berbew | d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509

Analysis

max time kernel
94s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe
Size

128KB
MD5

acb3ec790d68ba9f6661aca9ec8cb8dd
SHA1

18f1eddfcf9ebf9cf66a4bf94fcc859baec743e7
SHA256

d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509
SHA512

ed971284f99eaa9946229abf9c63f888dea6d30b933a8e37c430acceb7d3d9c043bebf689bf1ea3c60c7a95b37b017f7dfe474e03e91616c37c62863ef9154a0
SSDEEP

3072:NOeOw/GR1q47cZt3xgS9Q9Tq/s99CgI08uFafmHURHAVgnvedh6:c3EZt3xgS9Q9Tq/s99CgI08uF8YU8gnE

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 46 IoCs

pid	Process
3528	Aadifclh.exe
3664	Accfbokl.exe
3752	Bfabnjjp.exe
2104	Bmkjkd32.exe
3896	Bjokdipf.exe
1896	Bmngqdpj.exe
396	Bchomn32.exe
4336	Bffkij32.exe
3660	Beglgani.exe
2124	Bcjlcn32.exe
2548	Bnpppgdj.exe
4508	Banllbdn.exe
4000	Bclhhnca.exe
2080	Bfkedibe.exe
1788	Bnbmefbg.exe
3216	Bapiabak.exe
4856	Bcoenmao.exe
2852	Chjaol32.exe
1888	Cmgjgcgo.exe
2700	Cabfga32.exe
4848	Chmndlge.exe
3980	Cjkjpgfi.exe
884	Caebma32.exe
3452	Cdcoim32.exe
3712	Chokikeb.exe
2276	Cnicfe32.exe
3332	Chagok32.exe
3280	Cjpckf32.exe
2236	Cmnpgb32.exe
3416	Cdhhdlid.exe
1404	Cnnlaehj.exe
2508	Cmqmma32.exe
3056	Dhfajjoj.exe
4740	Dfiafg32.exe
4352	Djdmffnn.exe
184	Ddmaok32.exe
3900	Dfknkg32.exe
5012	Dmefhako.exe
3656	Daqbip32.exe
4724	Dkifae32.exe
1728	Daconoae.exe
1628	Dhmgki32.exe
4092	Dogogcpo.exe
4404	Daekdooc.exe
1260	Dgbdlf32.exe
3644	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Cnnlaehj.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Ooojbbid.dll	d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Banllbdn.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Bmkjkd32.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Chjaol32.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Daqbip32.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Cjkjpgfi.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Fpnnia32.dll	Bchomn32.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Akmfnc32.dll	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Accfbokl.exe	Aadifclh.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Beglgani.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Cabfga32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cmqmma32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4484	3644	WerFault.exe	128

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdlgno32.dll"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingfla32.dll"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooojbbid.dll"	d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpggmhkg.dll"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 3528	3252	d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe	83
PID 3252 wrote to memory of 3528	3252	d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe	83
PID 3252 wrote to memory of 3528	3252	d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe	83
PID 3528 wrote to memory of 3664	3528	Aadifclh.exe	84
PID 3528 wrote to memory of 3664	3528	Aadifclh.exe	84
PID 3528 wrote to memory of 3664	3528	Aadifclh.exe	84
PID 3664 wrote to memory of 3752	3664	Accfbokl.exe	85
PID 3664 wrote to memory of 3752	3664	Accfbokl.exe	85
PID 3664 wrote to memory of 3752	3664	Accfbokl.exe	85
PID 3752 wrote to memory of 2104	3752	Bfabnjjp.exe	86
PID 3752 wrote to memory of 2104	3752	Bfabnjjp.exe	86
PID 3752 wrote to memory of 2104	3752	Bfabnjjp.exe	86
PID 2104 wrote to memory of 3896	2104	Bmkjkd32.exe	87
PID 2104 wrote to memory of 3896	2104	Bmkjkd32.exe	87
PID 2104 wrote to memory of 3896	2104	Bmkjkd32.exe	87
PID 3896 wrote to memory of 1896	3896	Bjokdipf.exe	88
PID 3896 wrote to memory of 1896	3896	Bjokdipf.exe	88
PID 3896 wrote to memory of 1896	3896	Bjokdipf.exe	88
PID 1896 wrote to memory of 396	1896	Bmngqdpj.exe	89
PID 1896 wrote to memory of 396	1896	Bmngqdpj.exe	89
PID 1896 wrote to memory of 396	1896	Bmngqdpj.exe	89
PID 396 wrote to memory of 4336	396	Bchomn32.exe	90
PID 396 wrote to memory of 4336	396	Bchomn32.exe	90
PID 396 wrote to memory of 4336	396	Bchomn32.exe	90
PID 4336 wrote to memory of 3660	4336	Bffkij32.exe	91
PID 4336 wrote to memory of 3660	4336	Bffkij32.exe	91
PID 4336 wrote to memory of 3660	4336	Bffkij32.exe	91
PID 3660 wrote to memory of 2124	3660	Beglgani.exe	92
PID 3660 wrote to memory of 2124	3660	Beglgani.exe	92
PID 3660 wrote to memory of 2124	3660	Beglgani.exe	92
PID 2124 wrote to memory of 2548	2124	Bcjlcn32.exe	93
PID 2124 wrote to memory of 2548	2124	Bcjlcn32.exe	93
PID 2124 wrote to memory of 2548	2124	Bcjlcn32.exe	93
PID 2548 wrote to memory of 4508	2548	Bnpppgdj.exe	94
PID 2548 wrote to memory of 4508	2548	Bnpppgdj.exe	94
PID 2548 wrote to memory of 4508	2548	Bnpppgdj.exe	94
PID 4508 wrote to memory of 4000	4508	Banllbdn.exe	95
PID 4508 wrote to memory of 4000	4508	Banllbdn.exe	95
PID 4508 wrote to memory of 4000	4508	Banllbdn.exe	95
PID 4000 wrote to memory of 2080	4000	Bclhhnca.exe	96
PID 4000 wrote to memory of 2080	4000	Bclhhnca.exe	96
PID 4000 wrote to memory of 2080	4000	Bclhhnca.exe	96
PID 2080 wrote to memory of 1788	2080	Bfkedibe.exe	97
PID 2080 wrote to memory of 1788	2080	Bfkedibe.exe	97
PID 2080 wrote to memory of 1788	2080	Bfkedibe.exe	97
PID 1788 wrote to memory of 3216	1788	Bnbmefbg.exe	98
PID 1788 wrote to memory of 3216	1788	Bnbmefbg.exe	98
PID 1788 wrote to memory of 3216	1788	Bnbmefbg.exe	98
PID 3216 wrote to memory of 4856	3216	Bapiabak.exe	99
PID 3216 wrote to memory of 4856	3216	Bapiabak.exe	99
PID 3216 wrote to memory of 4856	3216	Bapiabak.exe	99
PID 4856 wrote to memory of 2852	4856	Bcoenmao.exe	100
PID 4856 wrote to memory of 2852	4856	Bcoenmao.exe	100
PID 4856 wrote to memory of 2852	4856	Bcoenmao.exe	100
PID 2852 wrote to memory of 1888	2852	Chjaol32.exe	101
PID 2852 wrote to memory of 1888	2852	Chjaol32.exe	101
PID 2852 wrote to memory of 1888	2852	Chjaol32.exe	101
PID 1888 wrote to memory of 2700	1888	Cmgjgcgo.exe	102
PID 1888 wrote to memory of 2700	1888	Cmgjgcgo.exe	102
PID 1888 wrote to memory of 2700	1888	Cmgjgcgo.exe	102
PID 2700 wrote to memory of 4848	2700	Cabfga32.exe	103
PID 2700 wrote to memory of 4848	2700	Cabfga32.exe	103
PID 2700 wrote to memory of 4848	2700	Cabfga32.exe	103
PID 4848 wrote to memory of 3980	4848	Chmndlge.exe	104

C:\Users\Admin\AppData\Local\Temp\d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe
"C:\Users\Admin\AppData\Local\Temp\d45c8e2f4a5b57a0a33de6d3770c8ea8e4da771de7f9c590eea543a435094509.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\Aadifclh.exe
  C:\Windows\system32\Aadifclh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\SysWOW64\Accfbokl.exe
    C:\Windows\system32\Accfbokl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\SysWOW64\Bfabnjjp.exe
      C:\Windows\system32\Bfabnjjp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2104
      - C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3980
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:884
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3712
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3332
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3280
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2236
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3416
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1404
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2508
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3056
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4740
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:184
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3900
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1728
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1628
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4092
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1260
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 416
        48⤵
        Program crash
        
        PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3644 -ip 3644
1⤵
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
128KB

MD5
c798eb71219cd3525bf3983baca7db2b

SHA1
060a3e387dabd6dbeb464a878b20b14f84439d3d

SHA256
6faf63749c0ad7190ba97d4352619fc2165b5731a01617babe37999f4dc28e23

SHA512
bfbf9110462407a0ccfc1c16b6b6c6cf5879792ff19bc5963aa909fbdb9519cba6e0b0ac0d6ed6bef9f46fe3c749f16bec910cab5b646e1f34c906b8f9f0e311

Download Submit
C:\Windows\SysWOW64\Accfbokl.exe

Filesize
128KB

MD5
23c26cd13c4f7da304d3d3628bb62224

SHA1
ea6dcdbf8fda883f35ce965b7f9c418dc53db8df

SHA256
a819c7c35f60bcdaca29510d04f64225e44998745c8e215be493b1fc2b1d321a

SHA512
133bc7f9c4f818a7c4c0ede9b781ff8c949ff20c4badb4696867784a37234aed63c098f600afcb00b908edc83fa011c963554770caf6e7c54308bf5a5992c025

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
128KB

MD5
53ab1bcf81928b54bb560ab4e04409bd

SHA1
30b67d14ba61853c8dc21cf9ef3f567cf1ec7631

SHA256
cedaecf8890230da9f576be315916bed681b66702720267f15e30b9ee2f072b9

SHA512
6ea350384194916ccb8d6458bde4253ed26bb63c3321c1eef44a4a0f5dd1c343bbd43f188ab3b435fcd0fa95edafbb145a73d47becd81dddc7ed671dcca23247

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
128KB

MD5
8c837423d980b3295da93c42686ac532

SHA1
12179a3e9bca88126e4734921a8b00b7ab7ca3fc

SHA256
566e32dae0b4f324bacd397754334a1d1893310abb334a718186e92850fa80c0

SHA512
fd47f97dfa94111d4ac15d2597cf9376b7704428bf08573570c0595eca41a7c8333de4e81547ab2021392c8df90dcd9b072fa0e5b899a383c68a4d7602911edb

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
128KB

MD5
9506be1230b8d57e16e5ec0ac1a84979

SHA1
c93e03c5decbf7f882abeadbe30df64259bb5aa8

SHA256
acaffdcc60baa027473c8e0a2c101b0d127391653e1875dde948305663de1c7f

SHA512
5b8d1a84dcb2540f0fcdad7a7fe457a73970e331a1ec81f00da78103dc8fc88f7c6651fb696bc266a696fa2d5cbed3371d8332203c12846d0d316e41d8a5dd9f

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
128KB

MD5
d9e47c925171d84cda832d00088e0ade

SHA1
81fa17c2a99af3555f5c37493b6f248a0336fd5d

SHA256
f3081925dda5ac2b1c0b5588699c9205520bb0f46bf2703dfa8315979df13197

SHA512
1cc537e4722fd52ca56217b7dcb74633d25d7c11577287af9f8f0baac11b6830e060debb2b166e8014836404038922a2fcd59b2c0234533c4925debbe9b9c206

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
128KB

MD5
bbf02a4080ba9d975ca0b5a31c570977

SHA1
209cb21b39eb98223746a13944a578d24f0d3cce

SHA256
57ff20507cbd08461f31150e8ddd4e7409afbbbf89d2ce47f92b89a0a1781e6a

SHA512
830b8cef2f990fe73055bf7d4c941fffa6c21796ef127b4ce235a57c22c3d9f167c680eddfdc35b4d20745b72d91ee513f14f1d98abd902c8aee8e7984b891d4

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
128KB

MD5
bca14b84c205ce2930887735c59180cf

SHA1
8746fefafa2afcfde43513959bc8d7cdafd89fcf

SHA256
ff2a0c162a89b47b07640a20b1624c265e9d644048ab235d555b94c35e63f29f

SHA512
5af60a994e1248301f7b83cafca0fcc34d456d3f4175575abfda9c4ab326238a44927e3ae094778b86bb0c1f5ba5bf10ea96e2935f2fcb67ff3acba62ae67a0c

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
128KB

MD5
bd08a0b5ef6a900cde36ddf45dcd0b77

SHA1
e71a40dc204aab4aafb98bb524bc423949cd4da0

SHA256
9d6f00b31eff28f88ea692ff235493941b494f133aad0bf0f6a1626a5af962a3

SHA512
e5d55959a2fbba217b7891e306487eec47c532290b705cf65f645756e08da03124d04e6d40da4405f5702adb8c24c8c7a25074e232891df5107737c43ece00bc

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
128KB

MD5
e7a3a5af4be023f27b7bf1fdda51d173

SHA1
b4bacea6ac56b5f758e9864edbf4ba0938c9c1cc

SHA256
58a42baaa40480815bd3c9f4537754be5d1375dafcc34e64a5635b990a07f0aa

SHA512
4e74ed73f8542cf282689b124dc5af6b1a98af3a1ac068e5a292c25ed2774c6ab86a91391d3c5b0b5d49a0f27413c309ea4abc839381b7ffcc9c1e531704cb0d

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
128KB

MD5
15193b1e3bfb3169471c0289c129e73d

SHA1
ad28a95a633a94b05dbd87589da44d354c00d46a

SHA256
6e7b3afa67c180409ed1dd6cda1a77901a20427540b08ad10581a9d185a1f738

SHA512
f764444f3f22f05798bd429203964c4e9d5eed4ffba0d1ed0b6a1c4911546397c8dda74c25f15f9cb959365e621b3da1058c7816381d720490db4930bb47f428

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
128KB

MD5
4cf2d01ee07b251e4dd9081187dadb47

SHA1
985f9b81e4c172e6fee491e2b5f797629882cc9a

SHA256
665e78e409e3f4bfe9b869675bb25105ec503a2474c19b99befda7aa85dfddcc

SHA512
c100ca2917f3e29f0d2bb311d93fcf3485677fe8661daa144c4149e2e3e71f7962bf4d8e4665cc8de9f0db69b27a8fe36ef6d66676ccab33890f55809fbd6d10

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
128KB

MD5
5c77e1aa4c53c21224b093b0fbf1e1dd

SHA1
090a974a5c1479fae212707fc70ddcfdbb1f03ff

SHA256
92a26ec78bbed50d170cc05e1c7b9539c8454c03a06547308d4aa3e6c76b1581

SHA512
6223c7d24ccf6754aded88f8baa4806c600ca07fbbc9671a1b6da2a56eefd4f48f1fdb7a356399c354d5c3f86a668e92d25922022c92070d50634405330c2301

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
128KB

MD5
057ef0d01e120611780d6f8f60400d8b

SHA1
0b7889d1e82ac0fdd35d9cff0511ac389e3ca912

SHA256
bda492a5f72b09fcb64b8af28e51ee67cc906487e6044bb3218d902b5ce2fd1a

SHA512
be65bcc448c324697a45c11cae90f01da35840d15a2102f622491527ad1eea537de3e40634a4b94f9c786f3db0f346b37a2ab1756dac4d2e8bc1a2462a6d6200

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
128KB

MD5
7e74dfe6193d60e0209ce68ad7ef68d2

SHA1
f1ad44dd48542d8b3d1d0a9423c7b3fcdc03490e

SHA256
178edbe9677de23bbd3bc7cab20c81d3fdcef004f5a1c0596ebb44f7b24e607f

SHA512
43652c9cc838b7e568a4a0aa1505c1c85df9d12a20074a289116c630b7e55f0ad4072410a6195e597fc31580fb1fd85cb415fffba5336682086d1e7be538b87b

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
128KB

MD5
f295838d98eab2731628092467694669

SHA1
54cf44ec67932f151445ec8795f42e9dfaaf8b39

SHA256
819bd6942bdbfa3f3f5480af2f96ebad40cb59b6d671a43c69b6d3a64f9cacdc

SHA512
8d67146e283098b321ecdf0b5a2f1e3f8f60cb28c63f1153da47ee497f173d7dbf27ada51fbc725bb24dcbb0f6a13af577f0e057ee86fa0d05039ee0f5bb75b7

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
128KB

MD5
1f8096e2bbb154583f830a5f7390046d

SHA1
730c97d997d9a23451f341a1b10d1c9ef634335c

SHA256
b04bf2fd666ca43e47240c497275e27072ed865b3c73169d6349af42f1d437a1

SHA512
02930a74bb4aaec8d56034e291f290fdb4dd893ea782a673c3d89ef883b6bb462469e7e51a4b794c37a9cea3cb13b8675af59330dfb1f421d61f7ca709c5d480

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
128KB

MD5
1b49e09c7502b56ea400a54ba7862377

SHA1
1789b7ad3825082e3357620e59082f135ce40f93

SHA256
f1534f97db330cdd00bb273bbddc2f3855cce423889f1702a9e24f8867b78553

SHA512
ae05593898ebd6903f479e178081d75acd8fc6202bd039c3216b04df1fbe6d4cffb517ee32a036c1e541dd307e7659a102a21b4caee428727ab4fc223654ff9b

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
128KB

MD5
cbc9ddb4bf4724c7e2205f639e307b8c

SHA1
338bdafae0959d684d87027cdfa7748bc47fb9e3

SHA256
444ee459a6cb86f8053235688a513ca42e5dc2d47678d5fbb3a745bfe46d0156

SHA512
988d1b2a5967a579349b2c36bbd2f090fb471e98f3104407a02b0728b335c09577fe3a0fc35558e3fd8af997e5db617386ee6944acc72eb384622ce26e1a062a

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
128KB

MD5
1a66803a675103a2a7bbcb76c8a8a3dc

SHA1
0e06b88e495edc1f6ddc12b85a5360f11eb25521

SHA256
10b6e27c630ebb876822bb0a4e4d8a4eb6007dff6aa715953e26b0f00fc931c2

SHA512
38610b66740c027286a782cfd47ecc101f2dfb1ef9b78acfda32054122c8c63f61f9ebd0725794875649b693fae1c2237041c3af69d1ec534d72e52813308b0b

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
128KB

MD5
9567eef9a21ff1391ac5649cc60705fa

SHA1
a3183ada4668188bdb722cda043e66b4d90be901

SHA256
d254201f1c48b02b5ed2a634981255c2e9e04b7999d6d58f272c03fbae7e06e0

SHA512
fa8fcf026fb81d39909dc3aea0226088db9a4027f3e2f183e8b9a90004e682f59ff72ccea88c4b854d1f4e1f435abc6247f0a10534e97378f18afabb298b5877

Download Submit
C:\Windows\SysWOW64\Cdlgno32.dll

Filesize
7KB

MD5
9af2c113da59704ecfb30067c9799606

SHA1
fe1c5fdfb05d851a376970905014a7bce60b442e

SHA256
9856efd9368eb377032a1aff742abf96001bd807da3c04968029436447903f80

SHA512
61751e90c03f604eaf31e7e6feb231b1ce42e6d1e2c92325dc38efef3461ad2a09f6f7aec0bd744ebc9fa35d362daa37168b21a5bbccc2cfb31629152f59aa70

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
128KB

MD5
60d0e36baf8d93acf455d15669665699

SHA1
e7d3f0daefe6e4f78cd8f358287fde141b35e599

SHA256
a57b87f911ecf278ba27966ddd3ed629fc73e08d5f3c009423aaa884c7db75cc

SHA512
4607ce0d78c800511f14235358f4968c6245ab70538da923ab9a6a7071068bc774ca8d361990b3e82b700c4c73a6c143c71489c6aa4cd91b427e742f450ccc40

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
128KB

MD5
dea334fd5f5b579f6001446862e8267d

SHA1
3f4ab265e01e021f42475159be2750c3c8509212

SHA256
416391e2f4ec9e90a0a5732d1849eba816d46557dc4e79a2cf0406606255182f

SHA512
6f2e151d97b9c1552a7d8fcc7421c54ca0ee4f3728fcbd106fe166dad555f8a629b3c4dbf5aa21c99ad23c025bcedfdcbbe4834fa92a714e7364befe892ddb6b

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
128KB

MD5
0112fe7b91bc086c7ac0d4b74dc7ea9c

SHA1
a33d9415dac104d1f64747e274d9f7d3c7a4d3cc

SHA256
19ff07cd2fc6dfc9f333aca9c91e1eb923222bfce3f3cd8971811930872dcf9e

SHA512
a5740047df20fb40022d6077aa6b21857ed2522bb48ce46766f6de354fdfbedc2015c05639644d1393d098e1a29ee84e4edb915ae09e9ef0efe40c8e68efa5fc

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
128KB

MD5
a757d484b9f048ec1051b188bf9ef527

SHA1
193e09740bb51066f863a0ea8a2a656cbab06c03

SHA256
04cadd74709d9c3a5cb1fcc412e22e847cec40dc01667fc4899abc0bce0f8fc5

SHA512
309c8a31d082cec5ed96bc1ba959184a5ef9e6e4c680134ced82f98ac0376aad1f3d0a7bcdf1692d92d9ef7cc3956af35b09062121149e06e37b7eac70e5c191

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
128KB

MD5
fad0a11faa7ddcc77ac8bae6f139d748

SHA1
d3644038cec8cd05ddb1b4447762566396d54972

SHA256
eeaced017abc8cdd1bdd766238e1d63cdd4781f84a34aeb4655c0cad4529a902

SHA512
5dd252b545a80c25fcfcd6e19ad53b51309df657a6ed97c36bc6c1010b76767aef42d84e219f5f8a368249455a84f796d8614c72064f8b6ad61b4f4fb00ead63

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
128KB

MD5
7f6fbeb703d3db852999b6feb808965b

SHA1
bcc1467e3f3427cddb7f455f3d6c1ff72d70445e

SHA256
12493bfdbb3a89bda76fc30c5eb9a1b8d83181c30d0968f62910cb3f03c811b7

SHA512
4820fab5f949970bcf82e98252163a07cb01508842817edae57c6f81232a654062338a5a24f02a8143184e1bc5cb123d4242582a6d573a5bdf5416ac3e37bb47

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
128KB

MD5
46e8d366556a464b3a44d5d0415af035

SHA1
ca8eacac7e39de04bd45ac87396ba7bf8dca2e1a

SHA256
e1f4ffa921da16b2cc8a7b32cf94d173a4d4da4a95d33773ad621a25cb89d229

SHA512
43caa2d68815cffd5f7cf6aba5f0467c7230247dfa5aed2d0a598bd4935274088a851cd7bd54d25616576e0feb20f4a44c50a404bdc42edff8578805aa5733dc

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
128KB

MD5
a1aed029ef2a28c4437073eec4c0e2b9

SHA1
23649741e0229130a9e379ebd99c02dafabe887d

SHA256
c9468234f587949f234059d94f4ba5044c1258ba516f18d9a28ebdedaf341b2d

SHA512
2522b9141c17f2e69cd5dd4b38551b6c61b47bd57c3fe7e6fc077a610365029a659ce65dd82634b863b245235c6eeee1a6b888dc12dd5425eeb4973d345af878

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
128KB

MD5
224d9e1a3069d4f132e4dd86abbeb4be

SHA1
d1c122aada662e3a33f137b460edf115326490f6

SHA256
da702ea2f56996d36ab5d7650fb1da834c8aa4e11d0f1b91e185f7f34b7d02e1

SHA512
7e53f0c20ea1eb82456580abf90c5866d3ba5b31c174240da7e566f81ba7d5757b5f6c4d5fc3aed615433b5c68f5dc1d628e693a3ad2e5de051d1c797ca28625

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
128KB

MD5
e80f39b94cc9ab0b42c45fa553d3acde

SHA1
505e2f11e0713ea3ad4777716b5b5e4eed30afc2

SHA256
f0dac29fd0102eeb54bd4f3ad130490af87e7998b03ba9bb002d655ee6f7338f

SHA512
da0ce3d38c9bfd43241057385c356130e1cdefd9ed874dc616156188fa511dfd3c47b7704e0d68708fb0ff8f29e683a2263b25d22d8e0a3caf053b7a77a4927f

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
128KB

MD5
c8feca8d29b349dd5921c561bc4ae2af

SHA1
3e9d37e438e94bf2f567c29997f919a192b8c78d

SHA256
f8fac168417bda3a03aefcc4ad59350a30efc4a3822c12a0834731286ea84fd1

SHA512
91fd092f2fbc1cc579bbd3dc90f1f2eb7ddfc318eebf49e35db97e300cd264b6daade0709fb9a3e8f5d7af708b78ab7ac56f12af83d60bd033217c119003ba55

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
128KB

MD5
23fa27dda11f79c33d09f6df642166ba

SHA1
a0ea2ec18f6d449d6a8a3be0c902270c62ff7099

SHA256
deebc0f9adfaa9744a7b5dab6c78d3f563c9438ba2a100e7cf9a63ca65518327

SHA512
ab3e93574596fca2b4335674ab2fc6f6d05ab2f389150431f89c30a5fb479cf6cc7c1e72132ec40561cb21ecf6356642a75ad691cae43468f111f70211c6f9b6

Download Submit
memory/184-280-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/184-351-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/396-376-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/396-55-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/884-184-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/884-363-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1260-334-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1260-342-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1404-248-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1404-356-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1628-344-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1628-316-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1728-347-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1728-310-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1788-125-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1888-366-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1888-156-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1896-47-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1896-377-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2080-369-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2080-111-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2104-379-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2104-32-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2124-373-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2124-79-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2236-232-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2236-358-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2276-361-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2276-207-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2508-255-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2508-355-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2548-87-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2548-372-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2700-159-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2700-365-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2852-367-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2852-144-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3056-262-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3056-354-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3216-368-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3216-128-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3252-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3252-383-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3280-223-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3280-359-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3332-216-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3332-360-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3416-357-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3416-239-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3452-196-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3528-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3528-382-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3644-340-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3644-341-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3656-348-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3656-298-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3660-72-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3660-374-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3664-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3664-381-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3712-362-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3712-200-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3752-380-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3752-24-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3896-378-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3896-40-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3900-286-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3900-350-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3980-364-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3980-175-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4000-370-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4000-104-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4092-345-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4092-322-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4336-375-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4336-63-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4352-352-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4352-274-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4404-328-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4404-343-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4508-96-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4508-371-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4724-304-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4724-346-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4740-268-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4740-353-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4848-172-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4856-143-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5012-349-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5012-292-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads