berbew | e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249.exe
Size 205KB
Sample241113-vpdapsvpfz
SHA256 e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249
MD5 8ed127a4b398619ce9eb4c49a8dc22f8
SHA1 d6845320f189ee5c01e5f85ad220d829459ea4ad
SHA512 64d37ebb8fcca8d031f4561de1ea1c5150c7adceeaba810ffababcd8a97edfd37f00eb8c19bdbd5b69eedbf6fd12802bd2178489682676658afa6f5d3c14d8ae
SSDEEP 6144:eKwrnW2WpGyZ6YugQdjGG1wsKm6eBgdQbj:e5rnW2qGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
548	Ofqpqo32.exe
3604	Oqfdnhfk.exe
4892	Odapnf32.exe
724	Ocdqjceo.exe
4472	Ofcmfodb.exe
4104	Ojoign32.exe
2776	Ocgmpccl.exe
820	Pnlaml32.exe
4268	Pdfjifjo.exe
2284	Pfhfan32.exe
1200	Pqmjog32.exe
920	Pclgkb32.exe
952	Pjeoglgc.exe
1916	Pmdkch32.exe
4304	Pcncpbmd.exe
984	Pflplnlg.exe
632	Pncgmkmj.exe
5012	Pdmpje32.exe
2956	Pjjhbl32.exe
2920	Pnfdcjkg.exe
3748	Pmidog32.exe
4484	Pfaigm32.exe
5112	Qnhahj32.exe
860	Qdbiedpa.exe
1084	Qgqeappe.exe
3792	Qnjnnj32.exe
1516	Qmmnjfnl.exe
1256	Qcgffqei.exe
960	Ajanck32.exe
3136	Ampkof32.exe
3196	Ageolo32.exe
3420	Ambgef32.exe
2788	Aeiofcji.exe
3452	Anadoi32.exe
4044	Acnlgp32.exe
3688	Agjhgngj.exe
3440	Ajhddjfn.exe
3588	Amgapeea.exe
380	Aeniabfd.exe
1452	Acqimo32.exe
4220	Afoeiklb.exe
4064	Ajkaii32.exe
1216	Aminee32.exe
1592	Aepefb32.exe
3816	Accfbokl.exe
660	Bjmnoi32.exe
1776	Bnhjohkb.exe
3536	Bagflcje.exe
4172	Bcebhoii.exe
364	Bjokdipf.exe
1500	Bmngqdpj.exe
2560	Beeoaapl.exe
4136	Bchomn32.exe
3528	Bffkij32.exe
1344	Bnmcjg32.exe
1360	Balpgb32.exe
2028	Bcjlcn32.exe
2068	Bgehcmmm.exe
1468	Bjddphlq.exe
5052	Bnpppgdj.exe
3268	Banllbdn.exe
4840	Bhhdil32.exe
4872	Bjfaeh32.exe
5040	Bnbmefbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pclgkb32.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Kgngca32.dll	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Ofcmfodb.exe	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Pncgmkmj.exe	Pflplnlg.exe
File created	C:\Windows\SysWOW64\Qgqeappe.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Ampkof32.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bnmcjg32.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Clncadfb.dll	Ofcmfodb.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Dmcibama.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Accfbokl.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Pclgkb32.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Chagok32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dkifae32.exe
File created	C:\Windows\SysWOW64\Gbmhofmq.dll	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Deeiam32.dll	Pflplnlg.exe
File created	C:\Windows\SysWOW64\Odaoecld.dll	Pdmpje32.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Qmmnjfnl.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Dmgabj32.dll	Odapnf32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Mkfdhbpg.dll	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Pdfjifjo.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Gmdlbjng.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Aeiofcji.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Pjjhbl32.exe	Pdmpje32.exe
File opened for modification	C:\Windows\SysWOW64\Pjjhbl32.exe	Pdmpje32.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Balpgb32.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Qdbiedpa.exe	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dodbbdbb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5540	5448	WerFault.exe	186

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqfdnhfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcncpbmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmidog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pncgmkmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfaigm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdfjifjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaoecld.dll"	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deeiam32.dll"	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnamnpl.dll"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdlgno32.dll"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmgabj32.dll"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 548	2800	e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249.exe	83
PID 2800 wrote to memory of 548	2800	e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249.exe	83
PID 2800 wrote to memory of 548	2800	e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249.exe	83
PID 548 wrote to memory of 3604	548	Ofqpqo32.exe	84
PID 548 wrote to memory of 3604	548	Ofqpqo32.exe	84
PID 548 wrote to memory of 3604	548	Ofqpqo32.exe	84
PID 3604 wrote to memory of 4892	3604	Oqfdnhfk.exe	85
PID 3604 wrote to memory of 4892	3604	Oqfdnhfk.exe	85
PID 3604 wrote to memory of 4892	3604	Oqfdnhfk.exe	85
PID 4892 wrote to memory of 724	4892	Odapnf32.exe	86
PID 4892 wrote to memory of 724	4892	Odapnf32.exe	86
PID 4892 wrote to memory of 724	4892	Odapnf32.exe	86
PID 724 wrote to memory of 4472	724	Ocdqjceo.exe	87
PID 724 wrote to memory of 4472	724	Ocdqjceo.exe	87
PID 724 wrote to memory of 4472	724	Ocdqjceo.exe	87
PID 4472 wrote to memory of 4104	4472	Ofcmfodb.exe	88
PID 4472 wrote to memory of 4104	4472	Ofcmfodb.exe	88
PID 4472 wrote to memory of 4104	4472	Ofcmfodb.exe	88
PID 4104 wrote to memory of 2776	4104	Ojoign32.exe	90
PID 4104 wrote to memory of 2776	4104	Ojoign32.exe	90
PID 4104 wrote to memory of 2776	4104	Ojoign32.exe	90
PID 2776 wrote to memory of 820	2776	Ocgmpccl.exe	91
PID 2776 wrote to memory of 820	2776	Ocgmpccl.exe	91
PID 2776 wrote to memory of 820	2776	Ocgmpccl.exe	91
PID 820 wrote to memory of 4268	820	Pnlaml32.exe	92
PID 820 wrote to memory of 4268	820	Pnlaml32.exe	92
PID 820 wrote to memory of 4268	820	Pnlaml32.exe	92
PID 4268 wrote to memory of 2284	4268	Pdfjifjo.exe	94
PID 4268 wrote to memory of 2284	4268	Pdfjifjo.exe	94
PID 4268 wrote to memory of 2284	4268	Pdfjifjo.exe	94
PID 2284 wrote to memory of 1200	2284	Pfhfan32.exe	95
PID 2284 wrote to memory of 1200	2284	Pfhfan32.exe	95
PID 2284 wrote to memory of 1200	2284	Pfhfan32.exe	95
PID 1200 wrote to memory of 920	1200	Pqmjog32.exe	96
PID 1200 wrote to memory of 920	1200	Pqmjog32.exe	96
PID 1200 wrote to memory of 920	1200	Pqmjog32.exe	96
PID 920 wrote to memory of 952	920	Pclgkb32.exe	97
PID 920 wrote to memory of 952	920	Pclgkb32.exe	97
PID 920 wrote to memory of 952	920	Pclgkb32.exe	97
PID 952 wrote to memory of 1916	952	Pjeoglgc.exe	98
PID 952 wrote to memory of 1916	952	Pjeoglgc.exe	98
PID 952 wrote to memory of 1916	952	Pjeoglgc.exe	98
PID 1916 wrote to memory of 4304	1916	Pmdkch32.exe	99
PID 1916 wrote to memory of 4304	1916	Pmdkch32.exe	99
PID 1916 wrote to memory of 4304	1916	Pmdkch32.exe	99
PID 4304 wrote to memory of 984	4304	Pcncpbmd.exe	101
PID 4304 wrote to memory of 984	4304	Pcncpbmd.exe	101
PID 4304 wrote to memory of 984	4304	Pcncpbmd.exe	101
PID 984 wrote to memory of 632	984	Pflplnlg.exe	102
PID 984 wrote to memory of 632	984	Pflplnlg.exe	102
PID 984 wrote to memory of 632	984	Pflplnlg.exe	102
PID 632 wrote to memory of 5012	632	Pncgmkmj.exe	103
PID 632 wrote to memory of 5012	632	Pncgmkmj.exe	103
PID 632 wrote to memory of 5012	632	Pncgmkmj.exe	103
PID 5012 wrote to memory of 2956	5012	Pdmpje32.exe	104
PID 5012 wrote to memory of 2956	5012	Pdmpje32.exe	104
PID 5012 wrote to memory of 2956	5012	Pdmpje32.exe	104
PID 2956 wrote to memory of 2920	2956	Pjjhbl32.exe	105
PID 2956 wrote to memory of 2920	2956	Pjjhbl32.exe	105
PID 2956 wrote to memory of 2920	2956	Pjjhbl32.exe	105
PID 2920 wrote to memory of 3748	2920	Pnfdcjkg.exe	106
PID 2920 wrote to memory of 3748	2920	Pnfdcjkg.exe	106
PID 2920 wrote to memory of 3748	2920	Pnfdcjkg.exe	106
PID 3748 wrote to memory of 4484	3748	Pmidog32.exe	107

C:\Users\Admin\AppData\Local\Temp\e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249.exe
"C:\Users\Admin\AppData\Local\Temp\e67c30fe3859a1246ac7a7267134cc9ceb2cbd842fe823bb88e45b8e0c765249.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\Ofqpqo32.exe
  C:\Windows\system32\Ofqpqo32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\SysWOW64\Oqfdnhfk.exe
    C:\Windows\system32\Oqfdnhfk.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\Odapnf32.exe
      C:\Windows\system32\Odapnf32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:724
      - C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:820
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:984
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:632
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:860
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3792
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:960
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        31⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3420
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3688
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3440
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:380
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1452
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1216
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:660
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3536
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:364
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1500
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1344
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1360
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2028
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1468
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3268
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4872
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        67⤵
        Modifies registry class
        
        PID:4088
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        68⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3152
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1800
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        72⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1496
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        76⤵
        Drops file in System32 directory
        
        PID:2876
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4756
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        81⤵
        Drops file in System32 directory
        
        PID:1324
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        82⤵
        Drops file in System32 directory
        
        PID:4520
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3144
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4344
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1100
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:344
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        89⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        90⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        92⤵
        Drops file in System32 directory
        
        PID:1000
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        95⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        99⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        100⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 408
        101⤵
        Program crash
        
        PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5448 -ip 5448
1⤵
PID:5516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ageolo32.exe

Path C:\Windows\SysWOW64\Ageolo32.exe
Size 205KB
SHA256 062d7deb8cedc7aea83474cd9937164fba76a5ee60ecd827bdcccb24e47e08bf
MD5 6b46114bb79d3f17bb1b98c50dc550c7
SHA1 1a5bdf61473468d23e394f5309001c8954f2e588
SHA512 76e8fec25b6497231c049569d83e727e9b554fca72e6e7e029f67045eb6e7e1ff690b6f6a7de28d3a659cd40901a33901ca7ae1ac7fbcbb527cd4e6bd578644c
SSDEEP 6144:4p0bip2feGyZ6YugQdjGG1wsKm6eBgdQbj:4pwjmGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajanck32.exe

Path C:\Windows\SysWOW64\Ajanck32.exe
Size 205KB
SHA256 e4ffc529b6f80d29d24a074215b57bb564961c15c7f1ca4c6c0cd9685510828e
MD5 d84f624b5ffd240a7f102cfd673722e7
SHA1 07ac66e43afe854efc1e1745b6b7679711f19b72
SHA512 3b55640a8cb24e4078b2b924854a44d1b105857593dcf85df1652369378d667a639fae999cfe8e9511aa0aaade37f91b5cc2b1ceef6946182e795d6531fd1d0d
SSDEEP 6144:vZgLezRSbVuLGyZ6YugQdjGG1wsKm6eBgdQbj:Bq6u8GyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ambgef32.exe

Path C:\Windows\SysWOW64\Ambgef32.exe
Size 205KB
SHA256 e46955a1678bbe2553f04d74288287891b062b1fd4c297da996f4537b4a181ba
MD5 5620554145939e05a9c5cb0959dab1a3
SHA1 89d5c7d8ae8147682abe248af328c68412bd690f
SHA512 c99d83920402c85c85209d6473c4e192e7e8fa2a3fedf90689c297416bcd6e5e2f980b0da83efac66574af1703afa477109d1c4afce53c10aa2b3ef0f90b0c59
SSDEEP 6144:0jGfbatEXLrvGyZ6YugQdjGG1wsKm6eBgdQbj:0aTatEXGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ampkof32.exe

Path C:\Windows\SysWOW64\Ampkof32.exe
Size 205KB
SHA256 665972f9a00339a900855b0a52ac6ab8c7336823ee3706c5b22e4ee7c37af64a
MD5 681626c338e6a5e422264d1f360b3435
SHA1 78482b60273ca04b21a1a62450838a4c0657fc93
SHA512 1a802222a3799819f7c089c357918ce2bacac78512305fdba28b0d4508ed4a4ffc1ef8e68cac723332b36d1e82840cd0f630f3ac9fda8d090e0ba5bd538c739e
SSDEEP 3072:X2++17NuQjIeAGBxzGYJpD9r8XxrYnQg4sIgQxzjGG1wsKmpQeBgdQbj:XqBWqRGyZ6YugQdjGG1wsKm6eBgdQbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bcebhoii.exe

Path C:\Windows\SysWOW64\Bcebhoii.exe
Size 205KB
SHA256 e15d496cdf436df1f6bf9e6fd4aebac0ec3f438cb61149d9c2bb912e96067ce8
MD5 252b6718be463f562a424bfd3792645d
SHA1 b346a186ee084551bb9ec3dcc1f0949cab693926
SHA512 21756d25523111ec2085333d34653ed5e2695d342619d8b29b0c9f260b1a7c0776e013a0b729eb5f78e555fd166f2d9abdeaa08d77d5349350c63fd9f4cfe9e6
SSDEEP 6144:cSVJOouJGyZ6YugQdjGG1wsKm6eBgdQbj:NQnGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Caebma32.exe

Path C:\Windows\SysWOW64\Caebma32.exe
Size 205KB
SHA256 cd32bda18a141388cddaf49c1611a9a94547bd9c2bba5880f294bba65291b425
MD5 64b69c425d312fd52844d21c40de3ec0
SHA1 7aea8f8354558192e68a8d3c1deab3256e34731d
SHA512 010aa4b0b2f3f911e608b4a97a70ff55af92cda727f508c1f6cac6d0992adc786a09e88fe34cbc90efd889a52ad3843c605fa68bb9577c665db2d349828ba287
SSDEEP 6144:YB6bWB4hIZWDP3SynGyZ6YugQdjGG1wsKm6eBgdQbj:7bByQTSUGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chcddk32.exe

Path C:\Windows\SysWOW64\Chcddk32.exe
Size 205KB
SHA256 ccaf482b36901d72160ba0fb71729caf0c8828c843320569474f4d2bd65eeb91
MD5 640129785d3f322ac17b0aa850e1f391
SHA1 58d963d47e98bd6f78a001e9c5cbee7a2097b945
SHA512 114722c3075fcd62664cc909a5c00b5feb61315d70438cfdf8711f278fdba59c97b3b024713bddc330ca00fb774521f1bfb626416ea5541cc13ce3dce6589b3e
SSDEEP 6144:tDTGoVRx6tOOGyZ6YugQdjGG1wsKm6eBgdQbj:pGoBOGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjmgfgdf.exe

Path C:\Windows\SysWOW64\Cjmgfgdf.exe
Size 205KB
SHA256 3f296114ae22996ea3d8cea7f10788d135335c50fb3ce2718d838b35ba24209d
MD5 da68e290f6649cf612bbf7246ae81210
SHA1 fede9a68915ba2c627ab03d7368919d41dec9d1a
SHA512 14b86a922f039342d3c71d312394b850eaca941b2fa95df84df498418044a1a262993d803f8ff07f3ac3dde4e2e5e14fdc8597d896b01a64f6874cc1075ec5e5
SSDEEP 6144:a/w4OaEPOGyZ6YugQdjGG1wsKm6eBgdQbj:a/w4ztGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daekdooc.exe

Path C:\Windows\SysWOW64\Daekdooc.exe
Size 205KB
SHA256 e5242969beba6b17dc93a6e10faaca97b51d98670a0e98dcb6f165dcafb479dd
MD5 02542efcb17b6432bd632c3dd8c113d5
SHA1 947ee5e516b36a242981eeb650e0c2dd9b986ca7
SHA512 ae241351f97d359b9a4fe2118d815f296819c63ac624065607237e7a0134145cacdbbfe9b4a253f7a36740aec669666050093fe032a0fcc8307070939de42bb4
SSDEEP 6144:5cMmCgg+dfDGyZ6YugQdjGG1wsKm6eBgdQbj:5uCggELGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deokon32.exe

Path C:\Windows\SysWOW64\Deokon32.exe
Size 205KB
SHA256 10337c423c9d6fb7b363e0c214818debba5f06fdb490860f685500d903dc9dc6
MD5 c26e9ec8eea733535fffb22171db0404
SHA1 8a240e61e1d05bc2cfac168124051288d5ddae35
SHA512 7174566245388b6a8cae592a4dc2f2d1feee3360219e479e086ee5477ec1dccb543f71f6304a7331dd535b4616c60f77cb609c68ee2b250d1cf89795e417aec8
SSDEEP 6144:vOjlaZdxHNnHGyZ6YugQdjGG1wsKm6eBgdQbj:v80GyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcdmai32.dll

Path C:\Windows\SysWOW64\Gcdmai32.dll
Size 7KB
SHA256 fa093e65445a46520fef9fc74654588044b89b72a3e82ae6df0e7a779cd5660b
MD5 e9a90f88bdf6884ab0a80ebed28f188b
SHA1 2e66609ee32f2f396fce557afe06727b978cda6c
SHA512 707315674a47b92be4039a71251605e792b60645dca372ed139a7ec27c333827aaab717380319bfc9bb05515ab224f9e0d7f6f33eddbaa06ab2aba1ff2ea2cde
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWhzCbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPUFq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocdqjceo.exe

Path C:\Windows\SysWOW64\Ocdqjceo.exe
Size 205KB
SHA256 4499e0235ab2783d42c2a6d0b186f4dc9c25585b006ab950969eaa620032d543
MD5 5a488862bfa01cfe65d2802610dd4be2
SHA1 d6cd221bd6fe81d7d2392196e9de2b0cdc5aabac
SHA512 353fb68cca9ef88fda9428dea0f3fc3a9ad87dbc1419bf10379723764dbb247f56fc3722ae4f9a44d7c5093e9e6eb7300443d70d33db8a2efcefbff43245d4de
SSDEEP 6144:Cd2MDKYKoGyZ6YugQdjGG1wsKm6eBgdQbj:CIM+YrGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocgmpccl.exe

Path C:\Windows\SysWOW64\Ocgmpccl.exe
Size 205KB
SHA256 a22a6d605e22935e08ba9fa4ec66918d297a5779a9c72a47553c0ed724137986
MD5 f86ae94e76a9925fe65e88b7a11033f4
SHA1 9512ba257e8075252929b324dd2cd927ce73cf2e
SHA512 6fe144693df52224edc2ff5cd421fe72f52924f3a6f7c63e72f0f9cfd4fbda37beaf87bc2c79465a2471f019eda1a472930bb1a47be4547346dbf9f8a9a4e7bd
SSDEEP 6144:BgHPfO5DGZkoW5U3GyZ6YugQdjGG1wsKm6eBgdQbj:B8O54kGGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Odapnf32.exe

Path C:\Windows\SysWOW64\Odapnf32.exe
Size 205KB
SHA256 db49bc67e1500de80260f8a8d2a005ced807f2930b856a1f0a162ba62a445b59
MD5 c4cd620b9e3cfaaf1bfe67d07fad3107
SHA1 9ade74b29cd2f13d14950f46f6e5644b07c576c5
SHA512 0d3120ed2a666a8849c46187e17ab0ae404c348d9960549b1566f754c88817e31442717452936b127c839c7cefbc5f554fc06f54d21f54aed6c8dbefe5b0c3cb
SSDEEP 6144:Lx1MYwVwroGyZ6YugQdjGG1wsKm6eBgdQbj:LoYwVw0GyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ofcmfodb.exe

Path C:\Windows\SysWOW64\Ofcmfodb.exe
Size 205KB
SHA256 aba86f241f5747d86dd6fdd4db4e2cb30a3ce07cd933af55659724ec83c7c13b
MD5 d488ecb60b8546689c79ce2cd170a36b
SHA1 f2ff0949ca95a3ab13aa1aa0d2053408c82ca5b3
SHA512 e3c4bf3520e0a8cfa54a6aca18cc62c3792fe956cbba58a534c2115f6e4fbe80f575a548ec76d849e531219a20feb8309589eed847b0d1ff97b2f2a0ec6ff825
SSDEEP 6144:Wcmd80QFtR2GyZ6YugQdjGG1wsKm6eBgdQbj:WTq0QFtoGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ofqpqo32.exe

Path C:\Windows\SysWOW64\Ofqpqo32.exe
Size 205KB
SHA256 7a77b4badaab6f58653251464003585a39de3acf29cd518b2e93335259b0f32b
MD5 7e2a72c32101d35e9258484c20fc0d23
SHA1 94ca52c332e8b0b2e3088a8ef2e0408c3d310571
SHA512 c546d260195a83c7150259c04a92c0197a34d5fac8fc1227fc5bab47be6f37b1f11084ded58c2f337462df2dc859178fc2a6b06b41e11562d8c54c37332c25ee
SSDEEP 6144:35EHbhDqR1RRGyZ6YugQdjGG1wsKm6eBgdQbj:35EHlD61jGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojoign32.exe

Path C:\Windows\SysWOW64\Ojoign32.exe
Size 205KB
SHA256 50a6f356c87eb393e44d0fed50990372780224f0c37c45c732ff25b8b625901a
MD5 4f3c40849fa2865057bb8e7a519850bc
SHA1 543d09bd5e9996262c6b9b05c38970fdcea473f8
SHA512 df25a15d6824e52180e27e87e145d5e21e1af1e884516ac8cde888c8b7373bec50c2dd13885a2c569aa13aaffa35ef279332571c03cdf2223d38ce98be6c4d87
SSDEEP 3072:4DifENMzGYJpD9r8XxrYnQg4sIgQxzjGG1wsKmpQeBgdQbj:4GfENeGyZ6YugQdjGG1wsKm6eBgdQbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oqfdnhfk.exe

Path C:\Windows\SysWOW64\Oqfdnhfk.exe
Size 205KB
SHA256 ca91b42ab0262afd47de2a0bda5eeb15d0ded64f05be2c4c4f90107a8884b236
MD5 dd7164b00913c3020f980cfb74ed221f
SHA1 79be61d8b142e9023189be3bdddf1739c07e4df5
SHA512 09b96e930124c5743d5a31f61b68a804cb9130b97243812aabf64a5a8374c26fe5132da4fd452dece1d8cbd1261443a6e101ac9fc2b66bfd29a352b446ea2719
SSDEEP 3072:8JnhapurDC4DbGVODpczGYJpD9r8XxrYnQg4sIgQxzjGG1wsKmpQeBgdQbj:ukPyhuGyZ6YugQdjGG1wsKm6eBgdQbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pclgkb32.exe

Path C:\Windows\SysWOW64\Pclgkb32.exe
Size 205KB
SHA256 686b41de1fa69e4da963961da55d251191aabf09b74a7a3f9785bd2fdf0f21fe
MD5 89b321b7ed9dec4c3063f9d694627c42
SHA1 54d906ba2bcb386e74fafb46e10c64eb98da957f
SHA512 2b3f089e4e6b26bcd4e57aedbaf0960034af194c06b653a6bc8d9b068591f2a22b0dfa4f16dbbc3ddf210df85729d42d1496e5be538311a2a5d1737c4a8c3e9f
SSDEEP 6144:h5fc8mnqPC4h3wj7+bGyZ6YugQdjGG1wsKm6eBgdQbj:hBO4z3wj74GyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pcncpbmd.exe

Path C:\Windows\SysWOW64\Pcncpbmd.exe
Size 205KB
SHA256 db026ffc70c825d4b17e277ee78e8799537b41b9ede0edd9949e65953f339a5a
MD5 eb33f8beb4f2a2d82cf6bbb06daf5e4c
SHA1 e6df032ca5e899f01870ad0957e891d6361c7612
SHA512 269e65ceca700839c152585130dafd04a218add380d5964e6f0d6f85f5cd1d13d58d09b642351f00b2bf54f6ce3ac1676e6857374dc806f1623853ca81c0e68c
SSDEEP 6144:MLSZJmJDaZnoAvBYGyZ6YugQdjGG1wsKm6eBgdQbj:MLDJDaZnpCGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdfjifjo.exe

Path C:\Windows\SysWOW64\Pdfjifjo.exe
Size 205KB
SHA256 74d02a1a6cc22dd9b055bfe7197fd01f70e416dcbd2d1744dc2eb7a638a8b0c7
MD5 bae68774b4ecc1fdc2ed3ef73dec9d58
SHA1 bdb2cbe734dd8c583d64bfe789e9e70e40247f7c
SHA512 8b40c59c240ae83907fdedac0b69a2ccc719e34ac88ff3ee02b57b7adca024914d0ab120eb610f27efb9cac8965ebe8f833eca6e098ec12ce3c0b1121bec8f97
SSDEEP 6144:B4ESoLp+YTC3GyZ6YugQdjGG1wsKm6eBgdQbj:BDS3YMGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdmpje32.exe

Path C:\Windows\SysWOW64\Pdmpje32.exe
Size 205KB
SHA256 ddaa15932d0733da70648ec963a9e194e398f57844717a591e04a1af53a52fae
MD5 861d691b61875f1b210cbb9dfe78bf79
SHA1 679baa9049b6950ae8bbf63bdd257d0743ed06e1
SHA512 ee3616b77b34f7cb4c21895f83e5d8ef107f4dcc3514fbec734b0fd8379904060a15f45b0ff1473eb3017f6b99653b04fbd8873703720ceeba4e0ea145f97281
SSDEEP 6144:IZDJGSUJ6gpGyZ6YugQdjGG1wsKm6eBgdQbj:AUGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfaigm32.exe

Path C:\Windows\SysWOW64\Pfaigm32.exe
Size 205KB
SHA256 b4248e640e7bde17ee9bf04258daf1bd4be7a9eafc70b9f4de462b306e4f847e
MD5 e9f01b24d187544504d040c84d704f1f
SHA1 8d76482745d8282aeac1a8c05363bc44adc20462
SHA512 897683e706ed395e01409504c00f58f77b06066fa5488337bc5405fc17ee8f40a9b31f0cccf3599a4216d531b7e5c16b1f1e6e59140b4673b6424b8471270828
SSDEEP 6144:Lzx4TxRKzf29pGyZ6YugQdjGG1wsKm6eBgdQbj:Lzrf2bGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfhfan32.exe

Path C:\Windows\SysWOW64\Pfhfan32.exe
Size 205KB
SHA256 181ed8f8e47dc4bdefa4bfc14334b59c84e98004e7da9f5e6a545a440e65d00b
MD5 a4ef90230a06d8b94d24b1574fc9e8b6
SHA1 1af5275fe8da79d2cd3a8fb09af41b705d332e0d
SHA512 51985053cb3e88e7aaaa08ff57b1baf5c5dab8047923fecdaa2c58b3056d49a3a6c48cbecfb0e2bef353243ea4ef7be2495a14be3095a93b105e731dc699bef8
SSDEEP 3072:FcXoSfENGNHRdfZm9BzGYJpD9r8XxrYnQg4sIgQxzjGG1wsKmpQeBgdQbj:SjfdfchGyZ6YugQdjGG1wsKm6eBgdQbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pflplnlg.exe

Path C:\Windows\SysWOW64\Pflplnlg.exe
Size 205KB
SHA256 f044c0e6d6830588a83967177ee16ab6ff17781287c7bc36444ce2d4d63b923f
MD5 7c04374b9dee3ab1995b28bb6f159b3e
SHA1 e0866fea6e7992a1112adba010984bcafd57183b
SHA512 cab67c9ebbd26e010cc8467f85f80161bb8a52d46832d36472b7c9dc5ee4eaee04606d283a20c5d66b86b44a470ce2b73247156ff53b7f3df180e1170adea7e9
SSDEEP 6144:SGVQtHuLG7S/77CGyZ6YugQdjGG1wsKm6eBgdQbj:3VQFSG7FGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjeoglgc.exe

Path C:\Windows\SysWOW64\Pjeoglgc.exe
Size 205KB
SHA256 f6d076876d738db38fef3cf2ecd799fd42c66bc1129d3d96926bcb91f4ddbcf1
MD5 886b9caf2fdab4af7b9a9655b4a3b5a0
SHA1 28037c459611888f2490276006d0872d9f900dc8
SHA512 8503b3da12a67ba77fbafda4e04aee47bc815da9f9026041729307321266e2d548214b3182a0786b4f728f66aea4ce029e4859a6e42361e34b3fa564d0c1ae1f
SSDEEP 6144:meTWUD6cPPleMyl11lKfa/AzfsPGyZ6YugQdjGG1wsKm6eBgdQbj:mXU13le5IiGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjjhbl32.exe

Path C:\Windows\SysWOW64\Pjjhbl32.exe
Size 205KB
SHA256 282aa56122b23e07b9fbe8aabfc83804789d0a92b3c8331d07b00a6ad8ef9bbb
MD5 c7445fe679fb4036b803c2c2134df4f6
SHA1 676112addb6b861f85afd8a64d042c43cd97036c
SHA512 ae8cc1fa01a538abb1c291bbf2d63bc7bbdff5f970c183f13b2ab29dbddfdeb6643f6bab93ffae74fd75d3c8ee9e515effe989261bb02ad942bf943fcc0539e8
SSDEEP 6144:bChzTAI8cKGyZ6YugQdjGG1wsKm6eBgdQbj:bChzkI8nGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmdkch32.exe

Path C:\Windows\SysWOW64\Pmdkch32.exe
Size 205KB
SHA256 af369ee6166ec65525e8c32922713b315e37f37bc6f09cdcf1807a856e0939cd
MD5 1d2f5c9291f7b5533a5350a66b970e27
SHA1 138551eb905804fd150de8991bf33b4913c5b816
SHA512 cae630e5391bbb5e462e46f384bf20cd8179c99673a325c4d89986847c00309287c7a9fb5bfa89914c3103c11befbd508bdfa55fffe472f694b8544ce3a12884
SSDEEP 6144:rtFjMgr2yHwAdaPcGbPGyZ6YugQdjGG1wsKm6eBgdQbj:fwgrp/cP7GyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmidog32.exe

Path C:\Windows\SysWOW64\Pmidog32.exe
Size 205KB
SHA256 95fe91c1447cb08d73c410a7d27c6474425a6db74015d540327cd0023946f946
MD5 23da257bb6c2fb0bb20895cf49470f7e
SHA1 7552886c604abc6031bba096055543aa62f31801
SHA512 a6b0d1bc37ac41f92aa2ef5d7c4df98fb2ed5999966a3d0013c61a38c760b4e39b86b708f6489298ff6085871c19c6f3ffdb524ee547d0efc7b76e7164120cab
SSDEEP 6144:l+VhBhPZgB9fGyZ6YugQdjGG1wsKm6eBgdQbj:l0hKGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pncgmkmj.exe

Path C:\Windows\SysWOW64\Pncgmkmj.exe
Size 205KB
SHA256 13862ac97801118c695caae206b1f614175e3cf1ca43ffaacca94ad652aa34af
MD5 bb7aa5381a8b3113dea5ae162047efd4
SHA1 c75f50cfd01f7e4d3e930bca4f776b92955559a5
SHA512 296ea2ccc50042ddac8a152930b3b54b5d59798070d4fa2a2ef88a0f5deaf2769e5c011c7e4c1c3ecd0f7f00ae31ca472738db0e79158d26318b7eae21b8485f
SSDEEP 6144:ejb2xc1vWrGyZ6YugQdjGG1wsKm6eBgdQbj:4b2W1oGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnfdcjkg.exe

Path C:\Windows\SysWOW64\Pnfdcjkg.exe
Size 205KB
SHA256 957e87ae2a32dd716433238a6d9facbb1cb30494f5cb18ec8163796eb095c345
MD5 bfd08902f56906f431a6cc5a2a8848c0
SHA1 d31bb3f5cf7488938f4186f526c9ef81f749f461
SHA512 f5a91b3804a2c4189bb84de27e9239204bf337ee0118339f4b1f530673cd3c924d2f44cdd4d55f1cf0a888732fc7d85e235263e16b7b8cefce13b7aaf3daaf63
SSDEEP 6144:H3kXE7ICGyZ6YugQdjGG1wsKm6eBgdQbj:H3kOXGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnlaml32.exe

Path C:\Windows\SysWOW64\Pnlaml32.exe
Size 205KB
SHA256 22fe33e00b3fc02bb306453b0cf7bd032ba225e4dfb4523790510b64884c18d3
MD5 06e352f43f5aad6e6daeb1c78d972130
SHA1 5ee4663c9b165c5703db1ad97637daadcf0a366a
SHA512 ab8e894eea6cdc082c9cf02274fc8bb7e3961ce12753f90c0de5f781cd847e6db69eacd891fb4e487cf3226549d7c050b6b24abc82390c35ba3bfc2e7b435252
SSDEEP 6144:ih4bIc4vZkptk1NuBa7aBGyZ6YugQdjGG1wsKm6eBgdQbj:o4bIcLptk7ka72GyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pqmjog32.exe

Path C:\Windows\SysWOW64\Pqmjog32.exe
Size 205KB
SHA256 6ca49593bc9158ccde39c62f2b753bbc7f503dbd5632753c8e16a1bc0eb2f01e
MD5 3f2c9b9b38adb38fdcf9551bf94df695
SHA1 15af9ff3ff9243f0ef34a3ad243cc79882d54e6d
SHA512 8f9ec2fc7499d65c67a4819068b7ccdf4cca087b483113ebd250046c5bf6c5cf77fcd097f47307cc092b77069de65711d767049d845ca9decb86202ad74532e5
SSDEEP 6144:57TJuNvjofGyZ6YugQdjGG1wsKm6eBgdQbj:57tu8GyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qcgffqei.exe

Path C:\Windows\SysWOW64\Qcgffqei.exe
Size 205KB
SHA256 84cd70904569c0b986744052d93b4a2f7b3c44963e98a5af9975f05127bbecf4
MD5 3693edea7cb49176fdd6e5025e25789d
SHA1 65e2a2d1a9d62310fb944571828cbbfcbc9efdbd
SHA512 305a0d7774b8caa195ff3d4b60953911a54025a870279dc3918b4f3081a8b52322691ab176d75b1a62555ba16a98ae2f430f00da48cd942bbc71fc3cca3e4734
SSDEEP 6144:232naUxtOYb8+GyZ6YugQdjGG1wsKm6eBgdQbj:a+EYbTGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qdbiedpa.exe

Path C:\Windows\SysWOW64\Qdbiedpa.exe
Size 205KB
SHA256 0168ff1e944607826936cab8067acf04e7e0c27c78e4e2cbb042c1c905db024f
MD5 b4c060a190603526ff1975bb3bb4b98e
SHA1 85d8e1cdef235b0fbc33ff72d279134cd17d6748
SHA512 8a0e890bf42a75a8d882ecc14fafd0238d0028dd867e643eb665b5cf7e2b1b5a12ba4995cca98983dc796e9715b9a81d6eb6ec415a06d09624330ecc3d926f34
SSDEEP 6144:/L3fp5mNNZr4pdGyZ6YugQdjGG1wsKm6eBgdQbj:/LPjmR4GyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qgqeappe.exe

Path C:\Windows\SysWOW64\Qgqeappe.exe
Size 205KB
SHA256 69371f4a8aa48c27ecac76e33e3fea3da0c16f9348c45f3c1473c886404d3bb8
MD5 cfdf4ddb7cfe138defd3a4c9a614d00f
SHA1 a510b4e07fc219d3adc27aec6c0cc9e641340b45
SHA512 13ccd9b860ffd74add3ad6f3bd93430694e8e44f07e6d5b3038bd9b7dc2d5b02b36388af562e5a7b1f5be6ad84e1b72a36f719155b6c0b107edb8301261dbace
SSDEEP 6144:/4hgzTsggiGyZ6YugQdjGG1wsKm6eBgdQbj:/Rzog7GyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qmmnjfnl.exe

Path C:\Windows\SysWOW64\Qmmnjfnl.exe
Size 205KB
SHA256 101c56c38301c7cfeda44f271c341d3b1c5333a9cac63d0291179fd7314849c9
MD5 12590f9042b3dcada8bd1cfa5eaa4d64
SHA1 330d9e87c788fdc8844bbab41b93291690722b27
SHA512 a7cdc1da21dee9cd7d4c71e0e625dca698c940751304548f8ba357e13d0305d974fcfe1cb233ebf481579bde095dc735906d489227d2daaedb80c8ec3e8a93df
SSDEEP 3072:tDm3csSy8zn9497mzGYJpD9r8XxrYnQg4sIgQxzjGG1wsKmpQeBgdQbj:tDBfJ8kGyZ6YugQdjGG1wsKm6eBgdQbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qnhahj32.exe

Path C:\Windows\SysWOW64\Qnhahj32.exe
Size 205KB
SHA256 712cdcd2194cd158451197ad3a1792cf2706eb4136c19e3b14b1bc3128c804a2
MD5 cb64a0b834ae32793beafaf9cf7418d0
SHA1 c222387eef33ae82857dea6db29d13ab403515fc
SHA512 01ca2265d36fa0fbc7c53b2798ad314260f0d6a0f4e98805dc7a205742b63816aa3efc8bb9de65b1cc36be1b69cbde879054467a365358cd989500d0c7db56bf
SSDEEP 6144:cGsPEBPfZHJGyZ6YugQdjGG1wsKm6eBgdQbj:qYPfZpGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qnjnnj32.exe

Path C:\Windows\SysWOW64\Qnjnnj32.exe
Size 205KB
SHA256 8418e10e9319581710f6422fd09341f944d193f3b83ca917adb3264fe6296283
MD5 b129623710d83e59fe1b0b2150cd32dc
SHA1 131b1a8ba232a7d16dca3d961be147f91c6e5d32
SHA512 f3bdb84cd143bff99c3aaee74af015afb545562a6952ec7c0964b957c2d3ffe093ac78975e7f30b26f8f7b57ca3445a47031aa3fec0e47d5d0c06a124174a138
SSDEEP 6144:zsLBZ8OO5eTGyZ6YugQdjGG1wsKm6eBgdQbj:gQvQGyXu1jGG1wsGeBg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/344-592-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/364-364-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/380-298-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/548-551-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/548-7-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/632-135-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/660-340-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/724-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/820-598-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/820-63-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-191-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/920-96-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/952-103-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/960-231-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/984-127-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/996-718-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/996-532-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1084-200-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1100-585-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1200-88-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-322-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1256-224-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1324-545-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1344-394-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1360-400-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1452-304-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-418-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1496-502-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1500-370-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1516-216-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1592-328-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1776-346-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1800-484-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1916-111-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2028-406-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2068-412-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2200-496-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2264-454-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2284-79-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2560-376-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2640-538-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2776-55-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2776-591-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2788-262-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2800-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2800-544-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2876-514-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2920-159-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2956-155-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3136-239-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3144-571-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3152-478-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3196-248-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3268-430-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3420-260-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3440-286-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3452-268-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3484-559-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3528-388-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3536-352-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3588-292-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3604-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3604-558-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3688-280-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3748-167-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3792-207-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3816-334-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4044-278-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4064-316-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4088-460-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4104-48-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4104-584-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4136-382-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4172-358-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4220-310-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4268-71-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4304-119-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4344-583-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4424-466-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4472-582-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4472-42-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4484-175-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4520-552-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4532-565-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4724-599-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-520-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4756-526-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-436-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4872-442-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4876-472-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4892-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4916-490-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4948-508-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5012-143-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5040-448-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5052-424-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5112-184-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5316-684-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads