berbew | a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6N.exe
Size 91KB
Sample241113-xhqcssxflk
SHA256 a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6
MD5 f219b9e1a43772f070c211c73f54cd30
SHA1 5e6f18741d730c7b0c3b49dfafa7f0fab929b528
SHA512 9caece243347a0fa2e7c811d9d66cade42d2d3fed239afde922a1c8518834e5099fb6175a1ecbb4daa1f6cf19e95804559b8a49bd6366791dbb075fdc784b2c0
SSDEEP 1536:D/me2Pm/qjKshgX0yf/k0RuCPvnOgGlYqMbxAkd73SeVXwYYr/viVMi:D/me2Pm/qWshgESM0dPvO7MbDdtjo/vu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njefqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfjcgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oneklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2648	Menjdbgj.exe
2924	Mnebeogl.exe
1092	Ndokbi32.exe
3088	Nepgjaeg.exe
4796	Nljofl32.exe
4208	Ncdgcf32.exe
2244	Njnpppkn.exe
1568	Nnjlpo32.exe
1580	Nphhmj32.exe
4560	Neeqea32.exe
1312	Nloiakho.exe
4460	Ncianepl.exe
4568	Nfgmjqop.exe
716	Nlaegk32.exe
2828	Nckndeni.exe
3508	Njefqo32.exe
4348	Nnqbanmo.exe
3080	Ocnjidkf.exe
2716	Oflgep32.exe
1184	Oncofm32.exe
5000	Odmgcgbi.exe
2240	Oneklm32.exe
3128	Ognpebpj.exe
1952	Onhhamgg.exe
3404	Odapnf32.exe
2820	Ocdqjceo.exe
1032	Ofcmfodb.exe
1492	Ojoign32.exe
4412	Olmeci32.exe
2972	Ocgmpccl.exe
3280	Ojaelm32.exe
2272	Pmoahijl.exe
836	Pdfjifjo.exe
1016	Pgefeajb.exe
1628	Pjcbbmif.exe
2724	Pmannhhj.exe
4256	Pdifoehl.exe
1268	Pfjcgn32.exe
4160	Pjeoglgc.exe
2612	Pmdkch32.exe
700	Pdkcde32.exe
1660	Pflplnlg.exe
3344	Pmfhig32.exe
1200	Pqbdjfln.exe
1160	Pcppfaka.exe
3972	Pfolbmje.exe
2860	Pmidog32.exe
2836	Pdpmpdbd.exe
3476	Pgnilpah.exe
640	Pjmehkqk.exe
4436	Qmkadgpo.exe
4504	Qdbiedpa.exe
1980	Qgqeappe.exe
5020	Qjoankoi.exe
4804	Qmmnjfnl.exe
4596	Qddfkd32.exe
4764	Qgcbgo32.exe
3248	Adgbpc32.exe
1504	Afhohlbj.exe
4492	Ajckij32.exe
1756	Aclpap32.exe
4956	Ajfhnjhq.exe
4864	Amddjegd.exe
2692	Agjhgngj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Akichh32.dll	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Ncdgcf32.exe	Nljofl32.exe
File created	C:\Windows\SysWOW64\Ocdqjceo.exe	Odapnf32.exe
File opened for modification	C:\Windows\SysWOW64\Pmoahijl.exe	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Echegpbb.dll	Afmhck32.exe
File created	C:\Windows\SysWOW64\Qgqeappe.exe	Qdbiedpa.exe
File opened for modification	C:\Windows\SysWOW64\Ceckcp32.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Bfabnjjp.exe	Aadifclh.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cndikf32.exe
File created	C:\Windows\SysWOW64\Nepgjaeg.exe	Ndokbi32.exe
File created	C:\Windows\SysWOW64\Ejfenk32.dll	Pdfjifjo.exe
File created	C:\Windows\SysWOW64\Pfjcgn32.exe	Pdifoehl.exe
File created	C:\Windows\SysWOW64\Dbagnedl.dll	Pmfhig32.exe
File opened for modification	C:\Windows\SysWOW64\Cenahpha.exe	Cabfga32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Ceehho32.exe
File created	C:\Windows\SysWOW64\Mnebeogl.exe	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Nloiakho.exe	Neeqea32.exe
File created	C:\Windows\SysWOW64\Ekphijkm.dll	Pdifoehl.exe
File created	C:\Windows\SysWOW64\Bganhm32.exe	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Onhhamgg.exe
File opened for modification	C:\Windows\SysWOW64\Qgqeappe.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Jpcmfk32.dll	Pmidog32.exe
File opened for modification	C:\Windows\SysWOW64\Qmkadgpo.exe	Pjmehkqk.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Beglgani.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Pemfincl.dll	Nnjlpo32.exe
File created	C:\Windows\SysWOW64\Hlfofiig.dll	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Ognpebpj.exe	Oneklm32.exe
File opened for modification	C:\Windows\SysWOW64\Pmidog32.exe	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Pfolbmje.exe	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Njnpppkn.exe	Ncdgcf32.exe
File created	C:\Windows\SysWOW64\Odmgcgbi.exe	Oncofm32.exe
File opened for modification	C:\Windows\SysWOW64\Ofcmfodb.exe	Ocdqjceo.exe
File opened for modification	C:\Windows\SysWOW64\Pfjcgn32.exe	Pdifoehl.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Nljofl32.exe	Nepgjaeg.exe
File created	C:\Windows\SysWOW64\Bjmjdbam.dll	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Nphhmj32.exe	Nnjlpo32.exe
File created	C:\Windows\SysWOW64\Adgbpc32.exe	Qgcbgo32.exe
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Bmkjkd32.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Mbpfgbfp.dll	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Ooojbbid.dll	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Bebblb32.exe	Bmkjkd32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5640	5348	WerFault.exe	209

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkcde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nckndeni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmannhhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoahijl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcbbmif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepgjaeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdifoehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbdjfln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgcgbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmkadgpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfjcgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nloiakho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnebeogl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnqbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmidog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnpppkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnjlpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojaelm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpbkoql.dll"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgaoidec.dll"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nckndeni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladjgikj.dll"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beapme32.dll"	Oneklm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lemphdgj.dll"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpllc32.dll"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjpabk32.dll"	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilkmnni.dll"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjgghdi.dll"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laqpgflj.dll"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffcnippo.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncianepl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojoign32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdjlic32.dll"	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blfiei32.dll"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdkcde32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2648	3684	a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6N.exe	83
PID 3684 wrote to memory of 2648	3684	a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6N.exe	83
PID 3684 wrote to memory of 2648	3684	a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6N.exe	83
PID 2648 wrote to memory of 2924	2648	Menjdbgj.exe	84
PID 2648 wrote to memory of 2924	2648	Menjdbgj.exe	84
PID 2648 wrote to memory of 2924	2648	Menjdbgj.exe	84
PID 2924 wrote to memory of 1092	2924	Mnebeogl.exe	85
PID 2924 wrote to memory of 1092	2924	Mnebeogl.exe	85
PID 2924 wrote to memory of 1092	2924	Mnebeogl.exe	85
PID 1092 wrote to memory of 3088	1092	Ndokbi32.exe	86
PID 1092 wrote to memory of 3088	1092	Ndokbi32.exe	86
PID 1092 wrote to memory of 3088	1092	Ndokbi32.exe	86
PID 3088 wrote to memory of 4796	3088	Nepgjaeg.exe	87
PID 3088 wrote to memory of 4796	3088	Nepgjaeg.exe	87
PID 3088 wrote to memory of 4796	3088	Nepgjaeg.exe	87
PID 4796 wrote to memory of 4208	4796	Nljofl32.exe	88
PID 4796 wrote to memory of 4208	4796	Nljofl32.exe	88
PID 4796 wrote to memory of 4208	4796	Nljofl32.exe	88
PID 4208 wrote to memory of 2244	4208	Ncdgcf32.exe	90
PID 4208 wrote to memory of 2244	4208	Ncdgcf32.exe	90
PID 4208 wrote to memory of 2244	4208	Ncdgcf32.exe	90
PID 2244 wrote to memory of 1568	2244	Njnpppkn.exe	91
PID 2244 wrote to memory of 1568	2244	Njnpppkn.exe	91
PID 2244 wrote to memory of 1568	2244	Njnpppkn.exe	91
PID 1568 wrote to memory of 1580	1568	Nnjlpo32.exe	92
PID 1568 wrote to memory of 1580	1568	Nnjlpo32.exe	92
PID 1568 wrote to memory of 1580	1568	Nnjlpo32.exe	92
PID 1580 wrote to memory of 4560	1580	Nphhmj32.exe	94
PID 1580 wrote to memory of 4560	1580	Nphhmj32.exe	94
PID 1580 wrote to memory of 4560	1580	Nphhmj32.exe	94
PID 4560 wrote to memory of 1312	4560	Neeqea32.exe	95
PID 4560 wrote to memory of 1312	4560	Neeqea32.exe	95
PID 4560 wrote to memory of 1312	4560	Neeqea32.exe	95
PID 1312 wrote to memory of 4460	1312	Nloiakho.exe	96
PID 1312 wrote to memory of 4460	1312	Nloiakho.exe	96
PID 1312 wrote to memory of 4460	1312	Nloiakho.exe	96
PID 4460 wrote to memory of 4568	4460	Ncianepl.exe	97
PID 4460 wrote to memory of 4568	4460	Ncianepl.exe	97
PID 4460 wrote to memory of 4568	4460	Ncianepl.exe	97
PID 4568 wrote to memory of 716	4568	Nfgmjqop.exe	98
PID 4568 wrote to memory of 716	4568	Nfgmjqop.exe	98
PID 4568 wrote to memory of 716	4568	Nfgmjqop.exe	98
PID 716 wrote to memory of 2828	716	Nlaegk32.exe	100
PID 716 wrote to memory of 2828	716	Nlaegk32.exe	100
PID 716 wrote to memory of 2828	716	Nlaegk32.exe	100
PID 2828 wrote to memory of 3508	2828	Nckndeni.exe	101
PID 2828 wrote to memory of 3508	2828	Nckndeni.exe	101
PID 2828 wrote to memory of 3508	2828	Nckndeni.exe	101
PID 3508 wrote to memory of 4348	3508	Njefqo32.exe	102
PID 3508 wrote to memory of 4348	3508	Njefqo32.exe	102
PID 3508 wrote to memory of 4348	3508	Njefqo32.exe	102
PID 4348 wrote to memory of 3080	4348	Nnqbanmo.exe	103
PID 4348 wrote to memory of 3080	4348	Nnqbanmo.exe	103
PID 4348 wrote to memory of 3080	4348	Nnqbanmo.exe	103
PID 3080 wrote to memory of 2716	3080	Ocnjidkf.exe	104
PID 3080 wrote to memory of 2716	3080	Ocnjidkf.exe	104
PID 3080 wrote to memory of 2716	3080	Ocnjidkf.exe	104
PID 2716 wrote to memory of 1184	2716	Oflgep32.exe	105
PID 2716 wrote to memory of 1184	2716	Oflgep32.exe	105
PID 2716 wrote to memory of 1184	2716	Oflgep32.exe	105
PID 1184 wrote to memory of 5000	1184	Oncofm32.exe	106
PID 1184 wrote to memory of 5000	1184	Oncofm32.exe	106
PID 1184 wrote to memory of 5000	1184	Oncofm32.exe	106
PID 5000 wrote to memory of 2240	5000	Odmgcgbi.exe	107

C:\Users\Admin\AppData\Local\Temp\a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6N.exe
"C:\Users\Admin\AppData\Local\Temp\a120139626b28d4df35d2ba5fea129e91ab28a2e45d668c2deb10b24039231e6N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\Menjdbgj.exe
  C:\Windows\system32\Menjdbgj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\Mnebeogl.exe
    C:\Windows\system32\Mnebeogl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\Ndokbi32.exe
      C:\Windows\system32\Ndokbi32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3088
      - C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4208
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3404
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2820
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1032
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1492
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2272
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:836
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1016
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1628
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4160
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2612
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:700
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1200
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3972
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3476
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4436
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4764
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        59⤵
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1504
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        62⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4956
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        67⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4336
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        70⤵
        Drops file in System32 directory
        
        PID:2212
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        71⤵
        Drops file in System32 directory
        
        PID:1788
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:932
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:968
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        74⤵
        Drops file in System32 directory
        
        PID:4172
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:840
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2432
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        78⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1424
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        80⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        83⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:684
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1332
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        86⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4744
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        91⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        94⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        95⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        96⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5708
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5768
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        103⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        107⤵
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        108⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        113⤵
        Drops file in System32 directory
        
        PID:5632
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        115⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5984
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        121⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 220
        122⤵
        Program crash
        
        PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5348 -ip 5348
1⤵
PID:5584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Belebq32.exe

Path C:\Windows\SysWOW64\Belebq32.exe
Size 91KB
SHA256 56c3347b3a105abedbaab2c820c425b44ed49190b1f6c4437cbe6c223900667b
MD5 b119413763115bd37c3c0a30164825c9
SHA1 9d1818123d22e7eaee8aa294725ddd6fab8e5177
SHA512 3bb8e2dff12fcd3cad7d648d98ff505de607e34ab553265d666ee79ebec179aba29e30c77bd0f86fb8a84ec87c50032ddf84de3f69ddfd70064b663762e57fc4
SSDEEP 1536:kd7L68GZrlJ4AAt9BbwP0GFYkdUjkAC/kUTu3hduVXBYr/viVMi:kdn63Zf4AmrbKCCTT4haxo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chcddk32.exe

Path C:\Windows\SysWOW64\Chcddk32.exe
Size 91KB
SHA256 56d886e8742adfed9971915e235ed1fbc019e3bdd09836d4cd601c0795676ccc
MD5 92201624e723f933883bf41cd525595d
SHA1 da5d3af0bc99898da91b699791995eef9e29c17b
SHA512 fbd2a359bd4021335b2441b6e9d4324c40b738d167e4e3b01d91f5e24d5ce9227234e7e65ef41bd66af31782440cc1778f640176fe257fe8179cb4e0773f5bd9
SSDEEP 1536:pG9x7Mu49kQ8oC/cR3vjOEVXdYr/viVMi:pGXYBaZ/cR3vjJNo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chfgkj32.dll

Path C:\Windows\SysWOW64\Chfgkj32.dll
Size 7KB
SHA256 90ff97cfc602ed1935fd8a889080eb096171f594adbe234f9da89e0cc61b2a13
MD5 c9dee70de9334c2077b00e35a28fe568
SHA1 e13c4c24514d2b16a2dcdd8adb7ac3b4af1f8ce2
SHA512 58a368a54490d645a1d003982145c474fc2196909fe7e9d800a40e5f6aaab460c0ae8a2bd0de4034b33dc826e95d25affadb161e286d7ac329aacdad0aa77804
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWoLJbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPdOq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deagdn32.exe

Path C:\Windows\SysWOW64\Deagdn32.exe
Size 91KB
SHA256 77b039e780009cf9bb6ce336720269bd2efaaef8c18a0161dc76081c0e3a7de0
MD5 872172273d93964780d76d93a1807db7
SHA1 093cf8ea875eed46b79f2e2f60ff2069f374d7f5
SHA512 a3852ee5df9fdbff4ebacf187a9605ee3d332d69ba54067b42b88239d4f4f461a2dc14459808dbc0c3af21ee244a37e83c7953e6642949e33219292bb91a675c
SSDEEP 1536:DJIubrgyCYbfMvXteluG9v/2sivQDVUpRA7UuDV5MmOSRVXY6Yr/viVMi:Cu3gnY7yYYE/kIVUrA7UIBOS7Jo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfpgffpm.exe

Path C:\Windows\SysWOW64\Dfpgffpm.exe
Size 91KB
SHA256 87eaca6b08bf8e1f0f4017d244d948c656764cdb44df995dfae1506a4e7d8dc2
MD5 10bf02c91b9746af12903c18650ea2a2
SHA1 c9623335dbe686e64436805d61d487bd900cf03d
SHA512 391326a7d76a259837361d38fa07e97bbaa2fed1d942966819c79a5c2e2cf0170e4c2238ecec0593702a00d7a54bd23cc328d82e550ada42be349137fd7cdf75
SSDEEP 1536:5ErWBLG5iaQdj1U7lPDWwdZkQmvO9bY53e3w3esR+mVXAYr/viVMi:ureLH2PDWwdZkQmvb3e3zsAowo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Menjdbgj.exe

Path C:\Windows\SysWOW64\Menjdbgj.exe
Size 91KB
SHA256 9f49107822800a8b4234cfc1c8dd1478aefdfa7af174eabb0b02120e4978e2ea
MD5 1283e99ad94c9ad820b9ad15072dc759
SHA1 fa8c9f859c2a1050661021c5b8f1b5c81feb8ad7
SHA512 ffd93065e506e12dd907265f37f10966ded4c192161005648e3ebddc4c6d1b05d8c7149049c7589dbd3450c699f3a09b677f57399b9248947e2d093cb4d640cc
SSDEEP 1536:oOqMyQc+EH96LOC9UikWo2Gz8/FQhVXVlYr/viVMi:opMyXd6nOWo2Gw/Fwjo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnebeogl.exe

Path C:\Windows\SysWOW64\Mnebeogl.exe
Size 91KB
SHA256 26584dbbab7379be3bb8efc02a8476a392a23b9a8fbed3d8502c24225b9c92be
MD5 b49cb6663bb296b4730f52e2b42b9def
SHA1 3c291d7cf0a441ae505d72c0eed9ba2afa543076
SHA512 57936d0e4a5a6fa5bbbb740fadc83c86603bef0e09190f641fd9761878ae088f1a621159fdd5e2b639d274dd507b47fd89e30f096e430b928678f8df4c673caa
SSDEEP 1536:2D2uVNaM/hDH1VE103b+tC7e3Z60lEGttttttttttttttettttttpjttttttS23G:c2uVNFh74100H3ooPttttttttttttttX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncdgcf32.exe

Path C:\Windows\SysWOW64\Ncdgcf32.exe
Size 91KB
SHA256 476532396bfbbe2be3c45951aac71f401b79a60d4a75b842e79abd5ff2474d47
MD5 14a55bd4a7062d902e5e1f2edfad3e7e
SHA1 0c1d5788da08a8875e65c1e5bb64539c7a96e2b2
SHA512 3c920b6fe8ac4b5e2cf238eae89e0b3756e260e2ce26962eb7a737196495d99b81a37ebde460ccc966648c84f73bc6a070a88c46c5cd06764b6ae329dab6f077
SSDEEP 1536:9S3y5FFt5QxIb1w6ABscJZ9Q1q4uun5irALtpeRlaeVX9/Yr/viVMi:uy5Fnp9uXJZ2Q4u65+8ngEwZo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncianepl.exe

Path C:\Windows\SysWOW64\Ncianepl.exe
Size 91KB
SHA256 2765c14d982ae329191d3de3748f1a8e8d1c2f4dc714b3f9980a124d0a0fb5c6
MD5 15356f92d49e50fbb3f3df6a4a82d835
SHA1 b853a1d9638c7bf79af6e385c64625653576af9d
SHA512 492d06a67c6825522f8e78a9ed6a2ec8d859e2bcf8caf007fb01c662dba90f187488f4041960ec54660a74cb87b1bdeebaab12fdf0d899089319c8a6a9072fa4
SSDEEP 1536:004XBtedhYLrh0vTKyZmSxJK9vhF/kVN9LfsEgcYbLE77+VXOYr/viVMi:00itedhYLKvT1vyF/IN9LixyQeo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nckndeni.exe

Path C:\Windows\SysWOW64\Nckndeni.exe
Size 91KB
SHA256 eaf5b9d13c382a055f02e3bf040d3a7f0647267670cf00effe1b488475b1c82f
MD5 e33897e7c9482cf339aee77540177377
SHA1 02e18644dbaa0711b902d10873a6f048af54e1db
SHA512 22faab482e9527cafc5b1d09f2abe602824a444ef3088baaae043ee6a94ceb602c940ec826a0aafa7c4df7a71700bb33ab65b6c96f32836bce00d58f4ab16409
SSDEEP 1536:66nPT049RAWgNkIWHSx4oQ0yFRj2ZeET4bRF8/1jVX0Yr/viVMi:PPTRS1NkFHXoQ0DAWNJEo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndokbi32.exe

Path C:\Windows\SysWOW64\Ndokbi32.exe
Size 91KB
SHA256 337d0726ffd059cfdbbcd3b07ffe9953e37bfa9e82cbfd0932c33e19d470ac2b
MD5 25d7313aa5b08411c75c09d6db37778d
SHA1 5af09713043028c9c0335f503881348fc4ed9ee7
SHA512 3c4a49613413dd5bd1ae1b5cb53e19a7d0599e5591162104a520947102d5c86e19e753df1afab0e13ff511413d2ea821f172dcb3b6d7f6e6605e7d1b7e43e7bd
SSDEEP 1536:lgWw+7XIv9Z5UP6Ecz46U4Q0wI3nvyjDkJB3Oi82v6VXCYr/viVMi:KWw+7XIv26EK46UxGvysJB3e28So/vO1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Neeqea32.exe

Path C:\Windows\SysWOW64\Neeqea32.exe
Size 91KB
SHA256 34049fefa396e62a1cb8d76bb685a6ea665e18f6252428799e5f60a1140a38eb
MD5 55f2e2e67013a362af4dbe56debc7c65
SHA1 e26277d64a0d60e5483a1711f32be40dce4a5ddf
SHA512 573a83fb33c97c542c778af61f288601b213325f5600ba023281ff60a38a101232c114bfd467ad57b30bf0e15767856a9f254c879bf2c1a2a532535dcc0617a8
SSDEEP 1536:z5KNcfqOktEemko2b2b2i42DD/c+V1kYhwspTZjVXcYr/viVMi:LktxmqCb2i42//cck6pTZJso/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nepgjaeg.exe

Path C:\Windows\SysWOW64\Nepgjaeg.exe
Size 91KB
SHA256 aec5be6c3904a3349123c53c7fcaa54f2ee4ca65d884814c4e24a0d11882e6cd
MD5 01774b91b2378ccd6f0d7f4182906ea6
SHA1 ae3f796a10ded7a7c78a6be9c37ab4e035d9b1a5
SHA512 1e62c97f332f841c990ac2c06c267186d60bc3d5a2c98a29da918eecd492bf03edf8702df37e6ea50e730207bc4f1ec708e9455a8d843cd0647c90c82ccddd66
SSDEEP 1536:XKWGP8EhGCSPCsofF4o60FKVOQBNE1GDEUDXyyfVX9Yr/viVMi:XKDG/CnFwE9OiydNo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nfgmjqop.exe

Path C:\Windows\SysWOW64\Nfgmjqop.exe
Size 91KB
SHA256 34865fc97321cc91378f3d08035c01b7be5779a12fc15e1f6293716a5a5f32bf
MD5 42cc3c90ab08490c3f0281302e9abca0
SHA1 2b32156ba4430122619ae2447f9444e246420f33
SHA512 faa9efcaafecfb438f606a12eb2967238b362c444d254e32d879c51c9561f4cd602eea556746c901d537d0d97f16b7c8fbe112bd49e10de606f2366cb5d6b72a
SSDEEP 1536:Adi/woCZYGUN14WMsiWXkQkpoBypg/INGAJoFhG4W1SVX7sYr/viVMi:AQ0UN1+xQkRcI8AJo4cLso/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njefqo32.exe

Path C:\Windows\SysWOW64\Njefqo32.exe
Size 91KB
SHA256 00c779394114f657929c1cc29f5360029d8f34b619561cd7778071b905d4cd80
MD5 f888d31d708a2308a9d7270b92710d28
SHA1 5cd19001c6bd9ab021e767e9531201136e008bf7
SHA512 a5ec03061a0e58f8dbeaed825356b428572fbe804b8ef6801742bdcfbd1e7f054f7fcb32e114490a91f726b2d5bf371867c0c49881c0b4aa1e230a510ba73626
SSDEEP 1536:d6/lsfi85a3OX6Ct56cf3nDLAcg6CfYeqx9t0eRVXJaYr/viVMi:alsfP5a3+6EIQDLhdCfit0W4o/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njnpppkn.exe

Path C:\Windows\SysWOW64\Njnpppkn.exe
Size 91KB
SHA256 998cafd7d24901f8a1624be5ef26fc059fd6293b27fd071c0d7140a3179fd8c8
MD5 0b2556c8a0faa55d3bd3e23c57c95b5c
SHA1 67f336233d2b8f62f76548024ff7a9739be3d729
SHA512 5338649be36d123ece88625403424a4b57a511006ea577b700ba385675c8967944c03ce6b041a1ed0b6d6330dc89a1b70d0a578abcbacdab16e3fd357c184c7b
SSDEEP 1536:T3ai1TUx/9M2tWk3TNsueWIu9WJI45bNC+U9NMME6/VXqYr/viVMi:T3aMugkZsFu8a+Uj99ao/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nlaegk32.exe

Path C:\Windows\SysWOW64\Nlaegk32.exe
Size 91KB
SHA256 134e8132cfaa1681baeba3d2fec0a0fd5deae4102694d8be480eab2626d576a4
MD5 e32e367a3a488b74c9cd0ca213f24ce2
SHA1 7a87de057b71584f3c186011ed9a12ad6edf565a
SHA512 4425b4bd8fb5266c9f16ea3dc61ee7fc7a55917eafc55747fe7a15920aa4a1e5466630f2a7750ae6e3561cf6c1ded3db91b820d7e5ee03c71d74679e99664f4d
SSDEEP 1536:hgZ20Dt2dG22n0dzQqkykAqHjEWHOdlhJDfx9Sv5dVXLYr/viVMi:OJt2dlmy2ntHuzwhbo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nljofl32.exe

Path C:\Windows\SysWOW64\Nljofl32.exe
Size 91KB
SHA256 4f1d44a0f689120f4020fc8db554ecb96ef16437703cd44b09446372b7094b1d
MD5 aebe50674f4946995757912095baa5c7
SHA1 10f61416fcea0457e14027dcfc3b0e143543951f
SHA512 05ee1f8452a34074176d210caf7797180229b8d0711502292b6460fb7b551819fa8b3242132da09d11ec80e14196a6a273f0cf563476c37ed5c08570bf567b5d
SSDEEP 1536:dT05yRqa75NxMwsEzE00iX7Q7ycbGoMNcxV8eVX0Yr/viVMi:dT0ARqa75NxMws500scbp6wko/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nloiakho.exe

Path C:\Windows\SysWOW64\Nloiakho.exe
Size 91KB
SHA256 6c4d1024454eae8c7ef9b663f9396deae756569738d47790c37d7b20c08d1ac8
MD5 3541c75f23a61762e9b62fbe27555aec
SHA1 77af13758976f03462b8b116da8fea585cd70f9d
SHA512 4128afc9812df8a008749907eeff6db693194251bc0f8f5ac9ac7c434d116968bd6810330ca881d71bcf1a085356b14a79f1890b7e9f0535110a155e00ad5c03
SSDEEP 1536:jfrjIRF3ZrFiXq4uv8Lz9LaPX6zOVB+VXjYr/viVMi:jjmZMq4q8Rc6iBQTo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnjlpo32.exe

Path C:\Windows\SysWOW64\Nnjlpo32.exe
Size 91KB
SHA256 64ad87d763c30da524c56e17788a20e63493e4e9d5328fc6ee50e73acba1e581
MD5 725fe9195d146c72cf749adef4d96457
SHA1 32ae4f44bf7d376d47574f4b50d89398890fd7c3
SHA512 3b2845e1b2bf1788c52d2086ca2d294e934ddecefb0033409cb446b2320de7bc956dd66d8aa377996782ab41fe8971b6a37aea83406a6502b0d316948203a6a6
SSDEEP 1536:iiLPcc9XMy/29QNxBcqOq3aZAw952ar8G2vmtMe9BZguVXznYr/viVMi:iOv98yO+tcR59MO8G2vmtd9ggDno/vO1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnqbanmo.exe

Path C:\Windows\SysWOW64\Nnqbanmo.exe
Size 91KB
SHA256 44c5ccfbe0ebed7eaba079125cb856382b717a21a462c6b8f713cd9603a78c05
MD5 384d1648f9d31208e737986275a62196
SHA1 fc10fb7ef14565b94b7a094e03e56f40d2d0d3a0
SHA512 10fa86b5f0a2db32a130facf9322bcda537db378a1163de57a36ed8fa903c7fd11f4ca019510f167d6e7d53e8391da840e5eb7a175085f11ce3f626396016783
SSDEEP 1536:uKmDJniBQW8rdFyTOCfBjKrtzfkAQqVgNqK61nddVXYuYr/viVMi:+DJniwdMOwBj4zd40djo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nphhmj32.exe

Path C:\Windows\SysWOW64\Nphhmj32.exe
Size 91KB
SHA256 5e6254ead3ee8f678dedd3c9fd6146f716f1ecfbbf072a9e02d3c3fa350f56a8
MD5 55b2d48bfa0d9642d078e6554dc4da7b
SHA1 ec18ade05b53a0b296cf43d206a8f3f814a9816c
SHA512 33fff3dcb4e18cb5ff1234687751679f639a81c1da48f8a44f25cb13eb99b8ed8970834e9515c0a2e6153c72637875b79abd87da889027b702f6da600e91ca60
SSDEEP 1536:iiLPcc9XMy/29QNxBcqOq3aZAw952ar8G2vmtMe9BZgg3VXgYr/viVMi:iOv98yO+tcR59MO8G2vmtd9ggFwo/vO1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nphhmj32.exe

Path C:\Windows\SysWOW64\Nphhmj32.exe
Size 91KB
SHA256 125dfc365eabde0a6b3574ded3a444f761c1a1e5a37e2f7e8fc1c87f89843a7a
MD5 51fe89a3cc2198be85ba7d38e50469e7
SHA1 206a8b527be72e8cd96e35e27cb7b821ab855c56
SHA512 ba19ad369d8f984f37df82b70a902b1da40b124ed0945804cb1228c42aca1a112c60681fb878c2b2c087d02fbb3df9a0f2f9af481c39ee755b0d58809bee50b1
SSDEEP 1536:DAAiRx6u3SY7O+qtWsjcW2LPIXB5nP/PPbPP/PP/PP/PP/PP/PPbPPPPPPPPPPPf:DAAmxV3SYBqtWsjcWMIXrIFwo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocdqjceo.exe

Path C:\Windows\SysWOW64\Ocdqjceo.exe
Size 91KB
SHA256 0fd88aee8439a984c6d32daae4eb1a192c9413fa5f5e8eba24b05aa5324cbb5f
MD5 3d8ea841c2b000b83b46b1f4fd11cecb
SHA1 9a0defda9217aace9e9e42b97e292c67868678c8
SHA512 5a132288a65461c0c9114c152ab0f732389d24e2346f3334960ace1c62be41b4124d728ce81d9cfc029ba60c4d877e2dfebf97eef6bb6943980d533315933858
SSDEEP 1536:q+vn1QIGeSc8OnT5dy5Ae5tFjlV823iN9SByKY3y/Y7K6jHVXNXYr/viVMi:qS2IGeSc8YldsAGMDCZYH/Vo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocgmpccl.exe

Path C:\Windows\SysWOW64\Ocgmpccl.exe
Size 91KB
SHA256 7e8904a7a0490f12901a4f06954997d8453ec8ccaad999b331d01274ee04e3e6
MD5 cbd4449bf82613fdbae92050eb8c6f36
SHA1 a25cfc46db5bcc3e4d9ed0a446333b7c5a7a3d2f
SHA512 1669bd4a63b5611ce7e53dcf96d7b4430b4f7fb5270afcc99a8a48c8eaeb012ed6b90374fdd4f3d6a2ecc91b752b518053250e958f413a823b26679e24ebfb32
SSDEEP 1536:7EElE+51/JIxcFLjfO5IBt8lGZvMoWoW1psm4yVXIYr/viVMi:IgHwKfO5IBalGZkoWd1pDx4o/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocnjidkf.exe

Path C:\Windows\SysWOW64\Ocnjidkf.exe
Size 91KB
SHA256 55fdb6b34cbbf888584c43e979ba62a0b0fb79eec742d551c3c840f5e37219d4
MD5 81232509a61c1d1378adbafe5b0d50c0
SHA1 452128a8b32db8874a86492cacadfcb65ca4a249
SHA512 35c1793c7cc75ff66a4a91ad7069988b0ec3a7b7eec4aca382ade2381cd4067db92c5fa39330da1bb4e7e19d1cb3540d9c28fc556de142989c0612ee44922986
SSDEEP 1536:4iv71tMWMGyklrlFdX8ZpiS4CzeJI6llFfvh/e2Y/4ZVXGYr/viVMi:4iT1M+PV5S4uU9bFfvI/YWo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Odapnf32.exe

Path C:\Windows\SysWOW64\Odapnf32.exe
Size 91KB
SHA256 57da1bee279a9689ec293835cc9e422eb769cdbda83d7c0197c2b5dc391f6768
MD5 fd34059eb4aef15b4c00f837b55f129c
SHA1 29742e3c522e802ac14464fb70b17523a1e2b2ed
SHA512 95298aa081c306cf22b79c9c5035df7dfe892260dc502a1c91908a12f8740c69270b1a0fd0deb5a99902a220f12205ec749fa41672f9241284ad1807bd19f4e6
SSDEEP 1536:ZGDRvfDrppYUJd/5ZbS9YwVAUmgVXBYr/viVMi:ID3bJ15ZbS9YwVlmuxo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Odmgcgbi.exe

Path C:\Windows\SysWOW64\Odmgcgbi.exe
Size 91KB
SHA256 89c9a788bf518b5c2d23420f48c332dda53fad50bf80566674dc0c9db621af44
MD5 36db481f4594a6f2e94215444ea47459
SHA1 3c3dc1a39dd95a37986eb33b7d7294778c16daa7
SHA512 1869523c295fcf1ea001aa17d219ddcd2a7f9b76a05b0ef0137c76c7faa3fd008a9e049e5d0f24f6a22c62767f8b5a7155071ab86b8ebe7fd41331ec754dbfd9
SSDEEP 1536:Xac0Jz923XO/Eq0fI8SzfXGhyNgyH0c5VxtfElsX3iScVXlJYr/viVMi:TnHLfYzf2hFyHLEi3iP1Jo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ofcmfodb.exe

Path C:\Windows\SysWOW64\Ofcmfodb.exe
Size 91KB
SHA256 93bf380baeb67e993f0eae984f6cb68c2c767368acc2d8fb20bfb4ba5cdc6aab
MD5 9665dc2056df1bd02cdda1b58a3f0f96
SHA1 516914cd7b7b9e25b0669a74db37a6871e1b295d
SHA512 f81d792f55e7a1bd8640e23842b247f514df7673519818af08ef91d0d51b0f6989424d5fe11479d3f9388bda9dde9bb9089e0eb785ab552062efc210461600d4
SSDEEP 1536:cU8m/ggeNmA9Q2YDdhOjEtq7YMroQU27eExqLVXDYr/viVMi:Am/cAnLdcjfD0QU2iE4zo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oflgep32.exe

Path C:\Windows\SysWOW64\Oflgep32.exe
Size 91KB
SHA256 71b9404d76e013c0702a537594e18c519468a870e8f79a9ada04d7808c509174
MD5 ec800963090eb5b3ca18fa7ddef6ea69
SHA1 0a98e42ecd51f62deb5bc373fb686cf6026da250
SHA512 796dfb93419023fd98aceb08aa50754f7d46a7f367a77307b4072ca285575010fe9b58e348f9d425e2bdffae7bfbdbeb0a8a6c1acac7dc5f0fbffb33505f3ea6
SSDEEP 1536:+H5c/QZ3QQELZGMXpHR53YXmWdOCXofD+2TIaLiaoVXwYr/viVMi:+Dnj6pHRVYXmn/S2Tneamgo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ognpebpj.exe

Path C:\Windows\SysWOW64\Ognpebpj.exe
Size 91KB
SHA256 64d8a94529d5031655c3239114450674591188908611895ecd044ac70b469074
MD5 ab7eec1f3de90cadedb605391752de37
SHA1 1a54b994893d5d3445d3a241280d20da8a29e092
SHA512 f366ba7cc09b0c22a32b51572aaa63d9735feba3beafb769eb58b9d75d46654b30233e71c57819a6ab1ea8c09475728625ac8694f6845250ae5ed5c5b8c8015b
SSDEEP 1536:mW1I6jnz2PKYRXH2FUJ02MPou97rEZB4Lnzi97NVX2idYr/viVMi:mWr/A3U43MPm/4L6Gido/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojaelm32.exe

Path C:\Windows\SysWOW64\Ojaelm32.exe
Size 91KB
SHA256 d507a28e531bababc26f5ccdfe43264133a2d865da8b8973d6391be794ae3aa6
MD5 af3a206b03d5622a0a0dc606040d8a27
SHA1 dacc29372c43280a952a82ff26343dfc8eed74be
SHA512 d6aac21fbcaecf513c5df97c2185af265dbcc50d47b0c104a911492ef2d16f1ee30931735209d1ee3c8d7e662636aa47b942b6dc8444884ff261444a191ad365
SSDEEP 1536:hxvYZTm3WZu5G7bN2v/umP5z4bBJaTVkUemO5ozY1fYOHVXBYr/viVMi:HQTSWZCG7bN5mR4ds+QzYNYURo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojoign32.exe

Path C:\Windows\SysWOW64\Ojoign32.exe
Size 91KB
SHA256 0944051e430633f18bbd43e1261b87c75435a28fae3ba6c9c66d15776c9de564
MD5 0aa9d39f7174b129b478de6c5c1c1323
SHA1 a87f7383f43021014728f1f40bfcdefc771eb6b0
SHA512 ee4d61628a8e6f2430019d2fcc0ef4bde53323320426c4cca847bba06e2b3c42c5ecfc8bbff82d6acee36cc676ac9b9672859d51cc7c50cb4c81bb8d46b68d0c
SSDEEP 1536:pEyNwQixjjkOczmRIXei75xUyCVXvYr/viVMi:pDifEs/o/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Olmeci32.exe

Path C:\Windows\SysWOW64\Olmeci32.exe
Size 91KB
SHA256 afa24d2a1df7d2e8063ce21c3e5e34660b53414d01c78eb1f81ed0dd62f2991a
MD5 051480ededf72fe3108c4d06dcf10583
SHA1 043b42cd73806333df78d666a29120e06c7cde02
SHA512 6e45967fc995c1b67b71cde5e28de8f0a3ec31b86ecedcff713aeedcd5358ab2c8a8bb704360bffd1a9b598295400ae85b98d946c74cafd81579ac757938a494
SSDEEP 1536:GrM4Lct3YvPKtGfvn8JAugR+w6x0LtAeuHWMYwUgTgwSw0nVX6Yr/viVMi:GrBLctY7P8GjRjg0LW9HWTwTnSw0VqoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oncofm32.exe

Path C:\Windows\SysWOW64\Oncofm32.exe
Size 91KB
SHA256 a0eba44831abea3f958dacc6bffd6c378d37538e151d20756ce2cc0a0313754e
MD5 7e406cc7553e5a3e8734f45bbc3eb2e2
SHA1 3a4fd04e37065f2f89124f48f9d429a468455d6a
SHA512 123b23df7ff14a96838d87d3a73d13b3a3e891f1f537fe2ad9e7b12ed4bd06a6691ea6c16b0b36929ed2b435f56ba2fc4417f6e42d43863d3376b1cc59ca8eb9
SSDEEP 1536:5OGcAmdZ9VNCJJdCcqztGd6VdzfGkcXTE6tb7dhwPaw8dO7VX4Yr/viVMi:MHDb2jEqNEeHwPa7Woo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oneklm32.exe

Path C:\Windows\SysWOW64\Oneklm32.exe
Size 91KB
SHA256 c2543c957dba7417c03f2d87c92e856a4b594934672fbc0ccd6c1208c69b0da6
MD5 138a62af8d6ed4417973f7f8bacb4b99
SHA1 cd71f8e7497e4360a4d9a718df2e00742b6898bf
SHA512 ad8b5a24385cb46d223a0a1e0955f41d2e6825f8e90b93315502363d36a0f6131ed14fb2294410c0bc56d4ceee8e6327a7d7abe6412cf9c81fd60b1e51a8e178
SSDEEP 1536:ZCYcS32Wnz8sRlAvC+kaS/j/v6tNw8icVXJ7Yr/viVMi:Z7cPcg6MC2S/j/vmwBSBo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Onhhamgg.exe

Path C:\Windows\SysWOW64\Onhhamgg.exe
Size 91KB
SHA256 0e47bf7b1c62e0a431f998d2c5459379f1b66e9fd23479346f87f2527f28c116
MD5 363032dbae9e88884f40d938ee62a490
SHA1 3d22199581414fa4b4cef10498eb59508378f332
SHA512 3f31859fb7dde7ff9fed972510e4dc7559fdc15b2687c0463f3043695f0befe92e7465f04122c524d3d8317ed8deb3256cde79a7709640c0ce0ccadf8748d36a
SSDEEP 1536:ohB0hYUYnxE3QBmGm5a0NnGlYI07h5lrN0KpMijyfVeyEVXFYr/viVMi:oL0hoxEgIGen407h5tGKpMij0VeyqVoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdkcde32.exe

Path C:\Windows\SysWOW64\Pdkcde32.exe
Size 91KB
SHA256 7593fbefabe100241e38543eb1abece9d3c3400d53e861d876d15932b26e6adf
MD5 21c65bded888c4539c99e71a7a68826f
SHA1 bd4298879d30cd577adadf15b3137cac692d5be7
SHA512 bf3354e597a9e883044480df5a4d92c36af6f9b3a6d139d0ec8f19e17f6d65b0e48eef4e843419cfd8cb5f263cbea230069531c18fe24ad71624b570dbbff4c3
SSDEEP 1536:WtN51LQg6pgz/eC3biXocymSygNsUThUFhRcMArDdaP1SObPNLvyQ+nVXAYr/viz:WtN51L/MgreXvymkNHohRcMkDdaPcO1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmoahijl.exe

Path C:\Windows\SysWOW64\Pmoahijl.exe
Size 91KB
SHA256 330e762a9290a8ab4e29e74e8fbb2b4a014a2bfb794f5becd79ce148a0acae9f
MD5 3bd6e97b452f0df24d24f708b8b5faf8
SHA1 c062915f91a104f9a7ed0adb99ac50f5834be347
SHA512 d856e761b87827715758a61224d33db5e4c1736d907c766518aeddbdefb4a734fbccae3ffae899dcadb3f864a1c864c2726077836b1a0df861b1601c3021aef8
SSDEEP 1536:uUqvVE/QZtq9H3+bu0WpF8VynOOzN4+UF3JVXkYr/viVMi:uzVuQZaHu60WT6yOoM3j0o/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qmkadgpo.exe

Path C:\Windows\SysWOW64\Qmkadgpo.exe
Size 91KB
SHA256 524429e3057864d3ef7624be5614a824bd1f09cbb6052746e6b294ee8b58d9f8
MD5 1083d1e82aca3c3dc744203747d16bda
SHA1 b2652e322ddfa2a92283646a7c62018219d1e633
SHA512 57364714be41b20af1e5a9118481e520c3a81babe90bf8566006e0816a4de0c67728dce919b715c81866cd7ef0d44e7f8eb45919a052fe592bc52debb448c771
SSDEEP 1536:y8lcf+ebPg5ap3TKEIlS2LVX8Yr/viVMi:if+ebY4klrMo/vOMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/640-364-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/684-566-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/700-310-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/716-111-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/836-262-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/840-508-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/932-490-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/968-496-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1016-268-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1032-216-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1092-565-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1092-24-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1160-334-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1184-159-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1200-328-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1268-292-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1312-87-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1332-573-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1424-526-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1492-224-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1504-418-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1568-63-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1580-71-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1628-274-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1640-476-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1660-316-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1756-430-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1788-484-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1952-191-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1980-382-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2212-482-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2240-175-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2244-56-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2244-593-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2272-256-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2340-460-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2432-514-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2532-545-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2612-304-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2648-7-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2648-551-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2680-532-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2692-452-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2716-151-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2724-280-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2820-208-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2828-119-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2836-352-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2860-346-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2924-558-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2924-16-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2972-240-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3080-143-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3088-31-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3088-572-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3128-183-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3248-412-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3280-248-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3300-552-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3344-322-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3404-204-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3476-358-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3508-128-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3684-544-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3684-0-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3736-559-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/3972-340-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4160-301-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4172-502-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4208-47-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4208-586-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4256-286-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4316-520-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4336-466-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4348-135-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4412-232-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4420-454-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4436-370-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4460-95-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4492-424-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4504-376-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4560-79-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4568-103-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4596-400-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4604-538-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4744-587-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4764-406-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4796-40-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4796-579-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4804-394-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4864-442-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4884-580-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4956-436-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5000-167-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5020-390-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5156-594-0x0000000000400000-0x000000000043D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads