berbew | 46b765b82b92f13908a3af4627af5a8312f5d2a5360caf7445f719312ace88fd

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46b765b82b92f13908a3af4627af5a8312f5d2a5360caf7445f719312ace88fd.exe
Size 64KB
Sample260910-tlj4eascjh
SHA256 46b765b82b92f13908a3af4627af5a8312f5d2a5360caf7445f719312ace88fd
MD5 c0a2585d4ce0cfa273bccbecb59e37b7
SHA1 09278761d61d0980281ad98e92c758579ca1b50e
SHA512 76357a64e973907aa62a98b91a8361645aa223097f86dca0697b2a4aea27bdbb7bd15f3c628b2eef525d6f3450d368c8690915f57d6e72bd976baf459d72b295
SSDEEP 1536:huVz/BCcZHaXTb1grOR+sCbFBEzrOIXUwXfzwF:4VzAcFAlgrORUZBE/OcPzwF
TLSH
T1B7533AE252EA1141E0278D7D767532A18072AFE17BECE2057E34E18A54B120FDE35BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qihoak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpbgnecp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijkled32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iholohii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilmedf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnpjlajn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjkdlall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kocphojh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aimhmkgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kblpcndd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piolkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pehjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iloajfml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhhodg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcfkpjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Namegfql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nocbfjmc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odljjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Podkmgop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pokanf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mllccpfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igmoih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijbbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlidpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khabke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldkhlcnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdgahag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoagk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjihfbno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jacpcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qihoak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehfcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnpjlajn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kefbdjgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lacijjgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndlacapp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfknmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iloajfml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijbbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	46b765b82b92f13908a3af4627af5a8312f5d2a5360caf7445f719312ace88fd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koljgppp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Namegfql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhjjip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piolkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcijce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apddce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leabphmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lahbei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfjcep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbncbpqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkpnga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkqgno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lajokiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Noaeqjpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omaeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibbcfa32.exe

Executes dropped EXE 64 IoCs

pid	Process
3240	Igmoih32.exe
3664	Ijkled32.exe
732	Ibbcfa32.exe
3644	Iaedanal.exe
5108	Ieqpbm32.exe
2052	Iccpniqp.exe
1964	Iholohii.exe
2112	Ilmedf32.exe
4128	Inkaqb32.exe
4236	Ibgmaqfl.exe
1632	Iajmmm32.exe
4484	Idhiii32.exe
3756	Ihceigec.exe
4132	Iloajfml.exe
4768	Ijbbfc32.exe
1280	Jbijgp32.exe
4568	Jaljbmkd.exe
1228	Jehfcl32.exe
4896	Jdjfohjg.exe
2824	Jhfbog32.exe
3400	Jlanpfkj.exe
1620	Jnpjlajn.exe
3712	Jblflp32.exe
4560	Janghmia.exe
3872	Jdmcdhhe.exe
4832	Jhhodg32.exe
3464	Jldkeeig.exe
1860	Jnbgaa32.exe
4204	Jbncbpqd.exe
1136	Jaqcnl32.exe
4576	Jelonkph.exe
3784	Jhkljfok.exe
5080	Jlfhke32.exe
4796	Jjihfbno.exe
4760	Jnedgq32.exe
1792	Jacpcl32.exe
4876	Jeolckne.exe
5104	Jdalog32.exe
3064	Jlidpe32.exe
4596	Jjkdlall.exe
3940	Jogqlpde.exe
3448	Jaemilci.exe
3552	Jeaiij32.exe
2040	Jhoeef32.exe
864	Jlkafdco.exe
1016	Jjnaaa32.exe
2636	Kbeibo32.exe
1652	Kahinkaf.exe
216	Kdffjgpj.exe
692	Khabke32.exe
2108	Kkpnga32.exe
3876	Koljgppp.exe
3600	Kajfdk32.exe
1056	Kefbdjgm.exe
4916	Kdhbpf32.exe
2504	Klpjad32.exe
2692	Kalcik32.exe
3912	Kehojiej.exe
1004	Kdkoef32.exe
3920	Klbgfc32.exe
2076	Kkegbpca.exe
4448	Kblpcndd.exe
1344	Kaopoj32.exe
1176	Kejloi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jnbgaa32.exe	Jldkeeig.exe
File created	C:\Windows\SysWOW64\Lefkkg32.exe	Lajokiaa.exe
File opened for modification	C:\Windows\SysWOW64\Mekdffee.exe	Mclhjkfa.exe
File created	C:\Windows\SysWOW64\Kchhih32.dll	Mekdffee.exe
File created	C:\Windows\SysWOW64\Ndidna32.exe	Nefdbekh.exe
File created	C:\Windows\SysWOW64\Pfqdbl32.dll	Ncjdki32.exe
File created	C:\Windows\SysWOW64\Obkahddl.exe	Ochamg32.exe
File opened for modification	C:\Windows\SysWOW64\Ocknbglo.exe	Oooaah32.exe
File created	C:\Windows\SysWOW64\Dlqgpnjq.dll	Pfncia32.exe
File created	C:\Windows\SysWOW64\Dbooabbb.dll	Qifbll32.exe
File opened for modification	C:\Windows\SysWOW64\Oloipmfd.exe	Odgqopeb.exe
File opened for modification	C:\Windows\SysWOW64\Kajfdk32.exe	Koljgppp.exe
File opened for modification	C:\Windows\SysWOW64\Odedipge.exe	Ocdgahag.exe
File opened for modification	C:\Windows\SysWOW64\Ookhfigk.exe	Okolfj32.exe
File created	C:\Windows\SysWOW64\Mkbdql32.dll	Ocknbglo.exe
File created	C:\Windows\SysWOW64\Mqkbjk32.dll	Aijlgkjq.exe
File created	C:\Windows\SysWOW64\Kbeibo32.exe	Jjnaaa32.exe
File created	C:\Windows\SysWOW64\Epqblnhh.dll	Kemhei32.exe
File opened for modification	C:\Windows\SysWOW64\Lddble32.exe	Leabphmp.exe
File created	C:\Windows\SysWOW64\Lkqgno32.exe	Lhbkac32.exe
File created	C:\Windows\SysWOW64\Ieaqqigc.dll	Lhbkac32.exe
File created	C:\Windows\SysWOW64\Oljoen32.exe	Odbgdp32.exe
File created	C:\Windows\SysWOW64\Podkmgop.exe	Pmeoqlpl.exe
File created	C:\Windows\SysWOW64\Lbqinm32.exe	Lkiamp32.exe
File created	C:\Windows\SysWOW64\Jmjdlb32.dll	Lbqinm32.exe
File created	C:\Windows\SysWOW64\Dfidek32.dll	Ldkhlcnb.exe
File created	C:\Windows\SysWOW64\Dcmlbk32.dll	Mkepineo.exe
File opened for modification	C:\Windows\SysWOW64\Podkmgop.exe	Pmeoqlpl.exe
File created	C:\Windows\SysWOW64\Pkbpfi32.dll	Iccpniqp.exe
File created	C:\Windows\SysWOW64\Llpchaqg.exe	Lhdggb32.exe
File created	C:\Windows\SysWOW64\Odgqopeb.exe	Obidcdfo.exe
File created	C:\Windows\SysWOW64\Jnedgq32.exe	Jjihfbno.exe
File opened for modification	C:\Windows\SysWOW64\Kahinkaf.exe	Kbeibo32.exe
File created	C:\Windows\SysWOW64\Hnggccfl.dll	Logicn32.exe
File opened for modification	C:\Windows\SysWOW64\Nlqloo32.exe	Ndidna32.exe
File created	C:\Windows\SysWOW64\Lgilmo32.dll	Akihcfid.exe
File opened for modification	C:\Windows\SysWOW64\Jlkafdco.exe	Jhoeef32.exe
File created	C:\Windows\SysWOW64\Nfknmd32.exe	Ncmaai32.exe
File created	C:\Windows\SysWOW64\Nlefjnno.exe	Nhjjip32.exe
File opened for modification	C:\Windows\SysWOW64\Nlgbon32.exe	Nfnjbdep.exe
File created	C:\Windows\SysWOW64\Fddogn32.dll	Piolkm32.exe
File created	C:\Windows\SysWOW64\Pomncfge.exe	Pmoagk32.exe
File opened for modification	C:\Windows\SysWOW64\Acppddig.exe	Apddce32.exe
File created	C:\Windows\SysWOW64\Pehjfm32.exe	Pbimjb32.exe
File opened for modification	C:\Windows\SysWOW64\Lhbkac32.exe	Ldfoad32.exe
File created	C:\Windows\SysWOW64\Bochcckb.dll	Jldkeeig.exe
File created	C:\Windows\SysWOW64\Dcmnee32.dll	Jhoeef32.exe
File created	C:\Windows\SysWOW64\Lacijjgi.exe	Lbqinm32.exe
File created	C:\Windows\SysWOW64\Bbndhppc.dll	Pdngpo32.exe
File opened for modification	C:\Windows\SysWOW64\Kblpcndd.exe	Kkegbpca.exe
File created	C:\Windows\SysWOW64\Hfdgep32.dll	Odgqopeb.exe
File created	C:\Windows\SysWOW64\Odjmdocp.exe	Obkahddl.exe
File created	C:\Windows\SysWOW64\Kkpdnm32.dll	Pmmeak32.exe
File opened for modification	C:\Windows\SysWOW64\Ldbefe32.exe	Lacijjgi.exe
File created	C:\Windows\SysWOW64\Oojnjjli.dll	Kahinkaf.exe
File created	C:\Windows\SysWOW64\Koljgppp.exe	Kkpnga32.exe
File opened for modification	C:\Windows\SysWOW64\Pbddobla.exe	Pcbdcf32.exe
File created	C:\Windows\SysWOW64\Iccpniqp.exe	Ieqpbm32.exe
File created	C:\Windows\SysWOW64\Jogqlpde.exe	Jjkdlall.exe
File created	C:\Windows\SysWOW64\Jlkafdco.exe	Jhoeef32.exe
File created	C:\Windows\SysWOW64\Klddlckd.exe	Khihld32.exe
File opened for modification	C:\Windows\SysWOW64\Nhbciqln.exe	Mdghhb32.exe
File created	C:\Windows\SysWOW64\Nfoceoni.dll	Nlnpio32.exe
File opened for modification	C:\Windows\SysWOW64\Ijkled32.exe	Igmoih32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lolcnman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohqpjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeaiij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkapelka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdgahag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odljjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmhkflnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koljgppp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhbkac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qihoak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abpcja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijkled32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iccpniqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jacpcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhmafcnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkepineo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdghhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofijnbkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pehjfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iholohii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iloajfml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlgbon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofoki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbgqdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbimjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piceflpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhfbog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhoeef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldbefe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lehhqg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibbcfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijbbfc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Janghmia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klpjad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcjldk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oljoen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odedipge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igmoih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jldkeeig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnbgaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbnlim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mociol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlcidopb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okmpqjad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdngpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilmedf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkqgno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lajokiaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhiabbdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlefjnno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfpghccm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ookhfigk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obpkcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46b765b82b92f13908a3af4627af5a8312f5d2a5360caf7445f719312ace88fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieqpbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idhiii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhhodg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaqcnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khabke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omaeem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmeoqlpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inkaqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnedgq32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jblflp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obidcdfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkclkjqn.dll"	Leabphmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohqpjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kblpcndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmkjoj32.dll"	Jdalog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcmnee32.dll"	Jhoeef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkegbpca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lefkkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbpijjbj.dll"	Odbgdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aofbkbfe.dll"	Podkmgop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaemilci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlqloo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kahinkaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhalpn32.dll"	Mkgmoncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngkpgkbd.dll"	Nlcidopb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nocbfjmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jaemilci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkglgq32.dll"	Mcfkpjng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnpjlajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhomgchl.dll"	Jjihfbno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbdpdane.dll"	Lcjldk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odbgdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oloipmfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocknbglo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akihcfid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjbah32.dll"	Klddlckd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofbmdj32.dll"	Iaedanal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jogqlpde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhbciqln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aijlgkjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iccpniqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qkdohg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kajfdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdlmhj32.dll"	Ldfoad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llpchaqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohhbfe32.dll"	Medglemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnpkiqbe.dll"	Jblflp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmbpeafn.dll"	Klpjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acibndof.dll"	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihceigec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlfhke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlkafdco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llkjmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oofial32.dll"	Lkqgno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncmaai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocdgahag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lajokiaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mekdffee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbqmiln.dll"	Nfpghccm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obkahddl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apddce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Noaeqjpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjihfbno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kalcik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ookhfigk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlidpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klpjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnggccfl.dll"	Logicn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdnebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgfaf32.dll"	Ndlacapp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edkakncg.dll"	Nhgmcp32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3240	3184	46b765b82b92f13908a3af4627af5a8312f5d2a5360caf7445f719312ace88fd.exe	87
PID 3240 wrote to memory of 3664	3240	Igmoih32.exe	88
PID 3664 wrote to memory of 732	3664	Ijkled32.exe	89
PID 732 wrote to memory of 3644	732	Ibbcfa32.exe	90
PID 3644 wrote to memory of 5108	3644	Iaedanal.exe	91
PID 5108 wrote to memory of 2052	5108	Ieqpbm32.exe	92
PID 2052 wrote to memory of 1964	2052	Iccpniqp.exe	93
PID 1964 wrote to memory of 2112	1964	Iholohii.exe	94
PID 2112 wrote to memory of 4128	2112	Ilmedf32.exe	95
PID 4128 wrote to memory of 4236	4128	Inkaqb32.exe	96
PID 4236 wrote to memory of 1632	4236	Ibgmaqfl.exe	97
PID 1632 wrote to memory of 4484	1632	Iajmmm32.exe	98
PID 4484 wrote to memory of 3756	4484	Idhiii32.exe	99
PID 3756 wrote to memory of 4132	3756	Ihceigec.exe	100
PID 4132 wrote to memory of 4768	4132	Iloajfml.exe	101
PID 4768 wrote to memory of 1280	4768	Ijbbfc32.exe	102
PID 1280 wrote to memory of 4568	1280	Jbijgp32.exe	103
PID 4568 wrote to memory of 1228	4568	Jaljbmkd.exe	104
PID 1228 wrote to memory of 4896	1228	Jehfcl32.exe	105
PID 4896 wrote to memory of 2824	4896	Jdjfohjg.exe	106
PID 2824 wrote to memory of 3400	2824	Jhfbog32.exe	107
PID 3400 wrote to memory of 1620	3400	Jlanpfkj.exe	108
PID 1620 wrote to memory of 3712	1620	Jnpjlajn.exe	109
PID 3712 wrote to memory of 4560	3712	Jblflp32.exe	110
PID 4560 wrote to memory of 3872	4560	Janghmia.exe	111
PID 3872 wrote to memory of 4832	3872	Jdmcdhhe.exe	112
PID 4832 wrote to memory of 3464	4832	Jhhodg32.exe	113
PID 3464 wrote to memory of 1860	3464	Jldkeeig.exe	114
PID 1860 wrote to memory of 4204	1860	Jnbgaa32.exe	115
PID 4204 wrote to memory of 1136	4204	Jbncbpqd.exe	116
PID 1136 wrote to memory of 4576	1136	Jaqcnl32.exe	117
PID 4576 wrote to memory of 3784	4576	Jelonkph.exe	118
PID 3784 wrote to memory of 5080	3784	Jhkljfok.exe	119
PID 5080 wrote to memory of 4796	5080	Jlfhke32.exe	120
PID 4796 wrote to memory of 4760	4796	Jjihfbno.exe	121
PID 4760 wrote to memory of 1792	4760	Jnedgq32.exe	122
PID 1792 wrote to memory of 4876	1792	Jacpcl32.exe	123
PID 4876 wrote to memory of 5104	4876	Jeolckne.exe	124
PID 5104 wrote to memory of 3064	5104	Jdalog32.exe	125
PID 3064 wrote to memory of 4596	3064	Jlidpe32.exe	126
PID 4596 wrote to memory of 3940	4596	Jjkdlall.exe	127
PID 3940 wrote to memory of 3448	3940	Jogqlpde.exe	128
PID 3448 wrote to memory of 3552	3448	Jaemilci.exe	129
PID 3552 wrote to memory of 2040	3552	Jeaiij32.exe	130
PID 2040 wrote to memory of 864	2040	Jhoeef32.exe	131
PID 864 wrote to memory of 1016	864	Jlkafdco.exe	132
PID 1016 wrote to memory of 2636	1016	Jjnaaa32.exe	133
PID 2636 wrote to memory of 1652	2636	Kbeibo32.exe	134
PID 1652 wrote to memory of 216	1652	Kahinkaf.exe	135
PID 216 wrote to memory of 692	216	Kdffjgpj.exe	136
PID 692 wrote to memory of 2108	692	Khabke32.exe	137
PID 2108 wrote to memory of 3876	2108	Kkpnga32.exe	138
PID 3876 wrote to memory of 3600	3876	Koljgppp.exe	139
PID 3600 wrote to memory of 1056	3600	Kajfdk32.exe	140
PID 1056 wrote to memory of 4916	1056	Kefbdjgm.exe	141
PID 4916 wrote to memory of 2504	4916	Kdhbpf32.exe	142
PID 2504 wrote to memory of 2692	2504	Klpjad32.exe	143
PID 2692 wrote to memory of 3912	2692	Kalcik32.exe	144
PID 3912 wrote to memory of 1004	3912	Kehojiej.exe	145
PID 1004 wrote to memory of 3920	1004	Kdkoef32.exe	146
PID 3920 wrote to memory of 2076	3920	Klbgfc32.exe	147
PID 2076 wrote to memory of 4448	2076	Kkegbpca.exe	148
PID 4448 wrote to memory of 1344	4448	Kblpcndd.exe	149
PID 1344 wrote to memory of 1176	1344	Kaopoj32.exe	150

C:\Users\Admin\AppData\Local\Temp\46b765b82b92f13908a3af4627af5a8312f5d2a5360caf7445f719312ace88fd.exe
"C:\Users\Admin\AppData\Local\Temp\46b765b82b92f13908a3af4627af5a8312f5d2a5360caf7445f719312ace88fd.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\Igmoih32.exe
  C:\Windows\system32\Igmoih32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\Ijkled32.exe
    C:\Windows\system32\Ijkled32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\SysWOW64\Ibbcfa32.exe
      C:\Windows\system32\Ibbcfa32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:732
    - - C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3644
      - C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Iholohii.exe
        
        C:\Windows\system32\Iholohii.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Ibgmaqfl.exe
        
        C:\Windows\system32\Ibgmaqfl.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Ihceigec.exe
        
        C:\Windows\system32\Ihceigec.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Jhfbog32.exe
        
        C:\Windows\system32\Jhfbog32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\Jlanpfkj.exe
        
        C:\Windows\system32\Jlanpfkj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Jnbgaa32.exe
        
        C:\Windows\system32\Jnbgaa32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\Jaqcnl32.exe
        
        C:\Windows\system32\Jaqcnl32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\SysWOW64\Jjnaaa32.exe
        
        C:\Windows\system32\Jjnaaa32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Kahinkaf.exe
        
        C:\Windows\system32\Kahinkaf.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Kdffjgpj.exe
        
        C:\Windows\system32\Kdffjgpj.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\SysWOW64\Kefbdjgm.exe
        
        C:\Windows\system32\Kefbdjgm.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Kehojiej.exe
        
        C:\Windows\system32\Kehojiej.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        65⤵
        Executes dropped EXE
        
        PID:1176
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        66⤵
        Drops file in System32 directory
        
        PID:1872
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        67⤵
        Modifies registry class
        
        PID:4296
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:944
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4696
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        72⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2436
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        74⤵
        Drops file in System32 directory
        
        PID:4344
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1908
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        78⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2012
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        80⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        82⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        83⤵
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        84⤵
        
        PID:888
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2036
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3200
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2536
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        92⤵
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Lhdggb32.exe
        
        C:\Windows\system32\Lhdggb32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Llpchaqg.exe
        
        C:\Windows\system32\Llpchaqg.exe
        94⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Loopdmpk.exe
        
        C:\Windows\system32\Loopdmpk.exe
        95⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Lcjldk32.exe
        
        C:\Windows\system32\Lcjldk32.exe
        96⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Lehhqg32.exe
        
        C:\Windows\system32\Lehhqg32.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Windows\SysWOW64\Ldkhlcnb.exe
        
        C:\Windows\system32\Ldkhlcnb.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Mlbpma32.exe
        
        C:\Windows\system32\Mlbpma32.exe
        99⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mkepineo.exe
        
        C:\Windows\system32\Mkepineo.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\Mclhjkfa.exe
        
        C:\Windows\system32\Mclhjkfa.exe
        101⤵
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        102⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Mdnebc32.exe
        
        C:\Windows\system32\Mdnebc32.exe
        103⤵
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Mhiabbdi.exe
        
        C:\Windows\system32\Mhiabbdi.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Windows\SysWOW64\Mkgmoncl.exe
        
        C:\Windows\system32\Mkgmoncl.exe
        105⤵
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        107⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Mhknhabf.exe
        
        C:\Windows\system32\Mhknhabf.exe
        108⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        110⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Medglemj.exe
        
        C:\Windows\system32\Medglemj.exe
        112⤵
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        114⤵
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        115⤵
        Drops file in System32 directory
        
        PID:2916
        
        C:\Windows\SysWOW64\Nkapelka.exe
        
        C:\Windows\system32\Nkapelka.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        117⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Nefdbekh.exe
        
        C:\Windows\system32\Nefdbekh.exe
        118⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        119⤵
        Drops file in System32 directory
        
        PID:1856
        
        C:\Windows\SysWOW64\Nlqloo32.exe
        
        C:\Windows\system32\Nlqloo32.exe
        120⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        121⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        122⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        125⤵
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        126⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Ncmaai32.exe
        
        C:\Windows\system32\Ncmaai32.exe
        128⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5716
        
        C:\Windows\SysWOW64\Nhjjip32.exe
        
        C:\Windows\system32\Nhjjip32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5820
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        132⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        134⤵
        Drops file in System32 directory
        
        PID:6016
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:940
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        137⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Nfpghccm.exe
        
        C:\Windows\system32\Nfpghccm.exe
        138⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        139⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\Oohkai32.exe
        
        C:\Windows\system32\Oohkai32.exe
        142⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1556
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        145⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        147⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Odgqopeb.exe
        
        C:\Windows\system32\Odgqopeb.exe
        149⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        150⤵
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        151⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        152⤵
        Drops file in System32 directory
        
        PID:5036
        
        C:\Windows\SysWOW64\Obkahddl.exe
        
        C:\Windows\system32\Obkahddl.exe
        153⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        154⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Omaeem32.exe
        
        C:\Windows\system32\Omaeem32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        156⤵
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Ocknbglo.exe
        
        C:\Windows\system32\Ocknbglo.exe
        157⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        160⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        161⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        163⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        164⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Windows\SysWOW64\Podkmgop.exe
        
        C:\Windows\system32\Podkmgop.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6172
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        169⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6340
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        171⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Windows\SysWOW64\Pmmeak32.exe
        
        C:\Windows\system32\Pmmeak32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6496
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        175⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6544
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        179⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        182⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6912
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6952
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:6992
        
        C:\Windows\SysWOW64\Aijlgkjq.exe
        
        C:\Windows\system32\Aijlgkjq.exe
        187⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        188⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7116
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        190⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        191⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6284
        
        C:\Windows\SysWOW64\Amhdmi32.exe
        
        C:\Windows\system32\Amhdmi32.exe
        193⤵
        
        PID:6356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Afnlpohj.exe

Path C:\Windows\SysWOW64\Afnlpohj.exe
Size 64KB
SHA256 a4630ff8c1d8c6a4313f7519bf059dadaedff7f62b364f9328e90f38b770befe
MD5 a3608be8a7e29b84d20d049cb2c8fde5
SHA1 84ca60b61b04376149235368f636248f73779894
SHA512 c952a32ebfb3a6b3b532a28cd8ce57c035e18f2ac897e88c8f25129aba0c6cec8ea4e0d87ed56b831fb666dc629f8d016b87b1d85d914405ca0646637b6c6856
SSDEEP 1536:CvQ5JWWlRl3roQcLnBoeQbHuyXUwXfzwF:CvQLnd3rPSnIju2PzwF
TLSH
T14D533946B2EA58EEEC670D350DA11292147ABCE547E0E244DC64C1BA46E01CD6FF7F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iaedanal.exe

Path C:\Windows\SysWOW64\Iaedanal.exe
Size 64KB
SHA256 0b6fe86ce826530ea53b79a54d581c05d4a7be91e6e68930d715ab5de37693db
MD5 f453bce8a4c175af16f6f7324da0d7cc
SHA1 f6e3b9a7a95976c4ad1cd32ad13cb5cdcc2f9ef3
SHA512 29e65d9cdaf290577bf10b47a223b428fb3d3aab895e678b77013f9c6215c535ab321cf0a1f8a09a8dda19b1179c6ce6f5da8dd8386c29d907b31ac871352501
SSDEEP 768:VTZVl7CqPHObEbk2tsU9W6FvFqBDQ1+Pu0nSed92/1H5y9h6XJ1IwEGp9ThfzyYW:VlVl7CwHoEmqaoejcfXUwXfzwF
TLSH
T104531792EAF609E1F4475E3016A1125230BDB9D28FE4E2555CEDC8DB81F820CAF15E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iajmmm32.exe

Path C:\Windows\SysWOW64\Iajmmm32.exe
Size 64KB
SHA256 b1fde7b674463950645a105dbc0ba749cb1f39e4555b62c081c8f9d493ddf128
MD5 174aa86c84d4dbc5961d3a57974b61f7
SHA1 45e494877040dcc32e07e2b395a2e38c840a0080
SHA512 d495bb6310ef0b2da52dd38a68e522a1b376826aed0bff1b1a82dfdeb83fff48a367f91669f17816becf787c2717734b698212b52e27d1a60a37506f538dac86
SSDEEP 1536:LI7+qXKgPJZ+ETWZhHYfxQ5k0HTXUwXfzwF:U7+4KUJZpTWZ9bHXPzwF
TLSH
T19653D69B67DA3441DC2B3D750AE062D190EBACA59BA1C048FD2CD05A58D12089DE7FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibbcfa32.exe

Path C:\Windows\SysWOW64\Ibbcfa32.exe
Size 64KB
SHA256 56c991b571d774b9028cdfe51fc75872d72d0848933662426bf2de4b085f4649
MD5 98f0ae086a20effa39d6cd92d01b340e
SHA1 f40771f472d481af8608f2babd2c56bc9f113c38
SHA512 a95c9678f31a77d959a6747447d36ef505ce21dbe8cbee7926b112d821464baee807af19503cea33079649bf3afef804ddf57d2dfeda79767ad176ea2e13e289
SSDEEP 1536:XEKDpWMDah0vIDdNZ5ccVVnFLXUwXfzwF:XJ05hhdNpVnFfPzwF
TLSH
T1E353299B52F6C456F4731D349DA2F2D1007C6ADE27E8C1970C25D37F49E2248AC66B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibgmaqfl.exe

Path C:\Windows\SysWOW64\Ibgmaqfl.exe
Size 64KB
SHA256 e84be17dd53d99ca8468be9267d177bf3cd477f90fd6795179c8ac442c8d8427
MD5 d3031943d15ffadd0be28cbce744fe81
SHA1 a8554a16ecf1007779c0aa1aae19f570cc9c9ab2
SHA512 dc19499a06b9db207ecf7b04713ab699b32fe80a0e2905102f58422589f9c6fb3dceaa184f21c3aeefa5389c0f091787baa84af1b59b94b2ae11082dadff44d0
SSDEEP 768:2uPLW66xGfG/KLE47v9i4pan6IdyEr3ak6EJHQNWL/1H5E16XJ1IwEGp9ThfzyYW:1Kh7W9D9iAzcyE/lwCzXUwXfzwF
TLSH
T175533B9762E91442C25B6AB842A8E38230A5ECD1D7D5C2D45D27E0B70CE62CC6F3DBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iccpniqp.exe

Path C:\Windows\SysWOW64\Iccpniqp.exe
Size 64KB
SHA256 7e830f4fceecca99d54a703215bad20d5191ac70d84fa65ca31e27a5fc75aee9
MD5 15b7b301bfc19b378d0ac9d63dcdf558
SHA1 b4ee4f4443dfb2e069e94c13f2b31b651b59d6d6
SHA512 fa1c51ebabdabe0bf8cdde8f652caf4efe917bf3e4f416ab037db77dcd508c7367a55927e594e02a3af978ee56391ca15e91f7f28b8b352a66f9cae2b71fc0de
SSDEEP 768:lh8VJi8vO0uYV3O4QL23ErVdIXAHQ+06D3QmV3zqd/1H5p6XJ1IwEGp9ThfzyYsl:lha0rYVe4QYErVp0s3QmVGuXUwXfzwF
TLSH
T1475329A223EBD481D8275E772991625270B16DEAD7D8D3DC1F20D34E20B623CDD61B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Idhiii32.exe

Path C:\Windows\SysWOW64\Idhiii32.exe
Size 64KB
SHA256 45a6e8e51191b23733cfce5f3a5a8b363499ccdddff45d46851b502c516342ec
MD5 9a8c8968d41c9abcdc1e316b9f9f071b
SHA1 d03a2187d42503b7cdaed1886d75a2e4c86e77c9
SHA512 13351eec30ab95aa30d400c2e4dcd567eccd3c327ce41628333292be9808f64443fb9f3f36d87bf6342e411226eb0a4fde62743daa4f3b3bb1ab160ec4581a79
SSDEEP 1536:gY61OjtcFjgJLSfEdYS05Pmz/nWwFhS0kuPgK3XUwXfzwF:0Lmzegk0TDPzwF
TLSH
T15B534A9F56AA0D42FC170B781A9ED243D27AA9E2F7F0C1392CA4D345159130CAD71BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ieqpbm32.exe

Path C:\Windows\SysWOW64\Ieqpbm32.exe
Size 64KB
SHA256 11c17d16e88f34d920cd44533eb87eb196653bfeaefac85ecb9c98f0e924503a
MD5 e600f907e0d038b7bd87a27b12f6fe00
SHA1 1704ffbcccdf51f221c084158be1747123ccd7ee
SHA512 359b397ff1011273c5ed6691af934ba381e59e9c5f2e36355d5dce0125998c5962d8f5c8b8e679c729653cef29ea399ed1dddff1ffac01a3ad5fb7ae63c3b9b4
SSDEEP 1536:+YusytySjGR36kM2AKx929Jizlxs1M5XUwXfzwF:+YwypH6JiuM9PzwF
TLSH
T19953199396FA0452F0E34E7207A53A5210619DF077F4ED689CE5F2C6A4A637CBC21B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Igmoih32.exe

Path C:\Windows\SysWOW64\Igmoih32.exe
Size 64KB
SHA256 a7ab6f2410a9fd342008e414d43d318602d90ecce3ba76a61574517ade219a46
MD5 0cc2b9dae4e1f7a56ef21c1e2c601ee0
SHA1 fe9fcc203e60a1233662a8a34fc75f1e13821e0e
SHA512 28bdb7caceb47ef44991f5d67811dd7ab6e600f880a1cfe0d777d96f27a78ef0d9f9e775469aa68fcfe72631b73554ea9000a4950dc1115ce88d87d3e0520d12
SSDEEP 768:tjVgs9xQwg2LSqcTPtK6pZPtyNcBz6iYphWblCN/1H53z6XJ1IwEGp9ThfzyYsHF:tjVj9xQ72LSq0NryNcMLHpeXUwXfzwF
TLSH
T19D53F65263EE0583F41F1D7CCA606E91747E9AE887E4D0788F25D4BE78F12086C26B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ihceigec.exe

Path C:\Windows\SysWOW64\Ihceigec.exe
Size 64KB
SHA256 7d1afaec9ced7c4b4eeb00c112bd1685eae0006ccc73debac7e71e271515d977
MD5 6afb33676eef4786743c264f96f418eb
SHA1 c270f51d2bc379ebddf1b0da74835a877ded812e
SHA512 faebb68bb7195b3d3dd9851000040be496c3cba6a58de195e72b0615c4a3cbe9b17840cd18da5c21888959b8b2befb0f508fe4429bb11f3aab7ff5f310e5ac8d
SSDEEP 768:B8j0JZkQHxM3xL5nsYh+gQD0tGDzvO8IhD2y6vR/1H5p6XJ1IwEGp9ThfzyYsHF:ds3cYaD0wDTO8gkL2XUwXfzwF
TLSH
T19F532AB267FAC085E5170F38D965624B10B1A7F64BE0C198EC18E04A7DE4F4CAD64BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iholohii.exe

Path C:\Windows\SysWOW64\Iholohii.exe
Size 64KB
SHA256 e875c674c72181f2eec4544db3846f9817d875c3f113ee258ef1eb16ee374b2a
MD5 07eb2be02380f46eecdd0d509600ff47
SHA1 40e7bc4f452df6cc21c0022efba59c0b296d74f4
SHA512 747ed24e45314b798b9fe7ed58d9c64f1abe16ebcaaaa80472e7c129132fa1134c21aa717f9cff980d7e5ee8d65d1ec53940bc0345b66659278f158a14409412
SSDEEP 768:v8t1Mte9zxqm72Ttov+gOUIPVofdQK4+bWescqKb/LaRl/1H556XJ1IwEGp9Thf6:vBI4pRFPK4+6ecfGXUwXfzwF
TLSH
T17953085663EB0C82E4935DBC17BDA3931062EDD1EFE8D6544C21D19A04A8719AF33F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ijbbfc32.exe

Path C:\Windows\SysWOW64\Ijbbfc32.exe
Size 64KB
SHA256 d6d4abf2f7c672abab20c521f2fa6c70717f59aadd270264d1de580447c6bd41
MD5 49c2484177054ae8d3425a2137c895ab
SHA1 94ede4911822f44beaaefc41cc2c4eea8ce5f2e8
SHA512 fcfc76c5df9af909157f208879cb59e2ef71cec81a2c362a05463f65b0d8412c9532238e9e3d2ac98d77842f78cca0622df05c6fbba2c93998fee2a069c79ce0
SSDEEP 1536:PQwNjO8HQMgyOaocTJAsVk784dSpQTAXUwXfzwF:PQwNjO8HQMgh3cNAsVr4dIQTEPzwF
TLSH
T14A534B5E72EE0180F4AB9E7005AF669220726CE5DBFCC2549D23C546A4ED30C9F25F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ijkled32.exe

Path C:\Windows\SysWOW64\Ijkled32.exe
Size 64KB
SHA256 f864e5886e0f4e4c3c5e170ce062b6454baceeb3634c2162606781c85baec707
MD5 ee73205b2546ee7809d3cb2ab5b4c8f8
SHA1 780cc408429ea8a4f906d944d1954ca57f8048b0
SHA512 90493c95383e4ec357dbc6887cb412a7271954d3d17ce95836bd6e16eb2bd37fc726da39587deb3959460c47b5f48a88bf102fb9284d9ddd399321693a230a79
SSDEEP 768:OnQ6L2+f+9oLajKI1er+nvFnXNQSIYianFIsX7YE/1H5vv6XJ1IwEGp9ThfzyYsl:k7v1dYNqSInaFFX71gXUwXfzwF
TLSH
T1DD53D6B692E63471F7AF7D3401617E5110F2ACF6DBD090981D69C1CAD8D22C8ED21B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ilmedf32.exe

Path C:\Windows\SysWOW64\Ilmedf32.exe
Size 64KB
SHA256 3cfca7b048eab269113bd2ce4dd50c5150724470bbf9e1306b6e592692fc650e
MD5 8ccd72c80c73d7f0980c8f10c4498203
SHA1 ad65e7e737ed5896e906213e05621de02856efde
SHA512 c0db806e0b077ad697e188004e57fc3898fc995d23c4f12226abae1d7abdbe0f220c8562a3140cbf3bc47b6d60f3810ac3e30971cefacb66a613b7bf37c14908
SSDEEP 768:LqWJE8W2M7fFJX2uLW7JlAXYvHAmoDVSCcAPV/1H536XJ1IwEGp9ThfzyYsHF:LdJavk7rAX0ODVBcAPPkXUwXfzwF
TLSH
T1D6534A9F77EA1941E0270CB849AA21C1D07EBB955BDCD2958D20D08ADEE134CCD23F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iloajfml.exe

Path C:\Windows\SysWOW64\Iloajfml.exe
Size 64KB
SHA256 e9dab562fa76914d279db4a29800e089723f1c6e040a151c73332200ebd64f8d
MD5 2167927d1d43b7607f7f1d9c5f0a8fff
SHA1 fb3dad2ee837f0a8f2bd3f7a262152f5433d3d22
SHA512 226996b63903bb989811771e4447bacba16237afb9da4b5fc64d4258adce555f41e5d881cef25c22dcca9772e6c6aa4a2c501cbec97b522cbcd3126672a7f77e
SSDEEP 768:58agCokUdJmPAFcA2VomcuT2imJdaIaRfYMpPHkl+/1H556XJ1IwEGp9ThfzyYsl:58aJAX2pHmJYRR9EG+XUwXfzwF
TLSH
T1685319DF26FA0CBAD1530EB506553352503F68E257E3C21E4C21E4ABE9912C87D26BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Inkaqb32.exe

Path C:\Windows\SysWOW64\Inkaqb32.exe
Size 64KB
SHA256 e47bdb072cc11bfc4f2ee2c81aa84bc6fe26ee0997b26e9c6f7bb7a4e8135e00
MD5 6ba50e4f27cd2ae06e6fafcda02de581
SHA1 12762119e543048c0b16c9eaf0c63a3f26041664
SHA512 3c88b8b805a18d4133b65a3d65b52fc9769e3c473975d8f237d9d99cc94795ff83f37680461a1275dca6fc1c3e2997e55cb55651678f57f53428fbc30a069970
SSDEEP 1536:W7KiSQdNTvJndjfQOoPy2yutd5XUwXfzwF:yL1VfQzZtd9PzwF
TLSH
T1F85307B7E7F50461E69B0E341BA152514076A8C61FFBE2994F20D1AB10D2E8CAF71F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jaljbmkd.exe

Path C:\Windows\SysWOW64\Jaljbmkd.exe
Size 64KB
SHA256 23553c7c3a8a6784f0f8a3254a3bb5d103428c5bc3abc642ce6957b171f26d5b
MD5 ed59a34bf906b75b0b97c437aab799ea
SHA1 726485912f290213e42fa4c42586272a5ab40f0b
SHA512 d72dccc0a09f22bfd6718f9b422d18d5a5211177bb61c8922ca92575888a5e880d028935cc5f523dfdae656965eb3df9463528fc9e0a5f12147c4d7e334f18bd
SSDEEP 1536:CyhK3gRx0bMUP8VRawPe3gBhJ9ieA2XUwXfzwF:CyhK3gRxsMOYRawPeUieACPzwF
TLSH
T19453187357EA0987E15B09380AB473834062A9E757D4C38C6CB9F4AAD8AD60C9D65F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Janghmia.exe

Path C:\Windows\SysWOW64\Janghmia.exe
Size 64KB
SHA256 480e62bd99d4ce9e885336e3414a3e5afc9e3d30757680a12456bcf65807a83c
MD5 51578fe1f67066736dca2435558e4dc0
SHA1 6278b29695afde27422125930d91d3672f780ea3
SHA512 b8d1a0482dfc06adf85592fa08334ef900a644e52ce748e3a02105aa3371d9441f018ef2e0e3f93728307c5ce59bc78de78107967d0050546f3ad446036cb094
SSDEEP 1536:jPd3vyX7T74pvtLEzEmGg9b3N4zOh88rXUwXfzwF:jlvyX7T8RU9bGzOhl/PzwF
TLSH
T10553078222EA5555F02B0E355E922372413058F5EEB1F69C9C22F78998F530DFD23B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jaqcnl32.exe

Path C:\Windows\SysWOW64\Jaqcnl32.exe
Size 64KB
SHA256 5a0544be0803c1bd323658f4a45816ebabc38d879aa6fd32cd4e5880adf0d249
MD5 ea9553f62f42d85494329900b4d9ea6a
SHA1 d65ded82ad4864ac71ea81108b06e375b278c43f
SHA512 844fcf45b19f86311939f31e59e66b9c50b3bbb1a07c7bf4e2453a32f0c9a0ba9d8c93471cef181de8e10b013cefd59012516e797f5463561488526aa62d2a03
SSDEEP 768:yTRQnozp84xSZ4HmQc29eWfFUMTyv72/1H5J6XJ1IwEGp9ThfzyYsHF:y2o18+SZ4GQcKHUBjcWXUwXfzwF
TLSH
T1DA53F6932AAB2E46D0E3DE7A16B52382F0656CD547D5D1753C23F0AA34913A8DC22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbijgp32.exe

Path C:\Windows\SysWOW64\Jbijgp32.exe
Size 64KB
SHA256 956f29ccdc352e37bf7765988abadf5b383c4c58fb2749cd4cb649e88207e5b1
MD5 4682c4cb9eff78a8f70740e5d38e71cf
SHA1 e9fbf39a6cf8ea6c617616ed21135bf88566cf18
SHA512 18aec68462ebd877d0a8786df92815d3b3ce28a9f644761cbc250193ae88f7ea010e4b53b2ceb2417ad03615a361fb340ec1afd8d56cd6ba82e9ca0e5f7895b0
SSDEEP 768:vO7NM+S81xpl6vhkGFuM8gzYDgKkyIE57rgdpG0XOx/1H5wX6XJ1IwEGp9ThfzyL:vO7bnrkvR9W11Ic2KXUwXfzwF
TLSH
T17053088F5EFADD44C0731D3785E8224A1062F9E75AE1C2B81CB1C05E97A620B6C26F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jblflp32.exe

Path C:\Windows\SysWOW64\Jblflp32.exe
Size 64KB
SHA256 0ebf0dc5c1c0d1624aff9249ffdc9e7baa2c61846f68b623c28c2e20f693536b
MD5 04df0c2d354fdf19cefa6b8f7a541c64
SHA1 0a17e272c8cd2d44bb43454cda7b52924e8d0c30
SHA512 43634627a38849539e6e2205559df395eb9931f4e0d526bc60de3f869c86f7e6815609ede1bc56c47bea1ac24b8678ae656264ef62519ae22df9ce7afa62f707
SSDEEP 1536:yxTWe3RZvm1qjikU8ftcr8tRAvRXUwXfzwF:MWkXCqjiYtw8KFPzwF
TLSH
T1655327C3BEE794BDD62309791EF81E4160A56CE14BF1C2244CA4F28A06D724CED36B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbncbpqd.exe

Path C:\Windows\SysWOW64\Jbncbpqd.exe
Size 64KB
SHA256 cb14be86a910ed0a404e10b5563051e91537ece2793a1346cd85d9a371c03b62
MD5 04f6ce903d9b45a9faf29fbe57e7ed96
SHA1 544d285a66d5b3a3d11fe5f52058f6543e3705da
SHA512 c6c3d800e9dc03bc5ad1231a08e6065359d4f0f2bcc106b535bdb82974e25d92ec072c796d467a7436729849e5b804f498a756e5638d4ed3caa61bf7440e7ec3
SSDEEP 768:aBWMuNOffuJCq19xsIR351SpmAHhTJWiA2jnf9yNuQ/1H5sa6XJ1IwEGp9ThfzyL:akMCJ5xh351OB9WiA2nfkBivXUwXfzwF
TLSH
T18C5306B3AEAE1C82D1330D702EDE31421475ACEB57F5FE8ACD24F18955A520C9DA1B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdjfohjg.exe

Path C:\Windows\SysWOW64\Jdjfohjg.exe
Size 64KB
SHA256 f83fcdf7c537cf0765f9148bf7568087b1af23b94be9072ca2848fae010d07ad
MD5 b460640eed1d83f0202652c2cb0d684e
SHA1 c6c5b02454f21e6a8944e02117b94acf7c5e27b2
SHA512 b14c0ca7c72f71767a429f3e6fda12eeed949b03a1f6da2f33661ff0da58e7b8bbcb55d15d2b819da5d300d1775f0b1c019966a1402baf285dd1705ea4ffa811
SSDEEP 768:1WWzVCJMzrxJ6V5G72U+FLACfYKZdI2I1ng3538DqM/1H5vd6XJ1IwEGp9ThfzyL:1Npz98gF+OYYK3DsWSqCiXUwXfzwF
TLSH
T190533A8263FA14D2E4231D39269A229200716DE58BDCC5549D32F19723EE64EFC35FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdmcdhhe.exe

Path C:\Windows\SysWOW64\Jdmcdhhe.exe
Size 64KB
SHA256 61012f7cf4e442c68923646e96ac0fefcd44660079b440c7b037b2f378c0992d
MD5 73d64417e06309e8de84fe60acca86d4
SHA1 5e66af0434ad9fd65ba6caa32a99211054e85233
SHA512 03165768eb00b326e7a551a8472c8718ec19026fba0870d7ee8a3472ee267b52f9627911ceb6761675946125e9e996f1dab85d170dd713481b5a3669dd672ec2
SSDEEP 1536:/28ZIXJsjJEN3664tEW71aaaaaa9gRFRsXUwXfzwF:ZOuJB1aaaaaa9SHYPzwF
TLSH
T128533A9FA3EE2931F3676DB445562286513A68B04BF2F1DC1C34D14A28E52CC7C67B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jehfcl32.exe

Path C:\Windows\SysWOW64\Jehfcl32.exe
Size 64KB
SHA256 322a7f032267238db883d3b04def084a00f5ed5d6ae47d83d12589a88f5b55f3
MD5 ed440f855209d93ffc8bd7b1f30974af
SHA1 fbbb55b9b9028e9b93c58eeb0315af577fdd4c48
SHA512 f783cfb85589ce78853083952b12cbab3ee672f7c30b2faf5cb623f65fe94258ff1ec22c85306cd311564d63601da0971a4ded32229db0c0c639ff6f47d2acf2
SSDEEP 1536:Z18UUAzKH1fcvnxikg1lN+lTHF2rrhHSyGGGGGFJ4dcXUwXfzwF:MZ6nxdc34H4RHSJJ4doPzwF
TLSH
T1F853299A32ED1C61E5D35EB1C3B86E5B5C7628BAC7D1D1680C20E6465BD0118ACFEF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jelonkph.exe

Path C:\Windows\SysWOW64\Jelonkph.exe
Size 64KB
SHA256 8b4b41e5b7ecdc843a05c895482ebc1ce8174830616bb7c4f5e78b5c979da8fa
MD5 a79a7eb0a289d1ae30bc8a51a058bcbc
SHA1 ddbe5eccd5223364888e484f7232f8d7d81180f2
SHA512 68ac816872ea4e8baabf608e7577161d2daad8eb991ed9c99cce99c97122002c321ebde36faf9b7b1e00975641d32b236f47eedcf590c8f2655e3c4f061ef2b7
SSDEEP 1536:JqKJojWxsbjb8Z3yiqaNbFW3r43QoR3kM0FteTXUwXfzwF:5JojssbjbCqoR3seXPzwF
TLSH
T109532AAB73DAC54EE7230E302ADD22525162AFD19BDCC118AE31C05B17E613C6D6DB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhfbog32.exe

Path C:\Windows\SysWOW64\Jhfbog32.exe
Size 64KB
SHA256 5abc0e33e025cef5806bd4a1417fcdd386a01c1b3c2f1381d7ea53144709a254
MD5 e89cbc62115f691f3d9266e964980f7a
SHA1 597a7b1c2030bdf6995bf96ca3ac0995519a4158
SHA512 fabe2ac1007247ea6fc199f0d45afbf51c26589f2b3fdfdd083c06ac914958c318e5c3c361fd65370dd9505eb008c177af70ed18caa633d85992af6a37930ffc
SSDEEP 1536:vTZoMjCeE1OSWFU5inJBSxUamK3XUwXfzwF:bZ92elFUcnOxUaTDPzwF
TLSH
T1EF53179FA7EAD553E7172D7406B4269E10A2A9D53FE0D29C1E11C0CADCF1A2C4D32B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhhodg32.exe

Path C:\Windows\SysWOW64\Jhhodg32.exe
Size 64KB
SHA256 03aa2e2df88d3c2c4863cbcc9a6a58322b34d34b07cb3ab25a84a077827e9aa1
MD5 322b48dfb1f20037962f8c85f8355c0d
SHA1 796c0e8a06af21d12c3e5ce9620a6070d0849546
SHA512 af23a602a63ba288a40654a491c8ee1cf6b0054c2af73f4bfefb1949161319b351ae9c305d240ebf303580a98a485bf0957a5d4c5169e56daec445a410b7130a
SSDEEP 768:21yl3onlfKa01cbN8cDBmxW9ImAa8/1H5mn6XJ1IwEGp9ThfzyYsHF:21ylGlfRmcbO+Ww6XUwXfzwF
TLSH
T19F534A6366EA1092ED9F4E7D47B132A711AC7DEA4BE1C3D40D21D48B25A020CAD75F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhkljfok.exe

Path C:\Windows\SysWOW64\Jhkljfok.exe
Size 64KB
SHA256 2b2c8b7b5d5cb3a3d64028e2c668e4b8a670be265dfc75a4210ae74a9aff805c
MD5 4686cc0573d684340637f7ba200cb114
SHA1 d753b90b301c732982285db66adfdaadc525572b
SHA512 79f57ea40a55c9418beac9890eb8379cb2a9f87aef650085331f28fa3456dc03db1aeb22f2cf4bceec8eef41aee0fd8d3856de29d548695c283efdeb99fb41a5
SSDEEP 1536:KygvgK2bYLhsojHxrrFQKtJRQkjre6YDOSuqAhb01uxLM+EXUwXfzwF:Kz4fbYvs6oFuqAhI1uZMXPzwF
TLSH
T179531952A2AE4781D213CD751EA676B130B198D197D0C3688EFCD08A7DE1E895CE3B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jlanpfkj.exe

Path C:\Windows\SysWOW64\Jlanpfkj.exe
Size 64KB
SHA256 d7f9cc6cc0608295c858386fd4935cef8c66c7d4c8f6b79c234d1b01c9039a2c
MD5 000d4afcd1de17429ac802d63071afb7
SHA1 db4ac0c1eca25070eb74b69e3f984a25256d371e
SHA512 04f248daca7f55b6c3c1328a1b77cec754172a0525483d3848daf8b431b83c870806ee07031e4368b37880bbb0c54ba815e27d7258cf20d0f89f2c23866ed5da
SSDEEP 1536:vZUU22zKAVjTcGR6BVtywUA4D/jOXUwXfzwF:vun2znVncGR6Xtt74D/jKPzwF
TLSH
T17E5307D3A3DA0847E5370DFAC55372D217B5ECA257D1E1180C29F14A4C9E24CAF6AB3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jldkeeig.exe

Path C:\Windows\SysWOW64\Jldkeeig.exe
Size 64KB
SHA256 b33b406610ae69a3d0b71cebadc2aaefedf6fce68a4f5d0c84ecc7d4f082c3dd
MD5 62cb23f11cfd18b767cda43809888db0
SHA1 c6a0332966f816ec245243ee38dca3b504fa5a43
SHA512 313319607903be217fdd2055afe72554c842f943df3d6ea72e444c117fc31e8e8d3e20f22da3d4732874c687eb3c64a8e7cdfb38762dfccf9ecd9414719263b2
SSDEEP 768:JzK07FpLKxco5MzquWD9bZbH+BVYdR2ZagcxIRWTfl63f/1H58B6XJ1IwEGp9Thy:lK0HLCYzKx1bH+SFxIRWTWSIXUwXfzwF
TLSH
T15153E6936FEA2896E0574A7F07E52FD310B228E757F4C198CD20D19A98D52089CF7E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jnbgaa32.exe

Path C:\Windows\SysWOW64\Jnbgaa32.exe
Size 64KB
SHA256 2f0e8b884ef073adf63d80020d690bb10d644961333482811528f21253e8da60
MD5 2b2abe81927e9886b64b2a2c5fc39ade
SHA1 b74d8cc1a8adfbad17d57253e49d8aec7496a386
SHA512 e213aa7ece47693139932d66210d995b0316926d290ed59a6d212aeeb7cbac37e2634b5a37eb2c4507e19933cb07df5a4ff662d861d1dd3dde428ce24f6c87a5
SSDEEP 1536:zIi5qs1JmHQkh7Kcw98AsgJRXRypwXUwXfzwF:UiMOkh7KcosgTgpUPzwF
TLSH
T1C953294E62ED24A2E51B4DB71BB07692C3B0A9E75BD2D1580C31FD4A90D530CBD26B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jnpjlajn.exe

Path C:\Windows\SysWOW64\Jnpjlajn.exe
Size 64KB
SHA256 869d61430de8fa724eac089b1b9d8cda7819205de7c32938e98aacce9c5b76ff
MD5 f9141d4306ebb9521fe61686489f590a
SHA1 fca9f46c8297d7057aadce97ad98e20a2025b72d
SHA512 e9e6fd18bb597b8bdb418e9a9c89a289a0d01d6a568b11ec754ca1c1fbdfd4cf1d198a68c084491b5c0b06e94ac83bbdd987ed42aff9b061f88c8132f6265916
SSDEEP 768:M7uPhBp90bNK58xTtqD0iuy27rhPpoKJNugbTsKnTfq/nJCY5t1/1H5uw6XJ1Iwi:Mqitt+F27rhPpocNE4qPPd8RXUwXfzwF
TLSH
T1F65339D7A3D90483E7D79E3D42602EAA7372689947ECD1AD0C27CC4EA5A424C5D21F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mhknhabf.exe

Path C:\Windows\SysWOW64\Mhknhabf.exe
Size 64KB
SHA256 22cc59d8ffdc3e7622a3d9f52ab6caa0d68f64c50e57fd798adf466c0775454e
MD5 b544c2d05e1bcbbc1380f274a3a25d2b
SHA1 83e09a9c541846fc491b0add7bfe2d3fadb93128
SHA512 c01ac6837100910055534f3536214f6c9f83007cb48f96c1cb243fd4c7f55738f462de791783a6f6c35f733ed897de15bb7f85fe5ed24883b52ff92cb07d052d
SSDEEP 768:I4je+7OnBG7EijMq1Cfyf3mSqmfRsmR5/Nr/HAO/1H57v6XJ1IwEGp9ThfzyYsHF:I4i5BEEiYqHfWSjsSV1/A0UXUwXfzwF
TLSH
T1145329D263EE3481E1631EFC4F6572EEDDA5A8A547A0D2E44C25D0CA2CE420B5C6973F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Obkahddl.exe

Path C:\Windows\SysWOW64\Obkahddl.exe
Size 64KB
SHA256 3939f7954517191e4cbe5529e530f83858767ccb6902e11032bc5d4ae28585b2
MD5 f1688a4ce66a2da9d6a31132d38e3127
SHA1 846218553e64b7918e64cc9ff44e342126db9f60
SHA512 49ce0e37fe5e806916ed506e2a332f7bfcdac43c87f01c9a43bc1debd8c0f1b49cadc9dbaf3c79ab1b72d89f2cc6a5465c7cbf1b479de0846b820e794beeffd9
SSDEEP 768:eGAlxmhZYmMNlKbkl6t305j8vdkiVT00SJGPcf/1H5y6XJ1IwEGp9ThfzyYsHF:eNxQYmGwoqY81BSDw0xxXUwXfzwF
TLSH
T13D53F8B6A6EA7D41D11F2F78BEA42D52E071A8E54FE2C2894C38E186C8E414CDC1D777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Odljjo32.exe

Path C:\Windows\SysWOW64\Odljjo32.exe
Size 64KB
SHA256 196a06d559c7e023dcd7868cc05b2415be9292f1415c0c9028fdd12abceb7ee4
MD5 fa94222150f25af3a633b5196911651b
SHA1 22aa703bdee657e7958a657baa688ad926cb0bf8
SHA512 a39f59a94f5493dc99101783a7dac88a4f8e10e1099a47b62defbad34552b2004e7901bb42645f253e4bfa69cfbee05c185ee017c7457afd46bc8d0f90372931
SSDEEP 1536:iHQmr+6/BItNSXgt3EfNf3DhH25ybvXUwXfzwF:iHQmr+0BGNSQt36TQcPPzwF
TLSH
T159533B4363F61BDAE5E30E34C5A92253007BA8D66BF0D2613D21D196D4D923CAD3EB36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Okfbgiij.exe

Path C:\Windows\SysWOW64\Okfbgiij.exe
Size 64KB
SHA256 129740c2a3d52ba38fbb822816c61b6c0f8f0630faa04f072646e79235b4dc36
MD5 f772314ce9db3b34a8160f22d6deb3e5
SHA1 bdefb8362906a8586cca35c1d955d2d8342cb558
SHA512 423c55dd31ca79d62e4aac0bba2285d872fc0a11713991c6ba01a6f3f0bc66acf846a0ca7f49b2483e470a83d5076205ea435d8afe8bf2944d0c2e97e2a3fb20
SSDEEP 768:rW3lNg2zKM0mZICiRLAjLK77UujzFYJnCL7spFlpMwkNRqwN/1H5j6XJ1IwEGp98:HfWiRLAf+WJCL7spzCRqwH0XUwXfzwF
TLSH
T16053D572D3FB1B82D01B59347DA63E517036AA928BD8C2E73C21D05679D620FAC25B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Piolkm32.exe

Path C:\Windows\SysWOW64\Piolkm32.exe
Size 64KB
SHA256 dc0a5b11dc393c87ab73119d0987ba68f23561f2e743900d33f291787f61f942
MD5 6546772353e2c32865be0f2fa08ed60a
SHA1 40ac8d3660ed2c5843c38658ce8c9b79ec4d259f
SHA512 b89be61f9952cc18d68a23953dca38d388922ceb20c9b40b6b531ed2aafb8bd29946bdc0e67c200e1b2efa7fc74248ee9e07183c730fd0bb12db873b4190dd10
SSDEEP 768:YCsF92gCsEQ2RoUTUEMD7OSPlbpck9JmMe/RAtNZXam+k/1H516XJ1IwEGp9Thf6:w5BQeJPp3J0/RCN9amiXUwXfzwF
TLSH
T1795318D267FA1590F42B0E760AA923726175E8E1DBD0C1643D14F187A8EE60C5DE3F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmeoqlpl.exe

Path C:\Windows\SysWOW64\Pmeoqlpl.exe
Size 64KB
SHA256 9da870892c4d3c1787f35b8cfd7f9f90589c9321eab2b0d6350c6aeefafc7e93
MD5 cf00e300ccada4824d6ee80c9af75ffe
SHA1 ac47b6f14ed410e53ab393f8cc60d8d895083c96
SHA512 a1e5ae07403195fc6c42c029340713fecf6cbb7683672ef60c664ee4919663d6d1e6d1a082a9f85cbec1b3069640c8bc96cac03dfd1a33e5427f830359e44aba
SSDEEP 1536:yBqY4Bb5F2PuRRLq55K/XQptlO+prGtqo6sUwmFcXUwXfzwF:yBSBbMuReDDwCoPzwF
TLSH
T1DF5318A36EDB0885D3134D755FA1229E187D68F24BD8C17B0CADC1C608D5E0CAD6AB7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qkdohg32.exe

Path C:\Windows\SysWOW64\Qkdohg32.exe
Size 64KB
SHA256 8a16401b08e2c290a1106637664014567015bcc7f34690649b03a6e559a69725
MD5 93677102f34d42321ef53b966ab4ca02
SHA1 1bca54fa9d644e8b66b377741e49667d48da8a41
SHA512 460b2d13db7e2ee19c7b385d2116fb621ac74b385329ad9996227cd382760e7e0cd2374828a20f4c41727b3deab512577820bb2fd0f65fca15844da9576edd25
SSDEEP 768:Tnl7LnHzN7oGlcshNyojclZhjawCB31JF1NunO/1H5s6XJ1IwEGp9ThfzyYsHF:Tnl7ziGlhhwojMhmwCXVE0LXUwXfzwF
TLSH
T14F53285362E65517E3B34F7905B0E27500E66BC55BB9C22B0C12C1BC58A05FBBE26BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-363-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/692-369-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/732-29-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/864-339-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/888-570-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/944-471-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/964-1794-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1004-423-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1016-345-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1056-393-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1136-245-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1176-453-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1228-148-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1232-543-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1280-133-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1344-447-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1620-181-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1632-101-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1652-357-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1732-556-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1792-285-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1860-229-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1872-459-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1908-513-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1964-600-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1964-56-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2012-537-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2036-576-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2040-333-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2052-52-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2076-435-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2108-375-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2112-68-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2112-607-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2436-501-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2504-405-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2536-588-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2540-477-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2636-351-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2692-411-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2732-549-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2824-164-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3064-302-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3160-594-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3164-531-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3184-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3184-555-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3200-582-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3240-7-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3240-562-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3264-1653-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3400-173-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3448-321-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3464-221-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3552-327-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3600-387-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3644-37-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3664-569-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3664-16-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3712-189-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3756-109-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3760-519-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3784-261-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3872-205-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3876-381-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3912-417-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3920-429-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3936-1663-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3940-315-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4128-76-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4132-117-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4196-490-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4204-237-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4236-98-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4296-465-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4344-507-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4448-441-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4460-608-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4484-99-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4560-197-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4564-1656-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4568-141-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4572-1662-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4576-253-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4596-309-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4648-525-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4696-483-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4760-279-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4768-125-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4796-273-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4820-1651-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4832-213-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4844-489-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4876-291-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4880-601-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4896-157-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4916-398-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4980-1658-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5036-1655-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5060-563-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5080-266-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5104-296-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5108-44-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5152-614-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5180-1652-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5288-1726-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5368-1659-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5472-1654-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5552-1660-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5584-1645-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5776-1728-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5816-1664-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5824-1647-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5856-1661-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5900-1648-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6012-1657-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6036-1649-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6120-1650-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6204-1795-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6284-1796-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6340-1774-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6356-1862-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6380-1775-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6420-1776-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6496-1778-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6544-1779-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6588-1780-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6628-1781-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6668-1782-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6708-1783-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6748-1784-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6788-1785-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6832-1786-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6872-1787-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6912-1788-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6952-1789-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/6992-1790-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/7036-1791-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/7116-1793-0x0000000000400000-0x000000000042F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads