berbew | 27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3N.exe
Size 90KB
Sample241107-ejapmavhnp
SHA256 27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3
MD5 aaad31929265f91483e12d98de3c9d20
SHA1 f504d7efb132d1e7c79a10031e349bb421b831dc
SHA512 e3b7f71568e81862b409c336a8e84953d72c8db6051074a12ef8bb34ccdf1d083c5a09b6796dc6e2a177ed8d0843643e94d7da20735999b61428d977ae22c837
SSDEEP 1536:q/Pwg1Iq0tBdht/ElWHp3miypGRjCA7Hg4GDjlOtmVKbGNu/Ub0VkVNK:JtTTMsJmzAmD8trGNu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdpmpdbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npjebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngmgne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlaml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
5028	Mlcifmbl.exe
5096	Mdjagjco.exe
3004	Mlefklpj.exe
1388	Mgkjhe32.exe
4584	Mlhbal32.exe
1856	Ndokbi32.exe
2860	Ngmgne32.exe
1912	Nngokoej.exe
1384	Ngpccdlj.exe
3336	Njnpppkn.exe
2708	Ndcdmikd.exe
4228	Njqmepik.exe
3724	Npjebj32.exe
3356	Nfgmjqop.exe
548	Npmagine.exe
4864	Nfjjppmm.exe
3600	Oponmilc.exe
2964	Oflgep32.exe
464	Olfobjbg.exe
3552	Odmgcgbi.exe
5088	Ofnckp32.exe
3240	Olhlhjpd.exe
4900	Ognpebpj.exe
4552	Onhhamgg.exe
668	Ogpmjb32.exe
556	Ojoign32.exe
1184	Oqhacgdh.exe
4972	Ojaelm32.exe
4212	Pnlaml32.exe
1880	Pgefeajb.exe
116	Pnonbk32.exe
1128	Pdifoehl.exe
1780	Pjeoglgc.exe
3420	Pqpgdfnp.exe
4476	Pcncpbmd.exe
4556	Pjhlml32.exe
3324	Pmfhig32.exe
4208	Pdmpje32.exe
3224	Pfolbmje.exe
4624	Pmidog32.exe
1364	Pdpmpdbd.exe
4932	Pgnilpah.exe
3936	Qnhahj32.exe
2088	Qfcfml32.exe
2664	Qddfkd32.exe
2528	Qgcbgo32.exe
3468	Ajanck32.exe
1524	Aqkgpedc.exe
2164	Acjclpcf.exe
4424	Afhohlbj.exe
2208	Ambgef32.exe
1944	Aeiofcji.exe
532	Afjlnk32.exe
812	Amddjegd.exe
1152	Acnlgp32.exe
2996	Afmhck32.exe
2304	Amgapeea.exe
2920	Aglemn32.exe
780	Afoeiklb.exe
1252	Aminee32.exe
1404	Aepefb32.exe
1380	Bjmnoi32.exe
1280	Bagflcje.exe
2280	Bfdodjhm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Npmagine.exe	Nfgmjqop.exe
File created	C:\Windows\SysWOW64\Laqpgflj.dll	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Balpgb32.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Njnpppkn.exe	Ngpccdlj.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Ihidlk32.dll	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qfcfml32.exe
File created	C:\Windows\SysWOW64\Gokgpogl.dll	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Mlhbal32.exe	Mgkjhe32.exe
File opened for modification	C:\Windows\SysWOW64\Bnkgeg32.exe	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Fpnnia32.dll	Beeoaapl.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Pfolbmje.exe	Pdmpje32.exe
File created	C:\Windows\SysWOW64\Pcncpbmd.exe	Pqpgdfnp.exe
File opened for modification	C:\Windows\SysWOW64\Pfolbmje.exe	Pdmpje32.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bffkij32.exe
File created	C:\Windows\SysWOW64\Nfgmjqop.exe	Npjebj32.exe
File created	C:\Windows\SysWOW64\Pjhlml32.exe	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Hpoddikd.dll	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Goaojagc.dll	Njnpppkn.exe
File opened for modification	C:\Windows\SysWOW64\Pnlaml32.exe	Ojaelm32.exe
File opened for modification	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Aqkgpedc.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bagflcje.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bmpcfdmg.exe
File opened for modification	C:\Windows\SysWOW64\Beihma32.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Ogpmjb32.exe	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pjeoglgc.exe
File opened for modification	C:\Windows\SysWOW64\Pjhlml32.exe	Pcncpbmd.exe
File opened for modification	C:\Windows\SysWOW64\Acjclpcf.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Ambgef32.exe
File opened for modification	C:\Windows\SysWOW64\Afmhck32.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Oqhacgdh.exe	Ojoign32.exe
File created	C:\Windows\SysWOW64\Pmidog32.exe	Pfolbmje.exe
File opened for modification	C:\Windows\SysWOW64\Afoeiklb.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Oflgep32.exe	Oponmilc.exe
File created	C:\Windows\SysWOW64\Bnkgeg32.exe	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Pnonbk32.exe	Pgefeajb.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Nkenegog.dll	Ngmgne32.exe
File opened for modification	C:\Windows\SysWOW64\Pdifoehl.exe	Pnonbk32.exe
File created	C:\Windows\SysWOW64\Aepefb32.exe	Aminee32.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Bapiabak.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Nngokoej.exe	Ngmgne32.exe
File opened for modification	C:\Windows\SysWOW64\Mlefklpj.exe	Mdjagjco.exe
File opened for modification	C:\Windows\SysWOW64\Olhlhjpd.exe	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Pdmpje32.exe	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Mlefklpj.exe	Mdjagjco.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Amgapeea.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5288	3840	WerFault.exe	191

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oponmilc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlefklpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgcgbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhacgdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndcdmikd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmidog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfobjbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdifoehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflgep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgkjhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfgmjqop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogpmjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nngokoej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngpccdlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njqmepik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofnckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olhlhjpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnonbk32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beapme32.dll"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmjdbam.dll"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpgii32.dll"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idodkeom.dll"	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ambgef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjgaigfg.dll"	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmmebhb.dll"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnlaml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngmgne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfenk32.dll"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfgfh32.dll"	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkbljp32.dll"	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Cnicfe32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 5028	2936	27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3N.exe	83
PID 2936 wrote to memory of 5028	2936	27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3N.exe	83
PID 2936 wrote to memory of 5028	2936	27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3N.exe	83
PID 5028 wrote to memory of 5096	5028	Mlcifmbl.exe	84
PID 5028 wrote to memory of 5096	5028	Mlcifmbl.exe	84
PID 5028 wrote to memory of 5096	5028	Mlcifmbl.exe	84
PID 5096 wrote to memory of 3004	5096	Mdjagjco.exe	86
PID 5096 wrote to memory of 3004	5096	Mdjagjco.exe	86
PID 5096 wrote to memory of 3004	5096	Mdjagjco.exe	86
PID 3004 wrote to memory of 1388	3004	Mlefklpj.exe	87
PID 3004 wrote to memory of 1388	3004	Mlefklpj.exe	87
PID 3004 wrote to memory of 1388	3004	Mlefklpj.exe	87
PID 1388 wrote to memory of 4584	1388	Mgkjhe32.exe	89
PID 1388 wrote to memory of 4584	1388	Mgkjhe32.exe	89
PID 1388 wrote to memory of 4584	1388	Mgkjhe32.exe	89
PID 4584 wrote to memory of 1856	4584	Mlhbal32.exe	90
PID 4584 wrote to memory of 1856	4584	Mlhbal32.exe	90
PID 4584 wrote to memory of 1856	4584	Mlhbal32.exe	90
PID 1856 wrote to memory of 2860	1856	Ndokbi32.exe	91
PID 1856 wrote to memory of 2860	1856	Ndokbi32.exe	91
PID 1856 wrote to memory of 2860	1856	Ndokbi32.exe	91
PID 2860 wrote to memory of 1912	2860	Ngmgne32.exe	92
PID 2860 wrote to memory of 1912	2860	Ngmgne32.exe	92
PID 2860 wrote to memory of 1912	2860	Ngmgne32.exe	92
PID 1912 wrote to memory of 1384	1912	Nngokoej.exe	93
PID 1912 wrote to memory of 1384	1912	Nngokoej.exe	93
PID 1912 wrote to memory of 1384	1912	Nngokoej.exe	93
PID 1384 wrote to memory of 3336	1384	Ngpccdlj.exe	94
PID 1384 wrote to memory of 3336	1384	Ngpccdlj.exe	94
PID 1384 wrote to memory of 3336	1384	Ngpccdlj.exe	94
PID 3336 wrote to memory of 2708	3336	Njnpppkn.exe	95
PID 3336 wrote to memory of 2708	3336	Njnpppkn.exe	95
PID 3336 wrote to memory of 2708	3336	Njnpppkn.exe	95
PID 2708 wrote to memory of 4228	2708	Ndcdmikd.exe	96
PID 2708 wrote to memory of 4228	2708	Ndcdmikd.exe	96
PID 2708 wrote to memory of 4228	2708	Ndcdmikd.exe	96
PID 4228 wrote to memory of 3724	4228	Njqmepik.exe	98
PID 4228 wrote to memory of 3724	4228	Njqmepik.exe	98
PID 4228 wrote to memory of 3724	4228	Njqmepik.exe	98
PID 3724 wrote to memory of 3356	3724	Npjebj32.exe	99
PID 3724 wrote to memory of 3356	3724	Npjebj32.exe	99
PID 3724 wrote to memory of 3356	3724	Npjebj32.exe	99
PID 3356 wrote to memory of 548	3356	Nfgmjqop.exe	100
PID 3356 wrote to memory of 548	3356	Nfgmjqop.exe	100
PID 3356 wrote to memory of 548	3356	Nfgmjqop.exe	100
PID 548 wrote to memory of 4864	548	Npmagine.exe	101
PID 548 wrote to memory of 4864	548	Npmagine.exe	101
PID 548 wrote to memory of 4864	548	Npmagine.exe	101
PID 4864 wrote to memory of 3600	4864	Nfjjppmm.exe	102
PID 4864 wrote to memory of 3600	4864	Nfjjppmm.exe	102
PID 4864 wrote to memory of 3600	4864	Nfjjppmm.exe	102
PID 3600 wrote to memory of 2964	3600	Oponmilc.exe	103
PID 3600 wrote to memory of 2964	3600	Oponmilc.exe	103
PID 3600 wrote to memory of 2964	3600	Oponmilc.exe	103
PID 2964 wrote to memory of 464	2964	Oflgep32.exe	104
PID 2964 wrote to memory of 464	2964	Oflgep32.exe	104
PID 2964 wrote to memory of 464	2964	Oflgep32.exe	104
PID 464 wrote to memory of 3552	464	Olfobjbg.exe	105
PID 464 wrote to memory of 3552	464	Olfobjbg.exe	105
PID 464 wrote to memory of 3552	464	Olfobjbg.exe	105
PID 3552 wrote to memory of 5088	3552	Odmgcgbi.exe	106
PID 3552 wrote to memory of 5088	3552	Odmgcgbi.exe	106
PID 3552 wrote to memory of 5088	3552	Odmgcgbi.exe	106
PID 5088 wrote to memory of 3240	5088	Ofnckp32.exe	107

C:\Users\Admin\AppData\Local\Temp\27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3N.exe
"C:\Users\Admin\AppData\Local\Temp\27983acd223e8bca7addbcc5107f7976714c44383883b1eb691b1d3449a448a3N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\Mlcifmbl.exe
  C:\Windows\system32\Mlcifmbl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\SysWOW64\Mdjagjco.exe
    C:\Windows\system32\Mdjagjco.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\Mlefklpj.exe
      C:\Windows\system32\Mlefklpj.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1388
      - C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3240
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4552
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:668
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:556
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4212
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1780
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3420
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3324
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4208
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3224
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4624
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1364
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3936
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2088
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2664
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        47⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1524
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2208
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:532
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1152
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        57⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2920
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:780
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1252
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1404
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1380
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1280
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2904
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2720
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4008
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2368
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1460
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2312
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:940
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        82⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        83⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5184
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        88⤵
        Drops file in System32 directory
        
        PID:5500
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        89⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        92⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        97⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        99⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 408
        104⤵
        Program crash
        
        PID:5288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3840 -ip 3840
1⤵
PID:5344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aepefb32.exe

Path C:\Windows\SysWOW64\Aepefb32.exe
Size 90KB
SHA256 98dd30b09331b81a60d4920fcf12ed75977a9c3cbe7e6f33576771f5c41f41b9
MD5 f78f3af857c51844455f8fe879823dd7
SHA1 0b7cd0b37ed951a8984db2c5896142c8f47d5628
SHA512 5860c722cc3b01a6f15bcb6bbcb641a1ec319a0033154b4b1cb60862f89661435c216719967e507b9a45bd7a4cfe3e041b57108e80ee9c1beb8463a45fdb88f2
SSDEEP 1536:JFVaVs0OpWCbCd2TcNKWCnzXW/Ez+ZBg3fGbu/Ub0VkVNK:JnaVs0OpNblTcNcnV7vGbu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afjlnk32.exe

Path C:\Windows\SysWOW64\Afjlnk32.exe
Size 90KB
SHA256 efe8bed294fba8958ae1e81e9cadade36f8e3ce29ce966da37329f0157af683b
MD5 dae6380b19b33f644e3e871cb5ec355c
SHA1 c91372fc579aaece26914407ab279924aa915adf
SHA512 311f493c05d2e65cd1c32a74814eacc2ccfc00f0352b8d97edcb9bbad0c2ff68ab26a296e54b0650417d68a21952c7cbf5ed057e4325d75e4fbd700ce3649cee
SSDEEP 1536:LY+c6oGNPfva3HxMFog65pJ1qWoCPnFylS71eEsmFIDyOn3P4A4WGHu/Ub0VkVNK:LDtNXbsqWIYO3P4AvGHu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfpgffpm.exe

Path C:\Windows\SysWOW64\Dfpgffpm.exe
Size 90KB
SHA256 746436bebbb45fd3084606586b10a07237e889aed1507c6d9eb1e3646b35c410
MD5 326e391259b54edfb7572abda2a5642e
SHA1 7df3b0196cbfffd914d0ae48494d25e54b620bdc
SHA512 37498f5be9b9768e781de338c006be687411a5eef87df58aca3c43568832a4fde974e44f64d5552497147392d2e79ed04fec9c7ab225dc0885d7ad159a9e84e0
SSDEEP 1536:I9KrkYLQr+tT58KkM3QZBFl4awDdRPG1u/Ub0VkVNK:awkWQr+BDkM3QDnN0G1u/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dkifae32.exe

Path C:\Windows\SysWOW64\Dkifae32.exe
Size 90KB
SHA256 7fba760339b97c219bdf993342ace9b06eb28d2c33054bd276cf2fe3a91f8f9d
MD5 bf322da7629086ed0bedae9b3560af75
SHA1 d6d3b000328fee7acb98e35b433053c2e0961006
SHA512 6b74682212fa803edc6afd56bf5c52a9f6f6cda435db968791c7e93a2387c26a9d02e4fd2d008137dc4373012a11b848edaa000de22ca578c98420f754ca2406
SSDEEP 1536:Ew4AN4XzTPL2HSpbAKPXPNA2fiJT4Dck2G4Zu/Ub0VkVNK:Ew4EwjCypbAKPXVAJJob2Gyu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lafdhogo.dll

Path C:\Windows\SysWOW64\Lafdhogo.dll
Size 7KB
SHA256 b18ebfe7129ed4641b27d5acdd4c8f68bc3291f76c726e50464e2ce62eb391b1
MD5 4ec9c78df9050e0b5c070eab45f36354
SHA1 0b1d7b978de773470a0c880265dd80cacb6b6445
SHA512 5fa40c6ff67512ca6fc8b975c9de2754f7e99f8e3cafbdef380c8b380bdd6a11dc974bfb77b28980de50fc5715fac072da8fb4405b30efd994a6e9a1dc10e657
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWHbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPVq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdjagjco.exe

Path C:\Windows\SysWOW64\Mdjagjco.exe
Size 90KB
SHA256 856965f018365347015af7f59fa9b1dac4a4f75769abcb8b5df1d71a71ded9a5
MD5 f7d3400791d64891b5ffeeb35d724b6e
SHA1 79ffadfc817009c9dec31f405ddc86a930ef00bc
SHA512 8fe83a31cdc58fcaa2369c2c1e93fb04a49c8410b034a04eacc528cd581f09c44e24f5216ae4a0b1f40b9f141254b8c8178062cc21de5dc6eee1bf2086248bb6
SSDEEP 1536:R03+3h8Caz8NU+pvkfCXCaPgwnAjftcQ/hK/G4u/Ub0VkVNK:R0OR8l8HkfrRnftc/G4u/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgkjhe32.exe

Path C:\Windows\SysWOW64\Mgkjhe32.exe
Size 90KB
SHA256 5f0febb7fe55fbebf75d559b937fc186aa85fb176b1ecb6a71c29fe9ec890292
MD5 7ba6b0ac57fc84800c68ea0b6f68adaf
SHA1 30cf435dc589dccf81afbd630384fa8633fe71ef
SHA512 1fa9cccb2770e0937b8439ebc3a284433dd7521abad47e5d14f730a70b4b7de4ab85f3a93bf753f5bd2a596780610702a8061ad0c3be3dfdad0b3b7e6d45148b
SSDEEP 1536:3AQ3cjVpuimayUFgR2qMh6PV6zZ2YpY3elFp3et0QjOtznGY4u/Ub0VkVNK:3AQsjRyUFG2qMhn1l+WQCtznGtu/Ub05
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlcifmbl.exe

Path C:\Windows\SysWOW64\Mlcifmbl.exe
Size 90KB
SHA256 e1ab476573f5392fedcbbb38e4918dfe980719e839ac6c98823dee16fe26e0e4
MD5 4c7da710633c3b16decf46055a17af60
SHA1 19be977a83b9125769facbad3598c6fca8b0da5c
SHA512 e339733592c4d3fa05bf41b8981f1a87b5e21ffb955c082e8b3a1ebbc384f79e26add043d6a919d3287888a707174e006f104e8e51b0e46f3785891ad5150204
SSDEEP 1536:6vXvdRPR7+WNt1zu11ltfQamTN1Fkxf9frQyJ0LNU/Gku/Ub0VkVNK:6vdRPR7LZsQamTN1FKd7ENoGku/Ub0+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlefklpj.exe

Path C:\Windows\SysWOW64\Mlefklpj.exe
Size 90KB
SHA256 e803280a576c6e11820bc9372cc2a267f0d85f89267c9037b0bfc274239129ce
MD5 083f7e687d69db606b6d397495d5ffab
SHA1 95b1d0d3a7e9df9262118e2ac6e030ffbed434b6
SHA512 f9f8e1e5d8d6dbfe23540c181502af4ab603abd2450d434726c6bdb6daed316c176830471b12f27277f9baf973db097f5f93df8575fd138539d95121d34d0706
SSDEEP 1536:PAK30y9jpKM6DU198DjyGu9sBcs7JfpG9bu/Ub0VkVNK:v6DkMyVaBcsdBG9bu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlhbal32.exe

Path C:\Windows\SysWOW64\Mlhbal32.exe
Size 90KB
SHA256 d4889e092656b72df9569d3d5658fdde5bee890bca6e4bc268bfb27e304854f4
MD5 57d87cb26d104946b1e4495c28f8cce0
SHA1 eb92dde0ebedacf707c2c77d1e419ad6595d93cb
SHA512 0c7772846e1bff5bcfbc64e8638bceb9d671504abf2aab6e07a1ec135484c9791cfdfc889f064cb8106cd75704de490ffe10792d1b6ad01df120815505aa5026
SSDEEP 1536:lRc5DRr7aKzMzp/XafNiXusipAhMKT9hb2r51eA0VTG8u/Ub0VkVNK:lRc5lr7ahVXaVsiahMOKV1P0VTG8u/UW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndcdmikd.exe

Path C:\Windows\SysWOW64\Ndcdmikd.exe
Size 90KB
SHA256 256520c93c72fbc75b5bba639c3f0c5ca0eba01814568739e1caabe9a7ee8ef9
MD5 816fea84346960b425eba7ff01fce0e6
SHA1 0d7452295c9f09981d62e5c4360f4922531b4e85
SHA512 41a1f83767360007dc7a4307c4624c2765e865c0aab794fe96fb797fc729123cca03ae97ede05eeefa3c0da0153e8719fc4d2df93d2ed61f007d2bd7626a651f
SSDEEP 1536:0LLmWT1jjp9boKPkLLZb5FdRThI6oCgmEjMDY5IgXzTakXn7YTKGHu/Ub0VkVNK:0LyE9jp169HTha8EjMDY95rQKGHu/Ubi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndokbi32.exe

Path C:\Windows\SysWOW64\Ndokbi32.exe
Size 90KB
SHA256 f953456e463e5545710fd2bc12ea8828a60d1f00d3524e3966ff0f99e3f618bf
MD5 10a7d169425397a4ae9d4c48950407e8
SHA1 ad1e5c4c738257f05aa5360784caacfa6c74beaf
SHA512 3f6a0ba965fc48502793ed18c92ffd599b439e1ca3e94878232ddd487b6d8599a4671644951e64e964e561769ccc068551a8133871c788e753ca3330f0cba824
SSDEEP 1536:LgWw+7XIv9Z5UP6Ecz46U4Q0wI3nvyjDkJB3Oi82vVG6u/Ub0VkVNK:0Ww+7XIv26EK46UxGvysJB3e2dG6u/UW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nfgmjqop.exe

Path C:\Windows\SysWOW64\Nfgmjqop.exe
Size 90KB
SHA256 c5bbf299850890424be5378df6960a2084ee9aee607db303b3b785fd78b06db7
MD5 f6f7bf79a95f101133016dd3a288bed1
SHA1 a8b779f63086f26992b3eedb31fcaacfb4dcef48
SHA512 78c537e0b2aaf4e03d603388fca3664432140d163f31f5aebedb111fab0177d1563d842ec89a1c9b3bd0214aed91536025b57621a722443874de3689fc8379ea
SSDEEP 1536:Odi/woCZYGUN14WMsiWXkQkpoBypg/INGAJoFhG4W19Gdpu/Ub0VkVNK:OQ0UN1+xQkRcI8AJo49Gdpu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nfjjppmm.exe

Path C:\Windows\SysWOW64\Nfjjppmm.exe
Size 90KB
SHA256 2c73f1d9997b0bc6574e874ab8316eb707afb069a755c9bad972258d0f067029
MD5 18cdc09fc74e8c0411e462a701095057
SHA1 42c8a8ebcc624d65f229c7a0d846dbcbfa0e9e91
SHA512 daa265c0924ba6c0e1341b2f89ffda64911e0613cc3003552da5f4358eb73aa9058971c52a3e17964e4e870c5a28d6c94aeda35293886e7d73d93f1463b0387a
SSDEEP 1536:Y1K6JkIjBQsXPrGnkO1LbwnYYYYYYYYYYYYYYAYYYYYYZjYYYYYYx88N3x+nbGHw:8Xk21qlB8+x+bGHu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngmgne32.exe

Path C:\Windows\SysWOW64\Ngmgne32.exe
Size 90KB
SHA256 60d794ede4f35d6d35e84950fe6ac0cdd8cfb78f74e8280fd1a197a50facaaf9
MD5 fbca118a01c7006df965972bdbb386f8
SHA1 fd09e2a714bc4d932b98d4304ee09396509dc30c
SHA512 2b9b39c4593b9e0d40cfc79bc39d9ff2d5c946a2fefadf65e942c855b7aa88bf3de14c035df38d59fcb1fc53bf99c038b446e3fc4050795cfa15dbe03e0838fc
SSDEEP 1536:FU38bOxw1uN7DejC/LlQg4dBayoftw6zKwewA5SV0G5bu/Ub0VkVNK:duFaMOgIay6WwAQV0G5bu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpccdlj.exe

Path C:\Windows\SysWOW64\Ngpccdlj.exe
Size 90KB
SHA256 eb78db2b13408f6250fb62dbabf119772e0af97a766a7d11394938f8ba37af14
MD5 79f636e7683d811e274a6e42d62cf501
SHA1 09e02a529360dd960dbf561fe1d16f3654b2f189
SHA512 c403e032c5647c46e929b850df35122a41c58f9ae032ae88d871114b28dd46140130c502ebc22c40399430b41bd330abc5b2ab4001660da2d31d5447761d0661
SSDEEP 1536:UsUxVZJPDTxsqCiO16ujmwytBsteq+hRu3cqq5f+Gfru/Ub0VkVNK:Ur7/vDO1qyeeAGGDu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njnpppkn.exe

Path C:\Windows\SysWOW64\Njnpppkn.exe
Size 90KB
SHA256 272ff2027aeccbaeaf0eab54560d7f5ad51b6948e9f096f98622c9c2844bbcba
MD5 352305e5ac8d66213a93ca470ccfec65
SHA1 3f499421442272ad89fa91304516f7830bd019f6
SHA512 ba6d1ebdfd07e157eada0f20ae8c4a276893a7c55f9fbdfe0e71fba9d7d220edae5dd0562fd6316df01d794d52d8c2e32f525e5be2a02745f91c42c7d0df2119
SSDEEP 1536:N3ai1TUx/9M2tWk3TNsueWIu9WJI45bNC+U9NMME6EGQu/Ub0VkVNK:N3aMugkZsFu8a+Uj9EGQu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njqmepik.exe

Path C:\Windows\SysWOW64\Njqmepik.exe
Size 90KB
SHA256 d423eda2e6d823a045e2734f3d26594ea2bd70b908b8bedb2a8b466738f331d8
MD5 10eb5584e4d74112dd0de454a6d30247
SHA1 6fcdfa9453f80c7b90349b068eaf2a6ac3112d28
SHA512 a9a8f611e4ee5022df9cd2852a5ebc0eb8765db588fbac05f37f9e06cf73b0984e0483862784d3d5bb545ab7e323946cb29aa5940069ef1674f627f26b34f694
SSDEEP 1536:nbdeL4EHhgBKJAxlRRPgGbBYtj58OFfwxrGqu/Ub0VkVNK:nbdenuKJ6gP18mwrGqu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nngokoej.exe

Path C:\Windows\SysWOW64\Nngokoej.exe
Size 90KB
SHA256 9c6b230ee2200fe6d56f0c076d22bf4c4bcf2abc7543e5b76cb9f0c003b8235c
MD5 fbba675ce8be02f08f7bfa9feed2419d
SHA1 112aeee0ea253d2088ecc9517c004ad63c6b9f1b
SHA512 df2b74c54759c068d97dca8bf8ec54d0ee70a2574c9b8fec23896e03cdd9843fee42805a29a0ea84fb998b15c00cf3acfeac90f9455f67cba65d7ce75f9d2aa1
SSDEEP 1536:OOWbFHVJcTdfWxGlHjCwFnbTDzUMXGJu/Ub0VkVNK:982YGDn37XGJu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npjebj32.exe

Path C:\Windows\SysWOW64\Npjebj32.exe
Size 90KB
SHA256 0f3eea9b7b6714c94585f7f332a9f76bb91cd6d675e5e1f947ff4e73a339f944
MD5 d82b253e30d098c6a80db85638f89803
SHA1 0c2290bee3497e6a38423392bc83b49beac8b17c
SHA512 0e1eb0217314b3ef8d5eebef1b5643111fd8a3f55dc05d3fd10aeb5bad3d4d40bacca9c788309d4e05bea399a167d6a0abff19ce845ae369ece076be8bbc5ea1
SSDEEP 1536:CqehdkzyKYgjt1UMhS8xdTGEA9tGCu/Ub0VkVNK:BmKVYWlhS8x4zGCu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npmagine.exe

Path C:\Windows\SysWOW64\Npmagine.exe
Size 90KB
SHA256 bcbee191cb85d64cef5edcd014533290f8ba3323077e718945d141ceb272fa18
MD5 1c9825bb4cf902d3d0245c855ffd6210
SHA1 dfa0f0346bf22b838f6af5c694fb846388c4de4c
SHA512 a1ce1cd35a136588eb4e39ba8632bb1c55e45f4572ab38f411900363a2feb881bd0f4fa23e88564539dc6b33f3b29f533550c669270f78679c2ea5d62e2f3f7f
SSDEEP 1536:9o60rRkM/W8ayPFNcev8mKJQcbuVAMlFDPo/uCM4wHtAYgOSTGlu/Ub0VkVNK:S6kkyPFNIEcbulHPo/uzHelbTGlu/Ubi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Odmgcgbi.exe

Path C:\Windows\SysWOW64\Odmgcgbi.exe
Size 90KB
SHA256 3991abe486befc4ebbedca8a2f3e3f524fad7eabe613c2adc13eb297bfbe5d8d
MD5 f61fa8a2e300ea82c18a608ff2fe9f94
SHA1 b8543b0956abb4e1c7b31db66c973fbc2487f03c
SHA512 623c82b51a8dbfdfdbb07c7cf6c11edda8ce85889b8c480377f1c8c0054b2d9210086fdf403ec507936fe2a6650ad45063ff340abf441c8ea36adf6f5d9c5b22
SSDEEP 1536:Rac0Jz923XO/Eq0fI8SzfXGhyNgyH0c5VxtfElsX3iSTGLJu/Ub0VkVNK:tnHLfYzf2hFyHLEi3iuGLJu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oflgep32.exe

Path C:\Windows\SysWOW64\Oflgep32.exe
Size 90KB
SHA256 60c97b2f6d235e13430fc52a2377d97b678284d3c38d2eca2d065b5f950138da
MD5 63e22fd69351006b917b87e13cdec73e
SHA1 33fa9dad39583b2e322817798c362bc88a98ef8a
SHA512 c2e99c8d05a6f90ca774bdc44790264f2d55d9ea2375f03b0f1cb4e806a9664b638b702e8b68ed1e9e3fd9d20f6ed337bce64905544a64fe5a4f1e8356e65216
SSDEEP 1536:cH5c/QZ3QQELZGMXpHR53YXmWdOCXofD+2TIaLiaHGHu/Ub0VkVNK:cDnj6pHRVYXmn/S2TneaHGHu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ofnckp32.exe

Path C:\Windows\SysWOW64\Ofnckp32.exe
Size 90KB
SHA256 e55c18f38bb1d56582f7c89cdf3aec2432bdde7ba83d682ed6dbb2e72d235229
MD5 b03c2338438fa80dd60803323251bc7a
SHA1 d29ff8adf00aa1a3168aa2033a208ae1b47d89a7
SHA512 dbe00e05a3c6702c6ffb50a86d19cb2795f0c7472e02cbe40cdc4188af85c5e7fec5b97e43e07a961857041fdd95ae66ed68d58798b9d31a7fee9b76dcd2a51d
SSDEEP 1536:2JCYMr7BMVaiFw5NdeWrTOGgzzX4xitztR6iK3PdT+yG7u/Ub0VkVNK:2NMP2VaiKzF3OGlAtBKfdCyG7u/Ub0+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ognpebpj.exe

Path C:\Windows\SysWOW64\Ognpebpj.exe
Size 90KB
SHA256 03bd8f48ae1c0675d13c76f35618b8ec94600a2c2de6d1ce316fe9b014133380
MD5 67615bb9f3caf5c3599b53eb7240625e
SHA1 5d6674cc2f4d3ab8cd68d38c88e2a497a5f50b50
SHA512 4dae73270f8bc008492eb54aa6e61824f514699fb17e2c3fb928340896be21da57c8297985acc6e71eaa282fc576e5b5ea61a63395acfbd5f944ba294ddcd9dd
SSDEEP 1536:4W1I6jnz2PKYRXH2FUJ02MPou97rEZB4Lnzi97eG4itu/Ub0VkVNK:4Wr/A3U43MPm/4L7G4itu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogpmjb32.exe

Path C:\Windows\SysWOW64\Ogpmjb32.exe
Size 90KB
SHA256 ade60297bf6fdcaa0eb8ee8b46a9b22a5bd9ff2f34e119315e6b6c5ef269e5bc
MD5 e8a0399a1b0639d66e53b27258e72c24
SHA1 830a66d48fba48321bf0ac120ea9e2a67ab246ba
SHA512 1814f06ba535ce37b551f6eb1a433e67493522173ffb1f8d9c14bca3612be1a5f1b2ea506f067a6046c021f3e405bea0df916ed6c478510e606ae974377f43e5
SSDEEP 1536:DUEYFA5QDEJaqBu+HFLbUPigeAQf86G5u/Ub0VkVNK:DAFA5QgQfULS+AQ/G5u/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojaelm32.exe

Path C:\Windows\SysWOW64\Ojaelm32.exe
Size 90KB
SHA256 8df8b32f82f2699912dd7b999b16f809e658807991cc85f2b7fb29fcad193a48
MD5 1755f169bab478e8056ac6470a2b6495
SHA1 2b431dded76058f7259f7f24830a1836bc50f079
SHA512 28616b204d99cbb5c3f00f31c769f3302da725607ed6e33be8e082f57cf9a0a15bbbc1809484b24396ca4432007e8e3ed8fc79caa7aac6a7a6e1037989587139
SSDEEP 1536:nxvYZTm3WZu5G7bN2v/umP5z4bBJaTVkUemO5ozY1fYOcGru/Ub0VkVNK:xQTSWZCG7bN5mR4ds+QzYNY1Gru/Ub05
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojoign32.exe

Path C:\Windows\SysWOW64\Ojoign32.exe
Size 90KB
SHA256 5f4f5d32aeb9c7013fc4fbb8465e97c11172549550ca35b02545ee5a3c9f4498
MD5 caa9d44fd3b763fb97bcd621ded45619
SHA1 1562297040a60d976382c1755852423e7946416c
SHA512 7a865b5cb11e07ea87e8f8e51ce1a81018e8e143e555d126ae1c4a32eb974c523c0683e0e177b8790695a1050907ee6a2aa17ce3806d945ff4a4f93bcfc975e7
SSDEEP 1536:zEyNwQixjjkOczmRIXei75xUyNGNu/Ub0VkVNK:zDifENGNu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Olfobjbg.exe

Path C:\Windows\SysWOW64\Olfobjbg.exe
Size 90KB
SHA256 cea05994ed4a32d3f475d1f426e9085f66564efb22bc7818be0ec9a5a51ef922
MD5 e34ea165198fb4ef75a9d0c3eff995ea
SHA1 0c26ad188367a968d4edd8b80bccd8991a227fe3
SHA512 26883b18d89df4206cd9b6203762895d6f078c0398959a8c5c1a92e275ca6c5aaf303c98f754056d93a85ce2c5c8bb8d676ee01ca7ee6d2ff339c864f42671f8
SSDEEP 1536:LTNP6L886Sw1s137s9JtVPlLIvo0+Dq+5uet08P8797khGOu/Ub0VkVNK:LTNSL88Kg37sPPlLIw0b+5ueW8PhhGOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Olhlhjpd.exe

Path C:\Windows\SysWOW64\Olhlhjpd.exe
Size 90KB
SHA256 54d584a5568a5dac7e1a3bc1e182434feccc81cd9697edba43abfc99eabbc2e5
MD5 93c86d116891e50a62f5c11635836d9c
SHA1 16475470adbd515b4c0b70b824453b140b7805d5
SHA512 4efc14477354ec0d243a122f7f1731fb04867e2c063081be0eb80311d1274d5896093da2d839059c9214db7d4b95229805788e211d229ebbf50f8d2e63823dc6
SSDEEP 1536:Juucs7Mufjl9LtE81zgWanTI+GRSQdKIwLB8mpuuxgq1kRG1u/Ub0VkVNK:J+cjrLtE81ZaYRP10WlRG1u/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Onhhamgg.exe

Path C:\Windows\SysWOW64\Onhhamgg.exe
Size 90KB
SHA256 aa3a21a6ad068bf24c01a5ab0e71725b99d04c459901ed5134a5a372565fdb93
MD5 f0dea411365175d14046d8507118f0c7
SHA1 98afce3673f30d221bf42641a385d6a87716f574
SHA512 1495743c76c2d4124ebbc80254765556cdd4718a80c2603cb6605947ea9330559f244cc6c87b62fd666fc01a610e744f737b71eca3ab7456370598eedd231b96
SSDEEP 1536:uhB0hYUYnxE3QBmGm5a0NnGlYI07h5lrN0KpMijyfVeyrGHu/Ub0VkVNK:uL0hoxEgIGen407h5tGKpMij0VeyrGHw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oponmilc.exe

Path C:\Windows\SysWOW64\Oponmilc.exe
Size 90KB
SHA256 58c9d38a8222b22a1b8263b64cf0e099b4520a0a0cd5854a21f9034fd92554ce
MD5 660a135736ff61a30055c49dfc7801cf
SHA1 b1dc0d6e99e4dd6eeca7345759cdd0391d87c3c3
SHA512 139bea9d12af348cea3d4199ecbeddd98d1531bfa00cfbf5b91225a73f9d9214a30c00710d26bbda41b8283dc8f34d2581969d08f6f527949cb0ede13c57ca11
SSDEEP 1536:+fa7KZVDQjcU4Fuppxte3fsljVOo1GR5QKakq9TGhu/Ub0VkVNK:97aVDTOcEljcoA1cGhu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oqhacgdh.exe

Path C:\Windows\SysWOW64\Oqhacgdh.exe
Size 90KB
SHA256 84e10e30b18b3f578d38e41fa55e94318bcf4abdb64213443dcfe8dfc3a20c88
MD5 9c1fa99e6ac75961d168a1bfc55f51f2
SHA1 791c2c390ae3ca8bd86888d68077f1ef6cfcf848
SHA512 3472407c73398474de33e600bffa6d12f377abfb90ac00dfa3ba9ef925078bb7422e14620972eabaa63eeee96d53c4e30c00b8baf1db14bcd13a56a46c2b484d
SSDEEP 1536:kZlZ4z/mkOT3g1Zp5s1/t8CVGqxHpOQ8/qq7qqbqq7qq7qq7qq7qq7qqbLqqqqqY:MlKz+kq3+8HGW4G8ZGvpu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdifoehl.exe

Path C:\Windows\SysWOW64\Pdifoehl.exe
Size 90KB
SHA256 21826837b7a4d5735a9b8ed991ea675e17d23861635ecfefe62314b70791e365
MD5 c86b4e5e905f2e33a22a0b8ea6e3857d
SHA1 fb2a04df303eebd9d1c41d2ef2ecdce560ea422a
SHA512 cc89505a818a69f6f6fab8a2a1453c99ec7ece5f9c45444114223b0dbe08875a6a8f2397f8e3f75f083108c62512dad14334b661eb7febdbddf2dc1f9f02ab4c
SSDEEP 1536:l7+8CqArF41ra8VFh3gqg9ZUzoovwz1/IH0ItGju/Ub0VkVNK:l7+8C5O1raoh3gqOGEovCEtGju/Ub0+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgefeajb.exe

Path C:\Windows\SysWOW64\Pgefeajb.exe
Size 90KB
SHA256 a7bcd2dae81c23ecb2cd9407c0e33cb10d22a6b618ac75948563d8f81b9f32a4
MD5 75d794362245201fe2cea34e81c06d20
SHA1 b990d49c5c1c64e456aff5a613d1a84f7ef62bfc
SHA512 8cf30be028ad06117446c5b9157e329b2e6ac801549c76d005c8a462ba6234278c0e20bdbfb7bac354cf42e75de21c971178b385b257e81fb6894a4550e26081
SSDEEP 1536:EFo38MSXErBeC4ofH5HcEpJna/SGjo+D9pL+DyzGtu/Ub0VkVNK:Ao38MSXEk+Z8EpJaXSDyzGtu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnlaml32.exe

Path C:\Windows\SysWOW64\Pnlaml32.exe
Size 90KB
SHA256 ff1806f23e20d52edd5a7d648ef7fd1d7383297486a523690bba9e69ce4d2a65
MD5 840a6559768b07a052ea8dc8eb634ffc
SHA1 3facb44e89c6bc14ad89a3c69293111675c0b8e7
SHA512 791a5485c97341c6e9845d9a0e8912249b8dc41bdfbb9e09d5feddcae3857880c64acd144ef40ee159f0e2e83d4cce49c7c72b75316b374fd3b8dad59f648a14
SSDEEP 1536:FuuH4bIcL0KHX9cPsoXrdghZDr9hRtk1d0+bSxe///HsWi9sD7uGku/Ub0VkVNK:Fh4bIcL0K6PBkptk1NuxHa7uGku/Ub05
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnonbk32.exe

Path C:\Windows\SysWOW64\Pnonbk32.exe
Size 90KB
SHA256 87c672a6a2626d2cb9f65d7c4b4dcdbaac94f012b160792ff619059ca7bd49f7
MD5 9da6c68fe58ab0e614af07dba5cb1f08
SHA1 f1965cd26863390fe5e0b0486d0819278d80a54f
SHA512 6e97b4c8a8ab519d5ca7cd9adb5d5437d1974634dc3d4177cc15c9164f8d387215bfeeb8f2e5973edc8f37cf7ae2f84e1a932f92a59fa735e452177ec96182f8
SSDEEP 1536:Hr1nt0IiWBd8GWXqOFdPSz4kVOCjgneGUwu/Ub0VkVNK:L1nWInd8GW6OPaz3tceGfu/Ub0+NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-248-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/464-151-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/532-382-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/548-120-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/556-208-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/668-200-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/780-418-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/812-388-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/940-532-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1128-256-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1152-394-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1184-216-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1252-424-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1280-442-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1364-310-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1380-436-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1384-72-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1388-32-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1388-572-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1404-430-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1460-514-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1524-352-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1780-262-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1828-538-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1856-586-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1856-51-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1880-239-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1912-63-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1944-376-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2088-328-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2164-358-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2208-370-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2280-448-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2304-406-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2312-526-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2368-508-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2528-340-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2664-334-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2708-87-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2720-476-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2820-505-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2860-593-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2860-56-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2904-460-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2920-412-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2936-544-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2936-0-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2964-143-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2996-400-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3004-23-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3004-565-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3224-298-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3240-175-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3248-520-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3324-286-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3336-79-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3356-111-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3420-268-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3468-346-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3552-164-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3600-136-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3724-103-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3936-322-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4008-484-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4208-292-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4212-232-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4228-95-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4384-490-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4424-364-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4468-550-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4476-274-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4552-192-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4556-280-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4584-579-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4584-39-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4600-496-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4608-454-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4624-304-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4816-466-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4864-127-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4900-188-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4932-316-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4972-224-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5028-551-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5028-8-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5088-172-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5096-15-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5096-562-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5100-482-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5132-552-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5184-563-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5260-566-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5352-573-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5396-580-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5456-587-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5500-594-0x0000000000400000-0x000000000043D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads