berbew | 358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf

Analysis

max time kernel
93s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2024, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf.exe
Size

89KB
MD5

ff8c8321bc96cfe64939f16ae2e1716f
SHA1

b04193c07e6413154c324ac9155c9c65762d748f
SHA256

358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf
SHA512

0bb5c648cbf15b997f1ffd27966680c27481c249585636e693dd4f721c4fd01f9dbd1d3ffe21298dddf1eb69c0f7b47a3b930b0456285b12af1b9be1104e3e80
SSDEEP

1536:+wYyD58GY/pCq6+SY7fKfi+WrxwNistIcgyr5vbMAAEQ6gJCK/1GcClExkg8F:+wYQ1Y/V6+P7791otIcgyrVbMAgEcCl/

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmemac32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 55 IoCs

pid	Process
4600	Afhohlbj.exe
212	Anogiicl.exe
3116	Aeiofcji.exe
3688	Afjlnk32.exe
4864	Anadoi32.exe
740	Amddjegd.exe
1864	Aqppkd32.exe
1364	Acnlgp32.exe
4876	Afmhck32.exe
2948	Andqdh32.exe
4768	Amgapeea.exe
4292	Acqimo32.exe
5116	Afoeiklb.exe
3460	Anfmjhmd.exe
3188	Aepefb32.exe
4684	Agoabn32.exe
4748	Bnhjohkb.exe
3940	Bagflcje.exe
4844	Bcebhoii.exe
2136	Bjokdipf.exe
2272	Bmngqdpj.exe
3200	Bchomn32.exe
1080	Bjagjhnc.exe
932	Balpgb32.exe
2308	Bcjlcn32.exe
2292	Bfhhoi32.exe
3404	Bnpppgdj.exe
3332	Banllbdn.exe
3292	Bclhhnca.exe
4976	Bfkedibe.exe
4972	Bmemac32.exe
3632	Bcoenmao.exe
2356	Cndikf32.exe
1988	Cabfga32.exe
432	Cdabcm32.exe
860	Chmndlge.exe
2828	Cjkjpgfi.exe
1508	Cmiflbel.exe
4204	Caebma32.exe
2276	Cdcoim32.exe
1724	Cjmgfgdf.exe
2468	Ddmaok32.exe
4544	Djgjlelk.exe
1204	Dmefhako.exe
1624	Ddonekbl.exe
2112	Dfnjafap.exe
464	Dodbbdbb.exe
3852	Daconoae.exe
2392	Ddakjkqi.exe
4224	Dkkcge32.exe
1920	Daekdooc.exe
4832	Dddhpjof.exe
2792	Dgbdlf32.exe
1444	Doilmc32.exe
1092	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Maghgl32.dll	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	Ddmaok32.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Iphcjp32.dll	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	Cabfga32.exe
File created	C:\Windows\SysWOW64\Andqdh32.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Abkobg32.dll	Bnhjohkb.exe
File opened for modification	C:\Windows\SysWOW64\Andqdh32.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Aepefb32.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Amddjegd.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bchomn32.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bmemac32.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Doilmc32.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Andqdh32.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Afoeiklb.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Balpgb32.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Cdcoim32.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Aeiofcji.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Afoeiklb.exe	Acqimo32.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Mglncdoj.dll	Amgapeea.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Anfmjhmd.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf.exe
File created	C:\Windows\SysWOW64\Afmhck32.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Anogiicl.exe
File created	C:\Windows\SysWOW64\Bcebhoii.exe	Bagflcje.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Afjlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Amddjegd.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Afjlnk32.exe	Aeiofcji.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4868	1092	WerFault.exe	136

System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdlgno32.dll"	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbpfgbfp.dll"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoddikd.dll"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeiakn32.dll"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphcjp32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcoenmao.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4600	4248	358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf.exe	82
PID 4248 wrote to memory of 4600	4248	358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf.exe	82
PID 4248 wrote to memory of 4600	4248	358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf.exe	82
PID 4600 wrote to memory of 212	4600	Afhohlbj.exe	83
PID 4600 wrote to memory of 212	4600	Afhohlbj.exe	83
PID 4600 wrote to memory of 212	4600	Afhohlbj.exe	83
PID 212 wrote to memory of 3116	212	Anogiicl.exe	84
PID 212 wrote to memory of 3116	212	Anogiicl.exe	84
PID 212 wrote to memory of 3116	212	Anogiicl.exe	84
PID 3116 wrote to memory of 3688	3116	Aeiofcji.exe	85
PID 3116 wrote to memory of 3688	3116	Aeiofcji.exe	85
PID 3116 wrote to memory of 3688	3116	Aeiofcji.exe	85
PID 3688 wrote to memory of 4864	3688	Afjlnk32.exe	86
PID 3688 wrote to memory of 4864	3688	Afjlnk32.exe	86
PID 3688 wrote to memory of 4864	3688	Afjlnk32.exe	86
PID 4864 wrote to memory of 740	4864	Anadoi32.exe	87
PID 4864 wrote to memory of 740	4864	Anadoi32.exe	87
PID 4864 wrote to memory of 740	4864	Anadoi32.exe	87
PID 740 wrote to memory of 1864	740	Amddjegd.exe	88
PID 740 wrote to memory of 1864	740	Amddjegd.exe	88
PID 740 wrote to memory of 1864	740	Amddjegd.exe	88
PID 1864 wrote to memory of 1364	1864	Aqppkd32.exe	89
PID 1864 wrote to memory of 1364	1864	Aqppkd32.exe	89
PID 1864 wrote to memory of 1364	1864	Aqppkd32.exe	89
PID 1364 wrote to memory of 4876	1364	Acnlgp32.exe	90
PID 1364 wrote to memory of 4876	1364	Acnlgp32.exe	90
PID 1364 wrote to memory of 4876	1364	Acnlgp32.exe	90
PID 4876 wrote to memory of 2948	4876	Afmhck32.exe	91
PID 4876 wrote to memory of 2948	4876	Afmhck32.exe	91
PID 4876 wrote to memory of 2948	4876	Afmhck32.exe	91
PID 2948 wrote to memory of 4768	2948	Andqdh32.exe	92
PID 2948 wrote to memory of 4768	2948	Andqdh32.exe	92
PID 2948 wrote to memory of 4768	2948	Andqdh32.exe	92
PID 4768 wrote to memory of 4292	4768	Amgapeea.exe	93
PID 4768 wrote to memory of 4292	4768	Amgapeea.exe	93
PID 4768 wrote to memory of 4292	4768	Amgapeea.exe	93
PID 4292 wrote to memory of 5116	4292	Acqimo32.exe	94
PID 4292 wrote to memory of 5116	4292	Acqimo32.exe	94
PID 4292 wrote to memory of 5116	4292	Acqimo32.exe	94
PID 5116 wrote to memory of 3460	5116	Afoeiklb.exe	95
PID 5116 wrote to memory of 3460	5116	Afoeiklb.exe	95
PID 5116 wrote to memory of 3460	5116	Afoeiklb.exe	95
PID 3460 wrote to memory of 3188	3460	Anfmjhmd.exe	96
PID 3460 wrote to memory of 3188	3460	Anfmjhmd.exe	96
PID 3460 wrote to memory of 3188	3460	Anfmjhmd.exe	96
PID 3188 wrote to memory of 4684	3188	Aepefb32.exe	97
PID 3188 wrote to memory of 4684	3188	Aepefb32.exe	97
PID 3188 wrote to memory of 4684	3188	Aepefb32.exe	97
PID 4684 wrote to memory of 4748	4684	Agoabn32.exe	98
PID 4684 wrote to memory of 4748	4684	Agoabn32.exe	98
PID 4684 wrote to memory of 4748	4684	Agoabn32.exe	98
PID 4748 wrote to memory of 3940	4748	Bnhjohkb.exe	99
PID 4748 wrote to memory of 3940	4748	Bnhjohkb.exe	99
PID 4748 wrote to memory of 3940	4748	Bnhjohkb.exe	99
PID 3940 wrote to memory of 4844	3940	Bagflcje.exe	100
PID 3940 wrote to memory of 4844	3940	Bagflcje.exe	100
PID 3940 wrote to memory of 4844	3940	Bagflcje.exe	100
PID 4844 wrote to memory of 2136	4844	Bcebhoii.exe	101
PID 4844 wrote to memory of 2136	4844	Bcebhoii.exe	101
PID 4844 wrote to memory of 2136	4844	Bcebhoii.exe	101
PID 2136 wrote to memory of 2272	2136	Bjokdipf.exe	102
PID 2136 wrote to memory of 2272	2136	Bjokdipf.exe	102
PID 2136 wrote to memory of 2272	2136	Bjokdipf.exe	102
PID 2272 wrote to memory of 3200	2272	Bmngqdpj.exe	103

C:\Users\Admin\AppData\Local\Temp\358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf.exe
"C:\Users\Admin\AppData\Local\Temp\358f671cc455e3d2fc0b95ce0529f88d8e5c9aaaa0ea8c6f6504fc4e8c35d2bf.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\Afhohlbj.exe
  C:\Windows\system32\Afhohlbj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\Anogiicl.exe
    C:\Windows\system32\Anogiicl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\SysWOW64\Aeiofcji.exe
      C:\Windows\system32\Aeiofcji.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3116
    - - C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3688
      - C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:932
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3404
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3332
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3292
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3632
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:860
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2828
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1724
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2468
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1204
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1624
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:464
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4224
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1920
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2792
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 416
        57⤵
        Program crash
        
        PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1092 -ip 1092
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
89KB

MD5
051cbcba26f7aa6f283b875bbfc84eca

SHA1
bd3f3e418fad286d5b475e86bb64d06b3bccb592

SHA256
4f7149d2d085ae4ce1b8d3b56f8234732d1141e7f7ea7828bdea9e4fadc77995

SHA512
d1e17d598e613d224226682e5c855f277beb3e11f526967a4ce32a591c208c3913c2a2f508ac044973cd19a72346486da9c703fb38771ff43b59c9083af158aa

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
89KB

MD5
6d29b71adf18e98ba5efae1f77b9be41

SHA1
5eb7bf796b231ce9813a997a32407ce8efb47e98

SHA256
f6ab743e2ab28b616f967c24e4b3e8aa0bd20a17abba2ce33748208385c2d20d

SHA512
245cf5bfac2e06bfcd18b0a6866137cbf84373831525591787c4a6cf8ccc93908c460d51e39b09507d3bf43aed2f1625d0a87d8e338ae2d7003a33f60d848c09

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
89KB

MD5
f1ccbfa3858e2ad73c2249132c097b1b

SHA1
a4973e3016b5d2a9ee77b744bea3e52f065a067e

SHA256
163f6d35d306e644163b8a174ed115d6ae799bd081bd97675c89afb0e152cf62

SHA512
6bf011fb6bcc88c5b45d86b7d39de5472eddc49ff7acab56cec7d82606a7856c3febc67ecd4b7dc9b952058e55c9949a21faa5e8407b5624c636ec0a8d009acf

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
89KB

MD5
1c9863bb229212256897f8de688b0883

SHA1
0eaac05cda9a75f24afd69e988d0939f3942fdef

SHA256
8f360725898819780e0d680e71b1a0c10d77a307a7389432478c156579cdc9ad

SHA512
e21b20e5f655b9020f51c6352b576571ea5acdaea35f388ce3985277dfc672118ffa5b8999efadb6f2ed588be8589bc5d6441a90f4d7f02d73bff2cf63eddb56

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
89KB

MD5
51a32f38e9733a85be9f42269c7c1842

SHA1
88ab37dddd56aefc85fdcb4deeaeada86be0ecea

SHA256
9a080314c8dd2aea590b7728b6525053a3a2dea141a193d3510e16bfca584bcb

SHA512
5b52cd741026e4899d5bc23df9353ab67d4a390401082c8139feef21c9859c3df8e98ce74b665f189fadc15c548336ddb06d13d6a4b02279219954a52e189d45

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
89KB

MD5
f9b48ccdbfa6d057ae969021b509d2dc

SHA1
c23f513f08672e56fc66824706fcb929bbc29ee2

SHA256
a36ddfad5ad9cd93723eda357e2bdc79153f409fd50d117c0903474d4a01cf7c

SHA512
8f6a11f86b39886ed304586e8f0caa37f0aa3514c1836ac1b9c8410762ae04a874435ca4b26580f8e93acac661b068e636ef6e8739dc94f484b84eb0b6868e3e

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
89KB

MD5
ac543096deaec5ebbef6e1f90b08a9e8

SHA1
36bc0f3693af5a31c7c4f325d92409a77a6a5dd1

SHA256
f5b5f111301ae9c2942d2dff02989d6f60572bc4f60048ae558d3f02c71fb28a

SHA512
b08aac4499278677a7f9d0e126c8e0140fb3f5466b6200e61d014a483028f91860648e62e99e7e165d55e6a4d5b659f9cd66fd400194e237951fabc1d8e8d6fc

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
89KB

MD5
b4baf6d7b3b3fdf10ff40fda758784a7

SHA1
9424d51831a410d06e6508a6b02363f8c433565b

SHA256
119d15aa424d5bef39e25f88a0ce2c7797ac0200bd51dc5e8e708ebc7edd85a5

SHA512
755b1a7f273074339f83b30428158b277b55a828c3c3673d29b6543818ae9d727c919a093e444160820e0e00e50c0626cbdafd4dd603a73273c83d8fb55ece7f

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
89KB

MD5
fe54cccd7a9753c5dcc45c70042a90fb

SHA1
e12ceb968ff15047842a98850888d4333431a8a1

SHA256
34f35f45c45aef33230917bc452886156689747859c81adf87986422f0d70b1c

SHA512
7a357e3e7a7b15c0cde12b3c3dfdfd79c3a9a0f9cae7fedc1851df541a2eaf7c8880f1e0cd777e432388579d158c241a0b6589e0244dded160609e3de730aca7

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
89KB

MD5
0307682841c988eabc08eac91278d476

SHA1
3e44e2efd425a3c9709b1c6e08d7c5ee0d9b14db

SHA256
37515de63739bba7069c50c12b5b6de47e9bdf5b69a8b44b7f4cb51b98c3100c

SHA512
e63d5c92a05cb2c543edd40ba91225a274f97d1f3909aa5c75838fa8ecd6b0796e80ccac080a819c7cdb78e67b9bb1b31775b4af5b1097ea66ad32f97a4b442e

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
89KB

MD5
008fb460e81da0c73d9e7bc786bb2f94

SHA1
bd817364ff5244e9b5584c11ce933ae5bee01190

SHA256
a336989fe268f8c3e5475e08b51d8614000856ef4d48d6d38511e9215b7612ee

SHA512
3dd934446a02eb380734979e6bd150129cc8a6d77d82b575ffea51d5d3168ae9fb41841f404afe8d58ed15ed0459db67213564400e430d9ab2b6395791f65dfe

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
89KB

MD5
286cab68fb1650c87aeb732d85069319

SHA1
b2fa828c284bec4269fd5754db6cdd1364fb1885

SHA256
bff65661d2c081c7f3e4bfd262610bc991295b4e25f2c6012f0668cdd460444b

SHA512
10796c9f33261b1989573edd373ee5818da459811099f53da19eac79d666e871fe82e074f34518fc91ab27f0cf2690358328448fca49bf9117d057cc7a6ea2ae

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
89KB

MD5
e669c3f47254bb2c213c29d5e22dbdd4

SHA1
6f1ed1edd5d53707f0fef76692fc8612b599cee8

SHA256
7454e9462e17ecf3eba4d0b59ac7b3ea775bec4030aca50c2de09d6d7076de84

SHA512
7b47dcdc562b88d0ac5086ae18799a30f756abcccd1b28c05fbd97148b01a3e0c8d291e6064b5d16f16d1497c825a1d1ec1ee382bef59d859494b9dca19e0442

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
89KB

MD5
a34462b72768f8a67135b5feb2989552

SHA1
19bb11d4b008769bca11c69342484d22503f9b45

SHA256
86eb73d4cf7dd856236877cef04170db64eb2cd05460d11373b5db13ed7bff6a

SHA512
9f34f6489d71b0ba5cabf244d7a7335a0878b06327ee66cb9acf1b8e82604628b8b8c7edcee98fb7df24f9f0b71641e12ca75cf9bf7a9137f4cfd79c0577cd02

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
89KB

MD5
c35c53f0b916b4a9fb6927ec40467238

SHA1
f0454f329557adac4d131231fb617dba31ddd0d6

SHA256
42d863cdd6f4f3005fff3a940146f79dd82cfa476587b91388a4ccf680e87df1

SHA512
c7dfa8218261b472d8d07ed39b73ea8ef3ee85fc5f1a12ec16532408546263e10e0a969e07d1f8564aa358b819f482efabdbef28bf0c81cf11cbebb37e1d5cca

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
89KB

MD5
6567d57c72b1c86fcb5e89e92f9ccc83

SHA1
f103c5ea5c7cb5355f4fa88c2be83cd823f2f467

SHA256
cb979c545263d3a16a3158dbb5fae36713d60baff5baaa93a2311d0604328ced

SHA512
8ec83e95d01edd98d0b3934371b28f4eb5bf20fa883cb9d3a9ee208cbfb9b88f7cd3b729e7f4bfd9c2056dcfe0d91d9329b2a9a28a77892d1fad0200fa04bd17

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
89KB

MD5
a0090f9dd1ee6aac07053fc96374f9f4

SHA1
2d78d620363fb242be5395f95bf8a6b9b779a46f

SHA256
8ff2e74edb0dbd94025867a52a6a41fecb915559284d271b578f613e8d872fdd

SHA512
bd412f5d89857b93697369c5768cb5d660f615f22205401e5302aeef13a0bb25e4133e46fe446fdc1fd768cfcdc5b860b8e93208ee2de82b69db506f9697583c

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
89KB

MD5
7fc67a03a9717d6a0fd787e3b7f1458b

SHA1
f4a57d4800d8c97229a4442a6ed5f2767e7dab0e

SHA256
bac4196f37545228fe232196a2dd25dbe9f0ceb557e3c39c51966c7b41010a7a

SHA512
131740ad212dff3b23ed38c1ef5de69b5995a1047c2b8a8ed5f109e26bb1b5a3b810f356d60eb859a46c7d9e48ae287c7e25f0ee18f7d7d65daaf11be6e16568

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
89KB

MD5
714cadd6e698b944bd3630f945984286

SHA1
97234678930e59e7c76806e0241783e52d94e9e5

SHA256
f8017be698735ffe7d414e3d095e6a39898f5c35bc74ed2b742c34d70c0453e3

SHA512
1a2a19a22ea2f2e9a19bdbff0bf5c0da556df24886acae0f03a4e573bc5e41e8d339254d019955e93045aac02da56f56101b7e962beed9a945d0b93f45d27ac0

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
89KB

MD5
68813400c9fca362e1d7580c74bd9186

SHA1
3e535de88d2ce0b7a0b90314f8758fe437aadaf3

SHA256
13509f43fe039faa5368a0f2a961ab82e35bc824dc7c54c43a4bb365665a090d

SHA512
a93b15bf429a2912b51f3618e23a101a0460054f2a8faf128bcd5ce778d0e8bc3b556d8b4f456c2aa3906b6db7356cc7903e24352aa9dcad5b9747d323d67d5c

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
89KB

MD5
fc461371c12b15abf74586c9de7db077

SHA1
cbe9969ecce8887ce750c29289de64133be11c77

SHA256
c41a94d1b672664f86db61015ea3d9a111c9947a095c8a6929eebbe65b6277b8

SHA512
abb3d4204c572c616d5760d055852d0ed3b20f958bab3520746043bef52b69fa240c4c67721d18c43a62ea1b23ea92c955c6fa91a91f79d1ec66a4411d970186

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
89KB

MD5
04ed032009c46c3d07ef1448789f0167

SHA1
4eb71346305538b1b00bf921ccf0a42a47a21902

SHA256
1d281998c5744328edd773b77f74413cf593909a0b2fd48aeed6fa034d146c3c

SHA512
8b5a9d65956e69de2da22dc8f2fc2f5ff640034350ab8849ced76236c5f54955f966cbdf3656b71268dff10e6181276349e78117937955d3aa663b039b774998

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
89KB

MD5
ad6c037a840bd6cf3a619ec410083d1e

SHA1
6830936fb75e7b1cb0c0f2e59346d338feb7e635

SHA256
22519e5b7c5912f4b324ac442e2070d0cc36075d6d71b87a21f2e0796ccbf665

SHA512
5835eb9b2895d4fcbb87fac25b6451946246a8f778ea2feba1b9962617e91f52b96469d8054ab99c205b7d876840c8d933a853513a21c19bb85d14491dc7bd50

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
89KB

MD5
6c94e8f6606b99744697f162b4927887

SHA1
190358582027ba736e8208a5777b4e969af66958

SHA256
076649cd6829987fd31ec4083442d7c216de2918a260ef7fc5419efd0cfdac68

SHA512
31e4ac04e4b6a7e27b6187c487b26f6840c53b3ec0178b5a683dddd4873379ac36ad66e0b593b8fa0447bb0d3c95c2f1cdee8c5af8e684c8404996b637613759

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
89KB

MD5
e26e7d09bd2d54ae9557500580685cfa

SHA1
9174f130dd1497edc6a6012fc821e1113b98fdea

SHA256
fc8faf05298b58f5275c703a0c37cc0505f0b946f237f6be78b3ae2977ffa2a8

SHA512
aec403faf8c1941d724f480f1d5a17f94ec5095883d550f92332c4a7381ac48ea1db63fde1a8a71cba77948c33bcebce689df5758dc46a28731a3006fb8cfcf3

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
89KB

MD5
8dd4b46f5702d6f9a681525a961d8918

SHA1
843654585679b47607c88b33242b1361625fde10

SHA256
c7569fbb01415a82b7b996e39070c98baa2fe7a330c28faa395ad5a0631e6e78

SHA512
b140592a00e6953ab1d930c8a1617d90835df2bda53afd5dc96e7a04b6c013dcc450c07951c7a97152a3c8bab45ae0979b3f200d1de2a43b78a2697c519fd843

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
89KB

MD5
a22350a28449f8e7004803790c96b740

SHA1
70a888d7e9e60f7173586241e358f9e9246eb0af

SHA256
70aefc9eb74258fcb93374fe685157b95a5795abbccf60e6d713606f9b08fc59

SHA512
fbf1877db47a9ad8d1193d307dd0585012a1099393d663af3f228c405b12c1f198479cac4cff7b3a6871b7cd46d9981a303d34ae2538cf41b085c6134d3c1011

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
89KB

MD5
d499f723eefc87255559927d38ec373c

SHA1
3d20de0359ffc96217fe61d38929246ba2866f41

SHA256
cef8fcb3a44e526b0036ff9e40c10357b2148ee3a19606776024867df1022edd

SHA512
1ec96064700f9925849d90281193746780c0907a3a4f52ffe2a24ba0c971b52c43fd84f982a8e982331f063b9b51277968e6156ce6c0540f01f5658fd4303624

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
89KB

MD5
2215af0df017d64276159e8995d7014a

SHA1
d8421eb9c5a2e87139fc4768cf4a732f25c05807

SHA256
e383d84ad5676c366021b62f5f1b9427d9be83572bec22822eb2c7d1617e1721

SHA512
a0cb321dd025db6775e790678ef8f3577e56c6e7b59bd0283758cddf1b98de103db22f74ed7a82b2d6614319f6f79ca8506e3ff4b36fec11260469b8b7ec407a

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
89KB

MD5
b62bcebe70c07b06ea37559a15e0444c

SHA1
185a45073aae8ed46498d368f264244b0fb22f01

SHA256
da3a7ef6612f5046cd85638bc07ee158d27be06b972e49557e57191c067999ca

SHA512
ea417747deb1883664828eaba0783fcce3b39df6c8298f2ee4410dc3bde74d2e95de64c7fc2408a3816227a281ecee4973f87c9cafb4676970b6e35a99252f61

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
89KB

MD5
e69a07f874ed5469d05fdeb28e434953

SHA1
4bc04ee9e916d8eef0629ca2c4903d1721609301

SHA256
7c61a555e15a2fef4abe762b15ff8d37b3243ac00ac83fd656a856ae81af663c

SHA512
1c0d8f6c7795ff2d1fabb8c67c7945539b4f847b1b4cff5210af3785359cbb4c64f727fa6e835d3abf97ea51fccdb529da5d777111c74ee86078b8120ecb03ea

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
89KB

MD5
0b5ce128af98ef78c798bc67090e0456

SHA1
ac10cc54d841bf3bb77da9d31b01a7d0d4892760

SHA256
f39f85d64c85388d813ecbd58a716c1c567a87bf57ea364e3122d1725287e58c

SHA512
20af066745e7efc74e6c138ee31509fba90a4f0cb6dcb6a8284403cab51a2f91443fd5fe9e74b1bc3a993b15c1a0cf06a982482af89f362c43c31031064c70e0

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
89KB

MD5
e8f93e18ba64474ecb47bfa9650b7378

SHA1
174e5d273cf86dcaf21374c30340d36eb9c6acf8

SHA256
30bd8c15418063833bd399311f59d9d9a91cc005aebf5616702d08bd46ca3eca

SHA512
94bf9af8304097f00f7233fae94aca1670b47088d196061e5d4c97c1b553fa1881b5b3902209ff8151f01e818ce4c0fa18592666c75d01b16358955c0b4f141c

Download Submit
C:\Windows\SysWOW64\Bnhjohkb.exe

Filesize
89KB

MD5
194ecf281c64f708cc8a6105382fc754

SHA1
5d585c4c28878fe81055dd7e8ad7f9d0a3179cd8

SHA256
741ac2ef4852d9b25f8cda2e4865ad70f363b6ae13787b370f8f31c0cdb76d2e

SHA512
f32ff3edc5e4366d381ebc58611d09831fbd288a0a78f4af4981daeccc88f332ae014c9623658498b985bbb5591903be42591e1f86378a89ad0b2f9f81ae2015

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
89KB

MD5
997996d9e7b9ac7a5a5d73e3bc490e0d

SHA1
f6226861c34d1398ccc155abd7c895882750d149

SHA256
061c1c63b970ae3f5d3270fcec8800904599054b9eed835d33f101169f715f37

SHA512
9ddbd69924609b6c90f3ba09eb515eabbc67af7936cca540e3a37120c01116e160e2bb706d027248469e0a69211959b4d3e047df2f81a03a4362e7287db868bd

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
89KB

MD5
f481223adc3321427562e0388e0d08e7

SHA1
f10deebb3452fc6ec2e748c9fb058820de3111fb

SHA256
3f4459ed34db021a0d1045ec6f34bc08f19b7bfb9e324711414920f2a0b3969f

SHA512
ea53321e1c580838f0ba78d4fcf1f1b1865bc3a38f6c03e7c05d8b0a6a11c2909cde6f571b5e0df219123346ed77a863221c8cd2d6b8167cfffa2bb2b3970737

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
89KB

MD5
bb4c43d53bd98a5be4d840a140d399e9

SHA1
9050abdfc26a8eaa92ca94600b01f3b9b39286e4

SHA256
f69e4b273589739ea079b476db6572677b9b9f1343f9264d8b62ac41d3a36d18

SHA512
9e1ff5350dfd6c5373e4be235e36bbfac60536ee390497c9edfb414d27759015ed27be0453c30482da8744c7ca698446e90fb5656b69a54fdc4934ed85e088ee

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
89KB

MD5
a28e18a6254c0e31e8a69aa7c028854b

SHA1
afa31f4e99339b35b867d9955a6e308cba9df443

SHA256
392a938b4105a91d67cd87998458b69250f03601f1645e66628626e08c73dbee

SHA512
e449ac1c46c071b9aeb6eb76b852222c6a74e0473e9d8158d1c9c53bf8b0026c1c632a4a3d2a0ea44b1d42697e02fdf8114f0035f6717dc59f10a978c84735be

Download Submit
C:\Windows\SysWOW64\Gfnphnen.dll

Filesize
7KB

MD5
0310649c090e864ca4a874480e305926

SHA1
0730b8398effe343564a28e1eb82e569de029adc

SHA256
14f28f853405e3ed81fcc6a8d73c2ba91c0bbc2cfba13a9782dd9b8792f7f9bd

SHA512
89f8dd56bb292fba1dfae45a9454bcd0db0a908e083932ad5d189fe5737cef62c42abbf5ceeaea18b2ff56b21ebdd036750525a46a72575c69db66e5b910cb79

Download Submit
memory/212-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/432-414-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/432-274-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/464-404-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/464-346-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/740-47-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/860-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/860-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/932-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/932-191-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1080-183-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1080-426-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1092-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1092-394-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1204-328-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1204-405-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1364-63-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1444-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1444-396-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1508-411-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1508-292-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1624-403-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1624-334-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1724-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1724-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1864-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1920-399-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1920-370-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1988-415-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1988-268-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2112-345-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2136-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2136-159-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2272-428-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2272-167-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2276-409-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2276-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2292-207-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2292-423-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2308-199-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2308-424-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2356-262-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2356-417-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2392-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2392-358-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2468-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2468-316-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-397-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-382-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2828-286-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2828-412-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2948-79-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3116-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3188-433-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3188-119-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3200-175-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3200-427-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3292-420-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3292-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3332-223-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3332-421-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3404-422-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3404-215-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3460-111-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3632-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3632-416-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3688-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3852-352-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3852-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3940-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3940-144-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4204-410-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4204-298-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4224-364-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4224-400-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4248-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4292-95-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4544-322-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4544-406-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4600-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4684-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4684-127-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4748-434-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4748-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4768-87-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4832-398-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4832-376-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4844-151-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4844-429-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4864-39-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4876-71-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4972-248-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4972-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4976-239-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4976-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5116-103-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads