berbew | 4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
Size 378KB
Sample241111-xbnwdstelf
SHA256 4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c
MD5 ff5663dc95dd43c1da812b1bf72caf06
SHA1 eb7bfb7a7cc8a760fd8308900d143f9782533faa
SHA512 6249f3affadb936eb2aa1278d6aec66099553a734eefcd005a72166ff440a4de8f0b95bae4531bea24cc6701f18d0db32e02e85b95acc1f23279ab5b621d4af7
SSDEEP 6144:Q1e0Z01EeVXEpeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42G5:vCeVUpeYr75lTefkY660fIaDZkY660fR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdabcm32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 40 IoCs

pid	Process
2444	Bfkedibe.exe
436	Bapiabak.exe
4576	Cjinkg32.exe
5060	Cmgjgcgo.exe
1028	Cdabcm32.exe
4808	Cfpnph32.exe
5076	Cfbkeh32.exe
3476	Cmlcbbcj.exe
4184	Cjpckf32.exe
2272	Cmnpgb32.exe
4896	Cdhhdlid.exe
2380	Cffdpghg.exe
3200	Cmqmma32.exe
3964	Cegdnopg.exe
4316	Dhfajjoj.exe
4408	Djdmffnn.exe
3636	Dmcibama.exe
640	Dejacond.exe
2560	Ddmaok32.exe
4608	Dfknkg32.exe
2388	Djgjlelk.exe
3940	Dobfld32.exe
908	Dmefhako.exe
4444	Delnin32.exe
4420	Ddonekbl.exe
4980	Dhkjej32.exe
2900	Dfnjafap.exe
468	Dkifae32.exe
4080	Dmgbnq32.exe
4496	Daconoae.exe
3660	Deokon32.exe
3208	Dhmgki32.exe
548	Dkkcge32.exe
2912	Dogogcpo.exe
3480	Dmjocp32.exe
1896	Deagdn32.exe
4176	Dddhpjof.exe
4784	Dhocqigp.exe
1692	Dgbdlf32.exe
668	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dkifae32.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Deokon32.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dmjocp32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Deokon32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Bhicommo.dll	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Ddmaok32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1408	668	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bapiabak.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2444	4380	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe	83
PID 4380 wrote to memory of 2444	4380	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe	83
PID 4380 wrote to memory of 2444	4380	4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe	83
PID 2444 wrote to memory of 436	2444	Bfkedibe.exe	84
PID 2444 wrote to memory of 436	2444	Bfkedibe.exe	84
PID 2444 wrote to memory of 436	2444	Bfkedibe.exe	84
PID 436 wrote to memory of 4576	436	Bapiabak.exe	85
PID 436 wrote to memory of 4576	436	Bapiabak.exe	85
PID 436 wrote to memory of 4576	436	Bapiabak.exe	85
PID 4576 wrote to memory of 5060	4576	Cjinkg32.exe	86
PID 4576 wrote to memory of 5060	4576	Cjinkg32.exe	86
PID 4576 wrote to memory of 5060	4576	Cjinkg32.exe	86
PID 5060 wrote to memory of 1028	5060	Cmgjgcgo.exe	88
PID 5060 wrote to memory of 1028	5060	Cmgjgcgo.exe	88
PID 5060 wrote to memory of 1028	5060	Cmgjgcgo.exe	88
PID 1028 wrote to memory of 4808	1028	Cdabcm32.exe	89
PID 1028 wrote to memory of 4808	1028	Cdabcm32.exe	89
PID 1028 wrote to memory of 4808	1028	Cdabcm32.exe	89
PID 4808 wrote to memory of 5076	4808	Cfpnph32.exe	91
PID 4808 wrote to memory of 5076	4808	Cfpnph32.exe	91
PID 4808 wrote to memory of 5076	4808	Cfpnph32.exe	91
PID 5076 wrote to memory of 3476	5076	Cfbkeh32.exe	92
PID 5076 wrote to memory of 3476	5076	Cfbkeh32.exe	92
PID 5076 wrote to memory of 3476	5076	Cfbkeh32.exe	92
PID 3476 wrote to memory of 4184	3476	Cmlcbbcj.exe	94
PID 3476 wrote to memory of 4184	3476	Cmlcbbcj.exe	94
PID 3476 wrote to memory of 4184	3476	Cmlcbbcj.exe	94
PID 4184 wrote to memory of 2272	4184	Cjpckf32.exe	95
PID 4184 wrote to memory of 2272	4184	Cjpckf32.exe	95
PID 4184 wrote to memory of 2272	4184	Cjpckf32.exe	95
PID 2272 wrote to memory of 4896	2272	Cmnpgb32.exe	96
PID 2272 wrote to memory of 4896	2272	Cmnpgb32.exe	96
PID 2272 wrote to memory of 4896	2272	Cmnpgb32.exe	96
PID 4896 wrote to memory of 2380	4896	Cdhhdlid.exe	97
PID 4896 wrote to memory of 2380	4896	Cdhhdlid.exe	97
PID 4896 wrote to memory of 2380	4896	Cdhhdlid.exe	97
PID 2380 wrote to memory of 3200	2380	Cffdpghg.exe	98
PID 2380 wrote to memory of 3200	2380	Cffdpghg.exe	98
PID 2380 wrote to memory of 3200	2380	Cffdpghg.exe	98
PID 3200 wrote to memory of 3964	3200	Cmqmma32.exe	99
PID 3200 wrote to memory of 3964	3200	Cmqmma32.exe	99
PID 3200 wrote to memory of 3964	3200	Cmqmma32.exe	99
PID 3964 wrote to memory of 4316	3964	Cegdnopg.exe	100
PID 3964 wrote to memory of 4316	3964	Cegdnopg.exe	100
PID 3964 wrote to memory of 4316	3964	Cegdnopg.exe	100
PID 4316 wrote to memory of 4408	4316	Dhfajjoj.exe	101
PID 4316 wrote to memory of 4408	4316	Dhfajjoj.exe	101
PID 4316 wrote to memory of 4408	4316	Dhfajjoj.exe	101
PID 4408 wrote to memory of 3636	4408	Djdmffnn.exe	102
PID 4408 wrote to memory of 3636	4408	Djdmffnn.exe	102
PID 4408 wrote to memory of 3636	4408	Djdmffnn.exe	102
PID 3636 wrote to memory of 640	3636	Dmcibama.exe	103
PID 3636 wrote to memory of 640	3636	Dmcibama.exe	103
PID 3636 wrote to memory of 640	3636	Dmcibama.exe	103
PID 640 wrote to memory of 2560	640	Dejacond.exe	104
PID 640 wrote to memory of 2560	640	Dejacond.exe	104
PID 640 wrote to memory of 2560	640	Dejacond.exe	104
PID 2560 wrote to memory of 4608	2560	Ddmaok32.exe	105
PID 2560 wrote to memory of 4608	2560	Ddmaok32.exe	105
PID 2560 wrote to memory of 4608	2560	Ddmaok32.exe	105
PID 4608 wrote to memory of 2388	4608	Dfknkg32.exe	106
PID 4608 wrote to memory of 2388	4608	Dfknkg32.exe	106
PID 4608 wrote to memory of 2388	4608	Dfknkg32.exe	106
PID 2388 wrote to memory of 3940	2388	Djgjlelk.exe	107

C:\Users\Admin\AppData\Local\Temp\4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe
"C:\Users\Admin\AppData\Local\Temp\4a82a36dfe72169ad91f80844947f2119ef46fe490e32aeab22306248dab699c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\Bfkedibe.exe
  C:\Windows\system32\Bfkedibe.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\Bapiabak.exe
    C:\Windows\system32\Bapiabak.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\SysWOW64\Cjinkg32.exe
      C:\Windows\system32\Cjinkg32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5060
      - C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:908
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2900
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:468
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4080
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3660
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3208
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:548
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2912
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1896
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4176
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4784
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 408
        42⤵
        Program crash
        
        PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 668 -ip 668
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bapiabak.exe

Path C:\Windows\SysWOW64\Bapiabak.exe
Size 378KB
SHA256 a71b91403cc156dff9135632f4995ebb70af7fcf72915c4e2aa453ba48161db6
MD5 576278f63edc1c4d39710fdb11cec311
SHA1 8ff39d5fa18eef13eabbf3c06d9b95403e039e84
SHA512 d6cf6620d992f93736bcb5a09bc0d70d86eba12ffeb8d91a5880220a3a5f339794abac167b835d6f910f9da08d4fd45f7285b3a7384a55eb8e99816e992c6cc5
SSDEEP 6144:ltmJ1jVqREyeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQ+:XmvjVryeYr75lTefkY660fIaDZkY660p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfkedibe.exe

Path C:\Windows\SysWOW64\Bfkedibe.exe
Size 378KB
SHA256 add0109c75ad474d47b2638dc630d8b1f91634ca71fdff646a4623cf6c3dfb7a
MD5 69ddd7999e3e87857063d03e2453343e
SHA1 e1f40ae577180e4c4ca3a48edf20d75f13643fbc
SHA512 e06d5886e2a3ccbad353bc67c87a347cbdfa2fc62e0749019bea78c4f843a3b8510214c21694911d9cfc352775349105ac56ef51b9109270a4ac9b2557ae876c
SSDEEP 6144:ezkxqdP0zUysEmeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42g:ewrmeYr75lTefkY660fIaDZkY660f2lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bhicommo.dll

Path C:\Windows\SysWOW64\Bhicommo.dll
Size 7KB
SHA256 e08c723ce7c65ad651c6cd5ab513be1e2013e7dcfdd2caf1c98a347ab26b5bb7
MD5 86524d4ffbb55056edc941a3111c917c
SHA1 9ac349406a05216a4a39e11b6e6e12292dd858e0
SHA512 c7ccb193f3bdb834b99c6ed07f8182bdb61a868027b96859f87771ab30d85cf33d06b9c5924cafd96e3ac9d0113898d0986ee1c98460f472e3a08c5a5de18390
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW5bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPzq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdabcm32.exe

Path C:\Windows\SysWOW64\Cdabcm32.exe
Size 378KB
SHA256 929def77b1351c6b3e2c8ebe4167668c029b6d0fb44c1d5f4ea6fab83956fdb2
MD5 8495e4dfa26ec7ee599e2151263dccf1
SHA1 312380a909e954e1e666572008e990881751b84c
SHA512 cca02ff670a7b4282a91c10d9cc9419c780904bbe17ae9a8fa967377b528041d41ddabc197f3dd155db52782b6ef7dc2ace693d887ad56921a4405cf8db44952
SSDEEP 6144:q39oGc/qrHzmxkfE5eYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UKb:q3K/OKxkc5eYr75lTefkY660fIaDZkYg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdhhdlid.exe

Path C:\Windows\SysWOW64\Cdhhdlid.exe
Size 378KB
SHA256 09d1a0841749584110f7db0d77fb409b067df8f4f919ad29f31ef205dcd976c0
MD5 500271b427f987ca823cafd795d71015
SHA1 ba868cbb131c2708c512676cce770a1986e9beef
SHA512 f5d8906459b82200d99f7c6f1207decb9f3cdf4fb7bcee826e3f456dc3b78552127b81acae8d9d0bdae5bcd3bf510cccc9f6d200dc7c54dffe904a7b963b270d
SSDEEP 6144:9+CJLyzvOZCQNEteYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+49:k1zvOleteYr75lTefkY660fIaDZkY66s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cegdnopg.exe

Path C:\Windows\SysWOW64\Cegdnopg.exe
Size 378KB
SHA256 2e600df866e2c65e2f41f53338ae058d6d6530ec1e23e54afccfc7ed0255ce8c
MD5 b925256a69efbf5a62ff3e6d20fe047e
SHA1 6bcb1c3c4e4692732bb3d5fe620cbb015a34cadf
SHA512 5f0e5cc4ff463efc2c4f196d84fa76742d273a60b1c972fca08a7ffadf8076a0e3cfe1ad0c185973a1a4671b28351ff005dd686d99bddce4500882f13775ec46
SSDEEP 6144:i9uc8S0UppfFMDEmeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+i:i9ucTeAmeYr75lTefkY660fIaDZkY66s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cfbkeh32.exe

Path C:\Windows\SysWOW64\Cfbkeh32.exe
Size 378KB
SHA256 3a90dc489e1e09891196efc11208e3dd07df99ee7ba5c59572e0eb05beb64d5a
MD5 0a43ebe9ccf0f4e25b29cdad5dd7a264
SHA1 598073d7258ff8e4d07735bbdef6d13b1a234ce6
SHA512 b2ce876ea72a6cd37b14a70a4685080d89af6d166df3a37534ae564f14b14b598464c58fb19e3810ac39d69abfe0b3ab8e6e01d6084b6647b5e56fc4256862b5
SSDEEP 6144:q/w4OaEeEIeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQM9:q/w4zgIeYr75lTefkY660fIaDZkY660p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cffdpghg.exe

Path C:\Windows\SysWOW64\Cffdpghg.exe
Size 378KB
SHA256 655051f72fa325f18d62a5e9cc1bdb012f3815cc15f8f4aaca623c02df3ed24c
MD5 2688e359bf537203b169fe2482fa154f
SHA1 760ffd17f2ccb20bb5608122e66351f5d64d1dfa
SHA512 c6b08fe9e7048057bc4a5d821f91c311b4a96c06e46f1eb92892710499ba68b89ca8956ff1c98f9d413a93e355f75f1ccdc768cb87c9f342e7de3d92c5ac0029
SSDEEP 6144:Jg63ov6EmeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQMJD:urmeYr75lTefkY660fIaDZkY660f2lT6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cfpnph32.exe

Path C:\Windows\SysWOW64\Cfpnph32.exe
Size 378KB
SHA256 913ce7d7621677c5ba24c188804a474bf202c3c5189698173a9c1c73b3d22003
MD5 2a7e58fb31385ce7064a8febecb9f4af
SHA1 d4e0acefadafa6d8aaed5f17fcd105d78255ee1b
SHA512 117f6aa22c0ffd381d74eac123937f8956554ad220f0390db7c15eb00685cbc3a064a862e35494f4748ecc2e5676b576b488f66e5a86f435556db8b26ec97603
SSDEEP 6144:B+Q/3j5YAEEeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQ+:Bl5YlEeYr75lTefkY660fIaDZkY660fR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjinkg32.exe

Path C:\Windows\SysWOW64\Cjinkg32.exe
Size 378KB
SHA256 153135dbedaa5038df3c3d3d1cfce8215fb359afa55def565bef77ed7d2f925f
MD5 e81ff347fad85de9bb394f4a63ca281d
SHA1 0589e1ac31d10c57a74a6d4cb848bc0123abaa3f
SHA512 4cbe01afabcb3540e88a4e46864d85a05d9eeb3cf60d0358f734d9cfd00ce09e569906df08931b26bd162fb83b1d120984ccc3e10d063cff7381681a77ee7cd2
SSDEEP 6144:1MWyFVsYleOR5aEWeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+i:feVGOR5jWeYr75lTefkY660fIaDZkY69
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjpckf32.exe

Path C:\Windows\SysWOW64\Cjpckf32.exe
Size 378KB
SHA256 313407f32ded6f41716dc3ce2006a2eb00b7e7764d889e3a3e9a742764cb8a23
MD5 4891057ad3ae8a4e0e5ae39973289339
SHA1 5bcec5bcca2c60dc72acb4a806842a08281186e5
SHA512 7a35e62317b8e6fea142c035b7fdc130006c9a626eb0272e8bf96b9d5a3427ab39fc91f6679e9efd8d14866a2850882642cd41fad97840238d26b60fb3e264ae
SSDEEP 6144:zsujj0cHtEseYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQ+:9j0m+seYr75lTefkY660fIaDZkY660fR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmgjgcgo.exe

Path C:\Windows\SysWOW64\Cmgjgcgo.exe
Size 378KB
SHA256 e2c5ee348f3cc9dae40df4eae23918065cdf913655accf0c4300e69d9a349068
MD5 81af8606fc11a6591b4b3ead52e79c73
SHA1 5ba1d86ba0905dd5f2f605b7ebe3eda515d85891
SHA512 197d9e297f2bf9dfca585696516720630c6c56deef7c6edb31f5cd347f42623d8a1b96e34c21cceb932b417a8061dd6020fee51a02be549ec50b494be5086784
SSDEEP 6144:5rvfdRDEMeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQMJD:5zfkMeYr75lTefkY660fIaDZkY660f2U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmlcbbcj.exe

Path C:\Windows\SysWOW64\Cmlcbbcj.exe
Size 378KB
SHA256 9252e76c2617328564f0af6267174b2d6cfe67cc674a264e4c1de5a204f2a51a
MD5 de01626ca7c99b94304822c0803cde9f
SHA1 cf878e11d909a7768c7464458e0ca1e0d80eca30
SHA512 a79b5d32717ca2c1f0b8f41f74fdb1acf727d4185767756635d65afe2b3215ed613ac954923b23158f2b34d42977cdbdab0c058cb558f6fbeba22e64c230aca3
SSDEEP 6144:FNupG6pEHeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQMJD:FNssHeYr75lTefkY660fIaDZkY660f2U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmnpgb32.exe

Path C:\Windows\SysWOW64\Cmnpgb32.exe
Size 378KB
SHA256 03500b18235556f558ebaa6d7306d11fcaf3f549b769d041d5cfe90a984f9445
MD5 a7c956adc2fc42d7ed02656bddb60229
SHA1 8bef49434c0ddf0f87f3a1b0f1225f342e661fef
SHA512 f859577818cbd7d2e4e97ad04418e09208b62622f5fbed2c84300c68246df66135458057e7ebc4468e403c3c5be64f03f620502527705b479d19d72641530200
SSDEEP 6144:k3mV8JzbYfstsEweYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+49:eJzU0xweYr75lTefkY660fIaDZkY660p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmqmma32.exe

Path C:\Windows\SysWOW64\Cmqmma32.exe
Size 378KB
SHA256 224b3b71be51679b193bf22303be5ab2ba55240ff915628a89a4e9e081615443
MD5 4546e4f64e4d96c802e8ac1e11628254
SHA1 bc4084a641d6ff306d5dfef0d9253ddcbaf81d44
SHA512 f175ef238f5ba9c7ce520d553f3571fd984a331bb9157bad6b339d46dfd94991a1ff18ded00c5cfed9bb0d6c3321d380e05b6048509c0eb828458fdce6924ded
SSDEEP 6144:IDQsjUyksLEfeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTV:GQH3sIfeYr75lTefkY660fIaDZkY660p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daconoae.exe

Path C:\Windows\SysWOW64\Daconoae.exe
Size 378KB
SHA256 39979649394f9878db136cf76c39e3d616c54762abb1931912ce8f729941da97
MD5 58f6b97fcdb582d266e7b0f40f8bd351
SHA1 c427037601e4e58c8a6998b241c0ca7465f73bbf
SHA512 4905f51bbb58d3f982a14398398104ff5983d08dfcadfcabc03f5183e05f761a8afe074eed1260a697e0d6480840f28eb045d227b4322dd27a6acd64d427ac05
SSDEEP 6144:iZ1WcKwBHDEueYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTV:iZ1WVUHAueYr75lTefkY660fIaDZkY69
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddmaok32.exe

Path C:\Windows\SysWOW64\Ddmaok32.exe
Size 378KB
SHA256 9a3f614a16dbee86e0b697d03d9d19946e9ca8f98419b8351429319b102a6220
MD5 ede03d7b7ddc2cab546a44b3fccfa4f9
SHA1 dd433bfc01b2d94598fd57216c5f65d70a177c1b
SHA512 ad90097bca990c549a137c21523f69a4f6c144978f62b041b571556bde4d6e86270a09e8901038b464adc7edc7bcee82995001360d2d2687b3a0a8300451d2d5
SSDEEP 6144:C3wt9ENeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQMJSZs:ttuNeYr75lTefkY660fIaDZkY660f2lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddonekbl.exe

Path C:\Windows\SysWOW64\Ddonekbl.exe
Size 378KB
SHA256 1837ac2ac5e5c6cbd85eb40084525c0342e4d0b9272d16aaabd2353caa3c3ecc
MD5 2b23c22ef9f75edb6f71b06ad31275f9
SHA1 657d23d5c5da180422c22f693a082fddcc53ded8
SHA512 f11d794d5961d6d4a7d7036ee3e6d8433d9b67819d8e0271584cc17b883358dd37467a4c5c29af09bf09967a28a5c7d1a068a6ab3f9b55da682ab131ed835342
SSDEEP 6144:Xw4Ew9AKvVAJoECeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+49:XjRv9AvCeYr75lTefkY660fIaDZkY66s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dejacond.exe

Path C:\Windows\SysWOW64\Dejacond.exe
Size 378KB
SHA256 1ff17b181d4af4ff99bdc9f9ffa3e76ea3b0663d40f93168b4d3d8569dd81a09
MD5 faaceab9622dba66bea2595964b0abed
SHA1 5d25ababf09365aa45cf2678d6a7dac0769ab2ae
SHA512 14f166a1fc81dd7857144b39417a2489e23c2717ee6ce8b2c456dd2e693ad0f9a3094e4f881eef52ca31fc44c983f423b9fad91bdcbf7939d39419d175a1b6a8
SSDEEP 6144:gptpU/inT22w6T6tEqeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6Us:n222ZqeYr75lTefkY660fIaDZkY660fR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Delnin32.exe

Path C:\Windows\SysWOW64\Delnin32.exe
Size 378KB
SHA256 4c6c4991408f8a43abde0e73c6661b25e80a502412c78b486ea284181f7cbb78
MD5 b64ce16ffc5eaebc260041d6437741d8
SHA1 1fd5ff924891020df9e2c62b50eaa768ea2c530f
SHA512 619ff5fa250c236d7194f4a2216adf262202bfaeac8b632cd60bea18bc030a63b2a52cd2c969e0bb8c95c5d2104f1c5a94de0fccf34f207498c827267eb3eaea
SSDEEP 6144:ubsS8+hEteYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQMJD:uBXSteYr75lTefkY660fIaDZkY660f2U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deokon32.exe

Path C:\Windows\SysWOW64\Deokon32.exe
Size 378KB
SHA256 10f6208d2df83e72d9c21b51df38e664f8936563f731eb838ae0fdb3f736c9c8
MD5 f1dc4225bb2307576ec56b21e9c3d7e1
SHA1 929fdc4b1356d95d1456d4559685f92df3ca01d8
SHA512 2935d55298daf9b264c2a6b557568b8099704145c9fbdbe471cfb40c653748e53bf4fa907986ab799a6e322fd335ce4cde6309e7b683afc102fbe1d9c0711012
SSDEEP 6144:Fes7Gjj3e3zyEneYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42g:che33neYr75lTefkY660fIaDZkY660fR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfknkg32.exe

Path C:\Windows\SysWOW64\Dfknkg32.exe
Size 378KB
SHA256 5e5ebbb45808ab014595e518112641c993a678c6051e2a43de16a619aeddb928
MD5 143b40bc1589835427e4dd61a99d1047
SHA1 a12fda54c00324ad6b82cd9af2c9f43d9c5a796e
SHA512 138ecab6fbfe4c8f8761927aa6e8e5d4ff4f9c424b3f989e446ae193e0e9db06bad6eb72db4f70add52fda67f06d3a67c66fc809d98c0391151d890f87364356
SSDEEP 6144:8vRyx71TP2vEbeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42G5:85ghPbeYr75lTefkY660fIaDZkY660fR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfnjafap.exe

Path C:\Windows\SysWOW64\Dfnjafap.exe
Size 378KB
SHA256 30b3b8926569e63ccedab0a0a2a4d872cfbdf2a3f71da7de165b42ee23a5aa8f
MD5 f9f2962831faa7765e3cce6064c630f2
SHA1 ddd143d85e644aed14b929cab02a44b40bde88d0
SHA512 ad705ccbdc88d0e0e07dd9d176504f71c35c1695f76f818b632684f7fd9ccc57339b2e4d5d64f199ccc4e5f5cb5ae62eaa5eee0369b605fb881b7057ca44fc37
SSDEEP 6144:F0um06bzECeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQM9:F0mCeYr75lTefkY660fIaDZkY660f2lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhfajjoj.exe

Path C:\Windows\SysWOW64\Dhfajjoj.exe
Size 378KB
SHA256 bdb924b80428b8bb1992f7a3e1c0607ab9ef2d06993324d78b1792ce2c174cd8
MD5 44136f773c5d5893fae67103deefc586
SHA1 6b2b8747ce649ba1e791d397ba7a850cfde4f1ab
SHA512 e8bcbcb2e56b3f2b94535460ee8722145d9fd00fea024ab30d14c4825a4ac0d88512b052ef2107aacaee9b864ad66322b50d4a74d06295e6a731a65a3501619a
SSDEEP 6144:W9gBpSS1YEzeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQ+:NS8zeYr75lTefkY660fIaDZkY660f2lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhkjej32.exe

Path C:\Windows\SysWOW64\Dhkjej32.exe
Size 378KB
SHA256 45537928416ba0dc86388ba4881d8146712fef1b2f3b090f3255fba6f103eda6
MD5 7e77de404baba786fbed39fdf80da635
SHA1 26ece712983a3651856f1921c46b29fef5655aad
SHA512 29c2099e9cc57ae51f2025b1a1831a533bf190c28bac29c8e66697dffc087f1424b5fa9660b3fd4ea887b64a53fac99613c0a8f41a7797074ccbb4376d4dc24b
SSDEEP 6144:LM13f6zAGwjEMeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42G5:413f6MGpMeYr75lTefkY660fIaDZkY69
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhmgki32.exe

Path C:\Windows\SysWOW64\Dhmgki32.exe
Size 378KB
SHA256 0e4c23fd39fb6be67bf48d966b3d6aa1030c4908ae83423f47011cef1f0cf1c3
MD5 e0f5ad73b42149e69d380330b4f6d438
SHA1 30a40715f79271903e162f5eec07f3e4c8d4da2b
SHA512 b786225087552dbf483de1cd20cd2c0f11b4f6c13e17338302b6dd45ff5877efd9b513034bb2277674f74986d46ffdbd49c666f38e03b6c09c16d9d213eb995a
SSDEEP 6144:ahAlj0xeJFlCjAXgIvyzsfyhklc+rh4sBfPaCWekY/QkYoEOeYr75lHzpaF2e6U3:ahAl0aFlCjAXgIvyzsfy4c+rh4sBfPax
MD5 SHA1 SHA512 SSDEEP

Submit Download

Djdmffnn.exe

Path C:\Windows\SysWOW64\Djdmffnn.exe
Size 378KB
SHA256 4b5340e697af4060d23609b7ea12ee11270fe8794f0c5da24dedc02a26208d7d
MD5 afb78379a495695e13e0f13753ffad32
SHA1 8ea69ea2494373e96c61b13ec672b3c1b2d4bea9
SHA512 8874dcd33a13ec04fe01e8910ef7a82dde799eba5192aa78e668d1f55245a0807eb76b83dbb277ab2e561d2d7d987955be54b6750f363a6a21e7bcc858bad64f
SSDEEP 6144:wmrhvWZnl1QUQhirKPeEzeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qv/:1hvWf1QYrK/zeYr75lTefkY660fIaDZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Djgjlelk.exe

Path C:\Windows\SysWOW64\Djgjlelk.exe
Size 378KB
SHA256 45b9e6b905dc8b93fd12af5dcb27a5abf0067cdbd8c52638aa05274bf190ea17
MD5 fe79527837b2ebfb5843583c1c747a66
SHA1 b556c64ce27e2455230cbeac648669da13972fb4
SHA512 f8b6ae52821b1367aaf8b7cd4da5435d5644d70c84e6a9d92e4749589a9fe80c949c6ac8ab7bdab7a9c5af31de6ab2cb3dab14579feda5da5acb6c95c7588839
SSDEEP 6144:RYzEXb+AEoeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQM9:+gXyloeYr75lTefkY660fIaDZkY660fR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dkifae32.exe

Path C:\Windows\SysWOW64\Dkifae32.exe
Size 378KB
SHA256 bc7a47ae20879a92289ecc1257cecaa40c1667dfc7bbf030a6caf08cc5a2ad1f
MD5 9a03eb3cb8a178959a2a3def3145002b
SHA1 2c12c6e5baa39f4713d3bb7fe4dbda976d45c239
SHA512 1d69934f2094b32d47231ed09932292b2fe7aba4c4721d20ff24e3d2b13abd5fea8d7194fdfdc405f0c81037669a5d095b8090a3a3490c7efd100ad93a7a540a
SSDEEP 6144:T/A7anwI3CaiQqEGeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+i:LWeOai6GeYr75lTefkY660fIaDZkY66s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmcibama.exe

Path C:\Windows\SysWOW64\Dmcibama.exe
Size 378KB
SHA256 b7c2942267ec07d9061bfbe387a722c708fdfc60090f0a99a8aecc540fa69a0d
MD5 e38ad5272e17e795046a3aa93a89b934
SHA1 3aa604f7dbf53117cfaa708dd04b9375f306e179
SHA512 79f0abcc53d1405d0ba6f52322a296781f15fe0b697d986c89eb64e83d9fd968964be69c2680ddcf2a770a1b6eb5b3f825b81986ba63b04613cb77e996e5de2e
SSDEEP 6144:7ZwJYhVPPUETeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTV:7OJa5P5TeYr75lTefkY660fIaDZkY66s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmefhako.exe

Path C:\Windows\SysWOW64\Dmefhako.exe
Size 378KB
SHA256 5f89d901267243c3f815f7470688369a6ca004156b92a9b6449bb6731dd04e2f
MD5 299a5fe3a5609ed19b8a96d5b0f39a48
SHA1 cb4440e7df149e44b2701b5b2f31aca9043fb3e5
SHA512 8a1114aeaeea05df1cde32121e6b4f99c4e116a29ed884772e91cc8a407c09c636a02bf1abc549461bf6c277d72b6c307abd5b57fa0734ead1a93d8da25f53ea
SSDEEP 6144:o9/AaESeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQMJSZs:o9/AjSeYr75lTefkY660fIaDZkY660fR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmgbnq32.exe

Path C:\Windows\SysWOW64\Dmgbnq32.exe
Size 378KB
SHA256 515d1e284a4c06d61ad300344a8ce2b6a099326c9ebd1e812f449e2e23899f3d
MD5 d532fd7e1dfca69ada5ecc2936fd6111
SHA1 5f9ed04671dd5bb4df7e797989652b7e36558cea
SHA512 ade5dd403853f03ad3096c7455d177933469e8f275b04c0c451b8e03f97dba5a00ae74c7c8f8c3c8bffa3c6dffe5f9dd342210ea9c1fd081b24c58a0ce1ddaa1
SSDEEP 6144:x+dDXehEdeYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQMJD:UdDOSdeYr75lTefkY660fIaDZkY660fR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dobfld32.exe

Path C:\Windows\SysWOW64\Dobfld32.exe
Size 378KB
SHA256 eaec098c1fc29b48887e26ce36f56b2592be20d6eaa28dfba3abbc297d29bae9
MD5 9d9a159541ff331a144ab9ed54f91789
SHA1 b3a92055ef1d9f63a8a22efbcd6ed47c24adc0e3
SHA512 c622088f062b836430450f8f483a8f4966b78229ce8e13efc21c2060cb18e4a519593a63977b2e3875fb258ab4c8c88d54b302c16be351aac27c10ee143321f1
SSDEEP 6144:+/Bs6hPfeEseYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQ+:F6hPfXseYr75lTefkY660fIaDZkY660p
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-312-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/436-15-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/468-291-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/548-296-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/640-281-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/668-303-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/908-286-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1028-44-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1692-302-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1896-299-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2272-306-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2272-80-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2380-100-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2388-284-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2444-7-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2444-313-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2560-282-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2900-290-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2912-297-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3200-277-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3208-295-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3476-308-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3476-63-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3480-298-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3636-280-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3660-294-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3940-285-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3964-278-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4080-292-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4176-300-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4184-307-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4184-72-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4316-304-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4380-0-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4380-314-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4408-279-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4420-288-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4444-287-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4496-293-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4576-311-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4576-23-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4608-283-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4784-301-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4808-47-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4808-310-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4896-88-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4896-305-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4980-289-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5060-36-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5076-309-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5076-56-0x0000000000400000-0x0000000000443000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads