berbew | 3167e29c60f5dbd468de77e8693dc04d2a89b319b3460fdbc4aabc4196f96d8f

Analysis

max time kernel
104s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2025, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Size

400KB
MD5

4cd0b8a7eef6432c1cba7246f3f03447
SHA1

325df799fdfbc5f198555c2bdfb61d9f2c46e653
SHA256

3167e29c60f5dbd468de77e8693dc04d2a89b319b3460fdbc4aabc4196f96d8f
SHA512

2cf9ed491f7cb5d45eec87b18aae0318377650a30aabc08256b362abe9a6d8d6e8c7ce8ce1386d38e3e0fc16c0f3eea550d11f7cc5761ea174e22622e2e25ff5
SSDEEP

12288:TO7im2o8wE39uW8wESByvNv54B9f01Zm:C7H2o8wDW8wQvr4B9f01Zm

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 46 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dknpmdfc.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 23 IoCs

pid	Process
2724	Bjokdipf.exe
1740	Bgcknmop.exe
4820	Bjagjhnc.exe
900	Bmbplc32.exe
436	Banllbdn.exe
3056	Bapiabak.exe
4868	Chjaol32.exe
5536	Cmgjgcgo.exe
4760	Chmndlge.exe
2120	Ceqnmpfo.exe
6072	Cmlcbbcj.exe
5796	Cfdhkhjj.exe
4600	Cmnpgb32.exe
1432	Calhnpgn.exe
3468	Dhfajjoj.exe
1720	Ddmaok32.exe
2340	Dmefhako.exe
388	Delnin32.exe
5472	Dmgbnq32.exe
2592	Dfpgffpm.exe
2360	Dogogcpo.exe
3252	Dknpmdfc.exe
3032	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Akichh32.dll	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Dfpgffpm.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Banllbdn.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Calhnpgn.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Dknpmdfc.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bapiabak.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\SysWOW64\Bmbplc32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Ddmaok32.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	3032	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfhhm32.dll"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcnha32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdlgno32.dll"	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akichh32.dll"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chmndlge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2724	1192	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe	86
PID 1192 wrote to memory of 2724	1192	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe	86
PID 1192 wrote to memory of 2724	1192	2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe	86
PID 2724 wrote to memory of 1740	2724	Bjokdipf.exe	87
PID 2724 wrote to memory of 1740	2724	Bjokdipf.exe	87
PID 2724 wrote to memory of 1740	2724	Bjokdipf.exe	87
PID 1740 wrote to memory of 4820	1740	Bgcknmop.exe	88
PID 1740 wrote to memory of 4820	1740	Bgcknmop.exe	88
PID 1740 wrote to memory of 4820	1740	Bgcknmop.exe	88
PID 4820 wrote to memory of 900	4820	Bjagjhnc.exe	89
PID 4820 wrote to memory of 900	4820	Bjagjhnc.exe	89
PID 4820 wrote to memory of 900	4820	Bjagjhnc.exe	89
PID 900 wrote to memory of 436	900	Bmbplc32.exe	90
PID 900 wrote to memory of 436	900	Bmbplc32.exe	90
PID 900 wrote to memory of 436	900	Bmbplc32.exe	90
PID 436 wrote to memory of 3056	436	Banllbdn.exe	91
PID 436 wrote to memory of 3056	436	Banllbdn.exe	91
PID 436 wrote to memory of 3056	436	Banllbdn.exe	91
PID 3056 wrote to memory of 4868	3056	Bapiabak.exe	92
PID 3056 wrote to memory of 4868	3056	Bapiabak.exe	92
PID 3056 wrote to memory of 4868	3056	Bapiabak.exe	92
PID 4868 wrote to memory of 5536	4868	Chjaol32.exe	94
PID 4868 wrote to memory of 5536	4868	Chjaol32.exe	94
PID 4868 wrote to memory of 5536	4868	Chjaol32.exe	94
PID 5536 wrote to memory of 4760	5536	Cmgjgcgo.exe	95
PID 5536 wrote to memory of 4760	5536	Cmgjgcgo.exe	95
PID 5536 wrote to memory of 4760	5536	Cmgjgcgo.exe	95
PID 4760 wrote to memory of 2120	4760	Chmndlge.exe	97
PID 4760 wrote to memory of 2120	4760	Chmndlge.exe	97
PID 4760 wrote to memory of 2120	4760	Chmndlge.exe	97
PID 2120 wrote to memory of 6072	2120	Ceqnmpfo.exe	98
PID 2120 wrote to memory of 6072	2120	Ceqnmpfo.exe	98
PID 2120 wrote to memory of 6072	2120	Ceqnmpfo.exe	98
PID 6072 wrote to memory of 5796	6072	Cmlcbbcj.exe	99
PID 6072 wrote to memory of 5796	6072	Cmlcbbcj.exe	99
PID 6072 wrote to memory of 5796	6072	Cmlcbbcj.exe	99
PID 5796 wrote to memory of 4600	5796	Cfdhkhjj.exe	100
PID 5796 wrote to memory of 4600	5796	Cfdhkhjj.exe	100
PID 5796 wrote to memory of 4600	5796	Cfdhkhjj.exe	100
PID 4600 wrote to memory of 1432	4600	Cmnpgb32.exe	102
PID 4600 wrote to memory of 1432	4600	Cmnpgb32.exe	102
PID 4600 wrote to memory of 1432	4600	Cmnpgb32.exe	102
PID 1432 wrote to memory of 3468	1432	Calhnpgn.exe	103
PID 1432 wrote to memory of 3468	1432	Calhnpgn.exe	103
PID 1432 wrote to memory of 3468	1432	Calhnpgn.exe	103
PID 3468 wrote to memory of 1720	3468	Dhfajjoj.exe	104
PID 3468 wrote to memory of 1720	3468	Dhfajjoj.exe	104
PID 3468 wrote to memory of 1720	3468	Dhfajjoj.exe	104
PID 1720 wrote to memory of 2340	1720	Ddmaok32.exe	105
PID 1720 wrote to memory of 2340	1720	Ddmaok32.exe	105
PID 1720 wrote to memory of 2340	1720	Ddmaok32.exe	105
PID 2340 wrote to memory of 388	2340	Dmefhako.exe	106
PID 2340 wrote to memory of 388	2340	Dmefhako.exe	106
PID 2340 wrote to memory of 388	2340	Dmefhako.exe	106
PID 388 wrote to memory of 5472	388	Delnin32.exe	107
PID 388 wrote to memory of 5472	388	Delnin32.exe	107
PID 388 wrote to memory of 5472	388	Delnin32.exe	107
PID 5472 wrote to memory of 2592	5472	Dmgbnq32.exe	108
PID 5472 wrote to memory of 2592	5472	Dmgbnq32.exe	108
PID 5472 wrote to memory of 2592	5472	Dmgbnq32.exe	108
PID 2592 wrote to memory of 2360	2592	Dfpgffpm.exe	109
PID 2592 wrote to memory of 2360	2592	Dfpgffpm.exe	109
PID 2592 wrote to memory of 2360	2592	Dfpgffpm.exe	109
PID 2360 wrote to memory of 3252	2360	Dogogcpo.exe	110

C:\Users\Admin\AppData\Local\Temp\2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-10_4cd0b8a7eef6432c1cba7246f3f03447_amadey_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\Bjokdipf.exe
  C:\Windows\system32\Bjokdipf.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\Bgcknmop.exe
    C:\Windows\system32\Bgcknmop.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\SysWOW64\Bjagjhnc.exe
      C:\Windows\system32\Bjagjhnc.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:900
      - C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5536
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6072
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5796
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5472
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 408
        25⤵
        Program crash
        
        PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3032 -ip 3032
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Banllbdn.exe

Filesize
400KB

MD5
4a02ba9186b6640e67ba93e594f7e23a

SHA1
01d755a94c45f0d8bc63316ff8dd3d6df09c54df

SHA256
031736547d4e90f5ac0c0f0178a5946a9304820caed70acab8ecd2517ca2b773

SHA512
26bc791fa4aa513acaa6a12e722a8141f40b61191a06244b1bdd4ece9b3998706a52bda5b42ba379061cd735eb6cc0f72e0b098d9e134119b45e15f7d154a1fc

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
400KB

MD5
322632194a3516895529357a1e088738

SHA1
cd15c02aed75bbdc4cd942afa43f46d000c3ab13

SHA256
17803fe96c4741971fdc68ea3141015e650d1741a083204583d99f42b70c8efb

SHA512
ddd0e3860715cbd6c8e536fab29243e2f88c67ba0ea6c483521fada19d6db9f2ae00024eb00a6347f9734b6f566afc55dc7a6e24224dbc498b41a3a5ff85a2cf

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
400KB

MD5
084126cc6d57ab03ff4827e4e99ce028

SHA1
33c7c93de2d252afb930c9ea3394bf421f4ea3a3

SHA256
3be13dc63bab3ebfc15635e7cd0db492a16d77eb96bcf8e7399d1f0003ba3dc3

SHA512
41accbe63f7295e9e37e884243c72465f7e304b1381096fe127d7b1173a6e4fe8767bf6c81023e47a9b8a135bc7434476a6ee11138c2e09b65869908c89290be

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
400KB

MD5
c8452a891a848b48ea511ed5ff51d48e

SHA1
31cc51a43e90c368722dc3664c80f786e3ed66de

SHA256
2941478e85613dc11c4baaa0a506ea555beda857ca451f78032068538da2ecce

SHA512
35091e7752aa33b0ca8af3a3eaf6dddd73cfba92bda2073af77a28148661d8a11dd469b09d680f5ca04d3644a69afda93c574be916de7baadee29a01c6ae5583

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
400KB

MD5
0a44b0d5168d39e6834bfc283aba2e56

SHA1
b16f599e71cab5fc5b5cc210fd7a47f9b80679b9

SHA256
f48cd5c565d7f58b391a1cf38025e1f1aebd611a868343dbbd56cadbeb73a40d

SHA512
87fac15e2023a8bec2d58bf45ebcff7d8449c50711610b69cd49e962e0078952b39a4acc12dadbee72fa0cf43b63f6eadd36925aad83dc947689ac25b731fb76

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
400KB

MD5
252d6787d068bcf3fe8aa1e70ff53efa

SHA1
b4a7f2c98f3b4bc2990aadd06184ace2509ee256

SHA256
0d3d8fbf026a5f1ed0d0b78fa3ef1087f584ad0d7e74d6e71929af564b1867ba

SHA512
0ed072a769f32ecdf697e93151a2f53dee594dca110001903d0f9d2751303da4cb9892f397cc42ec5298389f642a798e0131239e1458588bd73f30bfc6e9106c

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
400KB

MD5
bfa4aaa17574a557974b1509d5652628

SHA1
2140d79b3ce0e3a13ed2cc4bedf7b4f3a02d4bdb

SHA256
591a67775d655c99464938a8c3a957b9ae34fb03dd2a52ad540657065b157654

SHA512
132b7177108714c47de102a0126d4d4448bdbdf231177abb1a481e20746886a5d551560b0791a5a36650c64ce913b7a9c0501522a12c80c751c16022caf543f3

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
400KB

MD5
90729216d7ce091eac18a284dae15885

SHA1
7f365897b7589882bba524a408ff6d1ada2944c2

SHA256
035fa678ae835d11af4778d5a207e0d3486263eabe99b44356deddcff90c2f34

SHA512
72b4289554b98286ae99993a5eda4880a79181afd8b064d646e49460c790ffee5341681985d1d1dc26f3c79db559b8a23e8ab7b7ddd37e015327d07627a1cd90

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
128KB

MD5
b45a343babff8151ddecf78adf9fa64b

SHA1
c67ebcedd5544d0b00d003834a003d72fc3217cf

SHA256
5d54c097a5480f4ae9e374c67562fa8751794617b86257deaa37f6b0b7ff98db

SHA512
4b04748f914f00bf05ac3e1ea9822ffaf1b5756d08589caf475618cd921b77daf98c4abd2de2ed6d921c09c2d1cb2bd0989e3208a24ac53b101db30f08a1ada7

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
400KB

MD5
29962d5e08a66ae5ae1e81feb80b7eab

SHA1
c7cb7204a1087af24da3f191d5bfad72be741082

SHA256
b7246685fa52bc2d68620e0e9b8bbe8efefc6184df06a678293a573dc39344d4

SHA512
e8b170e47143c6306162914b9da320790060e0dfa13271b680c81a91c251727ddf1012cf22487866e3058c508dfde70ec193379bcb7fabb37f30bdbb8835fa2f

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
400KB

MD5
5bbb871640fe68f599a5a89d8346d72c

SHA1
8ce8d5d36a7aabfe3826a0fdc8e13e9dfb932ca2

SHA256
ff85b1a87ce15a88b5a8d58b3296cf4e412165acb7d9dfb37ff5b80a7d471bc0

SHA512
a9decacd32276c63e5887196928787827624df3cd3876a7d16c6c88b0006e5b1beb3c1092772e2b21c9fc939087f98073805adcf0d85e2fd68e3650889348dd5

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
400KB

MD5
a6cd1081361a56453f45b0df98984eef

SHA1
c11fb5e0fa876d68f3b69b1a609459512ff673a2

SHA256
d5e4d2fb71a70a42e944c0945e0c2042759a6292aad24292099c366ab4b631aa

SHA512
04a274620053bd0de4f63635932980658bdaf3ed6bb8438be451fb52561f852d0d21eb62f9e4db1fcaf6f6ca3a86af95280a8b9b0f6daa14b5796a813755b9a4

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
400KB

MD5
1a3a16a6e3bcddce90121f17573e8132

SHA1
5806aedd1767a026e9bb7f9615004c626d4d2986

SHA256
539e1bdcc132904b6728660306183e9361ade06b3d85e4f9be64daec25991862

SHA512
cfeb875a86b7192de0f35073ea5b0910cfa539e1e54f448746fd4a4337d0a5a9595f52e560b66049a30302616a2ae3d7a2b6db603470673ed6440930a03afa0c

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
400KB

MD5
8fee1adf51ba5464e4bca49075552db0

SHA1
cccd915651918a67ac7a84030091457d9e732fde

SHA256
3cfb7c406ca93dd57494a9f972979b91bf75abb5e1f7cd0125eaeb234ac10eb0

SHA512
0191e1d212fb371316729cd9da2a3e98cccf20bb8609d647689df6a4520ba52a1466d3cdb50ca8de52de2c33656d9f44740da749c82d230f20526bb3fdcb9da2

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
400KB

MD5
8f2049b353857c471890aa86efe99540

SHA1
46bfb1ddc5844f17c447186bcae4815608883cc8

SHA256
49b0398fef963e3d8e9a511b3f69a52b50f993822d695d35337b4368d5a5a51b

SHA512
faeb7550de0f5a7ea3315797377f7c0439a79c38a49902645eabdd556e19cba35e9c0a3e868b4dac99a7a754f062992fe04ef5d03d4d80e168421b7d140db148

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
400KB

MD5
f82365b379d707ff32936425fc883cf0

SHA1
a196a1734cc5b9c208b6e8bca97d44e27f76a632

SHA256
b9945f2a6d132f37386f20d6ec426536fe56d5b41dc7ec81e7ee038155e59b9a

SHA512
1a6024fb4a469f65ed69b50457cc0a4fe4e5f49af1f218771bd57c69a4675a2b90b6a1af9b3ef14f06a03afad3defc4e245fc0e790103512f30fd702b22b238a

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
400KB

MD5
96cf552b1e4e415226c4e24e2009afe7

SHA1
3a959b4287f6839f18f700ccaa198450c94cf3f8

SHA256
1f576f53517c8f3a87d72d80695cd636bd9e9f1787e6e190eccde160182d4ae2

SHA512
da761f262a6dcf7cc548339aaab0f4b31e7cc651ae9837f3cf5b3fdb588eb2bec6f1d8397ecb5636b0d1e9a87844fef8ef24981a08553df1c69d22f0b5c4ee30

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
400KB

MD5
3c10a6ffeaded5d6c32dadb58c74df46

SHA1
af8e4de538c95c5894807b6632ca62fee99c9885

SHA256
7e168bceb0d86294d8a3fc2921ef9a674f7704400dcb35016f0cd19fdb165a0e

SHA512
c8504d4506ed664bd0dc928a2be3b0a892941749df5499b85ad8fbe20d76fc905ee389be373db3a957109c9dec1777dee141e2d2c7bf4fd1124a09d87c232b96

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
400KB

MD5
baa5fc1023e6b095dd9ed99a5425b885

SHA1
3ea03709b6ffb2d36ba32a397f5e6ddb04d3b7dc

SHA256
a7e1e6b61b38c33fa55ae48d4289a578c18cca4c5c6495c98b6b9a7ead4ce800

SHA512
37391c9c62db79bc39a042d1d41b530864adb9c061ae221c48d4c7cf76c56375983958df06d15cac1627249396f693f3361bfa12132f858f60a2cae3e0fbd4dd

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
400KB

MD5
c9fa6fb26fd9a3ffdd9bba0fe4631182

SHA1
b6eb657dfd1efb53238b0629dd761323da275168

SHA256
17a5c03442dd245f15078bea900119ee30d20c20c4abe3134a3360566be8189a

SHA512
c58f224be174c4b1a14ff1c79d626d2a5cb23f8aa51bfffcaa231c5a3cf49a2c3f2d4716b43ff9c14ab1192b5896a041d83bd2db4fea6abc41d226b8744fc3a9

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
400KB

MD5
c11f65224ac6c8b0778256135b110b1b

SHA1
581ce914e16ef8b0116d8b9a0191a8f7a20e369c

SHA256
aac454d155064f781e393a399461b03ffd103d28211537c57c9cf983576c8316

SHA512
f45699dfeeeb7449c959dd18cfd90dd50b6b041bf9a154a5499dc80a603aa9d20897e6397a2abd8af2f2ffedfa872310a2ba8dfa2b9829e7842930b417f9b3d2

Download Submit
C:\Windows\SysWOW64\Dmgbnq32.exe

Filesize
400KB

MD5
7ca698b7725b6f28551b2e187992485e

SHA1
d8808502dda3d41b0fe4b4545ee14f93a86ca77c

SHA256
d9c0c38635fa0ccb5aba030d88d92c41b55ef0d43d554cb411e7d38ecf44e4cd

SHA512
5034e2bef91c7db7e769063d2507493839cbff1c9cbaf436b39b6cf51ca44448e2bfa6b9041e95d07452329f0ded63d043c8afcbf0b1fa5ce4421679dcc174b3

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
400KB

MD5
a925f5af58a056ae4948974a004d79b6

SHA1
cc8de321af9b8151dc751ece1cbc6bb2be61c2c2

SHA256
82aaafb5cca96fb6134dbd83da5bd7ecf879fc521845029ac244e3983c4cf031

SHA512
964a9a24f2329f83b2c0d5c43b39e3e75841edefc327afe7b5fbc5eaa81f8ebb156d8c293483db7e9017c1398c624311f0593e7e443d015d78b237140d986e42

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
400KB

MD5
1460dde12ed5d2a447a006d5e72e0ca5

SHA1
1493db250bb8313e4b80dc718bc136ca8277d8a4

SHA256
613e00607267a4c7742ecab28419d0378bc322a94eb80bc81d38a81eed49b1df

SHA512
a8bd4fac219a1f9f507c73645a9587e96df2abb734aa64523b055cec488c1d2f53b5b16fefe3170caa072646857a2bb43146b2d5fb9ac375905ee5618049afa9

Download Submit
C:\Windows\SysWOW64\Qihfjd32.dll

Filesize
7KB

MD5
ab0d395e26e859ef4365267064977880

SHA1
619f36f9411523850950adcda3a93cc70969c21b

SHA256
e27613bda28b00b0fa11c000d5fa1adfb393b79881fc929102c5cd9b1e3e04ac

SHA512
28917ab631e9cf26b1c4d08a9e537df3d7723590201304ba744488f4355abe4d619cde4185a609a2f54e42effb84b64657957707966b2c341ec8013df45bad1d

Download Submit
memory/388-196-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/388-144-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/436-39-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/436-220-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/900-37-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/900-222-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1192-230-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1192-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1432-111-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1432-202-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1720-127-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1720-232-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1740-226-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1740-16-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2120-80-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2120-210-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2340-198-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2340-136-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2360-168-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2360-191-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2592-160-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2592-192-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2724-228-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2724-7-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3032-187-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3032-184-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3056-47-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3056-218-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3252-188-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3252-176-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3468-119-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3468-200-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4600-204-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4600-103-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4760-72-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4760-212-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4820-224-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4820-23-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4868-216-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4868-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5472-194-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5472-152-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5536-214-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5536-68-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5796-206-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5796-96-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6072-208-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6072-87-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads