berbew | 8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe
Size

360KB
MD5

0df70b4f52a1d912d4c9c756f7433aeb
SHA1

9e83fc83dc34f10c2d4c0127ad5effe7e5e1bde6
SHA256

8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa
SHA512

684d63d321d3e641541c87c98e36da49b99084664bbf43ba54474eb54b950578821df9ec78f53e7334120b9fe93882af775edc55b1f7187a0d5268288edd51be
SSDEEP

6144:jGvBthnrCpX2/mnbzvdLaD6OkPgl6bmIjlQFxU:jUrCpXImbzQD6OkPgl6bmIjKxU

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3408	Bfhhoi32.exe
5020	Bmbplc32.exe
1928	Banllbdn.exe
4108	Beihma32.exe
4936	Bclhhnca.exe
4924	Bfkedibe.exe
4808	Bjfaeh32.exe
3272	Bnbmefbg.exe
3644	Bapiabak.exe
3676	Belebq32.exe
764	Bcoenmao.exe
2156	Chjaol32.exe
3276	Cfmajipb.exe
404	Cjinkg32.exe
2928	Cmgjgcgo.exe
4900	Cabfga32.exe
2472	Cenahpha.exe
4056	Cdabcm32.exe
3904	Chmndlge.exe
836	Cfpnph32.exe
3752	Cjkjpgfi.exe
748	Cnffqf32.exe
4368	Cmiflbel.exe
4456	Caebma32.exe
4364	Ceqnmpfo.exe
2060	Cdcoim32.exe
1540	Chokikeb.exe
3744	Cjmgfgdf.exe
2108	Cnicfe32.exe
4856	Cmlcbbcj.exe
228	Cagobalc.exe
1384	Ceckcp32.exe
4952	Cdfkolkf.exe
2964	Cfdhkhjj.exe
2564	Cjpckf32.exe
3960	Cnkplejl.exe
2764	Cajlhqjp.exe
5116	Ceehho32.exe
2276	Chcddk32.exe
3760	Cffdpghg.exe
3880	Cjbpaf32.exe
2708	Cmqmma32.exe
2624	Calhnpgn.exe
4316	Cegdnopg.exe
1920	Ddjejl32.exe
5016	Dfiafg32.exe
5028	Djdmffnn.exe
5136	Dmcibama.exe
5176	Danecp32.exe
5216	Dejacond.exe
5256	Dhhnpjmh.exe
5304	Dfknkg32.exe
5344	Dobfld32.exe
5376	Dmefhako.exe
5416	Daqbip32.exe
5456	Ddonekbl.exe
5504	Dhkjej32.exe
5536	Dfnjafap.exe
5584	Dodbbdbb.exe
5616	Dmgbnq32.exe
5656	Deokon32.exe
5700	Ddakjkqi.exe
5736	Dhmgki32.exe
5776	Dkkcge32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cdfkolkf.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Cdfkolkf.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Cenahpha.exe	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Doilmc32.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe

Program crash 1 IoCs

pid	pid_target	Process
2548	6076	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndkqipob.dll"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3408	4148	8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe	86
PID 4148 wrote to memory of 3408	4148	8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe	86
PID 4148 wrote to memory of 3408	4148	8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe	86
PID 3408 wrote to memory of 5020	3408	Bfhhoi32.exe	87
PID 3408 wrote to memory of 5020	3408	Bfhhoi32.exe	87
PID 3408 wrote to memory of 5020	3408	Bfhhoi32.exe	87
PID 5020 wrote to memory of 1928	5020	Bmbplc32.exe	88
PID 5020 wrote to memory of 1928	5020	Bmbplc32.exe	88
PID 5020 wrote to memory of 1928	5020	Bmbplc32.exe	88
PID 1928 wrote to memory of 4108	1928	Banllbdn.exe	89
PID 1928 wrote to memory of 4108	1928	Banllbdn.exe	89
PID 1928 wrote to memory of 4108	1928	Banllbdn.exe	89
PID 4108 wrote to memory of 4936	4108	Beihma32.exe	90
PID 4108 wrote to memory of 4936	4108	Beihma32.exe	90
PID 4108 wrote to memory of 4936	4108	Beihma32.exe	90
PID 4936 wrote to memory of 4924	4936	Bclhhnca.exe	91
PID 4936 wrote to memory of 4924	4936	Bclhhnca.exe	91
PID 4936 wrote to memory of 4924	4936	Bclhhnca.exe	91
PID 4924 wrote to memory of 4808	4924	Bfkedibe.exe	92
PID 4924 wrote to memory of 4808	4924	Bfkedibe.exe	92
PID 4924 wrote to memory of 4808	4924	Bfkedibe.exe	92
PID 4808 wrote to memory of 3272	4808	Bjfaeh32.exe	93
PID 4808 wrote to memory of 3272	4808	Bjfaeh32.exe	93
PID 4808 wrote to memory of 3272	4808	Bjfaeh32.exe	93
PID 3272 wrote to memory of 3644	3272	Bnbmefbg.exe	94
PID 3272 wrote to memory of 3644	3272	Bnbmefbg.exe	94
PID 3272 wrote to memory of 3644	3272	Bnbmefbg.exe	94
PID 3644 wrote to memory of 3676	3644	Bapiabak.exe	95
PID 3644 wrote to memory of 3676	3644	Bapiabak.exe	95
PID 3644 wrote to memory of 3676	3644	Bapiabak.exe	95
PID 3676 wrote to memory of 764	3676	Belebq32.exe	96
PID 3676 wrote to memory of 764	3676	Belebq32.exe	96
PID 3676 wrote to memory of 764	3676	Belebq32.exe	96
PID 764 wrote to memory of 2156	764	Bcoenmao.exe	97
PID 764 wrote to memory of 2156	764	Bcoenmao.exe	97
PID 764 wrote to memory of 2156	764	Bcoenmao.exe	97
PID 2156 wrote to memory of 3276	2156	Chjaol32.exe	98
PID 2156 wrote to memory of 3276	2156	Chjaol32.exe	98
PID 2156 wrote to memory of 3276	2156	Chjaol32.exe	98
PID 3276 wrote to memory of 404	3276	Cfmajipb.exe	99
PID 3276 wrote to memory of 404	3276	Cfmajipb.exe	99
PID 3276 wrote to memory of 404	3276	Cfmajipb.exe	99
PID 404 wrote to memory of 2928	404	Cjinkg32.exe	100
PID 404 wrote to memory of 2928	404	Cjinkg32.exe	100
PID 404 wrote to memory of 2928	404	Cjinkg32.exe	100
PID 2928 wrote to memory of 4900	2928	Cmgjgcgo.exe	101
PID 2928 wrote to memory of 4900	2928	Cmgjgcgo.exe	101
PID 2928 wrote to memory of 4900	2928	Cmgjgcgo.exe	101
PID 4900 wrote to memory of 2472	4900	Cabfga32.exe	102
PID 4900 wrote to memory of 2472	4900	Cabfga32.exe	102
PID 4900 wrote to memory of 2472	4900	Cabfga32.exe	102
PID 2472 wrote to memory of 4056	2472	Cenahpha.exe	103
PID 2472 wrote to memory of 4056	2472	Cenahpha.exe	103
PID 2472 wrote to memory of 4056	2472	Cenahpha.exe	103
PID 4056 wrote to memory of 3904	4056	Cdabcm32.exe	104
PID 4056 wrote to memory of 3904	4056	Cdabcm32.exe	104
PID 4056 wrote to memory of 3904	4056	Cdabcm32.exe	104
PID 3904 wrote to memory of 836	3904	Chmndlge.exe	105
PID 3904 wrote to memory of 836	3904	Chmndlge.exe	105
PID 3904 wrote to memory of 836	3904	Chmndlge.exe	105
PID 836 wrote to memory of 3752	836	Cfpnph32.exe	106
PID 836 wrote to memory of 3752	836	Cfpnph32.exe	106
PID 836 wrote to memory of 3752	836	Cfpnph32.exe	106
PID 3752 wrote to memory of 748	3752	Cjkjpgfi.exe	107

C:\Users\Admin\AppData\Local\Temp\8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe
"C:\Users\Admin\AppData\Local\Temp\8b0f8de1e3c92ce93d41ba6418287352eccb6234966615ad33ac28a947ba5aaa.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\Bfhhoi32.exe
  C:\Windows\system32\Bfhhoi32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\Bmbplc32.exe
    C:\Windows\system32\Bmbplc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SysWOW64\Banllbdn.exe
      C:\Windows\system32\Banllbdn.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4108
      - C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:748
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3744
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2108
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:228
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2964
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5116
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3760
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3880
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2708
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2624
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1920
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5016
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5536
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        64⤵
        Executes dropped EXE
        
        PID:5736
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5956
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 396
        73⤵
        Program crash
        
        PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6076 -ip 6076
1⤵
PID:6140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Banllbdn.exe

Filesize
360KB

MD5
d0ea1aefd39fe4bede1fa6a097992dbf

SHA1
2dc9e97a21111c9ada43a91ffcfded666eabae1f

SHA256
9d7893a0fdd5d0129aed3538cf2fa370dc7e5fa2d5b2087cb80db8b84c5e6fb5

SHA512
ff90cc5cf0bee61797b2973da9a51c486bbeb7ffb9b3737b80a4caa724a49594b7a8ba6664120641fd6fb035fbc1834a90bc5f97f5447fc0177f31fbce00aaf0

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
360KB

MD5
7ee07c99bdcf06b56bf104a16fcf87d9

SHA1
c23d9809605d854ba8a8b8c2dac4ba9aad3baa9b

SHA256
23bb8c8362259e772235b67e82366b3ceea22a327b4f45dc0c140f619927ed9a

SHA512
71fee4c6834078d62dde73ecc52b241526dd30ac2725685eeba9222f8b2fb1eec4f6457997230a91fdc01308b1989ada75c39b5efe8450845915bc4dca11b962

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
360KB

MD5
690d4a014eb76cfb8b9c3eaa149d3f5c

SHA1
c9e754020d9d28107e0ad4843759ffeeff164481

SHA256
d81e1d9d73de8b305b154d91e3e2122ee38cae88fbb059dda67e0a0809d9b1d5

SHA512
771554f53cf6d2b2a08f799f4c243b50323ef6d1124ceb2500df28209082dfb8ed54460b41caf3e746ec9646f3f6ebb6cb1615e10ede029097a56a868e7e3b2d

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
360KB

MD5
b33510b7dc804aa9c37798151a2f521c

SHA1
96dbe051f3defe159188f636924d3f00ccf99355

SHA256
8f7e51579caf8c813fc3e270e2364ca38e375ac05be61c58e64baa2158f80f4c

SHA512
e96e6c0cc213983f6cdcfe3e516c058410cb1dc05aa2868aa7ad546bcb319eda774b894bd4f428399bbe60679ba0d83cdf1906a351a0d284bc38d87263f0abbd

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
360KB

MD5
6df73171e1ed9a58f52a6bc786095ce6

SHA1
b69fd4306f03d5776b72754a6fe056c32ceab96d

SHA256
3939e532f66989922f76d97718a2bdb7ef105fab9b37f8d72af2e720fb96b3bb

SHA512
d49e40f646bb8ab2c0273864f64719a3f494d84338793681192788deb10d1b236618762b14679f5fcdb6e563bff932a3b7f6a2d2709c0286169a45c2a471e0ea

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
360KB

MD5
92f87820fb7d5bd437e1cf68508a9504

SHA1
e62f06afdd53bd7514f56e989f5e014e27a8b264

SHA256
228a06ecfcc1c3cb6763a74fb204c5658c65ca9093eadbffeca97272b95813dc

SHA512
2e8da121a8a96e51267487d91750485dc2192c948c70a0a15f507f09ec8fb0f726908d45e9f26bd01aaacbf259dee83f94f71cee8d2960e76e1f123681d979f6

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
360KB

MD5
e7be3adc455ccc7f4210804074820815

SHA1
1937af9fee7e7e6c17b2ec58936711e0d0926f02

SHA256
65f08d7490baef7113a34f2b103944191f2bf18412864e5853e5a8d64bf2db82

SHA512
7b3950f5e739a598d8db4a26da63f6889f9b20b5c7481fcea280d948b6e0d39cacaaf797091e62301fa457b4c3ed36a1b25ceffd8f5000784fc568cc5cac012c

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
360KB

MD5
cfbdc9365071445011bcbda6bdfa7c62

SHA1
d6b35b1d31fceea68c3ade6d8679989111906157

SHA256
ce9eeb556be5a9fb5865112794c97c2fcc11f33e060ca56c43446b66095f733a

SHA512
6cec6b45c710d9c3c6be903d89dcfc6533b91fc4c24511858629e1472c850257f85ebaf2f39a9a71166700ca1aa79fa382df901ca7ba09ac0c3b907de12caf3b

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
360KB

MD5
090718366f35f309a348a7cd9e54641e

SHA1
ac887ab32f0336a9b4bc099bef18f4b937013333

SHA256
69724a17ac5f7981c6ca35e383880ad7374497f4eec7c02b923a12a5766b2fa0

SHA512
976e74b9dea192572cccf8c000194887257e36507b50757719c8b22aae6e1032a900197b249a1f7144e2c881179c68851914c4b8f706415eed9a76ff75bf7ce1

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
360KB

MD5
b0a9019d2aedf488e8957473d1874f8c

SHA1
6ce12a08c8c35b8b18549856e047a7b3f97da299

SHA256
b8fa713192c89f48032e8163692146fa0651427e1536d51744a3256f42773361

SHA512
7d4046d46a1cabd58b47c12ac8fe82200f866fd8f07779e7b2161eafba2d3532a059968fd38c4323c46faf35960e789f6d8094ab13d687c664897d654488b2d9

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
360KB

MD5
c950201862b7ae33d59ca56b0404a506

SHA1
61afbb0aead65d7197463f86805b18b53fd7ae59

SHA256
8720bf6825bd78bd87e68ad13390bf5f9ef8011abb6b81b1761c67ef276be66b

SHA512
8170b6220bca8db6aba8c41e51999602b33b42384f41866e85a5770acfed607165c53132e5bcfbb9994517a743c976a02ba688a43c2b6ba140dba436601b6cc2

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
360KB

MD5
81dab4eddc860306516c972ba22e3f1b

SHA1
665c06296428cc3f6bb316330d20595682da80e8

SHA256
e8848da6cfb8b857747052fbf54efad44cb33429b151efcf128730e535f496ac

SHA512
c782da0767ce15331151b22a93d2bca188e3974e24c4c8560491ddb47b92615c0b1006e507bfc3686971d8910a40986df03264f93d1e53863d64e42e701f6002

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
360KB

MD5
b63984bb9a995711d58701fad2c15441

SHA1
8ec075baeca95f929802788b0aa8cb982d3ca105

SHA256
7439876099694c4bef96de141117a6cf9fe1b7c5846b77531153884b6af7cc47

SHA512
686500f2d71e35679c7932374b5aafcb20ced44c44ecb710d8deca7fe69ec839d886541fcd414f7315e21566ac15b284ebc36f02b991ff296ee8da449b9eceba

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
360KB

MD5
a9c72487152e7990f3d36975f7a1e75e

SHA1
4b574f36f801b98240599197fce2ef16f98bc82f

SHA256
8f91b30667918851512c0eee70e16526fdd1b94956f710f0fa69b9739c2a50bf

SHA512
86ca0a68f0af7f69ab78ddb833a11cd629222d6e70076cc280598d0959f36d8cb61a8da8d54eaa27178de1f1c815dcc1b5429bd61b3c09b2c178863c0ef88842

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
360KB

MD5
c377d08ea200af99422a1e70604c3bb9

SHA1
fb1d804d59924183a71cafae3b369437b190862e

SHA256
3dc30ebdf08399457258f14f324158513e99899b8e107a63e939a7a563256a15

SHA512
ad2552cd0127a3a368ed09bf5876dbb9d4bfe6f4f1cf3f1d40322cb56025b0e946a26539b4c3c168ea58a7096ef61372c3677ad5a32ecd82f32101b9b62ec88d

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
360KB

MD5
2c2b5e46a5ea3eb5448fe1ef5da6579b

SHA1
948362d3c242e5402909d1c4c7800de88819b84f

SHA256
eaf26e32d18dc63265ba3cb31a3533b304d11b45ffbb5f5e8c83363bd1092b92

SHA512
b815d4263eba05c7270da4780b5173f092697796ff520732d535f128087bd0f1c889c09f1dace5db2092f61ac2c2c3a76d0641ba3cb69c8acb9cf654823795bc

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
360KB

MD5
9ac926068b5cf2fef50ed1383bf01728

SHA1
5083b97bef8f5b9cd02874568e5862dd198ead87

SHA256
f9836e141492e12e349153a1da87c7814585ed843e0fd596aa488f2bd62f33e7

SHA512
7838a71dd6e6c60e27e4894dd5b5206820f20d733023de5b94ff08f04f2cc1b37ad9574865c154820e22de9aaf6285b4d6b2522c0fdf623d1ee7dd635f100b17

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
360KB

MD5
7d1fc6a5da17651f416abee9effa0128

SHA1
3485ae495af882c6ad71279137d372361e213fdb

SHA256
a109e7d3399c86a8a7a6b36ef1614db13519f0adc73167bc92f23828a7f3dd45

SHA512
8bf9ffd339cb3e264603e6bbf9fde3ce2639330ea7ea0c9f8f2499919dab426946fb03d2615aa9db63d12bd3193f04e4ee72ad9848fc63eb962c33168ea1e997

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
360KB

MD5
c6deb051d38a3952e0b3f854834b1d4a

SHA1
d2e153f0821ad20c240330b4694d19b854e292b0

SHA256
af204d01c1fb2c23fc371f1e49f2cbe42b2e033d4df73977cbffbc70c3a6a28d

SHA512
ab73fe18819790a8309b5a18716ee381c18079d1de6927b955c00e1384b65e41967d9b00027c5e92d8895dea062b344af6eae5be3efb31822cb59433f6280ef7

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
360KB

MD5
a8bed6799461e1e1f4b7c044c0959f1e

SHA1
f038cae103d28db941b84ed0a49b4021ebc18fb8

SHA256
b20add3651bc59598e41b75dd1715d103071779ca12a1536c1253ad60ee1f1bc

SHA512
27f96ce35a8fa3ff32791f0694d6c96a3aefa20565c42221f312dbfefbdf5e6b3de30687762ce3a290e7e06fdbf73a0564183c0686e7b4d6c43d68c4e2e888fd

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
360KB

MD5
6cb227803de357117b1c4942cc06b3dc

SHA1
2597543124d9898a09bdb6a1e03410cd160d0c16

SHA256
de8181fbabf74b7ae883a296dfce401a345aaafd381d2e806be9355331c2df84

SHA512
c5c8f02c37605cba824716791edd2cde8e0a09ff41d6c30fe1f01e3611cca5329c372068901f39673b4a5aa6c6dafb1eacdeae76c80e6ebf2b41d25bd4e0f1cf

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
360KB

MD5
1577ef5356ce7ff74f643355130046d2

SHA1
2f6d8df4061d89e45e205075599232751ec6d40f

SHA256
d07e79df810e2f8d4eaeb7c1cd98dcba6e61327c22625b49fd694491b14352c5

SHA512
3a7fbfd76100654a2442ff9dc5b6d40ecabe01e33e8477dd00d79ff1d41e4d2fc676896f5bc60dcde7474f69b1c8c352fc6923e7a78481010498cdcab686c440

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
360KB

MD5
7e7f9a58471567124bde9cb027720554

SHA1
7ec6c46811d33912a48694abf5fbf0cbdda98a95

SHA256
ef0a50f46c6f74fd0eb005e708644a38dd7bfc69f8a34ff57b892706e5e101ab

SHA512
a402407801f962382bd601f87a8739819440a692ec94a9aae2874aebba3b8cb09acc578455e2e0974ed3c491047a9a0b26fdb78301a73dde6bb7bb3cb81dcd8e

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
360KB

MD5
7b7fa435495e2a2f2cc0886f06d0edf6

SHA1
5ae0b8cde9013fbcf2ca5f42ffaf39fb3efdc6b1

SHA256
bf57fb03cb7132c2399ba99580fd40ff0447c9acb23fdff2dc9579827cb78404

SHA512
1eeb9b7e634095384baa29ba39a6e6ca87545b3fcaf09c0b6521887f190a61658a827b4a7d692fc71894d484af7090d99807a9b855e924f17572f2dd2569f9ef

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
360KB

MD5
308517ab2433b3e20261c773403f0665

SHA1
f5dbb5ffa6c177f5d1e66dfc0bf77d8e5a298d86

SHA256
31b5798fb57cca31d9d2c9e1cf1ac7dc53265b2e2ee6fa54b2644df70ac9b60d

SHA512
2a8c199be0e5bf850bcc86464c7183c7131bd1d33a42221fd6e444c32b88894ef1dad87a798c4a7d37a57ae885d59b25eb211203a86f73cb0c2160f1bc751940

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
360KB

MD5
ee6c9c4bf547dbeca6fe46df58437010

SHA1
1f8f56e7c1566b7600513be47f54115a1b071953

SHA256
0aeb318f80cd08deabbc31d6710b7fc715511de411b699ba0f468d1aceca6f05

SHA512
56623112b93a399c5acc3815ba83260b80e5dca1c04a8f6a88ac752d1fca19761b660a95643c995ed4a914b1802d9838d10f0f432f567c3474cd4496854ef636

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
360KB

MD5
19e0961cd0766fa98bfbfa4fd382a49e

SHA1
5650b782d9391bc61705f3e63af8560df2e46dd9

SHA256
f14ac35d33ce06e0d5f38bd1405a310ffb4b3ae68b1e5e60331080150c413b14

SHA512
483e819d14d0bc5188a052c6fa6acb2bce26d7668f54cc613d02a044da0c6957d2317247040b36ed5be0c65119f20b9bd9db11234f80e802475563304627b32d

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
360KB

MD5
44741ddb018847ec49cd96373de2f66f

SHA1
a9f7f5387f84a4b4e9f23a4dee828a299c0a6046

SHA256
db7c1acbaad633460478b9bfbbe4a27e4e7105218edb3297961b078edead3104

SHA512
eb4320f914f2d6853ec09842efce3baa5e9e8f285715963d97ad8b63df94f3e650e587587c9f5aaae27f99f2766fb16b9d77fd4b44c67d71ef1b3a52c90cfa76

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
360KB

MD5
66135c9427118642c9299d49c627c11b

SHA1
d65d189a83b4c8f732b2c03018f7cd3b11a373b1

SHA256
00089d732eeb03cc279dc8d8f4c5011060f7e770eadc6d07679f604a974f9545

SHA512
77a1eae1ab919d18581c0f13d576c1dda959d3abaad707b037b9520d4184e3f590a812e99feeb2fa165f9c72330f769becfcf5b7b5aced2e6c789035426ab8ca

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
360KB

MD5
d9f8b2c75dffe8499ceef7e40c31ddae

SHA1
f2fa3ac43ceb2086d6efcc3b09985323c548b7af

SHA256
d5f89e2b43cca85519f74ed05c71412aa56cbfc693c07ff5c4a4d5847324581c

SHA512
cd277dbfcbe66621f2917b7265ea0b683a9c846af3c4d1494627339626cd2092d36eedef1b13d1cfa4be082bbf370f6db4d311e36b8df0ec6553794c7cc0b22c

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
360KB

MD5
ad7a4a1bc8208348db3a1546b30151ad

SHA1
e73bf4daaaddc7f30443205d5d32d9a09a949c67

SHA256
6a551754d46aa3c0e9995736dd4ed56b52ccbe443c7ec2916e3ac0977da14c4b

SHA512
4d73af2e44dee20e01170abe36b15f87f0e78588f2662ec464ec407c8ba4d632240b9456d1ff5038fc6a728066d5c06062f60a358e1b9296f0884e62375e2be5

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
360KB

MD5
78d2ab077641aa65f4655460deb7cb89

SHA1
20875ab10618ed0e2b0ed68347b5af128b1aed1f

SHA256
c3cf18fea0a75c695f46f6ff6a6ac1ca06aea48796a81cca029a08cd0d479992

SHA512
0e806b3146aee7edab3723c1b5cd941374b4bc4fc3dcc28270fdb9d6aeeb7857d7324b72d26831f8181496567df3f104417029ba8c84a6173cb5765ee754c8a1

Download Submit
memory/228-252-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/404-117-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/748-180-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/764-92-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/836-165-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1384-261-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1540-220-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1920-339-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1928-28-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2060-213-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2108-236-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2156-101-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2276-303-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2472-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2564-279-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2624-327-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2708-320-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2764-291-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2928-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2964-272-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3272-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3276-108-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3408-563-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3408-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3644-76-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3676-85-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3744-229-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3752-173-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3760-308-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3880-314-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3904-157-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3960-284-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4056-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4108-559-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4108-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4148-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4148-565-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4316-333-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4364-204-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4368-189-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4456-196-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4808-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4856-244-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4900-133-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4924-53-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-44-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4952-266-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5016-345-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5020-27-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5028-351-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5116-297-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5136-357-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5176-363-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5216-369-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5256-374-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5304-380-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5344-387-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5376-393-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5416-399-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5456-404-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5504-411-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5536-416-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5584-423-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5616-429-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5656-434-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5700-441-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5736-447-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5776-453-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5824-459-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5864-465-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5912-476-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5956-477-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5992-483-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/6036-489-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/6076-490-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads