berbew | 4eba89639d7083de6946defca5af5c0f7920ed10c694d05ede0fd18a2631e8de

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4eba89639d7083de6946defca5af5c0f7920ed10c694d05ede0fd18a2631e8de.exe
Size 97KB
Sample260825-mvl6sshk5v
SHA256 4eba89639d7083de6946defca5af5c0f7920ed10c694d05ede0fd18a2631e8de
MD5 e405d56c910d60f835fe00bdd3a8239f
SHA1 7a3f70912703a889fe6c55c83657be82c1795633
SHA512 6bb24ad631bc118b10b4580117de06de27097262f1ee1c064ce5183d87fb24eba1bb54b434d617d388896f4af875a98ad68f3e9db3f1b82edc4389d0a29898fa
SSDEEP 1536:ntXiuRYSbQnwdAXouEDC1J1LUS3X582+VpRuqppppppppppppppRSBkvJXeYZu:tyuRY8duEi1LUS3XCvRuzUJXeKu
TLSH
T1A1A37C0A9B204F7AC26511F0EECB2B2B4595D60D37BF71E74F232A88E8DE5D0A1354B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bogkmgba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cammjakm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dojqjdbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdpcal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhphmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qjfmkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddllkbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpdgqmnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmhocd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apodoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjfmkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgnomg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklhcfle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caageq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bacjdbch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baegibae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cklhcfle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahaceo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bkphhgfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdkifmjq.exe

Executes dropped EXE 64 IoCs

pid	Process
408	Qjfmkk32.exe
4180	Qobhkjdi.exe
2356	Qhjmdp32.exe
3084	Qmgelf32.exe
4512	Qdaniq32.exe
3492	Amjbbfgo.exe
4464	Aphnnafb.exe
4772	Afbgkl32.exe
1084	Aagkhd32.exe
1404	Ahaceo32.exe
4312	Akpoaj32.exe
636	Aokkahlo.exe
3512	Aggpfkjj.exe
4332	Apodoq32.exe
3328	Adkqoohc.exe
4556	Agimkk32.exe
2344	Akdilipp.exe
2352	Amcehdod.exe
2364	Aaoaic32.exe
4680	Apaadpng.exe
4152	Bdmmeo32.exe
2384	Bgkiaj32.exe
3912	Bkgeainn.exe
4752	Bobabg32.exe
4320	Bmeandma.exe
1188	Baannc32.exe
4052	Bdojjo32.exe
2708	Bhkfkmmg.exe
4884	Bgnffj32.exe
1392	Bkibgh32.exe
4944	Bmhocd32.exe
4364	Bacjdbch.exe
4740	Bdagpnbk.exe
2996	Bhmbqm32.exe
3972	Bklomh32.exe
4636	Bogkmgba.exe
2500	Baegibae.exe
3272	Bphgeo32.exe
4268	Bddcenpi.exe
4844	Bknlbhhe.exe
3484	Bnlhncgi.exe
1908	Bahdob32.exe
2080	Bpkdjofm.exe
696	Bdfpkm32.exe
1820	Bgelgi32.exe
4008	Bkphhgfc.exe
2084	Bnoddcef.exe
964	Bajqda32.exe
1224	Cpmapodj.exe
3316	Chdialdl.exe
4948	Cggimh32.exe
3312	Ckbemgcp.exe
1928	Cnaaib32.exe
4832	Cammjakm.exe
3584	Cdkifmjq.exe
5104	Cgifbhid.exe
4476	Ckebcg32.exe
1372	Coqncejg.exe
5004	Caojpaij.exe
3248	Cpbjkn32.exe
1324	Chiblk32.exe
3180	Ckgohf32.exe
212	Cocjiehd.exe
3992	Caageq32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ckebcg32.exe	Cgifbhid.exe
File created	C:\Windows\SysWOW64\Bgelgi32.exe	Bdfpkm32.exe
File created	C:\Windows\SysWOW64\Bghgmioe.dll	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Nmocfo32.dll	4eba89639d7083de6946defca5af5c0f7920ed10c694d05ede0fd18a2631e8de.exe
File created	C:\Windows\SysWOW64\Adkqoohc.exe	Apodoq32.exe
File opened for modification	C:\Windows\SysWOW64\Bkphhgfc.exe	Bgelgi32.exe
File opened for modification	C:\Windows\SysWOW64\Cpmapodj.exe	Bajqda32.exe
File created	C:\Windows\SysWOW64\Lpmkebjc.dll	Bgkiaj32.exe
File opened for modification	C:\Windows\SysWOW64\Bdfpkm32.exe	Bpkdjofm.exe
File created	C:\Windows\SysWOW64\Chiblk32.exe	Cpbjkn32.exe
File opened for modification	C:\Windows\SysWOW64\Cgqlcg32.exe	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Baegibae.exe	Bogkmgba.exe
File created	C:\Windows\SysWOW64\Pghien32.dll	Ckgohf32.exe
File created	C:\Windows\SysWOW64\Adnbpqkj.dll	Bacjdbch.exe
File opened for modification	C:\Windows\SysWOW64\Dafppp32.exe	Cnjdpaki.exe
File opened for modification	C:\Windows\SysWOW64\Ahaceo32.exe	Aagkhd32.exe
File created	C:\Windows\SysWOW64\Apodoq32.exe	Aggpfkjj.exe
File opened for modification	C:\Windows\SysWOW64\Baannc32.exe	Bmeandma.exe
File created	C:\Windows\SysWOW64\Mmihfl32.dll	Cnaaib32.exe
File opened for modification	C:\Windows\SysWOW64\Ckgohf32.exe	Chiblk32.exe
File opened for modification	C:\Windows\SysWOW64\Coegoe32.exe	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File opened for modification	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File opened for modification	C:\Windows\SysWOW64\Bkibgh32.exe	Bgnffj32.exe
File created	C:\Windows\SysWOW64\Cdpcal32.exe	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Ijilflah.dll	Cdpcal32.exe
File created	C:\Windows\SysWOW64\Bnlhncgi.exe	Bknlbhhe.exe
File created	C:\Windows\SysWOW64\Cammjakm.exe	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Dojqjdbl.exe	Dgcihgaj.exe
File opened for modification	C:\Windows\SysWOW64\Bknlbhhe.exe	Bgbpaipl.exe
File created	C:\Windows\SysWOW64\Jhijep32.dll	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Dddllkbf.exe	Dafppp32.exe
File created	C:\Windows\SysWOW64\Cdbpgl32.exe	Cpfcfmlp.exe
File created	C:\Windows\SysWOW64\Fmbgla32.dll	Amjbbfgo.exe
File created	C:\Windows\SysWOW64\Ijikdfig.dll	Akpoaj32.exe
File created	C:\Windows\SysWOW64\Bljlpjaf.dll	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Bdfpkm32.exe	Bpkdjofm.exe
File created	C:\Windows\SysWOW64\Ibmlia32.dll	Cggimh32.exe
File created	C:\Windows\SysWOW64\Hbobifpp.dll	Ckebcg32.exe
File created	C:\Windows\SysWOW64\Cpdgqmnb.exe	Caageq32.exe
File created	C:\Windows\SysWOW64\Qobhkjdi.exe	Qjfmkk32.exe
File created	C:\Windows\SysWOW64\Baannc32.exe	Bmeandma.exe
File opened for modification	C:\Windows\SysWOW64\Cdpcal32.exe	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Jilpfgkh.dll	Dojqjdbl.exe
File created	C:\Windows\SysWOW64\Aggpfkjj.exe	Aokkahlo.exe
File opened for modification	C:\Windows\SysWOW64\Baegibae.exe	Bogkmgba.exe
File created	C:\Windows\SysWOW64\Cnaaib32.exe	Ckbemgcp.exe
File created	C:\Windows\SysWOW64\Cdkifmjq.exe	Cammjakm.exe
File created	C:\Windows\SysWOW64\Mmlmhc32.dll	Cpbjkn32.exe
File created	C:\Windows\SysWOW64\Gelfeh32.dll	Dhphmj32.exe
File opened for modification	C:\Windows\SysWOW64\Aaoaic32.exe	Amcehdod.exe
File created	C:\Windows\SysWOW64\Bacjdbch.exe	Bmhocd32.exe
File created	C:\Windows\SysWOW64\Bahdob32.exe	Bnlhncgi.exe
File opened for modification	C:\Windows\SysWOW64\Bnoddcef.exe	Bkphhgfc.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Cpfcfmlp.exe
File opened for modification	C:\Windows\SysWOW64\Qmgelf32.exe	Qhjmdp32.exe
File created	C:\Windows\SysWOW64\Qkhnbpne.dll	Agimkk32.exe
File created	C:\Windows\SysWOW64\Bnoddcef.exe	Bkphhgfc.exe
File created	C:\Windows\SysWOW64\Qfoaecol.dll	Coqncejg.exe
File opened for modification	C:\Windows\SysWOW64\Dhbebj32.exe	Ddgibkpc.exe
File created	C:\Windows\SysWOW64\Amjbbfgo.exe	Qdaniq32.exe
File created	C:\Windows\SysWOW64\Chdialdl.exe	Cpmapodj.exe
File created	C:\Windows\SysWOW64\Ndikch32.dll	Bphgeo32.exe
File opened for modification	C:\Windows\SysWOW64\Bnlhncgi.exe	Bknlbhhe.exe

Program crash 1 IoCs

pid	pid_target	Process
2892	4652	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmhocd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chiblk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhjmdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokkahlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akdilipp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bobabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahmfpap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjfmkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmgelf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adkqoohc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apaadpng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdagpnbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdfpkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caojpaij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cggimh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cammjakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baegibae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgbpaipl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bknlbhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckgohf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpdgqmnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4eba89639d7083de6946defca5af5c0f7920ed10c694d05ede0fd18a2631e8de.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qobhkjdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdaniq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chdialdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckebcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dojqjdbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpkdjofm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgcihgaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apodoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coegoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdmmeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bogkmgba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhphmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahaceo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baannc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpmapodj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dafppp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdkifmjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgnomg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnhgjaml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdojjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caageq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afbgkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgkiaj32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biafno32.dll"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amjbbfgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chiblk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhal32.dll"	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qjfmkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iocedcbl.dll"	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bpkdjofm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cggimh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbandhne.dll"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkamodje.dll"	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchkcb32.dll"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpmkebjc.dll"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Baannc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqnbqh32.dll"	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lahoec32.dll"	Bkphhgfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gikgni32.dll"	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baegibae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamhbhe.dll"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpojkp32.dll"	Bgelgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cammjakm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgifbhid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmbgla32.dll"	Amjbbfgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phlepppi.dll"	Amcehdod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeeape32.dll"	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Coqncejg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4eba89639d7083de6946defca5af5c0f7920ed10c694d05ede0fd18a2631e8de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnkdmlfj.dll"	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehmok32.dll"	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onahgf32.dll"	Adkqoohc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmlmhc32.dll"	Cpbjkn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 408	3152	4eba89639d7083de6946defca5af5c0f7920ed10c694d05ede0fd18a2631e8de.exe	85
PID 408 wrote to memory of 4180	408	Qjfmkk32.exe	86
PID 4180 wrote to memory of 2356	4180	Qobhkjdi.exe	87
PID 2356 wrote to memory of 3084	2356	Qhjmdp32.exe	88
PID 3084 wrote to memory of 4512	3084	Qmgelf32.exe	89
PID 4512 wrote to memory of 3492	4512	Qdaniq32.exe	90
PID 3492 wrote to memory of 4464	3492	Amjbbfgo.exe	91
PID 4464 wrote to memory of 4772	4464	Aphnnafb.exe	92
PID 4772 wrote to memory of 1084	4772	Afbgkl32.exe	93
PID 1084 wrote to memory of 1404	1084	Aagkhd32.exe	94
PID 1404 wrote to memory of 4312	1404	Ahaceo32.exe	95
PID 4312 wrote to memory of 636	4312	Akpoaj32.exe	96
PID 636 wrote to memory of 3512	636	Aokkahlo.exe	97
PID 3512 wrote to memory of 4332	3512	Aggpfkjj.exe	98
PID 4332 wrote to memory of 3328	4332	Apodoq32.exe	99
PID 3328 wrote to memory of 4556	3328	Adkqoohc.exe	100
PID 4556 wrote to memory of 2344	4556	Agimkk32.exe	101
PID 2344 wrote to memory of 2352	2344	Akdilipp.exe	102
PID 2352 wrote to memory of 2364	2352	Amcehdod.exe	103
PID 2364 wrote to memory of 4680	2364	Aaoaic32.exe	104
PID 4680 wrote to memory of 4152	4680	Apaadpng.exe	105
PID 4152 wrote to memory of 2384	4152	Bdmmeo32.exe	106
PID 2384 wrote to memory of 3912	2384	Bgkiaj32.exe	107
PID 3912 wrote to memory of 4752	3912	Bkgeainn.exe	108
PID 4752 wrote to memory of 4320	4752	Bobabg32.exe	109
PID 4320 wrote to memory of 1188	4320	Bmeandma.exe	110
PID 1188 wrote to memory of 4052	1188	Baannc32.exe	111
PID 4052 wrote to memory of 2708	4052	Bdojjo32.exe	112
PID 2708 wrote to memory of 4884	2708	Bhkfkmmg.exe	113
PID 4884 wrote to memory of 1392	4884	Bgnffj32.exe	114
PID 1392 wrote to memory of 4944	1392	Bkibgh32.exe	115
PID 4944 wrote to memory of 4364	4944	Bmhocd32.exe	116
PID 4364 wrote to memory of 4740	4364	Bacjdbch.exe	117
PID 4740 wrote to memory of 2996	4740	Bdagpnbk.exe	118
PID 2996 wrote to memory of 3972	2996	Bhmbqm32.exe	119
PID 3972 wrote to memory of 4636	3972	Bklomh32.exe	120
PID 4636 wrote to memory of 2500	4636	Bogkmgba.exe	121
PID 2500 wrote to memory of 3272	2500	Baegibae.exe	122
PID 3272 wrote to memory of 4268	3272	Bphgeo32.exe	123
PID 4988 wrote to memory of 4844	4988	Bgbpaipl.exe	125
PID 4844 wrote to memory of 3484	4844	Bknlbhhe.exe	126
PID 3484 wrote to memory of 1908	3484	Bnlhncgi.exe	127
PID 1908 wrote to memory of 2080	1908	Bahdob32.exe	128
PID 2080 wrote to memory of 696	2080	Bpkdjofm.exe	129
PID 696 wrote to memory of 1820	696	Bdfpkm32.exe	130
PID 1820 wrote to memory of 4008	1820	Bgelgi32.exe	131
PID 4008 wrote to memory of 2084	4008	Bkphhgfc.exe	132
PID 2084 wrote to memory of 964	2084	Bnoddcef.exe	133
PID 964 wrote to memory of 1224	964	Bajqda32.exe	134
PID 1224 wrote to memory of 3316	1224	Cpmapodj.exe	135
PID 3316 wrote to memory of 4948	3316	Chdialdl.exe	136
PID 4948 wrote to memory of 3312	4948	Cggimh32.exe	137
PID 3312 wrote to memory of 1928	3312	Ckbemgcp.exe	138
PID 1928 wrote to memory of 4832	1928	Cnaaib32.exe	139
PID 4832 wrote to memory of 3584	4832	Cammjakm.exe	140
PID 3584 wrote to memory of 5104	3584	Cdkifmjq.exe	141
PID 5104 wrote to memory of 4476	5104	Cgifbhid.exe	142
PID 4476 wrote to memory of 1372	4476	Ckebcg32.exe	143
PID 1372 wrote to memory of 5004	1372	Coqncejg.exe	144
PID 5004 wrote to memory of 3248	5004	Caojpaij.exe	145
PID 3248 wrote to memory of 1324	3248	Cpbjkn32.exe	146
PID 1324 wrote to memory of 3180	1324	Chiblk32.exe	147
PID 3180 wrote to memory of 212	3180	Ckgohf32.exe	148
PID 212 wrote to memory of 3992	212	Cocjiehd.exe	149

C:\Users\Admin\AppData\Local\Temp\4eba89639d7083de6946defca5af5c0f7920ed10c694d05ede0fd18a2631e8de.exe
"C:\Users\Admin\AppData\Local\Temp\4eba89639d7083de6946defca5af5c0f7920ed10c694d05ede0fd18a2631e8de.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\Qjfmkk32.exe
  C:\Windows\system32\Qjfmkk32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\SysWOW64\Qobhkjdi.exe
    C:\Windows\system32\Qobhkjdi.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\SysWOW64\Qhjmdp32.exe
      C:\Windows\system32\Qhjmdp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
      - C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4268
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        65⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3992
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2904
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2940
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3224
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1020
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4756
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2164
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1276
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:780
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1536
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3384
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        80⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4160
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:396
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        85⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:904
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 412
        87⤵
        Program crash
        
        PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4652 -ip 4652
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aagkhd32.exe

Path C:\Windows\SysWOW64\Aagkhd32.exe
Size 97KB
SHA256 630a8ae5c316af8982c3d59a0cf0af9af475ab114884fa74fce50187a6e22e4b
MD5 ca67247f6008c57f0103bfd541e3ca5d
SHA1 98c85ba8ca4b9a0ab1d904dcbdcde4ea38a7b44c
SHA512 ff03d6e8bd09730d0f3f4069eafef2041127d582665f35cd3f208c0ab145a8a5a297ebe3498d57f0dd4d582ae0afbf4379d21e0b4edb2c4d00e92089593d929d
SSDEEP 1536:qkKXa9ysbCSTk1OUCC3e6/SAyu9C4IFx/PS8/FOvJXeYZu:qkKXa9ysbrk1OvaeBAy74Y/ZmJXeKu
TLSH
T14AA38DF291948C7AF7640330E41FB5373AACD6361BAB80F38610A5785D131E36F79A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aaoaic32.exe

Path C:\Windows\SysWOW64\Aaoaic32.exe
Size 97KB
SHA256 96c64481afad1f2aed57c1e69c749b7cb51b45091d76f69c3319e0239b4d4f13
MD5 7e3b2977485ec105ab91c9bc2127e5dd
SHA1 cb4298ded3cf5659c86c8c5090aad3bded839067
SHA512 78216a4d255d868ff91d264ed17afe3b1025c304592c9801d732578f619e814e55929260020ca4e752fa152aaae8c547404a7b2bdac83d827656559564ac5f88
SSDEEP 1536:U5DxwdFHEYYc/2LngeTQn9epaPWv7XITZxt8vJXeYZu:U5VwXH7IXT90WWcJXeKu
TLSH
T1CDA39D0151D45D93DB394673B89A1DFA2929DD9D87F183FB4B21F2582C79AEC923C0B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adkqoohc.exe

Path C:\Windows\SysWOW64\Adkqoohc.exe
Size 97KB
SHA256 0a38ade5254e60e216d268e0e2c19bbbb0a343eb48f3fa224d5ebe081cf31e41
MD5 796233318b58619760b4c01e69145a9b
SHA1 57f287b46e39e49d4101167cd8c252b5ecd3d54f
SHA512 f596e28f985ff1a56ddb198c68168a1fc839b2a44611d9b68e076f1b0a340507a358ee5c1e0dc5d62d098929216da2c833aaa0dc56f1c2ed884f5f06f9ac89fd
SSDEEP 1536:oisd5OIU2gDopLzjeY1IwnqTvO322zR9SLpga6t8JDAd2vJXeYZu:POgIU2gDohvdkTG3pzR4LpgajkeJXeKu
TLSH
T171A38DF3E41AECA3E75C30F12D254533ABA953493BF440FF16A691C450AC2D9A9339E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Afbgkl32.exe

Path C:\Windows\SysWOW64\Afbgkl32.exe
Size 97KB
SHA256 452c72c37264da12d10964b8a6aa87568cd0972ea2ada37251069d7a3e7d683e
MD5 6026b9589a98d5145934ea16b2b71906
SHA1 47a5621e5af478ddd085784a806ac54aa99a79b7
SHA512 5f0d54cf8a896e50a2c29f90785c44b17fe1da38ace561337af5f039ab580d8beaaa537699f6401d780e1ac3711c9c41d2541826f12b2ef3a16e8a00f7b932cf
SSDEEP 1536:hKXEDNK5cGSgU8+wVM79rztcuccZcyEb7gkiD0AO4pvJXeYZu:hKUDg5cIvm9dGcmyEb8kiDnpJXeKu
TLSH
T143A39DAAD4218CE7C2780170605E36381B165A1803DA78DF5B5BD6EFDD0D2E06E3EADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aggpfkjj.exe

Path C:\Windows\SysWOW64\Aggpfkjj.exe
Size 97KB
SHA256 dcde2883e717836818fb355620a80e68ff3312cbdc8e2bd2d1b3bce7f9f051d9
MD5 aafa7077fad6bea7dc0d4db1e7e9057f
SHA1 15cd71d930c4865708a48e8f33fdaed870b9cacf
SHA512 16a3dcba88c89d26acd6fec674b62ed3e2f6146c643b84061dffa02af9d620a5f50e51eab7bd5c493fbdd30fefe7765580bc9a55895e70c425bfb0c1745af48e
SSDEEP 3072:K+W8H4GtuHAUEPUSgtsKu9aeNgWBr+JXeKu:9WfiuHAU/SgtY9BpNyed
TLSH
T1FFA38C12D4F3EC63F37804B1622B332A199B9ED837A185F7372259C618195D5BF3CA98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agimkk32.exe

Path C:\Windows\SysWOW64\Agimkk32.exe
Size 97KB
SHA256 e89646882b19f85a9781ad2aa7f4c7da11b78f0aedf9fe09e83d1c25f34f81e6
MD5 725969321c9da329fc71e776d3796d98
SHA1 01737171c152f58bde67b57b9ed529d41d097c01
SHA512 27b5bd5ca31ebcd5dd7bf746d539babfb9e79d90b7e55657e480ae554f24ccf9b277603381e1a3ebbbe818a2a6c56cc308c87f745eacd1ae857528d559f2e85c
SSDEEP 1536:nbbPsH9XqOPOu/c8HNJcCo1mm4IDsv/AvJXeYZu:PM9XqEOu/fHk1z4IDsvAJXeKu
TLSH
T15DA38D835C29386AD2B85E704B2B33668E6CB71653B6A0D34F62453F0927CD27539B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahaceo32.exe

Path C:\Windows\SysWOW64\Ahaceo32.exe
Size 97KB
SHA256 b25ce5dd3bd7bb41afa55244c44894d0acd5f38e2976c173d086a92a25849803
MD5 a4d63a237613b37bc3e9728f30d0380a
SHA1 a5378b7988ffa64c626390e6c90dff9a0a4684e2
SHA512 7ac0295e83bbe6bb0d591d3417b0f0c584d575081a0f10d75c6233cf0c092a4c4977d9c8f35f0c6c21c90b6ff4d2928d233fad28c2092a410345d380e8a08408
SSDEEP 1536:Ta07ZzUMkK9E2MqmgXiA08XYOHfW0DpRh9B1WMmvJXeYZu:TawUFK6F9gyAlXYIppRLaNJXeKu
TLSH
T14AA39EC2A8152CBBE6722070166E17770D9BD228A7F404FB9BF7B4AC5C994D3D538A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Akdilipp.exe

Path C:\Windows\SysWOW64\Akdilipp.exe
Size 97KB
SHA256 988b7f01b791522cc667d50a38e085e6f155fcfd70efbee9f9e5f89f2b07ea7a
MD5 ddafc02bc4cbf0a780738b9a87dfd153
SHA1 3936d77c21f6da5368c7995671c3b0c9d65af94e
SHA512 79241823e2c0d3a99d7bde3d2be8f659daa2341169190ed6c39fc58cb65366fda7b669ffae38a63189b7035abaaae133a92157f835934bc1c95e251b4f480d5b
SSDEEP 1536:OxYUG+O98GMV7k5ZUWk07ncxDvWpYxVElbm9vJXeYZu:OCqDyURGsHxCRmVJXeKu
TLSH
T1D6A38D16FB11AC71C3EE047CEF07096BA998D7F91B7920D78A7A528608373D55B3C09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Akpoaj32.exe

Path C:\Windows\SysWOW64\Akpoaj32.exe
Size 97KB
SHA256 3df00fdeb7dd09ab0329095c6e09a32eb3db67f7976d5f8a6ca764b3c367683d
MD5 71fcf3d0877a44a9d59638132f4f9ed5
SHA1 396b222688c1302431d3379019f367bf88197adb
SHA512 5572c48d393c01f3f46fc5e2f600e86e814946e64e45970c75d61ce0ff6fda051ec722b72248a6286ab0ecdeedb3426a08cab993751cff47a103227fdbb803ee
SSDEEP 1536:2mmMS2jlUmJv7hr36XFQpgiZlKqhIssjoHnlRYhu6BcItkvJXeYZu:2m/p3hFrqVcgiZlKqysWokB5UJXeKu
TLSH
T178A38D67E8A41DA3F3FA10F3BA16263E255DEA2D1BFB11C30B53E0D418980E1C63955E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amcehdod.exe

Path C:\Windows\SysWOW64\Amcehdod.exe
Size 97KB
SHA256 4a732e0e800cd07a3389da6202c6870c60c1075d4a8f07ed3d23a40bab777377
MD5 1319f1f390da2682c1a9ab4c6831acda
SHA1 50239b35a83ca930855a8e30dfe405273c504a3c
SHA512 007c027538b6d471b00a474dcb4454839fae61b08e4fce15834a3f273684631c23df8e083ccdd742c45f86c9afe5ad753cf2740a48fc713bb9081a6ea6c7c668
SSDEEP 1536:wpY7tAz2f68MJUzYsNNRZ0+LGP1vJXeYZu:UzEMJuvFLGP9JXeKu
TLSH
T1EEA36B0B9C247EA3FE3B31BFD81643AE629E6E441792C1D316CBB5487BDD9D25138A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amjbbfgo.exe

Path C:\Windows\SysWOW64\Amjbbfgo.exe
Size 97KB
SHA256 bf2e850c69fbc18d5cdb95f03d34f602810060d7abf6d0c5b90a20e5ef39f965
MD5 b61ef81a561be65d1b100198bafb04fe
SHA1 bdde01735c565eb739373445fc030201655fb58a
SHA512 89ea76a83790859085e4153087034777daca5849b9a0bf7d9df2c678b3bd711bb48d5fc545e27b2f44309a2263709a8a395b1605239db089ca48e9801760ed09
SSDEEP 1536:AJlXS6JM5RL/yDfC3gz8uTsf5jhdm5wvJXeYZu:ilXpMfL6D63gz8uTc1wmJXeKu
TLSH
T1C1A39D1750B63C4FCBBE1673E40E0E779659B7A40FF044DB1FAAB00825998C7A637981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aokkahlo.exe

Path C:\Windows\SysWOW64\Aokkahlo.exe
Size 97KB
SHA256 39a2dca9345bad509ede8fb78d9f7fd816728a8e9e79ec26ec328a0005661d9d
MD5 982865b5b7e7c9e53d2cdd4afddb38cb
SHA1 06ab33fcd77eb270a59dda7b056eec94b5f33fd5
SHA512 f3b59c8a18dddc0708ecd1cd8a415f6a15a8fbb38d2d71e4cd694b036a29c2e605ac442462b1b3ae2a53e466078c63f3c32391cff5306e407c685a8e0115c87a
SSDEEP 768:qfYUP+3AxPjFdrRK+MkAQqneNZyTLc6G+cZnKwljgIdpbxWEfpn8suJykAv8Q52G:q+8LIX63yPc6KnKwllxv8/Q54vJXeYZu
TLSH
T11EA36CD659383C72C7B826B2192E0EA632987D007BBD80E72B73C6D854375E7D232764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apaadpng.exe

Path C:\Windows\SysWOW64\Apaadpng.exe
Size 97KB
SHA256 3e789fe61bfd35da4b2645e2cfeec79c36a350fb8ade2bffa4f6b027dea0c2aa
MD5 54d7312509f25e018df0bcc1590f2315
SHA1 1b3399fa02a448e81a300ee8427b786717e5082b
SHA512 5c272826cc8788e8ee2df08918d65bff554b9b45dc0f8c8a2b822f066ea9554b43d8f05d4cd9f3729cb803a2f8687516d457027365ee57371728e84b60d067d9
SSDEEP 1536:PYT6gA4L7WHL0Zyl/D3g6xEy+WWbJiLQ8yvJXeYZu:w+14/WHLllL3gi+WW4L5SJXeKu
TLSH
T151A39E4189118FF3E3E054B0FC9E153B3BFBC60017FAB7C34617A5A9486A6E795B1928
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aphnnafb.exe

Path C:\Windows\SysWOW64\Aphnnafb.exe
Size 97KB
SHA256 fe075cd8dda434b42396ded5aa09654f386039e4a3637ae43ca79f137d31b0c1
MD5 8415414b44616dff1e34fba2f65dba30
SHA1 2cfe686c050b53ee15f1c40350781219ea93c915
SHA512 984f96dd0811b8abc86082188f0cb2071e4b8e1957a8081e768bc685c4ac5eadbd2ccbe8093b88b72ff6fb48ce8615a56d79115b756c73c109cc5f20cdf17acc
SSDEEP 1536:TQuJmVQWdb37aUBr9r/INHYFkqpk9X10wJzrvJXeYZu:TQkwHdSUBrlNF1k3Td7JXeKu
TLSH
T12DA37CD38C704FA6C37F05B12B1B562698E4EB0977E85CE78739A464966A1DBE03F070
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apodoq32.exe

Path C:\Windows\SysWOW64\Apodoq32.exe
Size 97KB
SHA256 394aa84429a642ae76523e4b4a87bf74c02d83d91c45c316f28be5ab848e478a
MD5 373524e91188f2a1cc782cc0117676b2
SHA1 15ad500c86c2b81a7210a72d23c458a5b5ec9d18
SHA512 f3f0ad6ffb0159a9eaf256fecd207c30f157484c77bebec6d38fa7b9c207ca3078021de007adedfef1446a83a5bec197e553d76589cf68e4bb24408d4527f5bb
SSDEEP 3072:6DI/pmhRSf9pQPXl5T/+m1WNM3jAgJXeKu:6upLVM3jAoed
TLSH
T174A39C8F98B51D93C378A0349C89527B356AC655E7E4C4C34EB9B94D8CBE0CEE334221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Baannc32.exe

Path C:\Windows\SysWOW64\Baannc32.exe
Size 97KB
SHA256 f2acbcea3647bbdd386c6984f9592d495a73f341983eaf34bcf5a7e43639a6b8
MD5 a9b2a1675e9f5b4f1cab86acb0f530d5
SHA1 a4e25ff2e82dd0332585af9527f75ce5e45f9a20
SHA512 75003c3f363faad09780b4a1e0cebf3b8100b80500d598e9b66a07cd57c9530eba885206ef459c1c9d109f6098f3cec4ec6d03bcb018672b8f1fb3b590094f68
SSDEEP 1536:hSDj0zvhGTd7h3gfwTTJd/YeAPx1dXSSBuHZg+g5F+PI8mWwOyovJXeYZu:MEzvQTdhgqlSvdx/ZL+aDwJXeKu
TLSH
T1CAA38D5AEC1B5C57C7A240324C7A473F17BC92151BAE89CB4B6ADE291B46DF1933C22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bacjdbch.exe

Path C:\Windows\SysWOW64\Bacjdbch.exe
Size 97KB
SHA256 3d5ecf69f8be98c1521bbc40b8cccd28338bc9592561f03af1e18845d5cf1b4d
MD5 64b17552efbb56e5b5117bb119c4662d
SHA1 4268c1ab86d4345c56c80fd3cc94eb86e6f98910
SHA512 289f23a2fd13b92239f0f180c6250eb31f0b9a124661bc1f0f43a55bea8b6e7d611a565fcbd542f7fd5269f92ee4c53fa243fcd6dcfeac9ce407ee679d88cbfa
SSDEEP 1536:kU5+yPNSegHqKRZQ1g+mCJ1aL3onWp85vDZVBuvJXeYZu:kcHN/UqK3Q1/jJ1aL3ouCzBGJXeKu
TLSH
T110A38DFEF5146CE3D3142C75890A1E2D2ADB9014AF7A60D7E373D41A4D280E4FEB8968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdmmeo32.exe

Path C:\Windows\SysWOW64\Bdmmeo32.exe
Size 97KB
SHA256 a78e3a08ab7070028724651c643e1aa9127e01feee405b42086f9def033970ec
MD5 1ddc4b9dacf3c0256a2fa0be257f0230
SHA1 e5da34efb17b7f48e5596cbbf20ceb6acda47747
SHA512 0ef49309a597e99e8ba015199f63ff6eb02efc839ec3e5444b80071906cd9d12d1450a7b56dba52e6ab8305aade6a261a66d79508604f0de98c66c7173079570
SSDEEP 3072:/iMkrfgBNXcGiXCJXfQpUG7IZuKqmQHJXeKu:tC8sGAXpUwIIKPQded
TLSH
T16BA36BA241360E31C3AB3CF13816397BBB548A00A7F402D72656D9AE94595D9A3FF53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdojjo32.exe

Path C:\Windows\SysWOW64\Bdojjo32.exe
Size 97KB
SHA256 5f4d03c829ae636dc3b532666e8446a1beda29d8e90fcd96ca8763eee0db1788
MD5 071abbcb831bf47a691bfa62d817153a
SHA1 fa5845620d4d5b8aefcaf8c6a97c57931e659815
SHA512 9557997700b18a5d74d9584c9b5c867de349113f26c3ced23b717589e777077a7e212e4459983832a30405997692068e57e482dfb2d6fb4f37255db526105e28
SSDEEP 1536:vqG6VvCpt/bUQzyC8CdaTsLU0FJ5n6BUIr3iU8oP7puDKvJXeYZu:yG6VvCpt/4N4aNM6CI+U8xOJXeKu
TLSH
T183A37CC78DA018EFE2A56F705C17E12A67AA872057F10DD3267BD04BDCB99C7AA37050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bgkiaj32.exe

Path C:\Windows\SysWOW64\Bgkiaj32.exe
Size 97KB
SHA256 a7f6fe02deea5e337c7fca3af89a34b7feb50074231ec64d6354488bbaa54bf2
MD5 b4d1c049aaf842768586b7cfe06ebaae
SHA1 3a209652c3dc35ada2c09f6495879e45a207394c
SHA512 8e5402f691877d2a7f4d08235ee6783fc44fce7283b190b12c439ef599b6e6eee7a267e227787a79c0462fcf500f682af6edcfe3b607e4e136cf171ef8a91eb7
SSDEEP 1536:ne6NP9RFP6ehdcPZK67lCrOqrBa6iW+GU0DYU0vJXeYZu:lFPcF7lPI4f0RkJXeKu
TLSH
T17AA36C8ECA383C6FDFA51370B7D592371A1CCB5C23C614E34626A5A89D192C2AFF4D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bgnffj32.exe

Path C:\Windows\SysWOW64\Bgnffj32.exe
Size 97KB
SHA256 e832701ecffc3353cb03ef1467a13bbc3359dbfa2ff3c5dfa821f44a1b44df16
MD5 db804c1801c7aa8af9d6c88cde4d82e0
SHA1 d41014692ebd20abc282cf8dd07ef1d961e7c792
SHA512 7174105ccccd216599268eec70a74792769c11475bcdf18e328adc8805ce66fd94e9fc58463ffed2492ad5df4840c88df7711f0aeabc1ca731ae997cc3b78781
SSDEEP 1536:3OkMJTJohs0EVb4kl/+l/KS9Uy1ez8fcu0vJXeYZu:3LyH4klGl/emDfcukJXeKu
TLSH
T1F0A38D02970088A3EFB512715117C33556BF6EDA5B7BCCD38AFBA158484B8F1DB3816A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhkfkmmg.exe

Path C:\Windows\SysWOW64\Bhkfkmmg.exe
Size 97KB
SHA256 b427bf420e9f875e1b3afa1c020aff78890e53b16ca6b6c78657b9dbdb2b65ee
MD5 fa310ca8f2371cc8f41dd6e8e6c051a3
SHA1 f81d8de8d725e7212016a5914d4b7a8ee03f99c0
SHA512 20f5c6f414aac03434e875620b73c1bc433f824bf50568165e34dc55397180574c7c763b342c1dd668cc144e07728116f53354614af97f79d6ce4f0ae953ecfd
SSDEEP 1536:sBaRcORzCdwVDBfKmfxqcSpK74aUQeyxTbty9ln945g8A/FDEOvJXeYZu:sBROBQwVV7fx0JirP0L8YEmJXeKu
TLSH
T1C1A38E3379218C53EE7801745D6E763A0EA7ED0537FA71E76A6AA35C18E84CF8238570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bkgeainn.exe

Path C:\Windows\SysWOW64\Bkgeainn.exe
Size 97KB
SHA256 8cc5a5e1e4a7fdf60a137cfcb6b8796aa13730829079b57692d15128b365c147
MD5 d4329f696da4b409563b4a509602ff68
SHA1 db43f39726ec08bd0ae686d48fd5d6777686c2a2
SHA512 d896f59af4c33518b6083d22d303f1b1e37eab1a96f18871e5fa2f42b754cf49214e2c0d321ef390ffc5094dcb21f9cd893f46baecb02224199df57c19f164e5
SSDEEP 3072:RqOgM/FcCgKWSe651rjF2FHDFtdUczgoJXeKu:RU61gKX91vF2FHDFtK9Qed
TLSH
T17FA38D366C289C63DEACC9709B86152E61EA992717B411F77FF1D8491C2AEC3D3306B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bkibgh32.exe

Path C:\Windows\SysWOW64\Bkibgh32.exe
Size 97KB
SHA256 9ceb183ae4b95d43520913f29a1d21cfcb71b4681586a765dfdd24cb45370010
MD5 c6e7a156bb7c4399116f5b7a6ab8b966
SHA1 096dd7429b0b4813b894c7d6c4f193fb28efc112
SHA512 3749718f430c94a1e27e032449e916052ba54bbbbaaf2b1c379c6d8db5a51952ae08b803eaa6a89b2d0957cf055623f2fb0c6d250a38788864ba77d74671dc8d
SSDEEP 1536:Xc9YuRgeH63QdXcTSP8rHJ8Y3aKCCubCAxvJXeYZu:X2Yu2l3QdXuz8GCCubJhJXeKu
TLSH
T1E7A38C47F8140D63E2AB04335119472F29B8BB80179441E7C3A7F79A68BB9FA92347DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmeandma.exe

Path C:\Windows\SysWOW64\Bmeandma.exe
Size 97KB
SHA256 0fd099e76b7227dde63c4412bc72b3c59dedf9b048c27fbf542ed26a284970e6
MD5 cd7904923b93a8a32cce7ea9ac6ac463
SHA1 a1dcd256982fc0f7b3e5ca65fdd09e470c4e6e48
SHA512 88b792170cff3a7acc81fc16493cbf424b58196d5e59da006c2d0ee6a0f39d5bc5cf31295e6453454cc2d8e82822f546abf886c730b32f59e79323da77afb3a2
SSDEEP 1536:gBKrWeJEKUDNVq8bZZeuPc5Td74U/ZW/EevJXeYZu:guEKcVqaZU3T2Io82JXeKu
TLSH
T1EEA39D13D61C9867FE9500B3190B16F75FE8EE5413AA20E3570EE265582A7F46F383E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmhocd32.exe

Path C:\Windows\SysWOW64\Bmhocd32.exe
Size 97KB
SHA256 8ac19f40011780f2895f62f7ab670a79afc9c0a5de3efeeb7c0d64ba5b8ee877
MD5 71ddc19e3e273055d97183f217ffe891
SHA1 da868adf8db93f31f901f650c089dde7ab2a6e22
SHA512 0db4475f149dd4320cd51e2951e4c85c7a0491600daf10c2285d301dafddbcb4929778e462259f5f166ff96f393336a3b5d93b00b8f2d6aee4c434a451924536
SSDEEP 1536:XyZ58CgdorO4dQvp/DXCrBK3MwA/Evrv89HC8vJXeYZu:sH7Qvp/DStitrv89icJXeKu
TLSH
T17CA36C8BA7274EA6E15E103028CB16235ACE873CC7F350F7D712525C561FAE19778AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bobabg32.exe

Path C:\Windows\SysWOW64\Bobabg32.exe
Size 97KB
SHA256 e1f6703cfffbdc50ce3a2c262b57de5b9cbaa56f0d54af0b8d8e1e294e1f7bad
MD5 5d22ebf935dcb0a425f46bfbbb02f67a
SHA1 5f2af5494223278296d35c01e5b64b05505d1355
SHA512 4f36ced5431d1c034fc97e288e4d8d40ac22cea54801f8f105b5d92bc35b4c55efd03a75dce0d0d733d6ceeee61983fcab60b6069fcdcc6b5d4385899ea4d0e2
SSDEEP 1536:zjoEhx56HyZpDLkMDHM2pTPO5P3cqfPhVyqBjotKOHvJXeYZu:A+AHyfDLkMDXO5P33lotKQJXeKu
TLSH
T125A38D52982F8DE2DEF740F0582D13267A98FBA8D3A050F34F5588C9455A9F2A53F07B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lbandhne.dll

Path C:\Windows\SysWOW64\Lbandhne.dll
Size 7KB
SHA256 cc1bdfc7498eb69fdabe12d7ce5d84bbb187ae34ae67a00aef45e2558653e77e
MD5 bb687fd2d4e5ca5025b18c67aa67c134
SHA1 285600b8f7f888e28e5f59a25af1823ee741ff10
SHA512 282ce13969deb0c6d9798f389904fdd36b653e5723a0bcc3b6582ef65e9cd60f548634b8f98f8d1f02c3667813682dd22a52fe01814bdeb897d41f209b039573
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW5bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPTq3qX5S2hV
TLSH
T1F6E13593F94041BFC09D057912FF29229B7E663426D96009AB809A210CDDBDFFF38545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qdaniq32.exe

Path C:\Windows\SysWOW64\Qdaniq32.exe
Size 97KB
SHA256 70858a2970514b68c139fddbf0b18a6262a1bdedf072875fff7ebd3a8485485c
MD5 cbb069b7c95babeba8048abf432d15cc
SHA1 4ae136886ba565ff191f71f94976bfbf7d50815d
SHA512 0f037302ae01eb99e759e42c267875cc2debcb61065fd058153b7cc951979536159626589b75715d537949d6405b147cc06404384b3be6d13ad2af385bc77f87
SSDEEP 1536:W8Lod6WDe6z1ArUeVdrHQ3FrW5WLq0Vf66o2lhgvJXeYZu:WKS6qjAdCXTNeah4JXeKu
TLSH
T116A34AFFA1A78E5EE22910735437C2BB169CA7041BBA35D32A1BF50834D99D6F5388C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qhjmdp32.exe

Path C:\Windows\SysWOW64\Qhjmdp32.exe
Size 97KB
SHA256 061ef198be4d0ad35f874f4f8059ff9e9ecf6fde9530c261a4e45a88408402c6
MD5 fed5cebf5a7ec007def328cae85a146e
SHA1 930486f6f97e61dccdc0f845bcfedf0e9b4650b7
SHA512 ddb44048a45609c28eb0ffea181befbb41580de565a70e8cecec582559a042d80375b3775a8d44f247799d4e44dbbc60fad516ac4dfba37952ce84a37511da41
SSDEEP 3072:J39AbqyumFO2z8lHa5QrI7tJ/Ksz0aHJXeKu:J39AbqXwO/6qM7FzZded
TLSH
T1B9A38C97A6240C97C2663EB21526437A3109FA7BABEDC0D7E762D38B0C1B3DDC639510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qjfmkk32.exe

Path C:\Windows\SysWOW64\Qjfmkk32.exe
Size 97KB
SHA256 c072e19c3998e96528bcf61184413882dc37a433ca65e0aced1356b617e478ae
MD5 388fea94da54d7f93ee76187bae18365
SHA1 ea870b517642da8a2f1f0567e8728fdeae13f29e
SHA512 b8bf19348b26635a1aec0bd713fe176013f3a7f6eedb346dea860361381f1d9fe03bd951e88952b5330a74b8e27f35d8e63956703eab8c1f04cd8e84b5da2014
SSDEEP 1536:HUnTDnTRAMCqVDPVdSEroT1OWvckiXu5HaDmvJXeYZu:mmzKBdPMT1OWvckUuaOJXeKu
TLSH
T190A3AE86A9D21DA7CFD430F03A6645377FDA99C417A474D3D3EAAD4838848E46E30F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qmgelf32.exe

Path C:\Windows\SysWOW64\Qmgelf32.exe
Size 97KB
SHA256 d0b9c17691b483d3f71ff93df5413805e866b058adb2addd808f036633c5dd53
MD5 ac8344ebf2acdaf49990c34f673a6d39
SHA1 447e44078d74edc71db928d9de64579aaf6c89ab
SHA512 4c0b1ab8e49f12b493918af9db85cde81039178efa851411e3edea52b00a76aa6031061df8ec31ef3e01181001a761379eb55cee3f1cff92ecaca42efcf59f45
SSDEEP 3072:7bxhrAnf6sBYqkkza4IKGyskfn7QJZd2bWJXeKu:7/rCHBYgzamykKed
TLSH
T1F7A39E4A9210DCF7C3BB0DB028576D19FA85A7CD1B5942E75F26AB4809DCCCDB83466C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qobhkjdi.exe

Path C:\Windows\SysWOW64\Qobhkjdi.exe
Size 97KB
SHA256 9f8f2e82ff5a68b59907dfe66257a812143dd7787aac7650fd539429b8265329
MD5 87babc3a9d2645af08c5d32d5a5466dd
SHA1 ec0aceac78bb2aeda95f890fea4a6d19eabfcb69
SHA512 955cf2fccf2c15b26a34f5522f8377674d29071b35187bf28313112acc958944cbfe060c313892ad8779310edf3dc1a3ba59703ffa01d2a1e79d1393f855d5cc
SSDEEP 1536:1IiaxBNhYhWpuLEIXoVPJvWlebFOGARuYghPfILvJXeYZu:mvZwTX2BJBOJeniJXeKu
TLSH
T171A348929F704DA2DEEB0470F706B73A821197020FE544D35B2A3F7A08A67E5AE39855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-448-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/396-566-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/408-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/408-551-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/636-96-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/636-650-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/696-334-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/780-514-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/904-572-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/964-358-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1020-478-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1084-655-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1084-72-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1188-213-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1224-364-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1276-508-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1324-436-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1336-484-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1372-418-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1392-245-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1404-79-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1404-653-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1536-520-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1820-340-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1908-322-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1928-388-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2080-328-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2084-352-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2164-502-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2344-141-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2352-149-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2356-24-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2356-565-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2364-157-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2384-180-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2500-291-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2516-545-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2636-552-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2708-229-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2904-460-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2940-466-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2996-273-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3084-36-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3152-544-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3152-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3180-442-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3224-472-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3248-430-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3272-297-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3312-382-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3316-370-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3328-125-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3384-532-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3484-316-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3492-47-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3512-649-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3512-104-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3584-400-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3656-538-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3912-189-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3972-279-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3992-454-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4008-346-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4052-221-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4152-173-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4160-559-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4180-16-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4180-558-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4268-298-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4312-93-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4320-205-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4332-647-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4332-111-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4364-261-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4464-55-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4476-412-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4512-573-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4512-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4556-133-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4600-526-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4636-285-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4652-574-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4680-165-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4740-267-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4752-197-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4756-496-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-63-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4772-657-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4812-490-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4832-394-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4844-310-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4884-237-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4944-253-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4948-376-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4988-304-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5004-424-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5104-406-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads