berbew | 5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bc

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bcN.exe
Size 96KB
Sample241110-l3teeaveke
SHA256 5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bc
MD5 ac23dbae1588f69a3dbb222336767bd0
SHA1 6067b4fdb6f4f881ccdeec21958a1144d9152bfe
SHA512 7837a688e82616ec96b29e526e655100db0f3af044036050bc9ac766d6bb2e70da681e23c7e7e1a75723048b048dd0680d99ec224712f31d209eafb3ad2f5aeb
SSDEEP 1536:haPBxh8Fh+wQwD5u6ge5KW6ZivLuOATSvjDU4duV9jojTIvjr:haP58Fh+wd5u6/5B7vLXU4d69jc0v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olkhmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojoign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pggbkagp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nggjdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhhnpjmh.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2944	Lfhdlh32.exe
1536	Lmbmibhb.exe
400	Lfkaag32.exe
3032	Lpcfkm32.exe
3312	Likjcbkc.exe
2916	Lpebpm32.exe
1720	Lgokmgjm.exe
4364	Lmiciaaj.exe
1260	Medgncoe.exe
964	Mlopkm32.exe
532	Mibpda32.exe
3408	Mdhdajea.exe
1664	Mmpijp32.exe
2552	Mgimcebb.exe
2772	Migjoaaf.exe
1100	Mcpnhfhf.exe
5040	Mnebeogl.exe
968	Nepgjaeg.exe
752	Nljofl32.exe
4824	Ndaggimg.exe
2064	Nebdoa32.exe
540	Nnjlpo32.exe
740	Ngbpidjh.exe
2572	Nloiakho.exe
1656	Ngdmod32.exe
2600	Nnneknob.exe
4856	Nggjdc32.exe
4908	Njefqo32.exe
764	Ogifjcdp.exe
3384	Opakbi32.exe
4532	Olhlhjpd.exe
4640	Ognpebpj.exe
4904	Olkhmi32.exe
2692	Odapnf32.exe
4880	Ojoign32.exe
3616	Oddmdf32.exe
2184	Ogbipa32.exe
404	Ojaelm32.exe
1320	Pdfjifjo.exe
1528	Pfhfan32.exe
4276	Pqmjog32.exe
1672	Pggbkagp.exe
3796	Pnakhkol.exe
3560	Pqpgdfnp.exe
1208	Pgioqq32.exe
4792	Pmfhig32.exe
4748	Pgllfp32.exe
3140	Pnfdcjkg.exe
4220	Pdpmpdbd.exe
4496	Pfaigm32.exe
4388	Qnhahj32.exe
3060	Qdbiedpa.exe
2172	Qjoankoi.exe
4572	Qmmnjfnl.exe
2428	Qgcbgo32.exe
2320	Ampkof32.exe
5008	Ageolo32.exe
4828	Aqncedbp.exe
2980	Aclpap32.exe
3136	Ajfhnjhq.exe
1936	Aeklkchg.exe
736	Ajhddjfn.exe
1508	Aabmqd32.exe
4556	Aglemn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lnlden32.dll	Pgllfp32.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Ajhddjfn.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Aabmqd32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Olhlhjpd.exe	Opakbi32.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Lplhdc32.dll	Mgimcebb.exe
File opened for modification	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Lpcfkm32.exe	Lfkaag32.exe
File created	C:\Windows\SysWOW64\Lmiciaaj.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Qjoankoi.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Opakbi32.exe	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Pmfhig32.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Pdfjifjo.exe	Ojaelm32.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Nljofl32.exe	Nepgjaeg.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Gfmccd32.dll	Ndaggimg.exe
File opened for modification	C:\Windows\SysWOW64\Ogifjcdp.exe	Njefqo32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Medgncoe.exe	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Cmlihfed.dll	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Naekcf32.dll	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Ehmdjdgk.dll	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bmemac32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Mcpnhfhf.exe	Migjoaaf.exe
File created	C:\Windows\SysWOW64\Gbmgladp.dll	Nebdoa32.exe
File created	C:\Windows\SysWOW64\Beeoaapl.exe	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Pnjknp32.dll	Mnebeogl.exe
File opened for modification	C:\Windows\SysWOW64\Pfaigm32.exe	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Gmdkpdef.dll	Ojoign32.exe
File opened for modification	C:\Windows\SysWOW64\Ogbipa32.exe	Oddmdf32.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Medgncoe.exe	Lmiciaaj.exe
File opened for modification	C:\Windows\SysWOW64\Ognpebpj.exe	Olhlhjpd.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Djgjlelk.exe
File opened for modification	C:\Windows\SysWOW64\Ngbpidjh.exe	Nnjlpo32.exe
File opened for modification	C:\Windows\SysWOW64\Qjoankoi.exe	Qdbiedpa.exe
File opened for modification	C:\Windows\SysWOW64\Beihma32.exe	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Nepgjaeg.exe	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Gaiann32.dll	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Jdeflhhf.dll	Nggjdc32.exe
File opened for modification	C:\Windows\SysWOW64\Ngdmod32.exe	Nloiakho.exe
File opened for modification	C:\Windows\SysWOW64\Pgllfp32.exe	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Lmiciaaj.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Chfgkj32.dll	Nepgjaeg.exe
File created	C:\Windows\SysWOW64\Jcjpfk32.dll	Lpcfkm32.exe
File created	C:\Windows\SysWOW64\Nnjlpo32.exe	Nebdoa32.exe
File opened for modification	C:\Windows\SysWOW64\Ojoign32.exe	Odapnf32.exe
File opened for modification	C:\Windows\SysWOW64\Qgcbgo32.exe	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Lfkaag32.exe	Lmbmibhb.exe
File created	C:\Windows\SysWOW64\Ljodkeij.dll	Lmbmibhb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5444	5196	WerFault.exe	195

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgllfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfhdlh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpijp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnakhkol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgokmgjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogbipa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfkaag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmbmibhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nljofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndaggimg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgimcebb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnneknob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oddmdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlopkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdhdajea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Medgncoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bcN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpcfkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Migjoaaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngbpidjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmiciaaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdkkfn32.dll"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcmfk32.dll"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcmjaol.dll"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efmolq32.dll"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laqpgflj.dll"	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnljnaa.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nenqea32.dll"	Nljofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjgghdi.dll"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngbpidjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ogifjcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmfpfmmm.dll"	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diphbb32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bcN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjknp32.dll"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngdmod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2944	3332	5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bcN.exe	83
PID 3332 wrote to memory of 2944	3332	5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bcN.exe	83
PID 3332 wrote to memory of 2944	3332	5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bcN.exe	83
PID 2944 wrote to memory of 1536	2944	Lfhdlh32.exe	84
PID 2944 wrote to memory of 1536	2944	Lfhdlh32.exe	84
PID 2944 wrote to memory of 1536	2944	Lfhdlh32.exe	84
PID 1536 wrote to memory of 400	1536	Lmbmibhb.exe	85
PID 1536 wrote to memory of 400	1536	Lmbmibhb.exe	85
PID 1536 wrote to memory of 400	1536	Lmbmibhb.exe	85
PID 400 wrote to memory of 3032	400	Lfkaag32.exe	86
PID 400 wrote to memory of 3032	400	Lfkaag32.exe	86
PID 400 wrote to memory of 3032	400	Lfkaag32.exe	86
PID 3032 wrote to memory of 3312	3032	Lpcfkm32.exe	87
PID 3032 wrote to memory of 3312	3032	Lpcfkm32.exe	87
PID 3032 wrote to memory of 3312	3032	Lpcfkm32.exe	87
PID 3312 wrote to memory of 2916	3312	Likjcbkc.exe	88
PID 3312 wrote to memory of 2916	3312	Likjcbkc.exe	88
PID 3312 wrote to memory of 2916	3312	Likjcbkc.exe	88
PID 2916 wrote to memory of 1720	2916	Lpebpm32.exe	89
PID 2916 wrote to memory of 1720	2916	Lpebpm32.exe	89
PID 2916 wrote to memory of 1720	2916	Lpebpm32.exe	89
PID 1720 wrote to memory of 4364	1720	Lgokmgjm.exe	90
PID 1720 wrote to memory of 4364	1720	Lgokmgjm.exe	90
PID 1720 wrote to memory of 4364	1720	Lgokmgjm.exe	90
PID 4364 wrote to memory of 1260	4364	Lmiciaaj.exe	91
PID 4364 wrote to memory of 1260	4364	Lmiciaaj.exe	91
PID 4364 wrote to memory of 1260	4364	Lmiciaaj.exe	91
PID 1260 wrote to memory of 964	1260	Medgncoe.exe	93
PID 1260 wrote to memory of 964	1260	Medgncoe.exe	93
PID 1260 wrote to memory of 964	1260	Medgncoe.exe	93
PID 964 wrote to memory of 532	964	Mlopkm32.exe	94
PID 964 wrote to memory of 532	964	Mlopkm32.exe	94
PID 964 wrote to memory of 532	964	Mlopkm32.exe	94
PID 532 wrote to memory of 3408	532	Mibpda32.exe	95
PID 532 wrote to memory of 3408	532	Mibpda32.exe	95
PID 532 wrote to memory of 3408	532	Mibpda32.exe	95
PID 3408 wrote to memory of 1664	3408	Mdhdajea.exe	96
PID 3408 wrote to memory of 1664	3408	Mdhdajea.exe	96
PID 3408 wrote to memory of 1664	3408	Mdhdajea.exe	96
PID 1664 wrote to memory of 2552	1664	Mmpijp32.exe	98
PID 1664 wrote to memory of 2552	1664	Mmpijp32.exe	98
PID 1664 wrote to memory of 2552	1664	Mmpijp32.exe	98
PID 2552 wrote to memory of 2772	2552	Mgimcebb.exe	99
PID 2552 wrote to memory of 2772	2552	Mgimcebb.exe	99
PID 2552 wrote to memory of 2772	2552	Mgimcebb.exe	99
PID 2772 wrote to memory of 1100	2772	Migjoaaf.exe	100
PID 2772 wrote to memory of 1100	2772	Migjoaaf.exe	100
PID 2772 wrote to memory of 1100	2772	Migjoaaf.exe	100
PID 1100 wrote to memory of 5040	1100	Mcpnhfhf.exe	101
PID 1100 wrote to memory of 5040	1100	Mcpnhfhf.exe	101
PID 1100 wrote to memory of 5040	1100	Mcpnhfhf.exe	101
PID 5040 wrote to memory of 968	5040	Mnebeogl.exe	102
PID 5040 wrote to memory of 968	5040	Mnebeogl.exe	102
PID 5040 wrote to memory of 968	5040	Mnebeogl.exe	102
PID 968 wrote to memory of 752	968	Nepgjaeg.exe	104
PID 968 wrote to memory of 752	968	Nepgjaeg.exe	104
PID 968 wrote to memory of 752	968	Nepgjaeg.exe	104
PID 752 wrote to memory of 4824	752	Nljofl32.exe	105
PID 752 wrote to memory of 4824	752	Nljofl32.exe	105
PID 752 wrote to memory of 4824	752	Nljofl32.exe	105
PID 4824 wrote to memory of 2064	4824	Ndaggimg.exe	106
PID 4824 wrote to memory of 2064	4824	Ndaggimg.exe	106
PID 4824 wrote to memory of 2064	4824	Ndaggimg.exe	106
PID 2064 wrote to memory of 540	2064	Nebdoa32.exe	107

C:\Users\Admin\AppData\Local\Temp\5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bcN.exe
"C:\Users\Admin\AppData\Local\Temp\5d720fac12a8ba8df7508f30b8916bbfd8f555630e78fd8866768c8000cde0bcN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\Lfhdlh32.exe
  C:\Windows\system32\Lfhdlh32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\Lmbmibhb.exe
    C:\Windows\system32\Lmbmibhb.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\SysWOW64\Lfkaag32.exe
      C:\Windows\system32\Lfkaag32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:400
    - - C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:540
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:740
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2572
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1656
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2600
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:764
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3384
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4532
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4640
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3616
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:404
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1320
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3796
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3560
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4388
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3060
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2428
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2320
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5008
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4828
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3136
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1936
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:336
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        67⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:4588
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        69⤵
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4868
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        71⤵
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2028
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        76⤵
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1852
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1492
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        79⤵
        Modifies registry class
        
        PID:3212
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        80⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1084
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3728
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        83⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4228
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        86⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        91⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        95⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        102⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        105⤵
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 408
        108⤵
        Program crash
        
        PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5196 -ip 5196
1⤵
PID:5284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ageolo32.exe

Path C:\Windows\SysWOW64\Ageolo32.exe
Size 96KB
SHA256 98cc11e0b87a129bad30ca9f2e4fe4b3c5c7d893455ad2f12cd95bd446ec59f5
MD5 9991486a54212c3e74f75bf33f365937
SHA1 95801dd2530ecf7adc23d9fa874b9fe54c785d13
SHA512 0d074e93e1c2480aac85a37ac0f4ae59bed12d4770a713552d963099ba23fdbb5875fca848c1015f09dcc06e26083928e751fba32267745605d291c97ee42c53
SSDEEP 1536:hRQWkXi/ZP0u4WTl/0ImbWn/cpFU8iwjwpgBKL4SkTIIduV9jojTIvjr:rpP0Sp0HcyipwNQyIId69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajfhnjhq.exe

Path C:\Windows\SysWOW64\Ajfhnjhq.exe
Size 96KB
SHA256 557e266aaf42870eac383faceb36f5fd6ffaa5e18758662c7cb984d8a89a156c
MD5 4f0f3918dff6dd6886f465d52fc37a07
SHA1 7d90232fd06568d2affb00665dacea05d5cccd0f
SHA512 e6237d8ac5f07e90d59f94032f229de8b25e4440e5a5e0398bd90072473f00c398e87923f93b01e012ffa66d5c25103ea456e585033b5bbbac6faec2d324ba3c
SSDEEP 3072:OWKMRt5yZaHLgexMTnD4YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYgYYAYYYYYY7:O0D5yZaHLgiMTnD4YYYYYYYYYYYYYYYn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjagjhnc.exe

Path C:\Windows\SysWOW64\Bjagjhnc.exe
Size 96KB
SHA256 d074a3751f633de3a78d628d1ddce41ec4b4b075a769148f724977970658b09b
MD5 85e5d1a56dccf4fef9d972f8221083bb
SHA1 88064303d46900cadc2911d07d92e10c410db54b
SHA512 2f792c62c35b4d4ef288e67487424af815f5c4febe78678105052c432ce222600423cdfb4ac9dbe2cfdb2a9ebac5610421a11d730220b12f179803a89bc93b62
SSDEEP 1536:K/BYxCyauAjuaccAXIMUdNWdFUSPlUI2/8ry8I84PmCrvWibduV9jojTIvjr:eYWuAjocMInj5828EmCrWibd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnpppgdj.exe

Path C:\Windows\SysWOW64\Bnpppgdj.exe
Size 96KB
SHA256 dd602261f575604adbc3fa0b6200a7a14b6eabb8cb1b227bed4ae185d4061db8
MD5 359728b3e950401b1b3da9d963cb9d49
SHA1 446156d68ca2b163aa1e9bd59d405acca3c2a45e
SHA512 4b03836b57560f46d5844d00d78129b48ce18b274bcabd3216bed47fbdf8b2ff9f596694e49d1e82642a4981cfccd9e435d30f544f2486b7f9596e26a61cf313
SSDEEP 1536:CkEFY++yjBkCWJwdTR8bQwPE6C/NdRinqmDKfU+K0CiYduV9jojTIvjr:NMxse2bgT/fpmDKfCxzd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhfajjoj.exe

Path C:\Windows\SysWOW64\Dhfajjoj.exe
Size 96KB
SHA256 23de8fa662ef0a677551dca11871b91e3afbd4b2606644467348937fdd74752f
MD5 2cd6fd87527418e3ca8bea317be725bb
SHA1 42cdff0e1fd6afb752ed48e7acaa1cc0457f51d5
SHA512 3a5b7740d3bfb9e9f468e1fe28e6e19976a2b9ceb62c9be541b2b1e13beb10833aa2dd013b578c81c78ef0923277c9a36de748baa8cc02fba12ae96c4870f037
SSDEEP 3072:JpsadJvXEOo7UpFNn/YPxCgsqGd69jc0v:VZVgRjGd6NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Djgjlelk.exe

Path C:\Windows\SysWOW64\Djgjlelk.exe
Size 96KB
SHA256 c3e449fad65d30518b18aed59ffad1c1aca04d3713ea8f29a5f66386f0236b5e
MD5 ea2e20d5fa461cf647a69e295ec1af86
SHA1 a1f35cc028f1a618fee9fe3d5297700f2d0a8ee8
SHA512 f7e3c6ba0c2fe29291c966d9820dbcc0b337e4aece4b8a2d60004caf08e2513724528d41fde894159404fb5c5b3623a2b6daeddbdfcd23cd5a18c27a6014b8ce
SSDEEP 1536:fFmgeTqKXU2G2xcI4XYGSciojHtqCFmcxduV9jojTIvjr:fFLeTbk2qVoGkojHcemcxd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jcjpfk32.dll

Path C:\Windows\SysWOW64\Jcjpfk32.dll
Size 7KB
SHA256 863cbd9a79dbf09cc5675149c8824fb5dd2720bfdf1ea3e5fd1037ed686dd9b3
MD5 19162f6e63af87aa65977d3dfbe67a05
SHA1 725faafbb529936272d0c60e3bc64cf2137d0c3d
SHA512 02365e553e4f3b6cb26b2b7c2be1b460fff3a301ea9c0cc78d181c6946cdf59b316ab62db0d3517abe8758bd47abd4e22852cc7b8a4ea754d62c512bf7fbeada
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWxbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPTq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lfhdlh32.exe

Path C:\Windows\SysWOW64\Lfhdlh32.exe
Size 96KB
SHA256 7c63cd3d5d35a7f8716d6ee038c3beb6a9d6239a56461e65975c005405e3c54b
MD5 2336639bc99b28db914096b9e5582d9e
SHA1 907f3b15efbedb4c6afce4e0c63343ac526e8150
SHA512 12b3fc6bf313f424587178caa463337c9e8529b400ace2682ab21e4a8343a88f2e724db76445e4fc67ef0af5783626e4b4e58c1ce199727a8373f22f65bdecaa
SSDEEP 3072:impFWjzMpuT+VE9RnS5xVWPyyquYi3GGtd69jc0v:5po0ES+RnS5xVcBqN2td6NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lfkaag32.exe

Path C:\Windows\SysWOW64\Lfkaag32.exe
Size 96KB
SHA256 c56a15eec859dde2209691c029deee9ab69f2bf147eab9a6a4ea1de18692093b
MD5 36cb1c5fae2c1cd7ad573f3eca4129c6
SHA1 fa286d74c023979d048adc863bb2b07aa84feaa3
SHA512 f7125714b628cb31503a40165bccce50d1ecd3808487b47f35d31dc75240d52ecd1b84b1c7900fa382cdbcbd5a03475816f49ecd833384866d84483a76d75029
SSDEEP 1536:L5PA8hAAJvC0MEmC4eheKC9IUXrVOQ0xYcWLnRcI6CNduV9jojTIvjr:q8hAAJvCPQWIU7rgTWTT6Od69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgokmgjm.exe

Path C:\Windows\SysWOW64\Lgokmgjm.exe
Size 96KB
SHA256 6837674b88ab6b91dc082ad29d2dc46c24f34b8ecec6b35ba624b9cf2dce3584
MD5 b201ddac2c2ee23bc5201e3ba6fb8c8e
SHA1 e1f04fee80fb68ac986f9cb858b83ab48fd12921
SHA512 1bc035f10c839516e27420e08b67d2766d475aed16ed119e47d0a4f541d9766e1393038bda22cd8abf2d3a3c9d81e2a87ba6c9a05c773e6fc3bd6b395053c424
SSDEEP 1536:4q7UIN5vScqZDyAaZepMJocpL+7otZAGK34fwduV9jojTIvjr:dDDSBnaZi88NIod69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Likjcbkc.exe

Path C:\Windows\SysWOW64\Likjcbkc.exe
Size 96KB
SHA256 4e93e815916870ff21d5d2ee3b7f0812105fb82c86cd7085db85788a491426d4
MD5 42d4aad609aa7d40b4d7314bf9ba47a4
SHA1 e641a2281456142ca4b34c80166de85425415c2d
SHA512 e410f282f2b35e17482189e7cd81d292153c33a94bc1362b80c518132d2b1c588080797f66a01eaf5c02d047930ca9a71c4698adbc3156c5eaac4a3b154f829b
SSDEEP 3072:jCAVgd5aS4lmNwtnGNiEuH9uRFlmI0MpQvY0Fd69jc0v:+AiDa39K0e0Fd6NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmbmibhb.exe

Path C:\Windows\SysWOW64\Lmbmibhb.exe
Size 96KB
SHA256 893d71a837a1b0aa9cced03cc6c111447d8d791ae803fe839f7404737bc00cdf
MD5 10a3fe8eb25cc7905bb949aef6d800b7
SHA1 89d12ac18e9b9c30097ffcd95e4aa0b60abb79a7
SHA512 07cd29ea2c0fa4613d13c0596af11384c4a66bf8f9c74c983501d8ae145886980df4c3474a790cbeee90c91f95ae3c6f6cc1049a1faf3578abbfd9929a6e7963
SSDEEP 1536:0A46mqUkCy1lMfdeF/HsqciPDF6hQ05RduV9jojTIvjr:0x6mqUkC89/6irYRRd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmiciaaj.exe

Path C:\Windows\SysWOW64\Lmiciaaj.exe
Size 96KB
SHA256 cb39411d5ce11a6c48db4a613b0fa85188aed46b56359ec2923ebff68436bd6e
MD5 8f3f8f8bdbb0abbf05a2fbbd7d793ae0
SHA1 d6f104e9943df0e4817a5a0e89e1f19f93b19902
SHA512 d9620dad42d28edb0aaeb27abd9d19526c0838ce30be4444b59d0cca5706372b723562bafc0fa87fe61da1c3717c91189b8b5f28889f84f2b78f35dcb9d710b6
SSDEEP 1536:FJFdw72yIBUqO3C8c2UY/ph1yesm1Gpjf7KduV9jojTIvjr:XFdwCySo3U2UYD1Ef7Kd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpcfkm32.exe

Path C:\Windows\SysWOW64\Lpcfkm32.exe
Size 96KB
SHA256 f375baa8155c08e940b4c70cb6af488c6a72ba656920a8aeb2b50c678f3fb10f
MD5 1897e59cfafb7226d2867c6adcfae5c2
SHA1 c276e4f40a999616a58741a4641921d90f498bb2
SHA512 c83a1f1d1243752ecd05057302abb9ef9bf59b8e4bdfeee3dac88fdf3d44fcb18ab9688359316564a3ff4db0aaf90dab93fa681b6f8282104333649547ec330e
SSDEEP 1536:zjBloeLzmLkk4gCukocBv9RbaoXyANxoIWFDrn2nRqwwiiiiiiiiiiiiiimiiiif:ztWuzmok/vc/RbNpNaXFWn9gd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpebpm32.exe

Path C:\Windows\SysWOW64\Lpebpm32.exe
Size 96KB
SHA256 50c6285c2ff9c2cbaca16975ca36d4a2f0a2a25c84fa41daa8e950594c556787
MD5 e92b4b43b4ba7552ed9263e5e6e375e5
SHA1 82125c1d40b7c31a63e545dfbb0cd72fec8043b2
SHA512 1177693df11f741f65ebfa2795bce3bc5e8ec0b46e0e0b5e4871279272ed7ffd3ed6aac71169803f472493ef67d35920ddf865f9f4228e50e3557bc7c364985e
SSDEEP 1536:KJj+I/fqTQVO1usyqQ/aybGY8w5arE8dLLQ7lw6HcqvsSduV9jojTIvjr:KBpqUsyqQZGLrrEEGlw6HcsDd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpnhfhf.exe

Path C:\Windows\SysWOW64\Mcpnhfhf.exe
Size 96KB
SHA256 c6046655a9840c1ac8f06894384c483868a9f53b2e1f85f192eed2107c863a6b
MD5 e6665589bae9237c0c504021af68188f
SHA1 8e71512df85e3a0f97830c9942a3166dd1cc7711
SHA512 1f48bb3c32bc12193afe7bada5085e8118dd70171181858f5fda561c9d362d4784ee190dc0943384273870fd0d850bcbd67ebf1467c28eed09f0a3611883c4d5
SSDEEP 1536:0BbHw79FzI3UvNkk0AluB45ty5u5/WkqBrduV9jojTIvjr:09ckhRBctyA5tq5d69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdhdajea.exe

Path C:\Windows\SysWOW64\Mdhdajea.exe
Size 96KB
SHA256 69d9b0022f1b861209eb2284df846af45cf6d9c1de5faa5862d256a306e1b423
MD5 73f09a1e1dff93132715d12ddec207da
SHA1 f0ab1b39497fb89f10d77cb3b16d503c5898609d
SHA512 7b6dbb520a0b121ff5f189c5863b5d8cad5a2942c8d110da57e47e5ec85288273edf8e7492a2baed4cc5f5a5125d0041f1d9c35df2cd7f0e31edda27d29a636a
SSDEEP 1536:wkmGFUKAbVjtN9H7+H8F41ckJb0YoKCS9R8hduV9jojTIvjr:w4qKArb+coaRKC06hd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Medgncoe.exe

Path C:\Windows\SysWOW64\Medgncoe.exe
Size 96KB
SHA256 28ada20f7d1d2bba3ec4512ba2ae8fb5d145c6623c60d11c1c9b918ba51913af
MD5 c514140e781ceafb42462bd5ca17b43f
SHA1 a183aba3bbfb4efe4e81565f4d9d631d3a47c4d3
SHA512 48625e45bcd17ff5d50f99cb1dc542863471050ea182a57b8ed1fcfcb99f7e750841d3667d4e856888db21d79e651a51bf9487c089d23888bc37bc9d05357a36
SSDEEP 3072:LjUg/nlg2AAHA62LhUEm/03mzFCq67s/Rkd69jc0v:LjD9g2AAHAdLhUEm/03sF367s/Rkd6NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgimcebb.exe

Path C:\Windows\SysWOW64\Mgimcebb.exe
Size 96KB
SHA256 8e7adf06eb8e0d446c3bd8f1cedc87f44730a11d1ea9107fd8f1386b3646bb5b
MD5 6a4da84af149034df1b1ffba407b53da
SHA1 109b868bf93f7d3f2cf2a01df5ba188fb01b69a8
SHA512 f4490fac945fefb0f67ea4f441d91201a6020dd7e7d12ffd330ee4bbe47d9706fce144970fdf177cd3d3410f756384f2676c4012467f41bc9c3b0ca46244ae0a
SSDEEP 1536:Vo0Kjstwdy46avxJdHuKapMw7lfUzFElguZZNoSduV9jojTIvjr:y0Kjkwdy46abdH6Mw76zQjiSd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mibpda32.exe

Path C:\Windows\SysWOW64\Mibpda32.exe
Size 96KB
SHA256 98c8ee881794b41e5002561a5bb2dd4593583e12a84cc90a28534c80e6f2fdf5
MD5 2b41a5436cf9c9a109425b3d3b2fcc0c
SHA1 11e6afb74a0bdf235913e1240ed1e0c7403ad6c6
SHA512 ee044ff94be4fd62a26c82f096bfef7ed200d707f02ddb3a7eb437847379eae1c8bd2b99c504b33f5f3a6a98e3bd4f3f66fecfa658a5aa8c61ab3b14c200ea0c
SSDEEP 1536:I6Y9yi0ayD2Mi6BKOqTsr8Gp9fkxu8DU2f+MdrFqduV9jojTIvjr://D2ub8sr8Gp9ow2FdrFqd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Migjoaaf.exe

Path C:\Windows\SysWOW64\Migjoaaf.exe
Size 96KB
SHA256 16c3fe426adeaf17749ca110f8e0c17a36c7d86f75e8ec5749245d13a68bdeee
MD5 b8857c76388ef342e83af76d389e31b7
SHA1 c3482b6924090bdb58b9aabdad934e6fddecd8ef
SHA512 870ee51b3cd0c34115427baacd5db69f5098fd1d98df4330c9493502c93e105ab40127a070a11c8fd43da0619c71c0e686138fe84a40e9300525db4317f99d78
SSDEEP 3072:z0H1zNxc+PtKdvybvnOmyQYeGd69jc0v:z0H1zc6KIb2y/Gd6NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlopkm32.exe

Path C:\Windows\SysWOW64\Mlopkm32.exe
Size 96KB
SHA256 465953ba6ca8c10c816f1a0d0f9c0ad0f1076aedefee69c1cd0e7115cbc25b7c
MD5 b3d99e12254b72c37b86029d931824d8
SHA1 63283c8a527000b4b1ff6e205d3402057ac51002
SHA512 216bf53dd6361e14c92d67451c647a5a2fc70c94e4b6918460de65d7f200655d98026506bb29a0484d45f55097f89577703d4b6e4f0071d85a0a4cd203e32f1b
SSDEEP 1536:k5QSSQxjxw4vk7eTeVxVs2S6ysEjiMFV1bEPpPQJdduV9jojTIvjr:4ttwrv7VG9KpIdd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mmpijp32.exe

Path C:\Windows\SysWOW64\Mmpijp32.exe
Size 96KB
SHA256 c5dcdff2080a285b580744ace2bf7f190ad46fd6602b42a74ffc148e90a37d31
MD5 fd2146a18d38cde04a43d26f35bf37eb
SHA1 ab7cd088c2df69fb66dbe80178232c981719be85
SHA512 1b93cdb9821a3d3b77d58dc1c8ac82637add1bc3935aaf7915acb78c4e79ea3f73686f1a72fbcdc2f56ed368d579f6d1beeebdba9f2bd1649a20f278386a629a
SSDEEP 1536:Qu0QJcgZT1dwJcQs10SlGexh1lC8BPcfjduV9jojTIvjr:QuPyCdwq0yvL1Kjd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnebeogl.exe

Path C:\Windows\SysWOW64\Mnebeogl.exe
Size 96KB
SHA256 c071a39c78162ddbb11da19cc1477a4965a001f5679ade54a7015d4c0c96ee07
MD5 4a265376cb2e5820892565d6bd30a995
SHA1 35b43cd8b4bd8b28a1fac648a91032eca71892ed
SHA512 e335cee947d0c2cf2e62d69639e233f3a177a48ed7b871d69aace9200e4fee2ca62d7d5880a4d86bb01d379e24a3e9987e62cb1419402e50137f1a303eb0f5be
SSDEEP 3072:w2uVNFh74100H3ooPttttttttttttttettttttpjttttttS23x1sd69jc0v:0/hE100H3oo72h1sd6NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndaggimg.exe

Path C:\Windows\SysWOW64\Ndaggimg.exe
Size 96KB
SHA256 dfeafc42145ee7812bdafa4d01d32f261647976a03f55bbd0657bb6ef77ace40
MD5 7a88bb8f154da150cb0889d601f67ddc
SHA1 c7ee3ef1544d22a51bf2b32ba5d8797ebd903793
SHA512 414d383e596b7afa67315bec99cda258f9535a812e10bdf631babf2eaefa74de74ac871f4333ba6d1a486936ea04ea8ad604b39540ebd755547b47842fd8ab38
SSDEEP 1536:tJ4bjAs6KDpjdhs2x0pqO7Lkg/DR/1/WS++sgpY+At7ICB8YL6egMduV9jojTIvf:ta76KzhnfO7Ygf/JBHO7gHMd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nebdoa32.exe

Path C:\Windows\SysWOW64\Nebdoa32.exe
Size 96KB
SHA256 3cf878021c43f36965bf1378f02959547fdf6ee3175c99a35f3c6a907f570f08
MD5 cae9522bc5988fe73723d1eb57bd0e5f
SHA1 5cae107c306091f509e3b853ede8f34829107243
SHA512 510b084dbc78f7358445882e74202130723b539c9ed2ca2a1cd751438a1b1f23f4825df5e08e0f687c64a01fd35817698fa6fc97f230ef2c218fc7ca7b70258d
SSDEEP 1536:ZSf0crxJFIELlQ63o2lB4EghqTBlGjtMduzp8LduV9jojTIvjr:FcrxkELlQ63o8N4QJqpkd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nepgjaeg.exe

Path C:\Windows\SysWOW64\Nepgjaeg.exe
Size 96KB
SHA256 8e16141f6695f782717cca7c026d29cc3817383fa8436406ebb0970be14c78ad
MD5 b0117b6ab189ce0f3c9010fc3eb4192e
SHA1 ce67ec77c2841536cc26a09b18e017acccc418be
SHA512 c6e94012b204ea29524db0e486332b6af2c59329371f6e58983af315813df5e6a362da035954552e5782f7c8c18d952f2e28029cfa108ff4a441130f9104f770
SSDEEP 1536:jKWGP8EhGCSPCsofF4o60FKVOQBNE1GDEUDXyylkduV9jojTIvjr:jKDG/CnFwE9Oiylkd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngbpidjh.exe

Path C:\Windows\SysWOW64\Ngbpidjh.exe
Size 96KB
SHA256 e0514323c4cb229b3c56e5dca80d870adb214ec3a69da320465319dbbdc84176
MD5 c8e8eb6481a88dd53a0626363edf033e
SHA1 ba12c695dceb9023f23728fdf3a80c494004a7ab
SHA512 a83b5d93e8d2bc39c7db16cc33705c04bdd6c5e8d1fa2df893bb968c1e894040a9340720db3fad16013bd73c9496579f8f0de51814883161369f73803ced7ee7
SSDEEP 1536:4oRCP+q5X7gQH1FwqN/MV3qGv+8dZduV9jojTIvjr:43GKX/Fr+i4Zd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngdmod32.exe

Path C:\Windows\SysWOW64\Ngdmod32.exe
Size 96KB
SHA256 2f1af463b581c36cccb44a9e4913a33f6542e2c1c98d1fadde52b9432e8f3f54
MD5 8a3c004edb6cb57cb57ec1fea6448872
SHA1 8f1f34a2c52678b9f5bcd740ef4bc4c22df7e1e1
SHA512 3d629fcb08ac1656f547ae281cf84e0491c4d50e9d3817694e00217dd08fa1546b68b1f5fbb0f914cd4ad9836335cf10245df8d00715d0ca05b25eab643f5afc
SSDEEP 1536:EKZHa1cHhktQkWivuUVhhx9Fy50ogLGQ9JLS9ycg2JPScduV9jojTIvjr:EiHutQkW4l7hBQEZLIJScd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nggjdc32.exe

Path C:\Windows\SysWOW64\Nggjdc32.exe
Size 96KB
SHA256 f5dcd0da386519fcb63f241bb98efd7ecb672ac5b8a1b6cdc47a0a026e2dcda5
MD5 b75702510eb2e2c4286e56b1dc18be88
SHA1 c2e25ac8a5b889ee006e7c775c3543aa9d4f3a27
SHA512 c507e1666c24393dcf326fdb33a6a7d03b6a75ec84beabe48ccd2c13a1f1ec18d70927c4c9c0a4a3e3fece2b6a5891a648f34adeefd85db2f80109eeab3f1957
SSDEEP 1536:XHaWy+fc8fzssoKeAcUXPZYjcy1ro0lxbUly0wjP9tNduV9jojTIvjr:vy+fc8Ltz4/U0H9tNd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njefqo32.exe

Path C:\Windows\SysWOW64\Njefqo32.exe
Size 96KB
SHA256 7f6d3c09ad0aecca445b83eea38dda413112c0f4bd2fbf203fe9e621c3fe4116
MD5 9c3a00d29ad7308191bd2f85b9f54eb5
SHA1 1837b7d556216859f361158803e8c04003f2310c
SHA512 83dac3bccebfc4b277f0c7fc08593e6b10e17f487c922e9d5b71c4bd8b425e909508c92a3a7bd8d874c2f5b6445d3c961c9621fef773910f5b6f3994a284c6d9
SSDEEP 1536:Z6/lsfi85a3OX6Ct56cf3nDLAcg6CfYeqx9t0e71KduV9jojTIvjr:WlsfP5a3+6EIQDLhdCfit0+Ad69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nljofl32.exe

Path C:\Windows\SysWOW64\Nljofl32.exe
Size 96KB
SHA256 a52b5781adf0226a6a2e6a6ea0a0a1bf3e12f9ddc7ebca46d853488e2daa17e2
MD5 634ca4dc645b93e470ab0a9db82150aa
SHA1 72f15d7d738b2f69d38e5e31899ca86b5454e863
SHA512 6e0d7e0667a90f325f36fe39bda1902dc8ae48917a891515bc16e22adf1879ce053dd79269eda4fdb81710bb88e29e0e4092cf7afa120e14e2e65ce1db3c144f
SSDEEP 1536:JT05yRqa75NxMwsEzE00iX7Q7ycbGoMNcxV84rduV9jojTIvjr:JT0ARqa75NxMws500scbp64rd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nloiakho.exe

Path C:\Windows\SysWOW64\Nloiakho.exe
Size 96KB
SHA256 2cb47a2fef78cb9f6ff2998dbd9284d8a72c7cf371ba11162b223afd4ad4b898
MD5 e1c33ee9d23330b6cfc305691125eea8
SHA1 1667e6e0e82fb706b89b6a179578eae5cf6112a5
SHA512 747b7006c983ccc88267a998b128c9e62d170bba78f5d6e06a4720429cf6760634fe447e3528f9e1d648cded59618ce363b677bb84e379790bece1f2efb07fcd
SSDEEP 1536:/frjIRF3ZrFiXq4uv8Lz9LaPX6zOVBYHduV9jojTIvjr:/jmZMq4q8Rc6iBYHd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnjlpo32.exe

Path C:\Windows\SysWOW64\Nnjlpo32.exe
Size 96KB
SHA256 576ad1f4e228526959463260711c396ed7d774bcbe78fa492cd45292093b1664
MD5 5787f7c0cf20ae4d312791371c4e3fdd
SHA1 d0176642159598686401330779942dfe8aaaf85c
SHA512 ac754dbc5c8f16be3bf2edf5556a637c8d4432489464626f8f4c0ab06fc50a8987263d849e07718c343cdd13a2a2a13d2c84dc7d13b21835a3b231f114b4106d
SSDEEP 3072:2Ov98yO+tcR59MO8G2vmtd9gIHmd69jc0v:x8yFS9MO8GFyIGd6NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnneknob.exe

Path C:\Windows\SysWOW64\Nnneknob.exe
Size 96KB
SHA256 7313a73ebd9c7a8a02434100826ca256782dccc7d14aad44fa8295775b2c340f
MD5 a0994b157ea5c679811cd631bbf044e2
SHA1 e5d5e0083271bd41309265e934bff90bcbaa5df0
SHA512 8302068c97a6757ba167f74e6aa79d99821d698ff440ff69df906734b961214b0efb1b082e736bd8b538225640f5a768a6978ed7cdc4c9c66a4705dea49b1537
SSDEEP 3072:abVCV7hNEvXU9zg7hSzHg8f3u7bwT/d69jc0v:abQREvX4yl8fe7bwT/d6NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogifjcdp.exe

Path C:\Windows\SysWOW64\Ogifjcdp.exe
Size 96KB
SHA256 688d397635fcde1e4c2726b52b031eb44b9f091a97215d591ee2d3a6bab6bb6e
MD5 8fd268b30b9ea648eefc112d310cd507
SHA1 8b6b45b2cd45cd4d9f5e57d7ad5b2c8b4dd16d48
SHA512 588fa81bb18090b5d9649ac69cdb8c4dc6eeae8ed7b2876cdc652be85333380cbc82dbca503b8358258a2bc8f28b2e6061402e7fd8247167a1af1b0c323c3001
SSDEEP 1536:FlEuyBStbyFnaKqtD9uScUoz4nUlfhCdBVJXzl0VduV9jojTIvjr:P5yBSFyfZzwUn2VJzl0Vd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ognpebpj.exe

Path C:\Windows\SysWOW64\Ognpebpj.exe
Size 96KB
SHA256 0afa18447092f7c92cdd3b812be73f42e5e345894aed136d5b15e457c673fee0
MD5 a02d5382f1bcca66a3dc82bbdda5e119
SHA1 a72ba778fc65f9ad43f491a39510753e61c5ea5a
SHA512 0ba116b4d04147e91cc0b31f731589d6383510bb4db8df54081ec04d369b312dcb728c057e011aa2cc4af3c58d6eeadf65af1a2dda25c234fa0e691045259efc
SSDEEP 1536:CW1I6jnz2PKYRXH2FUJ02MPou97rEZB4Lnzi97HSiqduV9jojTIvjr:CWr/A3U43MPm/4LqSiqd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Olhlhjpd.exe

Path C:\Windows\SysWOW64\Olhlhjpd.exe
Size 96KB
SHA256 e60098e8ad28cd604c325a4eafaa920600cd23275947034febc812914da56fd4
MD5 eefaf2f13692e078d816754b6b56ab79
SHA1 3d69a80b3227b34ade727ab7edf67ed1546a0389
SHA512 f1ccd91fc98baabb768a76d1edbda733c0eaf1c301574245ca5fc48d7224db62a29f8ac58b6bf058f19e86712261b6e8cb35f9289b2db823145c1a04eac6a9b1
SSDEEP 1536:vuucs7Mufjl9LtE81zgWanTI+GRSQdKIwLB8mpuuxgq1kI0duV9jojTIvjr:v+cjrLtE81ZaYRP10WlI0d69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opakbi32.exe

Path C:\Windows\SysWOW64\Opakbi32.exe
Size 96KB
SHA256 72fec33dd56588462216f9be6c64bd72ebad907cbf2707ec4fcd76f37331acea
MD5 4f7d3bebbeac0d074d7e6c17fb5f082a
SHA1 bbcefc87739ccd251ebe24d5c05b4c27b575f3ab
SHA512 59416549ea8f85fcd9487a13896da66c47b45d03b6dfacf995a372ac110fc9dc6b2d8bf04404e7b6b1aed4729a44bda64e9e714c6576937652ebd3be114c3559
SSDEEP 1536:FlEuyBStbyFnaKqtD9uScUoz4nUlfhCdBVMMZduV9jojTIvjr:P5yBSFyfZzwUn2VMMZd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opakbi32.exe

Path C:\Windows\SysWOW64\Opakbi32.exe
Size 96KB
SHA256 2c2b3babf23198af5524c59fb4d2ec8df85dbc9530687d57895870865ffaf969
MD5 613c58e45cda9b7f3a63f1b9da6a081e
SHA1 8cfaff72d28da937bc5aef317504e3509f7b5eed
SHA512 6eeca28b5582a95862207ab45a3bdb8a095b3e0e6a75dc5770c97446a6fa6b7ca22b2dd8b367e0054fe3c47c7c926adede8b1ac97f6cb36e20519d320c966968
SSDEEP 3072:aY3A8XjayoXZ4XBbjrzled6MZd69jc0v:a+XjhoCQZd6NV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnakhkol.exe

Path C:\Windows\SysWOW64\Pnakhkol.exe
Size 96KB
SHA256 e7f16b95c1e468cef3182825a80185d95cd7fecffc37a1e0f86d9ff0141a5c4d
MD5 385a2deb10f77bf36393c1539e9aff58
SHA1 b7184b8b3034d54a418b5595973ae6cc2246604b
SHA512 7e25383b1b5adf908b3bde94189236e714b9aecc252d3644505be8baf6813c01df50ef7152ab00d96b297964b04d25b783b2ac1d67b022759855890bccb8c0c9
SSDEEP 1536:rPBB5gEYhyp79cOlLfO2AWoHduV9jojTIvjr:ahETlzO2xCd69jc0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-514-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/336-454-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/400-24-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/400-565-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/404-292-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/428-545-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/532-87-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/540-175-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/736-436-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/740-183-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/752-151-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/764-231-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/916-460-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/964-79-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/968-143-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1084-538-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1100-128-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1208-334-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1260-72-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1320-298-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1492-530-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1508-442-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1528-304-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1536-15-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1536-558-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1656-199-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1664-103-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1672-316-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1720-55-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1720-593-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1852-520-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1936-430-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2008-573-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2028-496-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2064-172-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2172-382-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2184-286-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2320-400-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2384-476-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2428-394-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2552-111-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2572-191-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2600-207-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2692-268-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2760-570-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2772-120-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2916-47-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2916-586-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2944-551-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2944-7-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2980-418-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3032-572-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3032-31-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3060-376-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3064-484-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3136-424-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3140-352-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3212-532-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3312-579-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3312-39-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3332-0-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3332-544-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3384-240-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3408-96-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3524-502-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3560-328-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3616-284-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3728-552-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3796-322-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4220-358-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4228-559-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4276-310-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4364-64-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4388-370-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4408-508-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4452-490-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4496-364-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4532-248-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4556-448-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4572-388-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4588-466-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4640-255-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4748-346-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4792-340-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4824-160-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4828-412-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4856-216-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4868-478-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4880-274-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4904-266-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4908-224-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5008-406-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5040-135-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5172-580-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5220-591-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5264-594-0x0000000000400000-0x0000000000442000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads