berbew | 6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16N.exe
Size 860KB
Sample241110-acmndsvfpc
SHA256 6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16
MD5 a71b412f7e00dd456bd543299caadce0
SHA1 cc10022c706f85f438c508ea594bdae9f7ce7e55
SHA512 d2fe38dd751f85e4d3144b2e44218d8e004d52bc1c3d0c021d69ce330147b6772d9f01b28aa2500bd13dc6eac06e14c75f7816b6c1c890728a6d06154a798b44
SSDEEP 24576:U5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:LbazR0vD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqfdnhfk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nloiakho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opakbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npcoakfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ageolo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfolbmje.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1452	Mckemg32.exe
4540	Meiaib32.exe
2484	Mgimcebb.exe
1604	Melnob32.exe
3092	Mmbfpp32.exe
3724	Mpablkhc.exe
3008	Mdmnlj32.exe
2620	Mgkjhe32.exe
3380	Menjdbgj.exe
4928	Miifeq32.exe
5036	Mlhbal32.exe
1816	Npcoakfp.exe
4008	Ncbknfed.exe
980	Ngmgne32.exe
1228	Nilcjp32.exe
3224	Nngokoej.exe
3584	Npfkgjdn.exe
4980	Ndaggimg.exe
1864	Ncdgcf32.exe
4580	Nebdoa32.exe
4908	Njnpppkn.exe
4660	Nlmllkja.exe
4596	Ndcdmikd.exe
1400	Ngbpidjh.exe
2900	Neeqea32.exe
1116	Nnlhfn32.exe
4884	Nloiakho.exe
3680	Ndfqbhia.exe
3468	Ncianepl.exe
1184	Nfgmjqop.exe
1972	Nnneknob.exe
3796	Npmagine.exe
2064	Ndhmhh32.exe
3992	Nggjdc32.exe
2288	Njefqo32.exe
2628	Nnqbanmo.exe
1812	Oponmilc.exe
4860	Ocnjidkf.exe
2940	Oflgep32.exe
2172	Oncofm32.exe
1612	Opakbi32.exe
2744	Ocpgod32.exe
2372	Ogkcpbam.exe
4672	Oneklm32.exe
1924	Opdghh32.exe
3984	Odocigqg.exe
2896	Ognpebpj.exe
4756	Ojllan32.exe
3244	Olkhmi32.exe
4276	Oqfdnhfk.exe
728	Ocdqjceo.exe
2872	Ofcmfodb.exe
4848	Onjegled.exe
1380	Oqhacgdh.exe
2736	Ocgmpccl.exe
3128	Ogbipa32.exe
2564	Ojaelm32.exe
5152	Pmoahijl.exe
5192	Pdfjifjo.exe
5232	Pgefeajb.exe
5272	Pjcbbmif.exe
5312	Pmannhhj.exe
5352	Pdifoehl.exe
5392	Pggbkagp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Anogiicl.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Qeobam32.dll	Qgcbgo32.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Jbaqqh32.dll	Opdghh32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qddfkd32.exe
File opened for modification	C:\Windows\SysWOW64\Pdkcde32.exe	Pmdkch32.exe
File opened for modification	C:\Windows\SysWOW64\Ajckij32.exe	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Njnpppkn.exe	Nebdoa32.exe
File opened for modification	C:\Windows\SysWOW64\Pjcbbmif.exe	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Pqdqof32.exe	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	Pcbmka32.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Oqfdnhfk.exe	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Ldamee32.dll	Ogbipa32.exe
File opened for modification	C:\Windows\SysWOW64\Pfolbmje.exe	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Debdld32.dll	Opakbi32.exe
File opened for modification	C:\Windows\SysWOW64\Njnpppkn.exe	Nebdoa32.exe
File created	C:\Windows\SysWOW64\Ochpdn32.dll	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Aclpap32.exe
File created	C:\Windows\SysWOW64\Knkkfojb.dll	Npcoakfp.exe
File created	C:\Windows\SysWOW64\Fmijnn32.dll	Melnob32.exe
File opened for modification	C:\Windows\SysWOW64\Pfaigm32.exe	Pcbmka32.exe
File created	C:\Windows\SysWOW64\Anadoi32.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Cenahpha.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Gpaekf32.dll	Olkhmi32.exe
File opened for modification	C:\Windows\SysWOW64\Odocigqg.exe	Opdghh32.exe
File created	C:\Windows\SysWOW64\Qnhahj32.exe	Pfaigm32.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Chjaol32.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Ndaggimg.exe	Npfkgjdn.exe
File created	C:\Windows\SysWOW64\Bfhhoi32.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Pjngmo32.dll	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Ofcmfodb.exe	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Nilcjp32.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Odgdacjh.dll	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Gcgnkd32.dll	Nnneknob.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Pjhlml32.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Lffnijnj.dll	Mdmnlj32.exe
File opened for modification	C:\Windows\SysWOW64\Pgefeajb.exe	Pdfjifjo.exe
File opened for modification	C:\Windows\SysWOW64\Afoeiklb.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bganhm32.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Mdmnlj32.exe	Mpablkhc.exe
File opened for modification	C:\Windows\SysWOW64\Oneklm32.exe	Ogkcpbam.exe
File created	C:\Windows\SysWOW64\Pggbkagp.exe	Pdifoehl.exe
File created	C:\Windows\SysWOW64\Ghekgcil.dll	Ajckij32.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Ocgmpccl.exe	Oqhacgdh.exe
File opened for modification	C:\Windows\SysWOW64\Nlmllkja.exe	Njnpppkn.exe
File created	C:\Windows\SysWOW64\Nlaqpipg.dll	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Eiojlkkj.dll	Aqncedbp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5284	4696	WerFault.exe	229

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhacgdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmannhhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onjegled.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfaigm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nilcjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndaggimg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojaelm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkcde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlhbal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npcoakfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmbfpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndhmhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggjdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogbipa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdifoehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opdghh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meiaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfgmjqop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oneklm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbmka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neeqea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcbbmif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Melnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnpppkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogbipa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphcjp32.dll"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpllc32.dll"	Njefqo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nebdoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oponmilc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladjgikj.dll"	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnneknob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ochpdn32.dll"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acpcoaap.dll"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najmlf32.dll"	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hppdbdbc.dll"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nloiakho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Goaojagc.dll"	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Empbnb32.dll"	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chempj32.dll"	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pqdqof32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 1452	3124	6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16N.exe	83
PID 3124 wrote to memory of 1452	3124	6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16N.exe	83
PID 3124 wrote to memory of 1452	3124	6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16N.exe	83
PID 1452 wrote to memory of 4540	1452	Mckemg32.exe	84
PID 1452 wrote to memory of 4540	1452	Mckemg32.exe	84
PID 1452 wrote to memory of 4540	1452	Mckemg32.exe	84
PID 4540 wrote to memory of 2484	4540	Meiaib32.exe	85
PID 4540 wrote to memory of 2484	4540	Meiaib32.exe	85
PID 4540 wrote to memory of 2484	4540	Meiaib32.exe	85
PID 2484 wrote to memory of 1604	2484	Mgimcebb.exe	86
PID 2484 wrote to memory of 1604	2484	Mgimcebb.exe	86
PID 2484 wrote to memory of 1604	2484	Mgimcebb.exe	86
PID 1604 wrote to memory of 3092	1604	Melnob32.exe	87
PID 1604 wrote to memory of 3092	1604	Melnob32.exe	87
PID 1604 wrote to memory of 3092	1604	Melnob32.exe	87
PID 3092 wrote to memory of 3724	3092	Mmbfpp32.exe	88
PID 3092 wrote to memory of 3724	3092	Mmbfpp32.exe	88
PID 3092 wrote to memory of 3724	3092	Mmbfpp32.exe	88
PID 3724 wrote to memory of 3008	3724	Mpablkhc.exe	89
PID 3724 wrote to memory of 3008	3724	Mpablkhc.exe	89
PID 3724 wrote to memory of 3008	3724	Mpablkhc.exe	89
PID 3008 wrote to memory of 2620	3008	Mdmnlj32.exe	90
PID 3008 wrote to memory of 2620	3008	Mdmnlj32.exe	90
PID 3008 wrote to memory of 2620	3008	Mdmnlj32.exe	90
PID 2620 wrote to memory of 3380	2620	Mgkjhe32.exe	91
PID 2620 wrote to memory of 3380	2620	Mgkjhe32.exe	91
PID 2620 wrote to memory of 3380	2620	Mgkjhe32.exe	91
PID 3380 wrote to memory of 4928	3380	Menjdbgj.exe	92
PID 3380 wrote to memory of 4928	3380	Menjdbgj.exe	92
PID 3380 wrote to memory of 4928	3380	Menjdbgj.exe	92
PID 4928 wrote to memory of 5036	4928	Miifeq32.exe	93
PID 4928 wrote to memory of 5036	4928	Miifeq32.exe	93
PID 4928 wrote to memory of 5036	4928	Miifeq32.exe	93
PID 5036 wrote to memory of 1816	5036	Mlhbal32.exe	94
PID 5036 wrote to memory of 1816	5036	Mlhbal32.exe	94
PID 5036 wrote to memory of 1816	5036	Mlhbal32.exe	94
PID 1816 wrote to memory of 4008	1816	Npcoakfp.exe	95
PID 1816 wrote to memory of 4008	1816	Npcoakfp.exe	95
PID 1816 wrote to memory of 4008	1816	Npcoakfp.exe	95
PID 4008 wrote to memory of 980	4008	Ncbknfed.exe	96
PID 4008 wrote to memory of 980	4008	Ncbknfed.exe	96
PID 4008 wrote to memory of 980	4008	Ncbknfed.exe	96
PID 980 wrote to memory of 1228	980	Ngmgne32.exe	97
PID 980 wrote to memory of 1228	980	Ngmgne32.exe	97
PID 980 wrote to memory of 1228	980	Ngmgne32.exe	97
PID 1228 wrote to memory of 3224	1228	Nilcjp32.exe	98
PID 1228 wrote to memory of 3224	1228	Nilcjp32.exe	98
PID 1228 wrote to memory of 3224	1228	Nilcjp32.exe	98
PID 3224 wrote to memory of 3584	3224	Nngokoej.exe	99
PID 3224 wrote to memory of 3584	3224	Nngokoej.exe	99
PID 3224 wrote to memory of 3584	3224	Nngokoej.exe	99
PID 3584 wrote to memory of 4980	3584	Npfkgjdn.exe	100
PID 3584 wrote to memory of 4980	3584	Npfkgjdn.exe	100
PID 3584 wrote to memory of 4980	3584	Npfkgjdn.exe	100
PID 4980 wrote to memory of 1864	4980	Ndaggimg.exe	101
PID 4980 wrote to memory of 1864	4980	Ndaggimg.exe	101
PID 4980 wrote to memory of 1864	4980	Ndaggimg.exe	101
PID 1864 wrote to memory of 4580	1864	Ncdgcf32.exe	102
PID 1864 wrote to memory of 4580	1864	Ncdgcf32.exe	102
PID 1864 wrote to memory of 4580	1864	Ncdgcf32.exe	102
PID 4580 wrote to memory of 4908	4580	Nebdoa32.exe	103
PID 4580 wrote to memory of 4908	4580	Nebdoa32.exe	103
PID 4580 wrote to memory of 4908	4580	Nebdoa32.exe	103
PID 4908 wrote to memory of 4660	4908	Njnpppkn.exe	104

C:\Users\Admin\AppData\Local\Temp\6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16N.exe
"C:\Users\Admin\AppData\Local\Temp\6d4eef6997020ae7af2aca20e3ec384197094539e32c6c3ca591425c5fc5dd16N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\Mckemg32.exe
  C:\Windows\system32\Mckemg32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\Meiaib32.exe
    C:\Windows\system32\Meiaib32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\SysWOW64\Mgimcebb.exe
      C:\Windows\system32\Mgimcebb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1604
      - C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        25⤵
        Executes dropped EXE
        
        PID:1400
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1116
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        29⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1184
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1972
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3796
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2064
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3992
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1812
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        39⤵
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        40⤵
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        41⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1612
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2744
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2372
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        47⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        49⤵
        Executes dropped EXE
        
        PID:4756
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3244
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4276
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:728
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4848
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1380
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        59⤵
        Executes dropped EXE
        
        PID:5152
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5392
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5552
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        71⤵
        Drops file in System32 directory
        
        PID:5632
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        72⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        75⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5872
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        78⤵
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        80⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        83⤵
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        85⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2336
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        89⤵
        Drops file in System32 directory
        
        PID:4832
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        90⤵
        Drops file in System32 directory
        
        PID:760
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:672
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5304
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        96⤵
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        97⤵
        Drops file in System32 directory
        
        PID:644
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        98⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5668
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        100⤵
        Modifies registry class
        
        PID:5740
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        102⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        105⤵
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        107⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        109⤵
        Drops file in System32 directory
        
        PID:2188
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:224
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        111⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        112⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        113⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6164
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        115⤵
        Drops file in System32 directory
        
        PID:6204
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6324
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        119⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        120⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6404
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6444
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        122⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        124⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6644
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6684
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        129⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        130⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        131⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6884
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6924
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        135⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        140⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        141⤵
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        144⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        145⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        146⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 396
        147⤵
        Program crash
        
        PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4696 -ip 4696
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dddhpjof.exe

Path C:\Windows\SysWOW64\Dddhpjof.exe
Size 64KB
SHA256 1779988ff642890fa3a97af78c5b34ac156cb57bdcc7af5a349cb3c4b93c0d8f
MD5 5ab701f9b8b4f257efeebe796e2f042d
SHA1 e7649c3cd20a1cfad3fc42b85012fa27fdbe497d
SHA512 75499e1f805551f09572eb0e8725398d3be85c3f837320c7f6c143a55670462597d17b5164cd5b47a506c28d6a76b7276b3f53125b58d0ef29e87ec5888e5355
SSDEEP 1536:Gy482I1lG4KoJyDhbMRdvSEHSX3r3Hku11xXvvlQR8:X48T1c5oJEheSEy7Hku11xXvvlQq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deokon32.exe

Path C:\Windows\SysWOW64\Deokon32.exe
Size 860KB
SHA256 a287fcff3cbc5a4a791ae7e07810bafcb8d2d1bd1a909375bc9bb3d1c1903293
MD5 6c639731033d32fd2d745d73289d02b2
SHA1 4392a324b7f5ed5eacb36bacb2ab8f023a17e515
SHA512 87df4d3e18331e928ffabe9868392703ab0b879b68295b9f96c6f94043fc06be392cf6564a63e0df4dc4c4d383ea6e1ffb70aac9b30a4e55bb025d61a5aa9213
SSDEEP 24576:6jD5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:ZbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mckemg32.exe

Path C:\Windows\SysWOW64\Mckemg32.exe
Size 860KB
SHA256 2c21fbba1a8803104e04b25ce4d58019ff136b1e89509e4124ad029186dc073b
MD5 08b8acadf09f1be48d91e2377d0a0525
SHA1 b6a7fc8e0600dd53f735baf48ebea8868a3aa7ec
SHA512 fad02245df9700eb2cf6a18be730d27c3bf1bb7fd0ac42b3eccdb60392a2a2c2c83d5122b9f4725f4aca6d971ca03a1f28ed33c550ece0f3921845f9b4b1601c
SSDEEP 24576:75hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:abazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdmnlj32.exe

Path C:\Windows\SysWOW64\Mdmnlj32.exe
Size 860KB
SHA256 2f95e74986e267ce4efdda06548ea5212a325cb6d9686ece640225f790deca25
MD5 c37e31d1eceec90f4ded0bda84633d6e
SHA1 6657518ead5879baa694e8a93e478c381b2f1dc9
SHA512 fbe7853bc582008432a12b077a4a550ad208ce400c5f53f19d5dcad6e1ebc135ef6a4578ed7afc2621824145a28aee35d3c8100217af12a6b2a3e5aa5e202d0a
SSDEEP 24576:HvC15hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:HJbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Meiaib32.exe

Path C:\Windows\SysWOW64\Meiaib32.exe
Size 860KB
SHA256 34e892380b29de88b9de93bd43f2dde6255fa19159798355c8a0a02fddd81fe5
MD5 072b7aa30f788d4c7d57c455211035e7
SHA1 96c65a76058909306a4e9d4eec0424c027648633
SHA512 6a3c9771983f6ba212b0faa74ad8ef6725b4a2b153494cf2861e5a4c030de28731429d32d32b0b5786ac796bda0f4d19ddc699b556d628a4654877afb35fff86
SSDEEP 24576:rZGN5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:VXbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Melnob32.exe

Path C:\Windows\SysWOW64\Melnob32.exe
Size 860KB
SHA256 6b0236bb277cdea283f4d15be593f45cd8fbf589228b2e373c10045aba9498f7
MD5 c6c5385add29c8f1666858563e0c6867
SHA1 4efb34ff3758327293ba29985301c20350f8250d
SHA512 5c22aa6d235a515bd51742e8275a00f05625ec51021071e23da9d2b46af6e4b84be9bd6c04813378e00819081d28fa15634f4e60ba6d0a55604ef085a03e9d9c
SSDEEP 24576:ei2r5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:eixbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Menjdbgj.exe

Path C:\Windows\SysWOW64\Menjdbgj.exe
Size 860KB
SHA256 ede613911176d0f6ea0fce0404cd79df8c379d99deb2aabd244ee4edb8f08151
MD5 3c71b1dc3adc39bb87ca8b4b12610458
SHA1 c7786f7a2156bf2935a1d422a0a8ddc26d4d76c3
SHA512 04e76d5313589012749ff6cdcfabb26942fd50c1a6769cfef5373dcad4dbc4ac186c42c78273b45e4b4241cf522b119c1de0b8dc1576d65fa22648de84632c2c
SSDEEP 24576:sem5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:TbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgimcebb.exe

Path C:\Windows\SysWOW64\Mgimcebb.exe
Size 860KB
SHA256 7176c3be2724d421d5b8b869dc4d09d5772882f491232ab62cd083c833d2b96e
MD5 7fe0bafd5c095feff2e9450d82d0e922
SHA1 f308ce04854c259dcb9e05e9141df877b785fadd
SHA512 7811abc420dcc7057a33a25e6bbadcd6f270132a4b7ffd1b4059a5367c6d7c509c2d20848b654e71b5bac1d5f389eb0aedc40b5dd9504b83fba0645cd09b3962
SSDEEP 24576:AAR5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:kbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgkjhe32.exe

Path C:\Windows\SysWOW64\Mgkjhe32.exe
Size 860KB
SHA256 b68654be7a340efe5c27758265ee5e88fe37d17d2cc39a21182e0f48437b3aa7
MD5 d145ed18533e0b53b08c4de873332d52
SHA1 dc7ad2de7a967e36daa16d986ef7d8c248cc7241
SHA512 7b54eec41faa605735f1531aefc270643a691e0b5efd27bef5a83130599754fe0c634679d168ae6f40448abda904739c0cd4503b5edfdec1859c525fddc29fcd
SSDEEP 24576:k85hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:GbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Miifeq32.exe

Path C:\Windows\SysWOW64\Miifeq32.exe
Size 860KB
SHA256 0ef688b29384496fc83138b8bfe743145e87b6c933700a9e89a011659a968c0f
MD5 d5714639077b5dc3293932ba9b4d7dd7
SHA1 30b632ac249e648c0f0b0aed35ac44b0d979ad86
SHA512 4408c2860ab9323eb3943af6636c7b8e71d28671401257a53ed01c5620a42a062af42a0e3178a8c1cdbbfcda748f76b9add04db04787ca7c1a7adce302ec1712
SSDEEP 24576:9O5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:rbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlhbal32.exe

Path C:\Windows\SysWOW64\Mlhbal32.exe
Size 860KB
SHA256 ed4cbcbd7c2a28ea9602ff9c064bc73568af5acd84db11931912db669517ca9e
MD5 08e08168eb68049a269d472bf5ac8ce6
SHA1 1f4b6ee0dad553e5c7a466e63c49666832bf2fb8
SHA512 6beac67560cb7cc00ec56818b9a5fa5f703d6eec6b4bbc2688e9a9dabb19f4c80e5fe6f9022901d36daa81c03b24dd87d0d1cdfb580bdc559c8c082c4e948550
SSDEEP 24576:PN5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:0bazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mmbfpp32.exe

Path C:\Windows\SysWOW64\Mmbfpp32.exe
Size 860KB
SHA256 57c7ad9f28741bcc7f30926bf3e4027c2816e460a12d43fa762f657c9045d435
MD5 dab681dfa3d8034fbe77a7925ebec42b
SHA1 835787050a10165475f1b83d69e2bda82de52f0f
SHA512 68be2a9c57773167d4e6bb73c4976f034dee76ad0af853d3b5f6d7c8e5d4e21801362ea2b04aa407d445af16c62f3ead7e539bc08339b00f1adb20cf57d16d77
SSDEEP 24576:l5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:0bazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpablkhc.exe

Path C:\Windows\SysWOW64\Mpablkhc.exe
Size 860KB
SHA256 96fd6ad480b1c49cb8490e8e6df08d161963400c89f4fd6bf88a0c8d058456b4
MD5 77543848c02b38c622b968122ce2276e
SHA1 b7db150e6285c9e4e73e55d0d952a5a6ee4267d8
SHA512 f417dcfa8deb64b8f7f548892817b106175d9e74de3feb2edca83e03c192e1e398c6c06bcdb49ea91f010fc0c7453c3d624ad3cbf2299e5576a18b1f5e2a6aa9
SSDEEP 24576:eb5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:e6bazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncbknfed.exe

Path C:\Windows\SysWOW64\Ncbknfed.exe
Size 860KB
SHA256 c0b01f6f7e342a43ef447e20ea78d45e79f6ce3386c88acb585762b10b5e6819
MD5 0d634e50ffac4120047217c236fe38f6
SHA1 44c74d8a5d074efe15ef1c75570e77bb541b1ac8
SHA512 316ad0e68c8414458a1b4cf0d3283c539f1b5f14e98b5ab07a04c639d987ecdf559639cbf1895fd981224047fceb335729f900c851d7a03acbab7d12e0394963
SSDEEP 24576:K5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:5bazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncdgcf32.exe

Path C:\Windows\SysWOW64\Ncdgcf32.exe
Size 860KB
SHA256 5b39651a13935d771a4fd504801f18d9d66b262e9a897c728f6fbcdf2b17f482
MD5 cbef96edf8d326562dc5ca9075fa870f
SHA1 6d853ff0bbedf9a5109cbe6ddc8ef708f4fd6a73
SHA512 5662619d7f587f16b98533da2642276a3fc4fd73aa92a2940560638f8464f4870d17e1f64d33449caddd9a0efd2f7d43dc9b1e4eba69637586f9168ae77ba124
SSDEEP 24576:K5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:5bazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncianepl.exe

Path C:\Windows\SysWOW64\Ncianepl.exe
Size 860KB
SHA256 56e0f93fadca4eb6ed7af3beef2d38ee5858be9fd3d3d9736f608f4ce61cf42d
MD5 08d10e1664f962391ab97d28c889237f
SHA1 0646835ea3b6720f0d123ad738a3175dd3e148d5
SHA512 4afaeb3238bdff7800baed745a0559a705014e7a5cdb81c2ad3fcd662898651008c27057a8253e79993cf53fa869454c13b7f216cd6dbff822f20c1681a9df2d
SSDEEP 24576:nk5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:bbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndaggimg.exe

Path C:\Windows\SysWOW64\Ndaggimg.exe
Size 860KB
SHA256 e13cb44ee969013b1573aa779b04463b971cb764684dbd869d4336ec8aab17d2
MD5 089042fdfe47d6209e59377981f0b4f7
SHA1 3af09d7ce2ead5b6008ca40ace4736d2ebf113be
SHA512 7b6204a3677fc2bb7ce434620733bf5676c4c1468c4911e14cf4a7c02e47df0eb30208cc69b9e9f3bf069b38400c1950783537729b06457f199da0ddb481024c
SSDEEP 24576:7g5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:7PbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndcdmikd.exe

Path C:\Windows\SysWOW64\Ndcdmikd.exe
Size 860KB
SHA256 9aed6f41aa72ce98c5ba7bafe704baf7c6d94cec8a601b5487da135c4ebc73a3
MD5 40c554790f67b1b193f79b8802471e1c
SHA1 d235ce311fee7fddf4555a74f250ffa240bba022
SHA512 41072ba91f1a914e903d0251d9fe969965ac2572d518461c628cf26e7cec6157f15115d50e71f4df77f09d0c76144aa7260cd1da351059ea2b11545961abc73b
SSDEEP 24576:kf5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:5bazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndfqbhia.exe

Path C:\Windows\SysWOW64\Ndfqbhia.exe
Size 860KB
SHA256 05fa88ae39dfd84ebd583cb2fda46de05e8af22447f5bb30b1cfec5f88e8a1c5
MD5 bfdd0d7d9168cb043814e65d2b3ed664
SHA1 398283915aafefd0b2dac813555141faac277c46
SHA512 825acbe9f2bea79fb365043463aa26f7d3ecf23d96ebb9b530d5cf293028d3464e6c7a1dadd0c7896e93d5b18fd1700b7c8856c6e9b7d49f01b978f980d87761
SSDEEP 24576:c5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:jbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nebdoa32.exe

Path C:\Windows\SysWOW64\Nebdoa32.exe
Size 860KB
SHA256 79a7b4f66bcecb9cbe26d39ea1770a36f4faec812ead68207d2c388a93e7dfc6
MD5 b86bbeef952a03e529a81098d09b37d7
SHA1 524efcf02407ebf0bcf97cb65ab514e015048c54
SHA512 fe25aca44cbe6ddd1efb63ff6ecf6093275ad6a2125570c3261c219ea6a5e7f4d4cbb55f9f04597f33968e291427b73c439428438c346d342331421b309ec396
SSDEEP 24576:z5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:CbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Neeqea32.exe

Path C:\Windows\SysWOW64\Neeqea32.exe
Size 860KB
SHA256 b506038704033dee10a1f315ced34b883951d077f60bd2b6a64d1d1162eabdcd
MD5 c3d5c7a0145e6cb7cf0fe96a84c21234
SHA1 e84b5d6c20df020a559616e302a9ccff04bc0586
SHA512 b75009aa1d87e7560873ae1fec3e5aa49120a1bf5ee73b95161f85d8213a1c3f580aaaaf79a8282b372c0fad91b9e48c7e1adf69463bb4fa1d76ea403074f40a
SSDEEP 24576:55hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:gbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nfgmjqop.exe

Path C:\Windows\SysWOW64\Nfgmjqop.exe
Size 860KB
SHA256 11846de34d194da80649731f6c5bad05491f1ab2a39a05df2f869ae97e76f523
MD5 e727cb5c3b6fb1d7d8d71ebf55446ed9
SHA1 e63632344a227903e628c5ac8f127ab455d3b50d
SHA512 14001de32aa64a73ba22b16ee9fb5c0212e80bf29d6b8f2d7b73268760e8454ea721d1f2a2bfbe44af49c315c4d4af593a8c53150814be7988ec68a9096921fc
SSDEEP 24576:l2w5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:WbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngbpidjh.exe

Path C:\Windows\SysWOW64\Ngbpidjh.exe
Size 860KB
SHA256 ea7f879e23faac16fbf06424b6d793c7d04d7f06af66d3745fdf1a6c493e0585
MD5 43adb5ee5f3fa63639a78b33419cf7ff
SHA1 78ec38934a7d26a4a12e30fabc84c54c0688ba66
SHA512 d8cd01a34f66c1b1abf04c0127b002c43f2fe445f58fdf220106ace06f99bd8c0aaab951eae5ad0ffb1a0a5e81c9c87566e0951bc2a6eee3ff35430158e49a06
SSDEEP 24576:L5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:qbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngmgne32.exe

Path C:\Windows\SysWOW64\Ngmgne32.exe
Size 860KB
SHA256 402a0ac56628e2ec4ae9ba60a935b4d93513674a7abcfcaf74b1171dbf12ae01
MD5 c87172b1366f6d825188a4db9f968e9e
SHA1 8efb68cad10ce9e4a8c79456b0e79167b780b529
SHA512 4ceb565785647a4dab5df4babe99244d65ee39d780017c866dc4408a38254f9eddac2fff629692452d7884206f35b425860056c0bb31d6b307afbff04cf21630
SSDEEP 24576:mS5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:mxbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nilcjp32.exe

Path C:\Windows\SysWOW64\Nilcjp32.exe
Size 860KB
SHA256 1abea4f216c70487fffce6fe4ad3d9331e6f620d81616ef35e76065e6e380d7f
MD5 057436b610759f01ee103ac7b6be2f3c
SHA1 aa6017fb7d60377f1f16e1ea6c4753bbec76ba50
SHA512 6c39296ecb49045ca95b1fdd5935276470ce1f2b7bfbaa64cb580efcd40bd6d9bd6dcc23504f1137964925b7ce619c3ca56cb32d37b9ef1f63b9f716345eba21
SSDEEP 24576:02izY5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:028XbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njnpppkn.exe

Path C:\Windows\SysWOW64\Njnpppkn.exe
Size 860KB
SHA256 eed0522f04942bb8a0485ce29bc36918f2aa30683176126721d3e4e350fac348
MD5 ad5cd55c5e923d2d40390631990ee402
SHA1 0a9bcbb5bf10256ddd84470884af1a4a232a9f35
SHA512 637744760aa8070243f3d539d128fff5a9270435a1b87cbabea360bb390b518e9dfa4bfed4cd6b8c3a4d2c95db359b0c097790890329b954d3d0ccb76fe0bfbd
SSDEEP 24576:P5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:GbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nlmllkja.exe

Path C:\Windows\SysWOW64\Nlmllkja.exe
Size 860KB
SHA256 993f5b91d087e826e248952af95d16d3965760eb55c6d03ce99d615a963afaa8
MD5 060e486f8a07eff2dfd7ca46652dfd42
SHA1 8603824d14be10421ca6ca3ab21ec0472770c150
SHA512 516072d893f069db423600fbb8ad95e46997216a57175c62ac583e73068e4ca57e9e8f4933950c9bf5357f67a9cc266af32e64dcf018e8463c84f30e42a6d9b9
SSDEEP 24576:a5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:JbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nloiakho.exe

Path C:\Windows\SysWOW64\Nloiakho.exe
Size 860KB
SHA256 085c203887a9682931805aef5eb6d35206c1b28e811bd6ac58c51b1b451a74e7
MD5 7ac5eab66c0c06d806ee1c237a1e3803
SHA1 c3a4fd3b7ab0e65a9119bcfd0ae2e2812e4c39da
SHA512 26439bf3984fed3afe3b6b2ad4389e4b436ff15de3da142c23d62e52541a3460e333d937d4440bd90d810edf0d013223628a757e32ca4d3125452cb504465611
SSDEEP 24576:BL5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:0bazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nngokoej.exe

Path C:\Windows\SysWOW64\Nngokoej.exe
Size 860KB
SHA256 ae709f84d641b8a0ea8a8c364751c46689280fd03896c939a35a857e26f6e57f
MD5 25795ac05d2abe5e6645c8d92c7f4377
SHA1 09a1153b37beb1e9b3e1fbb697671ac10a01603c
SHA512 c8b3ccca1d8a4d7e601380f7627f953ddc83a5d901bfe212db463a9921bebf66777a3ae59c2117947b28900f55a267f2d6bd4436b48624be8173c3cbac219f50
SSDEEP 24576:275hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:2abazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnlhfn32.exe

Path C:\Windows\SysWOW64\Nnlhfn32.exe
Size 860KB
SHA256 6113b5a180208a8036820ece255831b3c4ae74df7bf3aba987901cdebcc478f1
MD5 c4bda695fc4b319d8c2cade7a727be25
SHA1 9c0317605f830c2dbe882d7fadf00c0df4adcb5f
SHA512 43a5fdb4091d931f8e5488dc8a2bd347c4b29357691433d05229c16bf8e3a05cda35b92ef014e9c469678a22abfe6af388e94d4d217ad3dc01ff485d4d5058cf
SSDEEP 24576:rEM5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:r2bazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnneknob.exe

Path C:\Windows\SysWOW64\Nnneknob.exe
Size 860KB
SHA256 e3ad85638a683b1b2983144a07028c4116f4e9a807e35804ae9172654b043f02
MD5 598bbc4ea31d153c7555a9998b2d4e19
SHA1 a9b46d6a1af19e63c939d8bdf9bd80a677c6a172
SHA512 147915e44d22739affda6f2e68b868e5828defd624c04884f4415df4d38eccc0deb3d244983c12ee09781d39b540cf1a0fac028777c70b8d6ce48c1bb480969b
SSDEEP 24576:rC5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:rhbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npcoakfp.exe

Path C:\Windows\SysWOW64\Npcoakfp.exe
Size 860KB
SHA256 91d7b277b9dd2d5d28d4eaae5fe0902e4b1a44702a7f7afa2f7449f04f428f85
MD5 d173fd913ef8902cd491d09dcbecc4c1
SHA1 ef7d6ebba56ce9409fa1aebaae7fd942e19b5327
SHA512 cc575e0cabce8944947757cc7d2f754c17e61af7ccd7a6424aa1b451385fe73c0e82123f6ad801886ff114fa73d29b8c38c0be5a69900d911c65b3535bf7cc4c
SSDEEP 24576:Jq5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:JZbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npfkgjdn.exe

Path C:\Windows\SysWOW64\Npfkgjdn.exe
Size 860KB
SHA256 a657b6c177b3b3d578a639f305874f5468ec386ec39c45b5a772b228d7c04c01
MD5 a99254ec6bc9d2fa45a612c48c64e105
SHA1 834de0d4b4a6248af26fd839bc77f8a1f42b1422
SHA512 cb870b254472fa49550652b553394894da93b4f0dc7bf2ede0df91320169c1f31fe4dbc111d508e865f268a172cd69140b2e5060426512d9672d7bbe7a1f094b
SSDEEP 24576:zZ95hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:z+bazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npmagine.exe

Path C:\Windows\SysWOW64\Npmagine.exe
Size 860KB
SHA256 8211b14c996fd947f98db98cae4826661a164a69ed5d8a2fbe763b8b9b278081
MD5 8a48c76eb33c2e54390c68b7a7c0fa3e
SHA1 f66b4df59bdda6eaff073c8811cc31babcd970b7
SHA512 95ea4d8091f37f2153f2a0f07d11b016d73ab9642da4db0664d18eb5812baaf53dafced553fea14feb931cc0166385e73470baf74d2748c527caf3b8b8205167
SSDEEP 24576:4x5hPuh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YS:4IbazR0vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/672-613-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/728-376-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/760-607-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/980-117-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1116-213-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1184-246-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1228-125-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1380-394-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1400-197-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1452-9-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1452-557-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1604-37-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1612-316-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1812-292-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1816-101-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1824-577-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1864-157-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1924-339-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1972-254-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2064-267-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2172-309-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2288-280-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2336-595-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2372-328-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2484-29-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2564-412-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2620-69-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2628-286-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2736-400-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2744-321-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2872-382-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2888-589-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2896-352-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2900-206-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2940-304-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3008-61-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3092-45-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3124-544-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3124-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3124-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/3128-406-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3224-133-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3244-364-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3380-77-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3468-238-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3480-583-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3584-142-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3680-230-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3724-54-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3796-261-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3984-346-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3992-274-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4008-109-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4276-370-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4424-571-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4540-21-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4540-564-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4580-165-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4596-189-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4660-181-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4672-334-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4756-358-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4832-601-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4848-388-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4860-298-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4884-222-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4908-173-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4928-85-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4980-149-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5036-93-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5152-418-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5180-619-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5192-424-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5232-430-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5272-436-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5312-442-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5352-448-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5392-454-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5432-460-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5472-465-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5516-472-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5552-478-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5592-484-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5632-490-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5672-496-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5712-502-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5752-508-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5792-514-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5832-520-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5872-525-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5920-532-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5952-538-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5992-545-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6032-551-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6076-558-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6116-565-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads