berbew | 4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1ca

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1caN.exe
Size 135KB
Sample241109-3bvltstld1
SHA256 4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1ca
MD5 6df8b9185fc0e28833bc972ed03f8830
SHA1 77c065fecee428134d3832cb1d1c89137211aaf8
SHA512 9c6076ecd1abab179fdff31b406ec6f557a504f032d5239303d3b9822553a9e2b68bc69a7bb01f1bc08ed6f20be01ef215f757e44ddd987f3e32fb74af287d42
SSDEEP 3072:dXMXSzyGBPyteGCDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:dXM1GhywMNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajckij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nngokoej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfaigm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oqfdnhfk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npjebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ognpebpj.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4832	Mplhql32.exe
1520	Mckemg32.exe
2012	Miemjaci.exe
3196	Mlcifmbl.exe
2188	Mgimcebb.exe
676	Mmbfpp32.exe
680	Mdmnlj32.exe
3960	Menjdbgj.exe
4848	Miifeq32.exe
5036	Mlhbal32.exe
1816	Ndokbi32.exe
4952	Nepgjaeg.exe
452	Nngokoej.exe
2356	Ndaggimg.exe
1688	Ncdgcf32.exe
1196	Nebdoa32.exe
3296	Ncfdie32.exe
5112	Njqmepik.exe
3668	Npjebj32.exe
2956	Ngdmod32.exe
3476	Nlaegk32.exe
1644	Nckndeni.exe
3136	Njefqo32.exe
3732	Oponmilc.exe
2296	Ocnjidkf.exe
4276	Oflgep32.exe
4912	Olfobjbg.exe
1960	Odmgcgbi.exe
1860	Ofnckp32.exe
2020	Olhlhjpd.exe
3944	Odocigqg.exe
332	Ognpebpj.exe
1188	Ojllan32.exe
4968	Onhhamgg.exe
3744	Oqfdnhfk.exe
4940	Odapnf32.exe
2040	Ocdqjceo.exe
3128	Ofcmfodb.exe
876	Oqhacgdh.exe
4656	Ocgmpccl.exe
3224	Ofeilobp.exe
952	Ojaelm32.exe
3932	Pqknig32.exe
4892	Pcijeb32.exe
1564	Pfhfan32.exe
1760	Pnonbk32.exe
1064	Pqmjog32.exe
1040	Pclgkb32.exe
2920	Pfjcgn32.exe
3428	Pmdkch32.exe
316	Pcncpbmd.exe
4708	Pflplnlg.exe
4888	Pjhlml32.exe
4368	Pncgmkmj.exe
3700	Pdmpje32.exe
4568	Pgllfp32.exe
1592	Pjjhbl32.exe
4156	Pmidog32.exe
2964	Pcbmka32.exe
4788	Pfaigm32.exe
2372	Qmkadgpo.exe
4068	Qdbiedpa.exe
1648	Qgqeappe.exe
3688	Qjoankoi.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Afjlnk32.exe	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Laqpgflj.dll	Qddfkd32.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Lafdhogo.dll	Miifeq32.exe
File opened for modification	C:\Windows\SysWOW64\Ndokbi32.exe	Mlhbal32.exe
File created	C:\Windows\SysWOW64\Fdjlic32.dll	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Pcncpbmd.exe	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Fmijnn32.dll	Mgimcebb.exe
File opened for modification	C:\Windows\SysWOW64\Mdmnlj32.exe	Mmbfpp32.exe
File created	C:\Windows\SysWOW64\Ocnjidkf.exe	Oponmilc.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Oqfdnhfk.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Ncdgcf32.exe	Ndaggimg.exe
File opened for modification	C:\Windows\SysWOW64\Nlaegk32.exe	Ngdmod32.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bmemac32.exe
File opened for modification	C:\Windows\SysWOW64\Nckndeni.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Ndokbi32.exe	Mlhbal32.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pmidog32.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Ofeilobp.exe	Ocgmpccl.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Aeniabfd.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Eeiakn32.dll	Bagflcje.exe
File created	C:\Windows\SysWOW64\Fqjamcpe.dll	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Ognpebpj.exe	Odocigqg.exe
File opened for modification	C:\Windows\SysWOW64\Pfjcgn32.exe	Pclgkb32.exe
File created	C:\Windows\SysWOW64\Miemjaci.exe	Mckemg32.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nckndeni.exe
File created	C:\Windows\SysWOW64\Jbaqqh32.dll	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Cndikf32.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Pkfhoiaf.dll	Oflgep32.exe
File opened for modification	C:\Windows\SysWOW64\Odmgcgbi.exe	Olfobjbg.exe
File opened for modification	C:\Windows\SysWOW64\Ajckij32.exe	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Bmhnkg32.dll	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Onhhamgg.exe	Ojllan32.exe
File opened for modification	C:\Windows\SysWOW64\Ocgmpccl.exe	Oqhacgdh.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Aminee32.exe	Afoeiklb.exe
File opened for modification	C:\Windows\SysWOW64\Mckemg32.exe	Mplhql32.exe
File created	C:\Windows\SysWOW64\Menjdbgj.exe	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Kgngca32.dll	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Bmemac32.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Mplhql32.exe	4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1caN.exe
File created	C:\Windows\SysWOW64\Oqfdnhfk.exe	Onhhamgg.exe
File opened for modification	C:\Windows\SysWOW64\Cdfkolkf.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Nkenegog.dll	Nepgjaeg.exe
File opened for modification	C:\Windows\SysWOW64\Ndaggimg.exe	Nngokoej.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qmmnjfnl.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bmpcfdmg.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bmemac32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6252	6148	WerFault.exe	228

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnjidkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgllfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbmka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlcifmbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofnckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfaigm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgimcebb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndaggimg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcijeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfobjbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgcgbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odocigqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npjebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mckemg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menjdbgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onhhamgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miemjaci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmbfpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miifeq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqfdnhfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekphijkm.dll"	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1caN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeiakn32.dll"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaoecld.dll"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgefkimp.dll"	Mmbfpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nckndeni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbkfake.dll"	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pqknig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojllan32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4832	2224	4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1caN.exe	83
PID 2224 wrote to memory of 4832	2224	4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1caN.exe	83
PID 2224 wrote to memory of 4832	2224	4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1caN.exe	83
PID 4832 wrote to memory of 1520	4832	Mplhql32.exe	84
PID 4832 wrote to memory of 1520	4832	Mplhql32.exe	84
PID 4832 wrote to memory of 1520	4832	Mplhql32.exe	84
PID 1520 wrote to memory of 2012	1520	Mckemg32.exe	85
PID 1520 wrote to memory of 2012	1520	Mckemg32.exe	85
PID 1520 wrote to memory of 2012	1520	Mckemg32.exe	85
PID 2012 wrote to memory of 3196	2012	Miemjaci.exe	86
PID 2012 wrote to memory of 3196	2012	Miemjaci.exe	86
PID 2012 wrote to memory of 3196	2012	Miemjaci.exe	86
PID 3196 wrote to memory of 2188	3196	Mlcifmbl.exe	87
PID 3196 wrote to memory of 2188	3196	Mlcifmbl.exe	87
PID 3196 wrote to memory of 2188	3196	Mlcifmbl.exe	87
PID 2188 wrote to memory of 676	2188	Mgimcebb.exe	88
PID 2188 wrote to memory of 676	2188	Mgimcebb.exe	88
PID 2188 wrote to memory of 676	2188	Mgimcebb.exe	88
PID 676 wrote to memory of 680	676	Mmbfpp32.exe	90
PID 676 wrote to memory of 680	676	Mmbfpp32.exe	90
PID 676 wrote to memory of 680	676	Mmbfpp32.exe	90
PID 680 wrote to memory of 3960	680	Mdmnlj32.exe	91
PID 680 wrote to memory of 3960	680	Mdmnlj32.exe	91
PID 680 wrote to memory of 3960	680	Mdmnlj32.exe	91
PID 3960 wrote to memory of 4848	3960	Menjdbgj.exe	92
PID 3960 wrote to memory of 4848	3960	Menjdbgj.exe	92
PID 3960 wrote to memory of 4848	3960	Menjdbgj.exe	92
PID 4848 wrote to memory of 5036	4848	Miifeq32.exe	93
PID 4848 wrote to memory of 5036	4848	Miifeq32.exe	93
PID 4848 wrote to memory of 5036	4848	Miifeq32.exe	93
PID 5036 wrote to memory of 1816	5036	Mlhbal32.exe	94
PID 5036 wrote to memory of 1816	5036	Mlhbal32.exe	94
PID 5036 wrote to memory of 1816	5036	Mlhbal32.exe	94
PID 1816 wrote to memory of 4952	1816	Ndokbi32.exe	95
PID 1816 wrote to memory of 4952	1816	Ndokbi32.exe	95
PID 1816 wrote to memory of 4952	1816	Ndokbi32.exe	95
PID 4952 wrote to memory of 452	4952	Nepgjaeg.exe	96
PID 4952 wrote to memory of 452	4952	Nepgjaeg.exe	96
PID 4952 wrote to memory of 452	4952	Nepgjaeg.exe	96
PID 452 wrote to memory of 2356	452	Nngokoej.exe	98
PID 452 wrote to memory of 2356	452	Nngokoej.exe	98
PID 452 wrote to memory of 2356	452	Nngokoej.exe	98
PID 2356 wrote to memory of 1688	2356	Ndaggimg.exe	99
PID 2356 wrote to memory of 1688	2356	Ndaggimg.exe	99
PID 2356 wrote to memory of 1688	2356	Ndaggimg.exe	99
PID 1688 wrote to memory of 1196	1688	Ncdgcf32.exe	100
PID 1688 wrote to memory of 1196	1688	Ncdgcf32.exe	100
PID 1688 wrote to memory of 1196	1688	Ncdgcf32.exe	100
PID 1196 wrote to memory of 3296	1196	Nebdoa32.exe	101
PID 1196 wrote to memory of 3296	1196	Nebdoa32.exe	101
PID 1196 wrote to memory of 3296	1196	Nebdoa32.exe	101
PID 3296 wrote to memory of 5112	3296	Ncfdie32.exe	102
PID 3296 wrote to memory of 5112	3296	Ncfdie32.exe	102
PID 3296 wrote to memory of 5112	3296	Ncfdie32.exe	102
PID 5112 wrote to memory of 3668	5112	Njqmepik.exe	103
PID 5112 wrote to memory of 3668	5112	Njqmepik.exe	103
PID 5112 wrote to memory of 3668	5112	Njqmepik.exe	103
PID 3668 wrote to memory of 2956	3668	Npjebj32.exe	104
PID 3668 wrote to memory of 2956	3668	Npjebj32.exe	104
PID 3668 wrote to memory of 2956	3668	Npjebj32.exe	104
PID 2956 wrote to memory of 3476	2956	Ngdmod32.exe	105
PID 2956 wrote to memory of 3476	2956	Ngdmod32.exe	105
PID 2956 wrote to memory of 3476	2956	Ngdmod32.exe	105
PID 3476 wrote to memory of 1644	3476	Nlaegk32.exe	107

C:\Users\Admin\AppData\Local\Temp\4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1caN.exe
"C:\Users\Admin\AppData\Local\Temp\4f34e4f282f9735626be594352b8b7f4603128ba5e44729aaaa4c799dd84e1caN.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\Mplhql32.exe
  C:\Windows\system32\Mplhql32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\Mckemg32.exe
    C:\Windows\system32\Mckemg32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\SysWOW64\Miemjaci.exe
      C:\Windows\system32\Miemjaci.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2012
    - - C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3196
      - C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1644
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        24⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4276
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2020
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:332
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1188
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2040
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:876
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3224
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        43⤵
        Executes dropped EXE
        
        PID:952
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4892
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        47⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1040
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        50⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3428
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        52⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4708
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        55⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3700
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4156
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2964
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        62⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4068
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1648
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3688
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3332
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        67⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1316
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4512
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        70⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2680
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        73⤵
        Drops file in System32 directory
        
        PID:4312
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1488
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        75⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        76⤵
        Drops file in System32 directory
        
        PID:3856
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:816
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3116
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4972
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        82⤵
        Modifies registry class
        
        PID:2544
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        84⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3456
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3516
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        90⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        93⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        95⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5532
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        99⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        101⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        102⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        103⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        110⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        111⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        114⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5540
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        118⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        120⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        124⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        129⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        130⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        132⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        133⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        134⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        136⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        139⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        140⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6148 -s 408
        141⤵
        Program crash
        
        PID:6252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6148 -ip 6148
1⤵
PID:6212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cmlihfed.dll

Path C:\Windows\SysWOW64\Cmlihfed.dll
Size 7KB
SHA256 3a6b958c6544ce8a36a4fb944a75e84e4100ae5683c3f6ef5458e756cb693cda
MD5 811d6a383150065c78450caa68a01c4a
SHA1 a05421d29cc6fa8ad44f039ceb621a24dab39a57
SHA512 09996557b7d8179316b070abcceb5746ef267accb6e5cb7ca88e872ee32cacbd161540ad6b98a0fa825108e2aac5a2fccd547952542ee1942e3afff6680aaab4
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPud3cX5aXW:wUaJf/aFbP0O92JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mckemg32.exe

Path C:\Windows\SysWOW64\Mckemg32.exe
Size 135KB
SHA256 959d8ce8a9dd49b045a5d5d0b553c9e826b855b65342743f48965040b44e7fb5
MD5 27b432da378780f83c26482d0f1cd30a
SHA1 24fd74bae8ecc5f6d3253c8cb05582532642c9a2
SHA512 c3c6aca51859569b80b0f1d6ea7724c9def7873cc85c0e86da0bb0dd989d26d2f5337789d903c1e35e9f3bced228c211658d89f7da5967d1ff04cb7214fe9422
SSDEEP 3072:xoDhA0GOiwVdeGKDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:mSOHgINxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdmnlj32.exe

Path C:\Windows\SysWOW64\Mdmnlj32.exe
Size 135KB
SHA256 98594fdbd5a6f00036b65f4b69a2d1d0400f492b4cc35528d8b930f8698876c4
MD5 7303222ecd089e36e72b9e789cafa6e2
SHA1 e1cdf8006d0b952dc836677dfee677c8d5d3bc92
SHA512 f68a158f5e7d908fcc38c2f84acf0b9e4e5ae16a7cf3b06826e77141ef0bb051301cadc0dfc41cb009dd4c3f8e2401561ca7aebf5ef2ac7716a99d04ecfa51a0
SSDEEP 3072:dbcz7+u/3R/eGyDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:dGaY8sNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Menjdbgj.exe

Path C:\Windows\SysWOW64\Menjdbgj.exe
Size 135KB
SHA256 9dd061e7dffb3df8398ffc228d7978cc8164dc42b078daf320ad043350ef2e0d
MD5 892b03bbadbf8663e3ee0d26aa95a84e
SHA1 40225b24140c40c4a6e61ef770ea85f9dad14402
SHA512 5c9f7ddffafd6f1ae2ed84dbbd951dc87629d83931dbbc70e35b828d3372ca7101543a3402d0e7d7ead6528b913c52cb8395a83029afc2f41b353097f9c039bb
SSDEEP 3072:RZFTKQ6IX76reGmDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:RZAQ6IXBMNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgimcebb.exe

Path C:\Windows\SysWOW64\Mgimcebb.exe
Size 135KB
SHA256 4445e25073e1b50e8aebea3beded636413b77da27455fedcff260cef5456a9f1
MD5 f8a8de139c0ab084016215a34d71aab7
SHA1 753ea0676629fcf16a8f7a4636a9ac152987531b
SHA512 e7ee5e75ddd337a2eded7a931314955955e5340c5042425a5dd0f9ee070b3fc0521b8b7db6ab345a67658d74c64c003bededbe111ef7b7f0c2bf4afe62b0fcfe
SSDEEP 3072:OqMnlmTk4SINZSPvLY5eGkDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:OqMGCIuPvLHGNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Miemjaci.exe

Path C:\Windows\SysWOW64\Miemjaci.exe
Size 135KB
SHA256 8cc16c60ba0601155d609e70ebc0118d76a647cb85e153cf75744be22f50fb73
MD5 e782881f7611607a8bc11c124baa1adc
SHA1 8c649514c31b2a18a02d9ee5226f8b2056c833f5
SHA512 0c317744cdf4cb592c147056ec82b53e6c6fdd7e5b4c589d18dcdd081d324392714a60ebb15d904342dc2c78a268f99365f5f65ebd64c0ad9a56bdf279cffe0b
SSDEEP 3072:/jrkXwXh7/8mcrBWaVmTM9xeGzDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:/j8wR7/85c49ExNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Miifeq32.exe

Path C:\Windows\SysWOW64\Miifeq32.exe
Size 135KB
SHA256 926e81d442b013307bd8e37f45ab4c0f9fff6c481226d35e4772687aace87f08
MD5 314320aae1234c32747e6ddcd7801bda
SHA1 c14fcb329ccc5405eceb03d693e4747ed4d13187
SHA512 df0f979b046dfac92999e57fddbe592bc4ee262494ce36fefbeea87a6608f2c2e3c84cb31b6978f44dc74084d6d2b611bbb024bd98f7f063f6900d4b8890a43f
SSDEEP 3072:gB6WFAVbvtCT/aixyOBegJlZeGWDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:CCptC7aukgEcNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlcifmbl.exe

Path C:\Windows\SysWOW64\Mlcifmbl.exe
Size 135KB
SHA256 9c722996431f14f8c3fa5b46d170b1607342574c594b29140e602e0471600ff8
MD5 d37c2e6243fb86169d1a9f2682be4777
SHA1 3974da97ebaf875bb3097056c95d0860a02474b0
SHA512 9e10d6e8f2b0c8341d81d52afa4525cadee950fded87c6ce65f9a8be2808fd5ab664ebab49df8e893765790e7e550abe25fa458cba93e8aaf3bcf40bac2463cc
SSDEEP 3072:KaPdbZ3jQl3UFi2Apy/UB7eG5DM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:Kaykw2ApaUAXNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlhbal32.exe

Path C:\Windows\SysWOW64\Mlhbal32.exe
Size 135KB
SHA256 2d730a7fafe07fb377fae977ab41482cde3e3b1e20f59afa7809ff030fc1f9b2
MD5 0eb336eb17a1aec20da2f2a6a2f90fc0
SHA1 5121389a19dedd10dc2e38c1b0aa74ba2babbdbb
SHA512 48b0328a97cfa598f60fabaef3b3cf3a242d2ba2eb7300cada58376ce5fbdec867d3a4d8d06dfb769ec924723dc92138f8d329dc84aa771f33456924cd609800
SSDEEP 3072:k4o6QrRpJ1bxeHw1V1gJiTJeGNDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:k/txKrjNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mmbfpp32.exe

Path C:\Windows\SysWOW64\Mmbfpp32.exe
Size 135KB
SHA256 260068ec4b32bc312cb568781da7d89a6d6953a81a408db108654f58d694df38
MD5 5b71b7d4c7c350beaa158baec475e4ac
SHA1 752163adbebf26cfbefd8cd6a0051ba9a2338942
SHA512 cb6c37679d5aadf289d66c4aad34ba65b264053e1d186aa8ecebcfc725744f8dbdfe2bf3404fc82ccc17dea651be6c688cea28ab971604c0a5c58e9c04e318a7
SSDEEP 3072:pzl8tWMJPf5gwrXeoXdeGaDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:pzl8tWcP9rrXgcNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mplhql32.exe

Path C:\Windows\SysWOW64\Mplhql32.exe
Size 135KB
SHA256 54f6d1b547944295ead83ca5e792d48b7c9d0a185a132db624099f5325db202a
MD5 efede23a05d6a283199bba723d50e63e
SHA1 5e3a0b44744373eb73de428440d98b454da81f2e
SHA512 653c5b8e0134f5e066fc4bf94c4508ac1095a656a4ac710847a93b7cceb6339918a9bf7740e175b96750ffc58fafcbc2d8f3c6cd2740ceece9964ebd6d768af8
SSDEEP 3072:nLQ7ELsBW0VnKOmK2s1RDh5uCeGRDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:LSdxVnhb2iR15uZ7NxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncdgcf32.exe

Path C:\Windows\SysWOW64\Ncdgcf32.exe
Size 135KB
SHA256 b02e1d4b714cb63adbb7c7c1baffa33f20aabe3870da233e8183376e5565f5d2
MD5 3a2de256a4a2240e9016168bfc9dbc6d
SHA1 0d165b24ae2789bfc5f675d6dc39b499ca676a47
SHA512 3f0e826756df7706fcb4a33c0148d177e4e4c452a254fe6c58a02d3bf68d022b701d8c3c550de2e3808bbe08e7f473f658553c056e347b479c88cdd824bbb148
SSDEEP 3072:/49OE5eENLHMspaXCEteGhDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:af5eiLhaXCEwjNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncfdie32.exe

Path C:\Windows\SysWOW64\Ncfdie32.exe
Size 135KB
SHA256 d83b89e1ea70c2150052cb255ca38d5d76890f392d34ba9c44e93fc99441107f
MD5 a7b3512c9f232b6d11d93a600c7870c3
SHA1 596bbc2d6527266f6fa9204dff56dc60e7148e78
SHA512 3e9fbf423c0bc4d2bb50f9ffdd5cd358dd1ded1f0e599eeefdb16b45ffe3964361c3fff99eb733cd8eb4d50245a3b695614e73adc85aa8cac9d6171ed1206619
SSDEEP 3072:YQTN2+XGNjQKSkz6eGkDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:jxVKSkzRyNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nckndeni.exe

Path C:\Windows\SysWOW64\Nckndeni.exe
Size 135KB
SHA256 1b98eca6174c3d482cb9ed7c4005101e1ae8c85fe6040f610bc923731d3a2021
MD5 bac7f96fade3346a5ac88005365110e9
SHA1 e5f81337012c7937857d77ebccf5ec5f170966ea
SHA512 40e451aac5a0159e9060913e14ef8b756851437a5c620e64ef5d4b41c144c75f0abf422835b12c69e5fa23b4c3b657e891139812ec996415c1fd5fb864d25bea
SSDEEP 3072:G55Taidjj5KOhMPNkeGgDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:Q5Taidjj5rhM1iNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndaggimg.exe

Path C:\Windows\SysWOW64\Ndaggimg.exe
Size 135KB
SHA256 ec48d0ff1d510f72d4932d4b4793358a76a42cf0a22b91347c6bc2092507f51b
MD5 cf2bb6215b6c8731442c511fea1adc44
SHA1 ecd247076a1f81958da45ebe95d042270ebf77db
SHA512 44e99467a2adb858619fb39d1bce1ab27520bd59e0967dd79c6ad0d113c10223a038bb1115d7ad37f0e8ed5ba5229ec7be371168b2a31ccfc2d3dcfe12b27afd
SSDEEP 3072:+PuYYFXQN+CpUgeGNDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:vYYpQ3pEvNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndokbi32.exe

Path C:\Windows\SysWOW64\Ndokbi32.exe
Size 135KB
SHA256 179954284447dc35405149678344f84c94db29630d5db7d1cfcf1005f7fbb833
MD5 1d6ecaee5d30893fe4074c7723145302
SHA1 6ac4c542ef22ab16e9a8c70b1430fb302e8398f7
SHA512 047179d3435a2d24ffb8b048035d78ea9ace1fcaadc35c3b7e7c41089ff5b6eada9f7424a653693b652843c9ecb6222105dc40ba6d72a734e08b284e0aded18a
SSDEEP 3072:ec2betiGKTR6/2LRuYalgXDldeGHDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:ec2betiGKR6ERVaSlgVNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nebdoa32.exe

Path C:\Windows\SysWOW64\Nebdoa32.exe
Size 135KB
SHA256 d6a86e5259d93f7de5addeb59d1a326b5e29457097aa87609464c296cfdf691e
MD5 f701d2a3042d4058158f27c3907cde5e
SHA1 8fb0e729fe0c8a56a90cc328f27b5ba2697eac28
SHA512 7f7a283912c67864f34ea1a617c9c4ceb1cd0f902fd91aba899fb902a75ebd9ce55ed6b3b3eadcb6adc48fd2781245e19374f84e13e2f25adeeaae1183fb748f
SSDEEP 3072:IMypSUtH2o2TyLENeGVDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:79gzXNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nepgjaeg.exe

Path C:\Windows\SysWOW64\Nepgjaeg.exe
Size 135KB
SHA256 6ecf41724dd40a81d067722a3b0e171f92bd6d98098c5b1bd42241f5cb50dc2a
MD5 3ee8003dcbdef5194a1016a479d6d23f
SHA1 fdfaa3f3ea6f6d51ccf727c84ff91e9195764c01
SHA512 33127f56acece07aa1acf02cda5f7a32d6fa406b789fd3ec69e1c23adb71a49e13ceeba30894531593344df4963a9f95d7bda2f6ff1a7c8d805adc2b0adbc3ec
SSDEEP 3072:zJXux8S6IqKt0vbUeGbDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:NuAKt07ZNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngdmod32.exe

Path C:\Windows\SysWOW64\Ngdmod32.exe
Size 135KB
SHA256 6daab3807363ca393729a58137bae0b9e5ddf08e25b9a6bf5b30059ee609427b
MD5 df8169a7ab7119b8ee502da27a57e93f
SHA1 b84f504b042fb00c3b0f9f03e6ad07d10d1caa54
SHA512 4aa6834759b84999dc4c17e6c33deb96e3dba08c7f7fa4ca66b419405e7d1e28b90419300fc8a9d32c709b49eaecabaf66dc5bb029f1d65979c804bd946d577d
SSDEEP 3072:Hqjp1qb/OxpIVnXt8Pa/NeGPDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:KjLqzv/QBNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njefqo32.exe

Path C:\Windows\SysWOW64\Njefqo32.exe
Size 135KB
SHA256 23806c7995c0b13bfad3bb73ef3f0a16d6022a800655860ab43ef6b058d1afaf
MD5 8c1385dda353e9740c67c7fb0bb8cb5c
SHA1 69576f76dbde4fcb1cdcd447371dddb462e97f11
SHA512 eb185de52cc854a43b63a328cb1496cc88db918f77e9d87152d9809d4cdd5e02ac357db3cb6971020fd0cd55984c339839fb04a6ddbbd20d15425515826b79f8
SSDEEP 3072:AUEPfPTh6QZ5zajjeGuDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:AbT8QZ1a+ENxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njqmepik.exe

Path C:\Windows\SysWOW64\Njqmepik.exe
Size 135KB
SHA256 61cb9830944f1834e088060da16717bd5c5b7416d9d8c90af663324bd161b8b2
MD5 b4c37ca5d3b271525d36a2a9f6b76cdb
SHA1 8526ce8e90d98a440f374387f0537e69d26e3544
SHA512 6502d7c12b13ff3a3295a6cfbd8b2009bbcfc464291cbc9e8712acfb34d53d6ec4fcfa124a501e9c9eccead233508cf83bcfa92f11e7ca2bb83ebcd04ff7ac34
SSDEEP 3072:8+jDjtP2gpeGeDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:xXjtev8NxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nlaegk32.exe

Path C:\Windows\SysWOW64\Nlaegk32.exe
Size 135KB
SHA256 878c2f44f02c2039854842050635adcdb8e6e6dddda51a2716c7ce21e841ea5d
MD5 9eca592305f569c10c3569425c233033
SHA1 4597f8a8d284e94f4cce4e51b5d1cb5caed7269b
SHA512 d9d170124e7b5c903f3e0e21142f3928a11694062dceb34249b6b7e83deba8160f9003ca4ea0f9ce7cc939842e8259af9cd4915b66386138db8d39042e76bf45
SSDEEP 3072:y0vyACV/ZSDsDTTSAXfmG/HsXveGwDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:y0vK0WTOAX+G/HsW6NxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nngokoej.exe

Path C:\Windows\SysWOW64\Nngokoej.exe
Size 135KB
SHA256 90c85817a60672ad598adacf1c3f82eae6187f3b2d5e459ccb82c18980de9ea0
MD5 ba1e7e18cc028180791cd264ca9301ca
SHA1 298735cd41cc66a17f49c9173660a8f2e5aa4582
SHA512 7581f32408a3761511be6f109561c27e553deb5190e82cc18a40949ebb5a99351004f743a66563c3a137e3308fdbb4085bf076c8cdaec261d26b9fab292945e1
SSDEEP 3072:FogekkP6kWy8Sl9HpijJ6KmeGVDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:+gdkDWy8SjJidRnNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npjebj32.exe

Path C:\Windows\SysWOW64\Npjebj32.exe
Size 135KB
SHA256 4af04013a7d5b961cbd24e3e1e1207501b8a12000564604687fb9cc4f6a8c03f
MD5 0394a53b2765342dacce2edad0891261
SHA1 84d271656a4f1b7ef89d1c366a78ccc42e038be1
SHA512 df480b7743303ee469b6cad11a288d84d7147536fd5f1928f53757a9eab4f9d052e9102d39e58cc5591499ccba3de209958fc6ba3c90b67e7c90a73e2fc4df52
SSDEEP 3072:OyTQ/TN0mqVROoZgfJm/r+eGeDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:OycrN0mqVklJmZINxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocnjidkf.exe

Path C:\Windows\SysWOW64\Ocnjidkf.exe
Size 135KB
SHA256 05dac0344efa62a105aa2994f0fcefd2a62e296ece5468363f1e5dfb4054a8ad
MD5 aa48c720160cafca95d69858b88da1e3
SHA1 5eb24cdbdceeb51f80225ccbe80976b202b3cf28
SHA512 561e28b9b4bb6562a05b556afa7b4cf6bf5c4601adbb584abbd9bcfa605c8f0bd23e340add40e446be783159fa95b43f0f8bdf148a5f5fdc6b55b23bad34ef83
SSDEEP 3072:cw53DNEi56p/PvUuVK8XKeGqDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:cwTEnvvKKhENxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Odmgcgbi.exe

Path C:\Windows\SysWOW64\Odmgcgbi.exe
Size 135KB
SHA256 4e7e29345b7aa7be539b683308be7dc210afa8ac25244b2f895f1eb2039033dc
MD5 49543894c478eba0fdb91641b610dca4
SHA1 f2c56a6e904a3586baa530b9f7381dd246b28ece
SHA512 9d22322339d07b704d8d02cbdb4ff72e3b24e0c8e9005cb475c98169afa366b4644b94cff2abde86ab9b30101f12fa1dfd186d30ac5d81dd0ad48cca4ceca44f
SSDEEP 3072:jDFRppL0iGdojneGL/DM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:jRpLJMoCy6NxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Odocigqg.exe

Path C:\Windows\SysWOW64\Odocigqg.exe
Size 135KB
SHA256 8946796dc6438f61c4d841ece25b40ee63ee64f0fe34d5717cf2f34d2b08c8a0
MD5 edec4bc3e23ef534a028b0d340698ee5
SHA1 3e3d20335b29679642aaa1a6d5b0e46912865162
SHA512 063b98d7465225f1e2ffc59cc5a1cff5572d44aefdfd9dbd83e5352ad619e59ef7d21fd968c6091f48561a4ebc11f677bec156cb5e869755230116ba96a385ca
SSDEEP 3072:9kRFmyu4pzTpk7hEdZMA5rdspneGVDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:9aFDuQeSddspevNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oflgep32.exe

Path C:\Windows\SysWOW64\Oflgep32.exe
Size 135KB
SHA256 d0cf3f4d567f1143310f221073b0a2850369f9bae47973ed98f25664e26d774c
MD5 8895ce0a6b524da4da64c971c36de85a
SHA1 fb965fbe456429a65b24bf691f4e253d230a1dea
SHA512 2b9ea43eb8da25ce9e85cef6ba04d5a6ddebd9d64fcdfd0bc79989b285a5030d00e80f447d3ecd43b74a1eb63f037981feb93f8c76424f5d90e13e5fbfcbdfab
SSDEEP 3072:Nz+T1ZlqzzNBtKpbQX394c5D4eZeGmDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAZ:N+WXo6X394cZu8NxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ofnckp32.exe

Path C:\Windows\SysWOW64\Ofnckp32.exe
Size 135KB
SHA256 3db1d4ec74d36595f433b03eecf1ff67ecb9a846c7bc9fb88bdefb3bd7c8c90e
MD5 a9313e33e56d9c4c825355dc2f42b568
SHA1 ab88b3b5b3297b31d6d7ddc6010df28a263b3ddb
SHA512 04395da4088519fbbd9ddbdef7440ab7d1ea017f9147d2994a6897f128400365a3e3139c8089147096b62293ef423039fdda44ee7c13a5e77153ee9f7e42a100
SSDEEP 3072:QNbBF5FRs4NfwNVAdpShJeG/DM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:8bBFvW4KGShcdNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ognpebpj.exe

Path C:\Windows\SysWOW64\Ognpebpj.exe
Size 135KB
SHA256 84978c58f61313d59e26a0785ff666ea79d14b17b553075b741a84f59061f080
MD5 a9c5cecb2851663f1c668269e4da0a84
SHA1 1edad1a219cdb6afafae006583d8cbc03427b397
SHA512 543e0a14c3622e80b750b243446a94143717fc63a2c2ba26c4777babdfab1d7ca3b217b74f34ff14f6e461eb942209307afe9d4bdeed8cc8bbcb348aa77ff050
SSDEEP 3072:if4LU4z4XXpplNReGGiLDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:ifAU4z4pp7kxNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Olfobjbg.exe

Path C:\Windows\SysWOW64\Olfobjbg.exe
Size 135KB
SHA256 ad8145d361f5455d8adb80b869a2dab477e33256201b5ee40664beb523836e3d
MD5 cb0aeea2d5366de8ad2d9ec2a0b8c429
SHA1 ce313dac7cefd9d18f5a8e6c8a55bc1816bc6d81
SHA512 1824eba3bc5fac59c50a5c4ff813a86e74b46371a74448ff7811aaa0d2c07834e784ffba42b6dc433c4b617ff10bf5fb85b64d23db35e33cd183567ff3d08e11
SSDEEP 3072:ZNt6p5y2id6VkFPYSEAx0Zt3EeGcDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:ZrBFnE1bfyNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Olhlhjpd.exe

Path C:\Windows\SysWOW64\Olhlhjpd.exe
Size 135KB
SHA256 690502652229b745658e8f2574f444325c0a9121337e2aa83603c7ba44ce1648
MD5 29e8dd1de8de234a19279ddda1986d2e
SHA1 2e588661576771fa927dfbbc6b5ac843b995ced2
SHA512 f36ff2cec8b2277d65abb98924b6e7f4382099c00a6ec9a52ed4ddc0d27968f2b255dbd9e5a2e915082d7671c6e8ecb0a9fcf6f38e9a88301b5bc369369a72df
SSDEEP 3072:Bk3Ix5TtxDq5Z3ZKqeGNDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:G3IxPxDq5ZpKBXNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oponmilc.exe

Path C:\Windows\SysWOW64\Oponmilc.exe
Size 135KB
SHA256 3b95658f9e63e468af95403a81eefd9ede244a1bf07777b0d32ff49da3bd8744
MD5 5ec021ad36c0cfbed37f063dedd65015
SHA1 bd2a2031d87fc765862d5ba53efab5c7113b950a
SHA512 92267035ecd4b85bfc91d94c399670625238ce7f7991c7ea59179b0eb25ccd6d2d52aafd7eb3632f5e8512ffc7a29a825c85d13b60e56df2a79ca3cd80d3c010
SSDEEP 3072:lLdv0K3/uZ2a0qeGKDM1IRwMkUIunCaRdelrOyX6gu+tAcrbFAJf:j0K3/1a0BsNxunXe8yhrtMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-370-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/332-256-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/452-104-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/676-47-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/676-586-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/680-55-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/680-593-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/816-526-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/876-298-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/952-316-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1040-352-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1064-346-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1188-266-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1196-127-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1316-466-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1488-502-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1520-16-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1520-558-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1564-334-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1592-406-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1644-175-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1648-442-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1688-120-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1760-340-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1816-88-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1856-560-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1860-236-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1960-229-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2012-559-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2012-23-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2020-239-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2040-290-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2188-39-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2188-579-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2224-544-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2224-0-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2296-200-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2356-119-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2372-430-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2544-552-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2596-570-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2680-484-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2920-358-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2956-160-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2964-418-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3116-536-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3128-292-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3136-183-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3196-572-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3196-32-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3224-310-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3296-135-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3308-508-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3332-454-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3428-364-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3456-573-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3476-167-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3516-587-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3644-460-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3668-151-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3688-448-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3700-394-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3732-196-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3744-278-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3856-514-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3932-322-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3944-255-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3960-64-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4068-436-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4156-412-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4276-212-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4312-496-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4368-388-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4376-520-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4512-472-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4556-580-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4568-405-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4656-304-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4708-376-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4788-424-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4832-8-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4832-551-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4840-490-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4848-71-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4856-478-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4888-382-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4892-328-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4912-216-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4940-284-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4952-95-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4968-268-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4972-545-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4980-538-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5036-80-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5112-143-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5132-594-0x0000000000400000-0x0000000000443000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads