1864bd00ad7c52c69317cf3758def6e92468e12714f32f5fe51eca6a2cb840d329524b04c

Download Submit
C:\Windows\SysWOW64\Adgmoigj.exe

Filesize
79KB

MD5
de065e62178f908a2629a93f7ff3bc34

SHA1
48fac405ee3aa066549b9ef2d49d407bb90ecc90

SHA256
582d8ae1f53edba9f785254b6590749df24d171ca226ec9e913b06e752f8def7

SHA512
aed15fdc07035ce848a2cee07876edcd65a622d8470a7c857efa2c1757941467772a3974643234c33f527ed5a3b1d190d8401aaf62b1f4225268289ea0dafeeb

Download Submit
C:\Windows\SysWOW64\Ajdbac32.exe

Filesize
79KB

MD5
e79868ac63b1b7f0940250e6c3f6f521

SHA1
fceae21957e5bdf766406d1c6f26ea77c78e6c2f

SHA256
29fe5931d91bb8ac8a0ede8186f8c679107af13802e74a19f2d3bd8f114bd299

SHA512
80671415ba9aec1b99422322438a19e3a1409d72e5bbab6d124405134356206fe51cc82ef188e899eda8dc2a099aea5a30fa206172ecf5a57a356893cc234ed5

Download Submit
C:\Windows\SysWOW64\Amikgpcc.exe

Filesize
79KB

MD5
96b042900e0545de28e31e7281c2f6b9

SHA1
32407a2d32551f133f0a702c2419c063303f404c

SHA256
4b81e0d387bd6bcbcd92f369e98c376b42f2b12300c96d4ebb8348aa15c43f46

SHA512
643572f83c6d73031751a5fef76cb078a84d79364cb8c35bef7bef1352fbe8913f02cc021e588c0a8618ec501783a6897a2621446ac0eee01cbe51bb21ffed04

Download Submit
C:\Windows\SysWOW64\Bbaclegm.exe

Filesize
79KB

MD5
9d996c49caa2b29141a88e8a34a9d1e1

SHA1
a9724e7e02aa4cb51715b860c582830be2a43956

SHA256
344b06225b7cf7cb6170c2102144acb5074d1f4e49bc091170f200cca179af87

SHA512
ddd4ba6696b5d9f1e18044337fd2dab6cb699e200bd3da2963ef80df961381e6d8eda4b65566376a7b4ef7af3e359256a4f3b3249aedd999b0e7878c5a819cf9

Download Submit
C:\Windows\SysWOW64\Bfolacnc.exe

Filesize
79KB

MD5
8138507ca6f520246ecc64916a2eae10

SHA1
b4f2b49db74b2b2e608cd7b8e01a1fbf9a6cfc64

SHA256
5d2c43f662964708e74747611502e6cf1fbb39902201349402b06cf8d883a15b

SHA512
ee03302fd64deb1d5bba251df5d3632f8720987edf8113fea0f99c9c04b7b1e38347305d8e8c1f9435c3356380333a8bb8bd10f6a4ad0194ea6004653685ca02

Download Submit
C:\Windows\SysWOW64\Biklho32.exe

Filesize
79KB

MD5
7a3342d7dd52e8b6b009ec0815cc073e

SHA1
57f819fd89ec21e93865361d82edd36424eb6c74

SHA256
4c6953e0734d0557af295dfc38c612a9d2a969142dcc42c66c556b41fb38bb32

SHA512
bd0c6420dca468e2c77cb4201b58966679187065b524d179d4cdb9c2f9073b7ebb26131fb39a637a982c4b310cae837b6f230b74f2d06628f662ba4ae24f5b25

Download Submit
C:\Windows\SysWOW64\Calfpk32.exe

Filesize
64KB

MD5
87028e18beae61bc1b09ca6b9ffddc74

SHA1
589ee00eed0eec9f4c3326ddadc6da500af91f7e

SHA256
08ce7db3b2595cbe770da06d0b82a79185a54bc4f06e14213c033952155a406d

SHA512
13d79ae9805492e0c08c1144390c5ddd5b21a80441311f155272c4dafdf5506d38b7caca7cda70d89b71966d4ab43dd8a6c92edb53ac516f1702152c6f61e5e0

Download Submit
C:\Windows\SysWOW64\Cibain32.exe

Filesize
79KB

MD5
2550f2c32695cd4c01773447821db549

SHA1
28b95e3dcb408ecd0e1d668c3b71cafb897846f1

SHA256
3937a9d67c9afdde5f4e55a1e370a3de0b507814536979fe567462d4a07ad411

SHA512
df9a843e8da4192f7b8e922f3de04f18d0055311145c0884f4aca1dd355f303ae5e619e99d8617adfd7cef54aa82a0309ecd624ba9e744b6f2f4ee0418fb9e12

Download Submit
C:\Windows\SysWOW64\Ckggnp32.exe

Filesize
79KB

MD5
551c8af9be9cc86655ee33b480c8145f

SHA1
fbc98b76547db911ced4701db1600096e7d6eeaa

SHA256
53e49dfa1879ebddcd712f0e0401ba8584148ceb91041a8b83ac8ce35ec71d33

SHA512
0637762f31020c0714b2889db19b855c0de45eb537dfb54b232cc7f628249e0baacee73724e9d4ff3d5d2af7fa0722fa5e5ac7a934e421f615f8fd20f8f3889b

Download Submit
C:\Windows\SysWOW64\Cmgqpkip.exe

Filesize
79KB

MD5
c601c7ac4b571ea76ccaecefeb8f92de

SHA1
bc703a7cd7074dd4b11abfd8297c67679fd07e65

SHA256
99553403da3af321dd3fbb8db46df28116eadc75d8d899cdd2aba037347ca695

SHA512
9b3c721b937ba423fffd321f481d46d68976fc024ba9371d7779c2f77288f177566d29d929bda462e2f38433f4a555cb763cc983629ce1857db5717c72fa4392

Download Submit
C:\Windows\SysWOW64\Cmpjoloh.exe

Filesize
79KB

MD5
c5c18d7fc6cb8d14066bc54f7e681b04

SHA1
4ef3b432f2f85d02919d197f9c71cc21361555e2

SHA256
0305ffe1909a329cb3c5803fa64d37fb8c7ca3d179193ce95f96dae2eee59206

SHA512
59bdfec2a688efd22a33fbbe68612bf989b8bdcdbe3b21f69a4f93e566675695f6c717fed48e2096740d625e193740be4e720aa6ce6a336acd0808df8eb8e2db

Download Submit
C:\Windows\SysWOW64\Cpacqg32.exe

Filesize
79KB

MD5
a3583119c492a04310387e8b035a3ebb

SHA1
22518e333ee770dde33e1ad28274a20c0fe72e68

SHA256
1e5be68c517cc082bdf652434c8be48abb9177a24e173b5f9407cf2ec0966c30

SHA512
0ac9ee726466e299141b9faca1debfec05154efe1762538fb06b4d6edb805ef76f4631291230ad305695816dfa06274d1d5a2827194a6b4fbd1d7c84ab93966e

Download Submit
C:\Windows\SysWOW64\Dhikci32.exe

Filesize
79KB

MD5
82d45cb1f6268dcadfb760e300d0ecdf

SHA1
b7d4661732f5e2adc2a1158824fff2d9dac2fc34

SHA256
c3468ce01b5c78ec4d292861bbd34f0b146ec6e091312cce443d67499caf3e2c

SHA512
0bfaae24c321f04727d5dbd5b56f2e1c944ab3c2a0fc703196787915a50fc8733f97954b9c8011a41876335d1176e20cabbd3b4c26e98d65eb0d6e215c904463

Download Submit
C:\Windows\SysWOW64\Diqnjl32.exe

Filesize
79KB

MD5
7e5e17b635ec8417c93d8e7016b28c78

SHA1
5ad40f646b86c4d86d6fc4b7429736c878d0e8a7

SHA256
183f55661a28c05763166d01647872946e35cb7f7e7818cbb7ca658a9830a966

SHA512
8c195fc2431d899fee84d1f497eedfab863b7d78ea12119de75914c815b1ebf4ecee2eada751ce42518616e724262247bd6c95a1d05631241bf2a5104bd7b6f2

Download Submit
C:\Windows\SysWOW64\Dkhgod32.exe

Filesize
79KB

MD5
5c36616a6abb4cdee6bcfcdb345ae87e

SHA1
ab9929ff8515d6607f63b9d2cd8ca080b81ad166

SHA256
2026f2f46184ab632da8a62b1ae502f1907728f97d6f8dbeaca3d860c33fc92d

SHA512
c4ce97f3152e54e9e1a0c51d11c16ab533ed6412a9cb3df3757d4f9a8c693c391edb4fbe80d205f2aa94aabf00f1beb5f4fdc2cb2107c3999af79fead8a49ee8

Download Submit
C:\Windows\SysWOW64\Dmjmekgn.exe

Filesize
79KB

MD5
fdf0f508e3cfd48a4060e5aab4553aa7

SHA1
c4faed0fab18483c63b15f2e9cf02bd4243f9040

SHA256
8f4064e7e2dbdff88bac05bb2f203a8dde5bf2f75f0d3f22cabfcaefb87ec92a

SHA512
b6232eb52f5f5e076eb477a73e2eb261f7f01c344dc3490d6d48035ebe377adafd3a682257f47187889faf67caefe763fa28c4c4efa5e8ea6cad516c3294e2dd

Download Submit
C:\Windows\SysWOW64\Doagjc32.exe

Filesize
79KB

MD5
815677704dca066aa4b283e19e7e1b2c

SHA1
ecaed761192ace730295946cb5e53bcd6c1ba331

SHA256
db36aa303b62dc63df70a623e420e3e6c0d30c347293756ad0915901b0b0ee34

SHA512
c88c53a4270c18b1cdacdf07b74cd06cec762a58af8f2d06b32764a0bc9c7ca65718f4a32599d959f13a7278daf3e7bee99ce47ffae47d87d97b8922d724f2fe

Download Submit
C:\Windows\SysWOW64\Dqbcbkab.exe

Filesize
79KB

MD5
8c8da6eef738685bf7c76f1804b135c6

SHA1
18175e82b5a531fa5680e3af33ac1d1dbf6d3f0a

SHA256
cb1e2b153eaff7d96f4f50b6ac36f17f6baee30af4071940d3c0c456704e642d

SHA512
7b36ecb84f32b74912fe3d5b0f6374f0cf9ba114e3a2b687f5874fa16b6a2eb75eefac44ee3f9f196ac4d00d10e3bf1b831b52849be82c401aad20b1482e8175

Download Submit
C:\Windows\SysWOW64\Ebdlangb.exe

Filesize
79KB

MD5
b5094373b5d010e60af2a7e1994f2713

SHA1
1b561917d1834e71b319215715d346bfc2992856

SHA256
d60aae7c4ff1e6ba625173a3c3dd452d8f7cafc71aac02dcc409dea7ddfb9392

SHA512
bf8f98ab30f5922bd12e2bb903675bcc0def3ba1b25515f9b9ec422a1d0832cab68d13dc7ed26c9d51673ee1a992933ebbdd5dca4dc6bff347a0bfdda2744e46

Download Submit
C:\Windows\SysWOW64\Edionhpn.exe

Filesize
79KB

MD5
c01c053e968679c17ce6c7677ed05a95

SHA1
00530c522ec830d81882fd6e22916f91feaeb835

SHA256
644dd6b8de2aae17731c40dfb0c7f207756f3b681fa683c065545032f0c03468

SHA512
a833cb8ea2321a325c3ae120c0161d30d7cd949fcc9e0d2cb69e11d768b0f209b040a7519a0b0295990027fcf4dc13ebed6d29ef6288bbe46bef86f5ab95d958

Download Submit
C:\Windows\SysWOW64\Egened32.exe

Filesize
79KB

MD5
3255511eac5a7c6b7deb2e298b5c2661

SHA1
35f55de8ed71b190436ac6002fd45756e86d5f92

SHA256
66135defb3950722edb59e47b50a028793b9028c4d4a9a4b4966aed4db25267e

SHA512
e2458f903d8cfe06a012b42bc55ede2df4ce59a832c759208d51ee21faae69f0eb8453827de827e494363a4bd40646224c20d33a921bb0af8d135f0ca2941c5d

Download Submit
C:\Windows\SysWOW64\Ehndnh32.exe

Filesize
79KB

MD5
446cdc9c5629966d5c8be38f9ba520af

SHA1
0624253e0d282b72a851550e6769285b35bcda29

SHA256
b71bc49813acf9eb2aa4737f39daed6dd2314e371631a708554321c743bc8d95

SHA512
e89c1aa8d969bcdaeb760bdeb3fd55f1518899fdb14c2c65064327398371f61c88a8194abc0bc394d15034aa35cd6aa1dbe8118239e3754224e8db35dda01f8e

Download Submit
C:\Windows\SysWOW64\Ehpadhll.exe

Filesize
79KB

MD5
5a02f59b0f0e680d4d85342706eb639c

SHA1
161221b34aaddc4b09d37436d06a8684f2dc0f4e

SHA256
e6ab33fd12dd54e42a14ea6bae10868ee0303574d5bd823e5e7d7173e32fa71d

SHA512
17712d39f1b63628d60cb9c9a5e26e0026d1300858e39ebe91c2778087f71cce02fa8b290ddd823c9d827215faacbca6b3f0176f77627e636e2a4ede3cc6c53f

Download Submit
C:\Windows\SysWOW64\Ekjded32.exe

Filesize
79KB

MD5
9c39fb19e5bca1057f37a7956684dfca

SHA1
506eaef5abae3b789a27055e74e0aef567035b1f

SHA256
c5598199118fb078934968a0471b0f070c67c6f529f46e0f1b85a7e8fcf814b4

SHA512
5a805817d31d1867175f028302b8f1ed667c2ad331addae2ddf121c076fca5b2c3123edb7ecb3353e914b21d2bc85701165b401393ad703292c7b4630d10adfc

Download Submit
C:\Windows\SysWOW64\Ekonpckp.exe

Filesize
79KB

MD5
f3d6d53948f8ce1c906913acfb33a290

SHA1
1c70edad2e0ce4408c34580587d24f2d84b35d79

SHA256
019304ccc04e05a923f7d9e6afe5b45c9a99fc90431b4f8e75768108a3c1c360

SHA512
327812f4879a3d9a7a3a587981cb5bc500192196c77ca556fe12ea16891f79affe715a16ab73ab13ef2ff6bd08cc3772785b1324d9034624cb886c11882eae61

Download Submit
C:\Windows\SysWOW64\Enkmfolf.exe

Filesize
79KB

MD5
39960a89d69b1e098da7b70bf856e6b6

SHA1
19f3520657b63a8a58db1897c8e65dbbfeec38bf

SHA256
53dde7e6c6c3a0d49904440113eec2461ead5b72aaa0000cd506faf2216e3294

SHA512
fde8f560fc937c206b86c96ab6844abfeac60198d920ff0e26de927722f7564a767558ca1fdfed29b89bc851de85bbdd09a2ebfd2afca9a2c7e91e7a2d386bdf

Download Submit
C:\Windows\SysWOW64\Enpfan32.exe

Filesize
79KB

MD5
afdfb9790a4950a3e8ebe7d8ae02f3a5

SHA1
b18cf204a06a2dbd8a0c319a6d1a36837e904045

SHA256
be4f2a1d3321034de0f2cd97d90ab1f9cd449aca15a9d786ae41135dda857317

SHA512
833332a3c915391edc350f4967b3b5ff2e3456c8983ca46e3f7d0230d2719c20e7962cda237a2878e0327cf57256664b3c62b32f52454e20aa17b42ccab964f9

Download Submit
C:\Windows\SysWOW64\Eqdpgk32.exe

Filesize
79KB

MD5
8d6a5742847d1ff129d2be87bb1efd84

SHA1
f91d49125205f126e7b6a134d064facf8862f006

SHA256
b10037ca2aacd47fa26281416012a26054865665b4ba006e15b2e11e5aca9aa2

SHA512
2a7f7a7ce26e7a20c4cc6648372f9d1281374ffd5789e69c27b3ecf3992010846e162a55799d39ca7d8f94d10c0d78c6d6994c7b87a4ce24b43dd3120311035f

Download Submit
C:\Windows\SysWOW64\Eqlfhjig.exe

Filesize
79KB

MD5
1ca0755abe845c77571de6a64614ca15

SHA1
bba4d237d9bdc7fdeb3e872494a5ceba7c7893fa

SHA256
1ad7796075cbe83189d2aef84b2de16bb00376ce897bbe31d7b24135cd8c4f62

SHA512
61775ed228021bc38982d8f8b7eb7a4b465f364fb7f2718953b61997f480a1f7bed80615b329bf4a58c1db5644dce52db18e8b7cb07f1a39d8ea1c17c0cf2d5d

Download Submit
C:\Windows\SysWOW64\Fajbjh32.exe

Filesize
79KB

MD5
34adbeff5c53d13347b7fa3099dd2855

SHA1
89fe14932452007b6eb75c5087789c806a63d37a

SHA256
e2a6a0da4c36ebc7580a5c6c75346330d9b1c936c4ae4004b48357771bf2fc70

SHA512
39dc654e12816aee89713f0e00389be4a5c99495a4debd2befe883bd9e941caf7b21ac2c0d3d099dc65cb7439189c81b3d85a1985371b707476edb8e0ca2cd34

Download Submit
C:\Windows\SysWOW64\Fgoakc32.exe

Filesize
79KB

MD5
4e241c874740d39a4aadfa7464ff525c

SHA1
2e6ae3de1e7671c99628ab0dbf5ed2c3b7dae5ce

SHA256
0d3c1be21640d120ef05f0b6987cfe0b2dab24b46d36c0b5be350f005dc0a716

SHA512
e375a20ffe455e55b7697f09cfe3c2c77a9c921fe503c0946dbf90e5f1adfd1ddef7cac171d92cc1ec0f7e2244ecb1d7c3a7020dfa3ec309c8f103c2c7c4b642

Download Submit
C:\Windows\SysWOW64\Fijdjfdb.exe

Filesize
79KB

MD5
4da9f751dfacec12dbde6cf7ca5e4520

SHA1
a75b904fdbc0e5e8f3d780b5ed5f93e8757bc09f

SHA256
a8c41fa55deb1deabe2aef3a3470c5325244b87a9e3997c8dcf909337a3132a8

SHA512
8ec4bca2f3ba9c499171f039db4adac9d9eebc6dd8ba39b09efbef62aae8d6d88d0cdc7d396c7354807a18c8e3e90fffdd3ca10bfb0f285691d1581821dc8728

Download Submit
C:\Windows\SysWOW64\Finnef32.exe

Filesize
79KB

MD5
7e9438ee3d14d50b1371d416fe62052a

SHA1
7c2d1bd567fdcace6cbd0cd6046535bbfe735034

SHA256
6354119204866f79e402d2c2ec4cb551c1e9146a6ebafce8d254587e485bda0b

SHA512
96b6793fcc8ea453364c22535162c99e353453293356affabf4f62726de719e23080473aacdb97f1f5e2bfc677fde7b5988343f8bc9f186be6abcd7ca2327884

Download Submit
C:\Windows\SysWOW64\Fiqjke32.exe

Filesize
79KB

MD5
739e0ca9a06d9cae69fbe3e29e09975d

SHA1
31b692ff2c7994b4c3fa533fce677eaf7bb1beca

SHA256
7f179fa85d145cb496c994f7807ae029ad6a1c6bb47c16108cea3305d1115728

SHA512
4391b37633d5c336b2f232ac7955cb4124160104d4551c69f85854b233e9d52a609b5a10a6583d88c0dcbd3e419b0ffa6db51dd2ce5d82554cfd22cb50d22919

Download Submit
C:\Windows\SysWOW64\Fkfcqb32.exe

Filesize
79KB

MD5
fb4d4285beffd1d2196d9f03b0771eba

SHA1
6271e25ad20139653053efab85081a834f303ed5

SHA256
11749beff2dd4ee244672bcf39f22ba1a73af091d4bb1b72c966ef44eb6dddb6

SHA512
50a15f65e89f18b4566e0a1a3a8c35e653a931fff9930f4ca7b99795f5bb6f917cb94e26d3d499e503ed60ad50c91100995d7934ca00d9c8e3d3be10171d020b

Download Submit
C:\Windows\SysWOW64\Fndpmndl.exe

Filesize
79KB

MD5
bcf196dd6587374ea5947051e5520ef1

SHA1
87fd1db566293229ad43285189ef7854f49a7cea

SHA256
5f73b6bc7e873834a1d84c307b4a2c3a5a799c08ceb9fd19c2412dd7e0ac31ab

SHA512
9908bf153b28a87bb97ab9522b21f8ccbb5193fd18e5e0273ed4a8e5ab6d98e693961048c0fb5d1fc591200674bc1839969d41c2b08fc4fff2399355063b8240

Download Submit
C:\Windows\SysWOW64\Fniihmpf.exe

Filesize
79KB

MD5
3a350ce27e7acc4d55e3b5c2e2a14e36

SHA1
4707a58d3f6d2b050fed7172fb132e4188de81b4

SHA256
a8001d5877aaedad8b6512df97b11f94896f2c74734819a1aec6dd160b10c4bf

SHA512
fd804e795ffe2349f15a99f358d4ed01f136bc573dd7082d3eb7b40c6d43deeaee4d518946c0c6bf3377252dfd27fa70302a06f24846e40f18360201b9decc7d

Download Submit
C:\Windows\SysWOW64\Fohfbpgi.exe

Filesize
79KB

MD5
ae3c7dcf1925b3510c3d0d3bcd423419

SHA1
35d5c5b3994b47cdf16de5c5cc127df5baac05ec

SHA256
b5a71953317935400514f6a496387391854a75629dcefab71a2956d0e765b868

SHA512
cd2596ce15ff7c3d2442887b6da1ec8fdc8180ad58e14d506f8de2868d3d2aff02815ed5d03d8ca96044f1bbcacd5084c1d31bc96b32c745ac1a65a72013cb78

Download Submit
C:\Windows\SysWOW64\Fooclapd.exe

Filesize
79KB

MD5
9e530784320ee0f2c9cff3b2ee5b1be8

SHA1
40bb5074ae85624ac6e05a3368bcc840d3e6c962

SHA256
65133160438912a6b9cb18945be4915dd6cb05b0dcf3d1946bba8cfdf4b6ee3f

SHA512
be69b24a2a1e0da35e0089e251420111dd2bc3a50d8edc26e68da3f7e641429e2cee605c8483bf06f15002f04a604c2063e5be1300a613669dd3709a679a21bb

Download Submit
C:\Windows\SysWOW64\Fqbliicp.exe

Filesize
79KB

MD5
de053e17565b556b31261c32a95d97e4

SHA1
3c2e29379842934f6742b214385e0c6189b4bcbf

SHA256
f72a642c6aa3fcda45a0b6c58774e1dec72ff996efdb40e0c0f6fba114c39961

SHA512
b4cf10db7660b94fa5de0190e78ca9ac98d4d45f52746aa68b83137863343e0c69d44d7ee0f2d1bbd90e07f893f3ccf202950ea61281b533a3eb3f73b3c8fd79

Download Submit
C:\Windows\SysWOW64\Fqeioiam.exe

Filesize
79KB

MD5
07d1389fc35d977435e29532ca5e3b3c

SHA1
6781db7241d88f57502ca3d40886097d1a42e15d

SHA256
90c7548a5e2714ee20181cf99fb1515d930b5d98cc486d2db1abea0c0902a9f3

SHA512
93fe7187ed94d4fdfb0a9ba495c244b33656c863aa17f6f18f64db9c5adb2940fa10a69935e3049d07b8a8a7892bf2ca88e2c47e1157a0e3ca9d819155ce1074

Download Submit
C:\Windows\SysWOW64\Fqppci32.exe

Filesize
79KB

MD5
44f977fa6e130bafe1396bc936f417da

SHA1
a2e05ef1e8daad488113912bef5635c77e521553

SHA256
9572981b3bee4b5ccb55299fde4649b54ed609c439dee71e3bc5788932e03f64

SHA512
149a183cf21df96b92dbbeaa1605bcf0c417cc4ead4ecd03cea128c0bb8b50f018bb37928bf9ef2609b76f48753805c8dcad6d56f0fd152e962b8b31d33a817d

Download Submit
C:\Windows\SysWOW64\Ganldgib.exe

Filesize
79KB

MD5
a74beeee8698e06d484fa1ba9f1257df

SHA1
e93d24128aa1b5502696796eb129b7f4b3e893c1

SHA256
7f475932e475d21f0df6e2aa445b1bc54f83c5767b3114d0571c42950ebba875

SHA512
eb994e0154eaf60729a4aceb6fa974c9e09638e63f54ca640f52029b1b6046cef0ed08da7d117150f716c923a4b55c1d732335d8322ec16532abd372d4ac3369

Download Submit
C:\Windows\SysWOW64\Gegkpf32.exe

Filesize
79KB

MD5
98f86858771ff98887a46770b72bf66c

SHA1
5805ee86da6b0f89c7fa1846db5af81dc9e2f5a2

SHA256
c6b6ba1e76fae72288ff978e622c18ab94661ffd249606cc4cca2811dd77241a

SHA512
033ae235159040443b2b7615f6b5ae6ae0d96b74f65b9f12e6873d31dee57c7ad7e43c53026a20be94a5de9a36d968ec865e0112050303dc557d52aa0d6fb983

Download Submit
C:\Windows\SysWOW64\Giljfddl.exe

Filesize
79KB

MD5
083c96d3725fc20f44623bd509c4bd89

SHA1
d0122b793e0c31d6d13364de8ab88f1cc39fb4a5

SHA256
3f5e9de18ff31a130c415bb0e9178426640f40b44074c7fb8cc39d5f32578a93

SHA512
39e4c1be5a3c3115fb04dcc4cc8667ca061d5fb80cab5083f83c586f0e9f42b05a9ce7fb3473ba62a07d8214e11f5e5e57d7164023925791395e86587a822b08

Download Submit
C:\Windows\SysWOW64\Gkaclqkk.exe

Filesize
79KB

MD5
618b24b9bbe380320d3bcd3c7cae1b79

SHA1
950cfcf48508dbb6bd85f5ada58bef7dd9030fce

SHA256
b3db37f03e5bd31c82c874f15ba864d2a831c23944d7a59844fab1c4bc7f3d17

SHA512
88a1df471ba2199f44533ab3453ed6708ae67b4c33e3579f0a2af4d21ccf5e25df9bcbb9672675109c564cde0aa292842b213e98652fe28ef7db381e713642c9

Download Submit
C:\Windows\SysWOW64\Gnblnlhl.exe

Filesize
79KB

MD5
ebb60314f1728a29ea62c9bb8d38a9b7

SHA1
758f91f426fd2fdd64205d9d7e3a5de5aca5d5f1

SHA256
ba87df40d91c052c6825167352ccf8d7bfb4904f6e82ff85736a5f1ff333d608

SHA512
d895cbc7a525791c476713a65d477aac7dd2af090aa950eb71f8478ce06e5e91f6e033092558f477a6aedcc94a30ed382ab5c7d243612c3982e8b745bb6f1fb7

Download Submit
C:\Windows\SysWOW64\Gnnccl32.exe

Filesize
79KB

MD5
3bb803afc15e07fc2e58435937f73bf3

SHA1
201abf041a65e8844ce039cf0c2347868fac2ae4

SHA256
5829e04b021d6b716b8d2aeef07342951567b01633d73ef5b7c4b3c0c4205f45

SHA512
ee494abcdc17ddce4d62ae71126cf046f6cf698d8781d58ddfa10072743dd6627c83b233050e000f14b6e2f5dee0b53efdf740ccc8c62dd503bb90c584fd1ae1

Download Submit
C:\Windows\SysWOW64\Haaaaeim.exe

Filesize
79KB

MD5
437a35b252730ab4894e853bdac4358b

SHA1
078bd28e15a7ee5f50689aaf79b824b7db990e76

SHA256
fc8e37387782ac4fcf59bcf2149dc9bdf13ef0d74fd073d0d1e93116ca7ab462

SHA512
8793f88ec7a2e04056a7ae5f0bb1ed4aeb1273dfa1564931ea3e6335945ddb4e3343d719662daa9a8ce3595941f153b702d59c87b0e0ce3757fe4525a7fee31b

Download Submit
C:\Windows\SysWOW64\Hpmhdmea.exe

Filesize
79KB

MD5
5c7c1304bf7c3452f84f9f54f4485267

SHA1
180d19b57518c32e7f163d627c83cb55fe187cbb

SHA256
5cbddeca8f557f0c9799e6f5a8e4cb58c17a316ed95148a07ad85b709bbb612c

SHA512
82255d3e47973c2ae15251c11ac3a67e01139369767afc1417de1c3e817e69df37553975bcde0a2bda7ef05359ebb18e3eb673c1336b68fed0e4fc9f033ac588

Download Submit
C:\Windows\SysWOW64\Kidben32.exe

Filesize
79KB

MD5
01addbb8dd54b38f108fe0f37432220e

SHA1
ddc9147def22b04d949116591bcd7d9334cb1245

SHA256
6d7d13c177a16f5727f106ad1e9195ec55bef0d9272aab91b15f02d036dc9be9

SHA512
ed96e47b05373734279bb25f15b48545a0bb9b6703055db0227a66dd3b5aa3355c7360d24f6d7599c2b48290d22134ece0652688c7e439be28fd8acc7d1009d5

Download Submit
C:\Windows\SysWOW64\Kofdhd32.exe

Filesize
64KB

MD5
2a8736a42a2159c9d164078c644cf670

SHA1
1401f35d28fd96935d63529ca69478ba0ba60500

SHA256
884b001675b35f592a80e805828e395d946e499b19d736bffb68aad1f280b2bd

SHA512
e30760ae9a993544f239bf197985ae362f6cc41569ba2bea2ec8665b10257d2b0312a702e86b06541f75b5afcd748b3e34da916f9ea4191b7ed64d22cb52c0a2

Download Submit
C:\Windows\SysWOW64\Lfiokmkc.exe

Filesize
79KB

MD5
2e3b9733ae0ab9f6ea99d096a818003b

SHA1
96ec24ce167aeb0b6eccd70684ea138167c79164

SHA256
a2357cd5fa0ee4658ab4240c6c3090606717383c6b65dae68efff4c6bdd4b19c

SHA512
13e71a543f299d10ae5afb4dbd471cf96c628e01e06b564f8c55775c00fd55bb8cb7c4b3f27d0c36e9cc6c36f1bbdc8bd83d266c77bbaee32cf7c092c1c3e5df

Download Submit
C:\Windows\SysWOW64\Mjnnbk32.exe

Filesize
79KB

MD5
33d22573bd73334a2b2b436f8cd51b3f

SHA1
ce113899bb1f25c025c41c28fe64eeed0f72de27

SHA256
a906bbc8e5a71445ef953781bfef0a0b112696c54dfded57b24bd63cbe76a263

SHA512
4ef8838f10cda8af365903ed844498158625298d9af4af39ac55a2d886842f6a0f1c07ed99263b25011fe5eafa1ada9f12a0d56ea322277538e1869573c901d4

Download Submit
C:\Windows\SysWOW64\Nijqcf32.exe

Filesize
79KB

MD5
51815cd83b00d461690a73b670caf4a5

SHA1
3ea26fcb53d7ecccf0c4b1380e2263f736836a75

SHA256
71204079b721e17d97be4662a7131fd3f100e1a1823993d610aa8497b2cb063d

SHA512
b34d56c969053a192f93e55ead7e56cf00528ebe93e85d6a1750d8644f159aa984cd0256dbf7c8ccd497275c2cbff065bd65ef1842538813f9fb18b16a67e08b

Download Submit
C:\Windows\SysWOW64\Nqcejcha.exe

Filesize
79KB

MD5
008f64dd739333f01ce8bac201e81370

SHA1
74b811770eacf28eba8f6f2321b057744d89456f

SHA256
b7565f66f526d57176f41d3560cb215100fc78cc17b9f5049ea17b27ed6f20f8

SHA512
a2a04fca1a797370cb8db6780aeae79b7f36662ca3b5f814e65ab57ab6c5998cd92d6dad01e6eb5b142c2cb2217aec24df11cc0ce7a2ff1a0b54e43aa77d55fd

Download Submit
C:\Windows\SysWOW64\Obqanjdb.exe

Filesize
79KB

MD5
1dbc2f2bb6db2c2f76c7500580cb1f77

SHA1
a25ad0aac9cf573dbaa9589c19c359811daf4efb

SHA256
4b42295d6178d700002a986fef080f422cefedd76baf61fbae828770854f98c0

SHA512
f7a7837e9af71bddfd2d2ef06ab2c1248e36e6099957aeefccda6f88d3025bb3a0ed56e102106d9f0c78670586ce4a841778b7bb39ba02b0704de2481521bc54

Download Submit
C:\Windows\SysWOW64\Oqklkbbi.exe

Filesize
79KB

MD5
35bb55917d6b73d3f5a880cb9c8956e5

SHA1
2642a409e1d1f6d81a2af7f7b7df8528760298e0

SHA256
1bb845b817c410e25cea9bff57f2023b32bc9b95a537e321bf58339330e1ae8a

SHA512
32710b698cf2d3b6fe0f98c30600d6f31cccf211666d070c98f3b0c825966ac6c9f855b95de1252922bd451fc09f1132089cdf23a4f363f0257922d523ccb2ef

Download Submit
C:\Windows\SysWOW64\Oqmhqapg.exe

Filesize
79KB

MD5
5139676a4a30e13c00b914d95a7dc2fd

SHA1
56369fdb2663aca05dc2bacc30e2b7aef81a8589

SHA256
093aacfa502304a9f4e2a518e5c5522f3a5d38258792bc4ff2484a63da5048b3

SHA512
1539f66c9d0b42d50472297a19eb01ba0a2a6df03fa068d499a391b1911cc7824faedd8232d58931931fa252f8aa6c8feb95f1f5c0c5b62d5bf2542cb43541ff

Download Submit
C:\Windows\SysWOW64\Pakdbp32.exe

Filesize
79KB

MD5
2f68673d6c4c19ffef70c5b53d03bdac

SHA1
904a9f0cd20f5ceaff1f06ad339802799495846b

SHA256
06d4a4fca704909b8d08014e664c24a9b83753c909ea57cc7f455eaa628ef906

SHA512
543d9b6ad4f196d21553191cca88b073b8ea4657ed25a80abc58a63ab273f7ade5d2054ed013eb2f4c5dac23ee42bf300d01f024fcf260e747887cc6ada0a0d2

Download Submit
C:\Windows\SysWOW64\Pbekii32.exe

Filesize
79KB

MD5
0ce6e558a923ceb8ffa002871b0cf5d1

SHA1
3cfb4077b92c2930c27b54e5a905db9b509141e3

SHA256
2919dc1e8abed0a6749929f22267145e01f4c3636a57ee06c8f0df160780a400

SHA512
98829c8b3e925e51c8750d7f5985a93cfe9354ad29c6eb560a8b358a5d86b841d41fb03e31bff96473b7d8370eae5ac4f8398282e5e2d656af46bcb13c36d22b

Download Submit
C:\Windows\SysWOW64\Piocecgj.exe

Filesize
79KB

MD5
90412148fc21009f18ed51227e4b0275

SHA1
a17d2809692056c36a8fd2d7b312ae3f1d4a4396

SHA256
0acca45473fe2595253f6d05aa3a691e44a2eb23d37abf781c086fe36516d132

SHA512
a2abcb57bf55e7ba081ac09e0271cc4627d71ed02131c3c632f0a0e38639a20e7e94ff3806ba857be109dd9239e6f5141ac72d3b06a024bd84df77c79d653ef6

Download Submit
C:\Windows\SysWOW64\Pjcikejg.exe

Filesize
79KB

MD5
1c71acfb43d54b5884a2e63c128fc5a0

SHA1
2463ae0dd98dec641015c849f5c3d4eaac7bbdce

SHA256
875207b65dca6d6edabc5036dc9a833549d327b7ce8b99d194e1eacbafc5cf70

SHA512
5896363bbd274ef1edbe85c5fbb850e1ac954f64ae3f73dc1782473cfe9e5cf9290b531963cb1800548a193bedae17767b10ec11521f9f5be04aabe21fc3a926

Download Submit
C:\Windows\SysWOW64\Ppdbgncl.exe

Filesize
79KB

MD5
c57268548efcad2d770b2416259aa416

SHA1
4e60990bf37baf39b694901f942c4369c66146f3

SHA256
c9480854997a0ec5083fe085aacf8e57600e5694c0965ae01132e9ee7a18bea0

SHA512
a99ecc3a52e8199b0c87cad08bc666c29a5286781881a9b999572d9dd47208b0944999ae7fe7ec86ff9bc87c8890137bdcf0c67fb281c83fbe28d99587cbb6d9

Download Submit
C:\Windows\SysWOW64\Pplhhm32.exe

Filesize
79KB

MD5
ec2cd99e1421548adf09bf30b97a1aad

SHA1
83cbe9faa0b2f26cc3efc817c2ac64519f563dec

SHA256
14e2ed0ca8215e4f8d27185af45ae3971cc10f94c5d46f710fa7438487067878

SHA512
e3c8b2441d65a5854b5f48b52cfe5d3300fe5413a57d1a796239b704fe53526c0f1641fd5c387c616cb8bd91485a2d28f298ca1f240ab7a8eeb0a5e1c8b58d99

Download Submit
C:\Windows\SysWOW64\Qfmfefni.exe

Filesize
79KB

MD5
b2f067a1a8effa7a310675438323da75

SHA1
a16d994ff43ff6b39304c3fb50b9e7a2dafa902b

SHA256
0503d4d397565b3ac55c6bce32fbb84ed11537d92055dbce811430465140b7c9

SHA512
f426bfbd5be621030eb3d3214dc1b5cbd398e80830f02d7317fcea55182e1c46ece66f4927e59199ccb9a46339c18bb5216969c1f00a1693aceb28b6d98a1343

Download Submit
C:\Windows\SysWOW64\Qiiflaoo.exe

Filesize
79KB

MD5
2bb255646b0cc03d90dd276ed6cf9918

SHA1
1aaac06dc321a12843e38eb48a34545288cd9d9c

SHA256
14e9a54ea496cd06f34a5925af5dde84ea4d4c3a36de793c1500e188769b96c8

SHA512
0e50012c57a3bc97c48b180018e1fca22c25d278c59c03a889272de5cd30047be38af2f1891b9f24d091fe4ec0f1c4e008f091b4582ae22d4157fb32bb2e574a

Download Submit
memory/116-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/216-509-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/624-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/856-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/944-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1036-104-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1324-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1372-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1372-573-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1380-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1436-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1436-594-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1564-479-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1608-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1616-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1740-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1800-527-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1812-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1820-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1944-491-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2028-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2076-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2108-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2108-587-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2168-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2324-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2500-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2580-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2628-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2628-559-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2676-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2724-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2744-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2788-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2820-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2880-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2912-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2968-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3052-473-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3060-497-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3076-279-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3080-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3176-489-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3212-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3412-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3484-580-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3484-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3492-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3504-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3584-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3584-552-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3632-533-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3656-566-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3656-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3712-149-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3768-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3888-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3940-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3952-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4000-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4008-248-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4016-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4116-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4180-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4196-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4208-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4220-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4372-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4384-515-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4416-160-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4444-521-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4460-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4504-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4544-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4580-449-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4736-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4760-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4760-539-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4760-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4764-503-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4776-208-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4876-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4896-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4900-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4992-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5040-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5044-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5088-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5156-540-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5216-546-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5260-553-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5304-560-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5348-567-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5392-574-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5436-581-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5484-588-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads