berbew | 0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
Size 128KB
Sample260825-tx24csstfx
SHA256 0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547
MD5 fe2540891ac8ae9b3b115ef16770451d
SHA1 79c22150d34cd7175cef22f37b631ce61d0b7cee
SHA512 ffc5735d267024252b787e3aa84c4b5e51f7014313961ace4a732c1bb9c0e1f1238cec0cbcddbb0074256e94e34a4e91080f0449a81f70dcc4ee82f72ee50e3d
SSDEEP 1536:9SYA3y8gc/UsrxbO8M2hfD9+y6RffewEUCVIX8iAwdraEznYiGzBn2rq15bLSwij:jD8g7UyGR/Q3AiAaraEznYfzB9BSwW
TLSH
T16BD37D5FA2061FB2C3C106F01B0667937D25613BD3A988FB54BC842F1226EE586FB6C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkjfakng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ephbhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqmlccdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fggdpnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fnalmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdpnda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejojljqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eqmlccdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjhmbihg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ephbhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Egbken32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqkondfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fboecfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enlcahgh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecikjoep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ejojljqa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edihdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdkdibjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkemfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkjfakng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egbken32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enlcahgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enopghee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcneeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edihdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fdkdibjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ecikjoep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ejccgi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fboecfii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbdnne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejccgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fklcgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnjocf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Famhmfkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcbnpnme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbfkceca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcbnpnme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eqkondfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Egegjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fggdpnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fglnkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbaahf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egegjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcneeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Famhmfkl.exe

Executes dropped EXE 35 IoCs

pid	Process
1160	Ejojljqa.exe
4196	Ephbhd32.exe
3440	Egbken32.exe
4520	Enlcahgh.exe
4144	Eqkondfl.exe
4420	Ecikjoep.exe
1944	Egegjn32.exe
3068	Ejccgi32.exe
2236	Enopghee.exe
4500	Eqmlccdi.exe
3548	Edihdb32.exe
436	Fggdpnkf.exe
1196	Fjeplijj.exe
1356	Fnalmh32.exe
2132	Famhmfkl.exe
4736	Fdkdibjp.exe
2420	Fcneeo32.exe
2120	Fkemfl32.exe
388	Fjhmbihg.exe
1452	Fboecfii.exe
1616	Fdmaoahm.exe
988	Fglnkm32.exe
1288	Fjjjgh32.exe
3080	Fbaahf32.exe
1088	Fdpnda32.exe
2116	Fcbnpnme.exe
2300	Fkjfakng.exe
1220	Fjmfmh32.exe
956	Fbdnne32.exe
4816	Fdbkja32.exe
3448	Fcekfnkb.exe
1016	Fklcgk32.exe
2108	Fnjocf32.exe
4804	Fbfkceca.exe
1216	Gddgpqbe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Enopghee.exe	Ejccgi32.exe
File created	C:\Windows\SysWOW64\Cnidqf32.dll	Fkemfl32.exe
File created	C:\Windows\SysWOW64\Hdeeipfp.dll	Fglnkm32.exe
File created	C:\Windows\SysWOW64\Bejceb32.dll	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Celhnb32.dll	Fcekfnkb.exe
File opened for modification	C:\Windows\SysWOW64\Fjeplijj.exe	Fggdpnkf.exe
File created	C:\Windows\SysWOW64\Fjhmbihg.exe	Fkemfl32.exe
File opened for modification	C:\Windows\SysWOW64\Fbaahf32.exe	Fjjjgh32.exe
File created	C:\Windows\SysWOW64\Fofobm32.dll	Fcbnpnme.exe
File created	C:\Windows\SysWOW64\Fcekfnkb.exe	Fdbkja32.exe
File opened for modification	C:\Windows\SysWOW64\Fnjocf32.exe	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Gddgpqbe.exe	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Kplqhmfl.dll	Egegjn32.exe
File created	C:\Windows\SysWOW64\Fjjjgh32.exe	Fglnkm32.exe
File created	C:\Windows\SysWOW64\Fbfkceca.exe	Fnjocf32.exe
File created	C:\Windows\SysWOW64\Ejojljqa.exe	0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
File created	C:\Windows\SysWOW64\Fllinoed.dll	Ejojljqa.exe
File opened for modification	C:\Windows\SysWOW64\Enlcahgh.exe	Egbken32.exe
File created	C:\Windows\SysWOW64\Fcneeo32.exe	Fdkdibjp.exe
File created	C:\Windows\SysWOW64\Ppkjigdd.dll	Famhmfkl.exe
File created	C:\Windows\SysWOW64\Eqmlccdi.exe	Enopghee.exe
File created	C:\Windows\SysWOW64\Kkcghg32.dll	Enlcahgh.exe
File created	C:\Windows\SysWOW64\Jhhnfh32.dll	Ecikjoep.exe
File created	C:\Windows\SysWOW64\Fjeplijj.exe	Fggdpnkf.exe
File created	C:\Windows\SysWOW64\Fglnkm32.exe	Fdmaoahm.exe
File created	C:\Windows\SysWOW64\Gbjlkd32.dll	Fdpnda32.exe
File opened for modification	C:\Windows\SysWOW64\Fcekfnkb.exe	Fdbkja32.exe
File opened for modification	C:\Windows\SysWOW64\Egbken32.exe	Ephbhd32.exe
File created	C:\Windows\SysWOW64\Ofjljj32.dll	Eqmlccdi.exe
File opened for modification	C:\Windows\SysWOW64\Fdkdibjp.exe	Famhmfkl.exe
File created	C:\Windows\SysWOW64\Fdpnda32.exe	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Fbdnne32.exe	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Fachkklb.dll	Fdbkja32.exe
File created	C:\Windows\SysWOW64\Lhlgjo32.dll	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Ephbhd32.exe	Ejojljqa.exe
File created	C:\Windows\SysWOW64\Enlcahgh.exe	Egbken32.exe
File opened for modification	C:\Windows\SysWOW64\Edihdb32.exe	Eqmlccdi.exe
File created	C:\Windows\SysWOW64\Hmcipf32.dll	Fbdnne32.exe
File opened for modification	C:\Windows\SysWOW64\Fkemfl32.exe	Fcneeo32.exe
File opened for modification	C:\Windows\SysWOW64\Fjhmbihg.exe	Fkemfl32.exe
File created	C:\Windows\SysWOW64\Nhbjnc32.dll	Ephbhd32.exe
File created	C:\Windows\SysWOW64\Edihdb32.exe	Eqmlccdi.exe
File created	C:\Windows\SysWOW64\Fggdpnkf.exe	Edihdb32.exe
File created	C:\Windows\SysWOW64\Pbfbkfaa.dll	Fjeplijj.exe
File created	C:\Windows\SysWOW64\Fdmaoahm.exe	Fboecfii.exe
File opened for modification	C:\Windows\SysWOW64\Fdpnda32.exe	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Eaecci32.dll	0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
File opened for modification	C:\Windows\SysWOW64\Ephbhd32.exe	Ejojljqa.exe
File created	C:\Windows\SysWOW64\Mfikmmob.dll	Egbken32.exe
File created	C:\Windows\SysWOW64\Ejccgi32.exe	Egegjn32.exe
File opened for modification	C:\Windows\SysWOW64\Eqmlccdi.exe	Enopghee.exe
File opened for modification	C:\Windows\SysWOW64\Fggdpnkf.exe	Edihdb32.exe
File created	C:\Windows\SysWOW64\Fnalmh32.exe	Fjeplijj.exe
File created	C:\Windows\SysWOW64\Fboecfii.exe	Fjhmbihg.exe
File opened for modification	C:\Windows\SysWOW64\Ejccgi32.exe	Egegjn32.exe
File opened for modification	C:\Windows\SysWOW64\Famhmfkl.exe	Fnalmh32.exe
File opened for modification	C:\Windows\SysWOW64\Fcneeo32.exe	Fdkdibjp.exe
File created	C:\Windows\SysWOW64\Fbaahf32.exe	Fjjjgh32.exe
File opened for modification	C:\Windows\SysWOW64\Fcbnpnme.exe	Fdpnda32.exe
File opened for modification	C:\Windows\SysWOW64\Fbdnne32.exe	Fjmfmh32.exe
File opened for modification	C:\Windows\SysWOW64\Fklcgk32.exe	Fcekfnkb.exe
File opened for modification	C:\Windows\SysWOW64\Fbfkceca.exe	Fnjocf32.exe
File opened for modification	C:\Windows\SysWOW64\Ecikjoep.exe	Eqkondfl.exe
File created	C:\Windows\SysWOW64\Egegjn32.exe	Ecikjoep.exe

Program crash 1 IoCs

pid	pid_target	Process
5056	1216	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ephbhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnalmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbaahf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnjocf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecikjoep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fggdpnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdpnda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gddgpqbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egegjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejccgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkemfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdbkja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqmlccdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Famhmfkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcneeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjhmbihg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejojljqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enopghee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjeplijj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fboecfii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fglnkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcbnpnme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjmfmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egbken32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdkdibjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdmaoahm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdnne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcekfnkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fklcgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbfkceca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkjfakng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enlcahgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqkondfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edihdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjjjgh32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fnjocf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eqmlccdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nailkcbb.dll"	Fcneeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjhmbihg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbdnne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ephbhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eqkondfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofjljj32.dll"	Eqmlccdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glkkmjeh.dll"	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fcbnpnme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgjjlakk.dll"	Ejccgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adbofa32.dll"	Fjhmbihg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fboecfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egnelfnm.dll"	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eaecci32.dll"	0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fllinoed.dll"	Ejojljqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Enlcahgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fglnkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fcekfnkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpiedd32.dll"	Fnjocf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcggmk32.dll"	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfikmmob.dll"	Egbken32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Famhmfkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajgqdaoi.dll"	Fdkdibjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkemfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdeeipfp.dll"	Fglnkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fggdpnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejceb32.dll"	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Celhnb32.dll"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fklcgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fnjocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ejojljqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojimfh32.dll"	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhlgjo32.dll"	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Egbken32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fcneeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkcghg32.dll"	Enlcahgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ecikjoep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ecikjoep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ejccgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Edihdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjhmbihg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjjjgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ejojljqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Egbken32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhhnfh32.dll"	Ecikjoep.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1160	3264	0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe	87
PID 1160 wrote to memory of 4196	1160	Ejojljqa.exe	88
PID 4196 wrote to memory of 3440	4196	Ephbhd32.exe	89
PID 3440 wrote to memory of 4520	3440	Egbken32.exe	90
PID 4520 wrote to memory of 4144	4520	Enlcahgh.exe	91
PID 4144 wrote to memory of 4420	4144	Eqkondfl.exe	92
PID 4420 wrote to memory of 1944	4420	Ecikjoep.exe	93
PID 1944 wrote to memory of 3068	1944	Egegjn32.exe	94
PID 3068 wrote to memory of 2236	3068	Ejccgi32.exe	95
PID 2236 wrote to memory of 4500	2236	Enopghee.exe	96
PID 4500 wrote to memory of 3548	4500	Eqmlccdi.exe	97
PID 3548 wrote to memory of 436	3548	Edihdb32.exe	98
PID 436 wrote to memory of 1196	436	Fggdpnkf.exe	99
PID 1196 wrote to memory of 1356	1196	Fjeplijj.exe	100
PID 1356 wrote to memory of 2132	1356	Fnalmh32.exe	101
PID 2132 wrote to memory of 4736	2132	Famhmfkl.exe	102
PID 4736 wrote to memory of 2420	4736	Fdkdibjp.exe	103
PID 2420 wrote to memory of 2120	2420	Fcneeo32.exe	104
PID 2120 wrote to memory of 388	2120	Fkemfl32.exe	105
PID 388 wrote to memory of 1452	388	Fjhmbihg.exe	106
PID 1452 wrote to memory of 1616	1452	Fboecfii.exe	107
PID 1616 wrote to memory of 988	1616	Fdmaoahm.exe	108
PID 988 wrote to memory of 1288	988	Fglnkm32.exe	109
PID 1288 wrote to memory of 3080	1288	Fjjjgh32.exe	110
PID 3080 wrote to memory of 1088	3080	Fbaahf32.exe	111
PID 1088 wrote to memory of 2116	1088	Fdpnda32.exe	112
PID 2116 wrote to memory of 2300	2116	Fcbnpnme.exe	113
PID 2300 wrote to memory of 1220	2300	Fkjfakng.exe	114
PID 1220 wrote to memory of 956	1220	Fjmfmh32.exe	115
PID 956 wrote to memory of 4816	956	Fbdnne32.exe	116
PID 4816 wrote to memory of 3448	4816	Fdbkja32.exe	117
PID 3448 wrote to memory of 1016	3448	Fcekfnkb.exe	118
PID 1016 wrote to memory of 2108	1016	Fklcgk32.exe	119
PID 2108 wrote to memory of 4804	2108	Fnjocf32.exe	120
PID 4804 wrote to memory of 1216	4804	Fbfkceca.exe	121

C:\Users\Admin\AppData\Local\Temp\0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe
"C:\Users\Admin\AppData\Local\Temp\0fbca6fa5c54617f94870c59506616c3d4b273860900491f1d436b7cfdea1547.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\Ejojljqa.exe
  C:\Windows\system32\Ejojljqa.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\Ephbhd32.exe
    C:\Windows\system32\Ephbhd32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\SysWOW64\Egbken32.exe
      C:\Windows\system32\Egbken32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3440
    - - C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4520
      - C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\SysWOW64\Ejccgi32.exe
        
        C:\Windows\system32\Ejccgi32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Fnalmh32.exe
        
        C:\Windows\system32\Fnalmh32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\Fdkdibjp.exe
        
        C:\Windows\system32\Fdkdibjp.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1016
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 412
        37⤵
        Program crash
        
        PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1216 -ip 1216
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ecikjoep.exe

Path C:\Windows\SysWOW64\Ecikjoep.exe
Size 128KB
SHA256 87a4347a5d07ade8ce1d5a7a089bff33e345a820db79e05b459e4fc58c169fe4
MD5 43ba9bc693051aefc262b061a79393d7
SHA1 57fe6a737c797a52f8823a307cb5bf367e256dc8
SHA512 b8dd4da3f5c380824efeb18177cbb26baf9a378e764a2cdc8aadac05990fd3421f10667385dd6a516c3f208ce9f20aab4c04f5abd9e25d3fd68fff45e5e464bd
SSDEEP 3072:5mAAX0ZzSRqpwrc3pCB/RbrBEznYfzB9BSwW:5mAAXu9ic3mbrBYOzLc
TLSH
T129D39C1BA3374FE5C6810271660AF2CE7215907A13B985EB5B74801DF31BAF687BB349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edihdb32.exe

Path C:\Windows\SysWOW64\Edihdb32.exe
Size 128KB
SHA256 225d7e5fbc183b423174a098e0d90184cfb083379c36d39142622dab6fe33b69
MD5 81ac4d073cae903cdd0e6b5ce86f869a
SHA1 16dbc8144fd341cd9f6e0bede5ad4a106c87d1be
SHA512 d43fdd4d4e03ca61d5279de7cf87f4a5d8c0665d0f511b163de201c1671407fedc1db1db15cb8c7cabf0d1754f95cca52f716e8b9d6766b0d9d45160a1a3e698
SSDEEP 3072:8aJuEQAj8hdhMMq6yrbbbXUZBPSjQCeMeR9WIrfEznYfzB9BSwW:8aJJj8hdhM8yrHj6BPAQCeMeR9rfYOz
TLSH
T19AD36BABA2C50FF2C7B10376260D5AD6721A8075F3B6BAF77456801C531BEE8333A585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egbken32.exe

Path C:\Windows\SysWOW64\Egbken32.exe
Size 128KB
SHA256 1095b446474efd3cbc193bdd1360322b0cd0c7d18ca4e10df6819e21534e803b
MD5 56d58fddd37ba4dbd8fd6b3db8dbca91
SHA1 9b882eb3372e83358ab7ee0e0d56b146ad8089b7
SHA512 4d817f703ea1bf1fdd674bfaf7a49c1519b5beb39fc54072e46a34d57af4b9590516e3ef786e271f299101730b458c06a6330943b93bed4db184578d464ef192
SSDEEP 1536:JGlX0Xb4EhTiKT2egWexOmtV66BTE+zatLrdEznYiGzBn2rq15bLSwiHr/:ESB2e/yOmnNEVxrdEznYfzB9BSwW
TLSH
T1CCD38E7772090FB2C2820772260DD5C7765BCC7553BAF1E3B874B0DD1266EE982BA690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egegjn32.exe

Path C:\Windows\SysWOW64\Egegjn32.exe
Size 128KB
SHA256 53cf45ea2a65c4bfd6893f737c5047a2712cf158d4f49e699b77e3ef3bf4ec01
MD5 b78344e6688968d681b51cfe424cbc0a
SHA1 d9b946867787c969a3f4a5124f808b2e724276ee
SHA512 327000eef2aeb3ab47c1b59e63c516bdc5ae3f6b00500b16f713cd44c7df58a549a8c9fb23484de61979e75cd4cea69739a39d7ac8f08251b5336bcd933df023
SSDEEP 3072:LuCF0iMOFjG73mi+qoI/aGYrVEznYfzB9BSwW:LbSUo7+ciGYrVYOzLc
TLSH
T17ED36B5BB2477F72CB920D71E91F96C6B37D87396369C9E32864801D42269DB823F2C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ejccgi32.exe

Path C:\Windows\SysWOW64\Ejccgi32.exe
Size 128KB
SHA256 32fdcc5ac46ccffb57fbea8f825fa2265312224fdecb2b2768d2aa1df6d5fe7f
MD5 06bd1396fc069e29642cde24f6c352bb
SHA1 5f3756354cd1bb2e6c2c11d6a20e6e756411c7a5
SHA512 95b57ce70f1b38b1c9d5ee15503249fac84b79ded39c18f556d237137ac4d5b51349a6c2659a5f2d3c27b2be533320c7ced0d5a8bc9f4a9c621149a04fafa37d
SSDEEP 1536:Xfk2AXCM5276s+ezyWFUXoB2M1dsV+BreEznYiGzBn2rq15bLSwiHr/:8/yM4e+yWaYqVIreEznYfzB9BSwW
TLSH
T175D33A3B76883BAEC78301F616FA9DB265D651E84F2EC5E35874805C1227EF813766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ejojljqa.exe

Path C:\Windows\SysWOW64\Ejojljqa.exe
Size 128KB
SHA256 0f291c8fa66097debda67df814dc594c2f65c88d8dd35075af81458db4b25998
MD5 07d798aee2db9ae9c149043d31bba572
SHA1 a7652f821f36470f21cafb7c67ce1898b64f5ae4
SHA512 06d6c76a8d17c27235d671e9a0bfd95f6f5eb800bf2fe0ffe639ffb621b65478549061a7480480c4a8e5fb67c23d9e3ce19038fbb4fa021dc911ca2fd24c0c82
SSDEEP 3072:sEX5dBF4cUtYYNq5ZNreKhBnhrqEznYfzB9BSwW:sEb3+YYNWQKNrqYOzLc
TLSH
T184D35E9AA2081F31C68E02723E46D59766697C2863BDC4D31C58FC3D3262EF8B7F9594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enlcahgh.exe

Path C:\Windows\SysWOW64\Enlcahgh.exe
Size 128KB
SHA256 367c7dceff46d84eabcc3e1ea3b7a010f47be2a5b0a7f144b12fa417c8838939
MD5 f707714f74de5367b14543b41c98e479
SHA1 f70d54e012fff347a203c362520a3eb357b053cf
SHA512 ecfd190db38f4a963d76567a9616b606f2d4c8dafdd7ed569602e728f50e6da780b7e38b8ab3cf509f8486b4a894e3aa7db81c154f05b1d30a556a72df487db4
SSDEEP 3072:JK8P/dW9+l6uDiptd/rHfQ7rCEznYfzB9BSwW:Jp3++l6uDihzH6rCYOzLc
TLSH
T1F1D38B3FB5861F6DF7820171335A56F6B2566878E3EE80D768D9C81C316AED801BD2E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enopghee.exe

Path C:\Windows\SysWOW64\Enopghee.exe
Size 128KB
SHA256 9d0e837e43e663e7fd4d55aa3aa7cdf30a528e5360b749d10f897cb0baafdb8e
MD5 554c0a53b51bdd07077684cd83985df9
SHA1 49f3caa03a0d9c0d7d3df402842b5afe3150ebe0
SHA512 b7e07b0e39edffcf8a97f6e9a74519f856c0e27f23395f1ffff740639605408c94765986563aef77e6ec4c51b11912b56edb464d2be2018db82f4093759aac22
SSDEEP 3072:nWDnGSxTwus7fUg0YKgrMEznYfzB9BSwW:m51wfUMKgrMYOzLc
TLSH
T1A3D37DEB55541FA2C7820073210AA9F67BEF443F53A69BD36464C05F02D6ED8533B6B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ephbhd32.exe

Path C:\Windows\SysWOW64\Ephbhd32.exe
Size 128KB
SHA256 f6f80d0a42d5ba689c0b483a55fb65fc85faaf8149c1b0ab9983415330c81afb
MD5 55ef042ca5ca6825e6b1eebd4a89a83e
SHA1 c4d8950a9c7dfbd41573ef5d7d1d28b7d84cb82e
SHA512 5b325b89db7b57fa530a09751368aff4038315ec572332eb78c2b3fddbd64bfdb841463d6dc41b8adbe20ae46a37a6ddabd102d4688ce2f44e0443c6141cd986
SSDEEP 3072:1dRkpLAOecVUj4zwkfaurXEznYfzB9BSwW:1dwNbzRaurXYOzLc
TLSH
T14ED37FABB2753F71C28202B12E0759DA762C923D63AEC6F3555BC02C035BED9767D680
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eqkondfl.exe

Path C:\Windows\SysWOW64\Eqkondfl.exe
Size 128KB
SHA256 d50f4e0b4c7b86fe11486423669ec4185269209096c9e19cfb0f015409cc76b2
MD5 769f6d643b0285a0a59d5b6d6565199b
SHA1 a420404ceaeedda1f338975d35507238d71c9ac2
SHA512 d012b723ed567a6802d34d566884171eee67ea151248163fffb4178e169e23f78d3b647150d48654b3a0ced716572ac5318212e2e43af41ca5c5e99a13f960b4
SSDEEP 3072:dpjonA25jNiJP425UQSIy0lhS5rJEznYfzB9BSwW:7on/Ni9425LfIrJYOzLc
TLSH
T169D37F3BE3561FA1CF8101F1320665D7B72F443AA3B5D7E30769C0E82506FD961BA6A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eqmlccdi.exe

Path C:\Windows\SysWOW64\Eqmlccdi.exe
Size 128KB
SHA256 c7e896bfa3ad1bcff6dc73509fc44e4bed35a935d31771186ef4fe49b10e6920
MD5 4557efdef3c4b1418b21b69b265b81a8
SHA1 bf4165e96abd0b61788dc924f428ff7481dddcfe
SHA512 8e45930a8a315abadf2ab11b6ce1aafa04181d7c6ca18bb93594e94a551e3be99b4b9952cf3af0fa1cf6b644c89e95ed8666056fea3548c8388ff2e600c0352b
SSDEEP 1536:aG+SNHDo5hqwVOgHQlNFc/jnk8RZGmxPrzEznYiGzBn2rq15bLSwiHr/:OSdoZOk2NFcbpGmxPrzEznYfzB9BSwW
TLSH
T129D35BEB62311F73CBC101B2694A56F77A278079676EC0F35598C03F02269EBCDB6694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Famhmfkl.exe

Path C:\Windows\SysWOW64\Famhmfkl.exe
Size 128KB
SHA256 966c42594afc93d6629d4ecfa6e8dc2ab9e2dcd449f9a8c4360998e6fc833169
MD5 c9b9fa50a0d692a18d4e8792a5c849cb
SHA1 9ae01a3d84af3b827cb7bc7017952f2c2212ffd4
SHA512 3a8ba34fed6c631c12ad21aeb16fdfa1e5f4c6b96fa06683781b85bd4a1cc577a46ffdf7aaf261a0cf56a9f40e070715e0a0ba5a86cb181a9d17a0c937a1e0c6
SSDEEP 3072:7WeBKtuUWloTyCmq8NersEznYfzB9BSwW:6eBKoUWlo0R8rsYOzLc
TLSH
T12AD35C5B22470FF2C681017E16CA658A76359CF9F36982E318698039D1179E8CFFABD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbaahf32.exe

Path C:\Windows\SysWOW64\Fbaahf32.exe
Size 128KB
SHA256 874b72a2d722a279b7c9067e95ea81c4b2cc1d73b0d1bc1da4739388149fe859
MD5 ce9fa8e4292155c912cc2041deb04905
SHA1 1f1d78d93897ccf0c1c78ebf38788aa73edbbf44
SHA512 b145f29efa8d5eb38cc2a88edec8c9738775458313de82b422c27824840c90907aa792299ba45b8cce85611eb33dc1e4ba94ea87a5d2c954640a437b9565bcb0
SSDEEP 3072:FEwBQH67gyEXvs6Wf2xmThkeH3dArYEznYfzB9BSwW:nQH6tEXvtmdkkurYYOzLc
TLSH
T1D3D38E5B72150FF3C78A0272390B95F67B29517A23A9D1E7D9A8F01C0307EE95EBB184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbdnne32.exe

Path C:\Windows\SysWOW64\Fbdnne32.exe
Size 128KB
SHA256 5ebf9985c2241fdb5345869aa1470cab4cfd8bbde66bb8429b435b4bae1bad70
MD5 a555a2c479905915e93f2d26935f3c28
SHA1 84bef2196775219c4335932e2194eb9fc7cda5da
SHA512 b74c8ade1cfa7f7f7492aae3aa6a117a9698af62b2571587d13924340efd6814be221d2b23e225a9d265155959b38816c8631bdf1568faf1e8e6b2715ff165cb
SSDEEP 3072:MXMZL3yFU+hBSQAMClpXG+lOr3EznYfzB9BSwW:MXO3yFU+buMmlOr3YOzLc
TLSH
T187D36CBBA2843FB2C3460DB3264FA992B61A5034D36F85D70C25804D2F27FD5537EA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fboecfii.exe

Path C:\Windows\SysWOW64\Fboecfii.exe
Size 128KB
SHA256 a2f63a9f00dded5af43295e238108bc707e371212ccbb38e2258938f91a07ba1
MD5 df75e066b88a45d9386ffe483d36c80e
SHA1 d0d6009f2268f7dcb5e7ff1e91aad8356729d346
SHA512 14cd3d908fc0d44f70978bfe471b5ee367a671f5619cc6fa6079b75b68b6e24b63c2c1326e5a1d8b9f0bf8444f48be74fed5c9ba15ec43dc7e2ec2f35a8447a3
SSDEEP 3072:TD/swFWltQtRaiL5cxJ0JiRrrEznYfzB9BSwW:sGWlutRpiRrrYOzLc
TLSH
T1B7D37C5BAA4D0F61C64303BD2A4E97C53A2E41AD13668DD3D435C02D296FEECC3BA794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcbnpnme.exe

Path C:\Windows\SysWOW64\Fcbnpnme.exe
Size 128KB
SHA256 c4261d0c2cbaf91dc8bc1c157da7c0bae6861a5ffd346d92af3c208cbfefae42
MD5 03e9511575ef1d1f1d2e61c5c2ed7fb7
SHA1 88e6074af82e52287f6422035a7def973aa3dd8c
SHA512 1d9a159e77b746dd7ca2d5dacde31b3bca9868035854bc7a779ab37f12d828797a90e290bb9bfc4dea180d6ed09e718bd7528d7151aa3d7331e2832811f3c8cb
SSDEEP 1536:xwOiltheFPtJXMZOFi3Uf1En1Dxk6/H8LoIzaXDzS0rLEznYiGzBn2rq15bLSwij:mDtheF1Ev3UiNT20rLEznYfzB9BSwW
TLSH
T1E4D38D5FB1480F72C682C3722505EDB2BB7990A433A789E344A9800D1757FE592FF69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcekfnkb.exe

Path C:\Windows\SysWOW64\Fcekfnkb.exe
Size 128KB
SHA256 daae8734d21edc8894f2154716ad8b8326007d21a25151182e456fd5cc46f8a7
MD5 b6ed00a260d47d265ea9c1bf2a636b94
SHA1 2c5a77cc90ae5e9b74ad594ee8f6e6b2ff540250
SHA512 817883d594456f1ebfa1f3b83ea89c9cd286d01c43c7ad1cafa4742856758256642f699444bfb08e003ac4f644d66c9a4c16d4cb966de9f9a9075c0e9ef40800
SSDEEP 3072:MJDa5UbxpWSBq1kE+4S8AvrGEznYfzB9BSwW:MkP5eb4gvrGYOzLc
TLSH
T173D36EBBB601EF72F19A02F2151E4686730DAD3B63A6C2E758F8800D1617BF9537A744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcneeo32.exe

Path C:\Windows\SysWOW64\Fcneeo32.exe
Size 128KB
SHA256 1b6761f69344dea92b385cd8be4327cbbd3ddec077b4da94677a7991f27ccc31
MD5 065d1fc3ae14c3d8dbcab63571147186
SHA1 9adc0898869ecac89e68cd167e15cd5289fdb1f3
SHA512 e1b2c0d13e44fa3feb62e2600560b93f37a150586ce644245a93345e01472520576b20112bb970a15da89db0d15ec12beab0f564db77bc29e6a6a414f245e555
SSDEEP 3072:vQGsVLpDZQncv9lJw0Bmv4vLVONaPMUrUEznYfzB9BSwW:VsVdDScv9PURUrUYOzLc
TLSH
T10AD36BA7F58F1F71C68607B0E20E20DAA6150437F36646E31756841C0A52ADCDFBFAE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdbkja32.exe

Path C:\Windows\SysWOW64\Fdbkja32.exe
Size 128KB
SHA256 6a95f87ea657ca78d3ab89552988ed7d2ff5c01034655a98588dcc74def07ccf
MD5 e500eff4269dbbb5c7a6eb270659aa6d
SHA1 35b90c9f598231e9fa04b34d5063fc3f4b484f53
SHA512 831e350666b77eddfa49541d57818295965deed1b5d0218c83138da3874de0ea02e2fc52372f1437badf64a3a55796e58b74ab2138411444c56a2f588bb12708
SSDEEP 1536:f5o8jBH6xwssBU0dxooeWVjJUJpjPkbKur15EznYiGzBn2rq15bLSwiHr/:2mGwHy0dxoZWyVlurrEznYfzB9BSwW
TLSH
T1ACD39EAF79898F61CB8102B2290759CDB34ED928DF768DE35064C10D252FAD447FB6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdkdibjp.exe

Path C:\Windows\SysWOW64\Fdkdibjp.exe
Size 128KB
SHA256 8637d48ed9f75060aa4146e54f467c5a47491f94a4de7c9b3d887a391815426b
MD5 c6b2adc08565dbc38c0e7dced49a17b2
SHA1 168c9f2681ab9a0fd923ac5b8d05e58100fc0541
SHA512 a5fddf04e3d8fa6f2466022625822c6d3d5138e3e502edc85e0d988fb2e208e3903abe2347d4d1e74d8c1427534c33afcf33ba8c426a9b1d51bb49cfbc60ed91
SSDEEP 3072:I24O8LDqgH9qFqprqSrUEznYfzB9BSwW:I24O8LDqc95prUYOzLc
TLSH
T1FCD36B5F7226CFF2C68202F6360B47C97719943913FB85E718D8D01AE157EE842FA9A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdmaoahm.exe

Path C:\Windows\SysWOW64\Fdmaoahm.exe
Size 128KB
SHA256 1705b84d7d25171be74d1a9b6e72e22c2ea7f3badb1d0d1f69562d5b5aac088a
MD5 8c9f2197c0d12cd8b4daa7d4a7250f78
SHA1 7b65f55bdcabaedc2aaa638f5fa6993c462bb7a3
SHA512 ed2ccb9444683e8410d247ddc1153818e4b698103fa81f912dd1166eebb1dd283096f6c93e10ef06ad34e0d90da83fab99b98a4b3fec910bbd7b1834e66e686f
SSDEEP 1536:Ie0w0kyfs4aLoNYxferRSwTfgSnoYNrNEznYiGzBn2rq15bLSwiHr/:Ih44aFQrXTQYNrNEznYfzB9BSwW
TLSH
T1E6D36D6661320F72C7811E7D375BD49EE61A6D293379C2E34424802E131AEDAD37BE6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdpnda32.exe

Path C:\Windows\SysWOW64\Fdpnda32.exe
Size 128KB
SHA256 5bd0879fa333b9273c243f8fafe18cd74bd43a74c78ee959088f80f190585aec
MD5 68e8612178a5206e9db8f6b670f3c7a4
SHA1 5b5a0c3684b8739e79401e63c99b71dcb9a60b94
SHA512 257b53e655705a511bcdbc28ebf714a514628c38693573c1bb3111229a7d47718cf1f550c2d586911a13e240bad1dd1994beb1bce31231256857f5ed66e2948a
SSDEEP 3072:odUzgXzx5ojJIBvx14LYsBBrhEznYfzB9BSwW:7zgXzxO9IBvx1gYsBBrhYOzLc
TLSH
T17DD37DABFA781F72DA820271364B5A56F319602D13BE4BE7145B803D1223AFD463FE54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fggdpnkf.exe

Path C:\Windows\SysWOW64\Fggdpnkf.exe
Size 128KB
SHA256 a02982b73106802bbb9e3eb278c938ae756ad2381e83a4264fe8e729eb316fe8
MD5 3035a82902c59ed5d5e79d8eb091c09b
SHA1 ac34a28f991aa5cf8a0b12c9fbf9d43265ffb965
SHA512 2ecc53ff26f8ba364a8f318005532b8f40f7c9afb28bc03711d2b335fd24a3f64a9839c87cae0f7205a4c7da2a04f9e13bbdb0875502884e3aeecf2af7b65c68
SSDEEP 3072:/uqfWwcm7xXOs///OJv5GnPr9EznYfzB9BSwW:/aVAxOQwvsPr9YOzLc
TLSH
T1F3D36C5BB6453FB2DA820273264F5D92A21C817B0F6B95E718A4CC1FF216EDC41BB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fglnkm32.exe

Path C:\Windows\SysWOW64\Fglnkm32.exe
Size 128KB
SHA256 117c691c2ad41c300c179300edf8ac0ad4dbf06acea63968a9452129001ef6eb
MD5 ac9acba4db3a0c16e58f5089145c3b2c
SHA1 09c16130d57ae3887d8822b254a752a11c437d75
SHA512 91abab7f105a96c8a31f055b0369ef52362d8cd1b7ec771c7c06a82a4d289f46a6525f7ee1d9c082e89e3aa54e6da1e1bfff9e842d137d281c2306cc183475d6
SSDEEP 1536:rzO4ibyEftLxE+RQoMWIpcPfmU/hwzfFxIi1broPEznYiGzBn2rq15bLSwiHr/:+L+LWicPZwpxIUrsEznYfzB9BSwW
TLSH
T1B4D36E2AB5453F31C18216F3E60A55BAFB1A433833BA84F74198881F0667BD5E2F7592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjeplijj.exe

Path C:\Windows\SysWOW64\Fjeplijj.exe
Size 128KB
SHA256 74fbf2676a36b6ee05f79b45b647cf006a407d96710e2a3c5897023080732273
MD5 ee8dc9275fc64640ba291b729effc8fb
SHA1 c97736d78eddfb218cb7a00252becc9dddadcf54
SHA512 d4c88fdda5736ccde0fd7a4660b08dcf27efc9c2da921a20ec90591a21093d6bd011d12b5bd65d1153f49f4883eab21159110cd8e0488ccedd2b42ef49e25435
SSDEEP 3072:3D9ZGIHVPQHGL/h1WgrVEznYfzB9BSwW:3D9ckImprVYOzLc
TLSH
T1A0D36A1A750D2F62C2C311F175CBD8DF7629916873AA8FD3342CC01C2AC79F88675AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjhmbihg.exe

Path C:\Windows\SysWOW64\Fjhmbihg.exe
Size 128KB
SHA256 6d0386797891d3749dabb5f75ee7f57ce3d70d07f5c7c58816c012ee1847b3fc
MD5 acf48384c1ff187e3c0f49c4ed30f801
SHA1 5f7d05d4ac2c4a5a29a8c6c29c5f2e1b31fd668f
SHA512 08555cc42ea3f786cdf1ae720f7c8f4025808a0ec75b59ca2c95c4f292eec1dbf8000f02e00844621eff9e21e235e3aca48e808a1bc823cb28ebbb3784fa762c
SSDEEP 3072:7BSqRmKYVHLnx2Hgd3TrZEznYfzB9BSwW:NLMTtrZYOzLc
TLSH
T1E7D35B6672890FBDC581023D3186C89FF7155279E39992E329B4C01D13A6DFE02BBED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjjjgh32.exe

Path C:\Windows\SysWOW64\Fjjjgh32.exe
Size 128KB
SHA256 5aa015f388689cf837e26680667e3c37e9c36cd015cc8f91812bd8617e63ecdc
MD5 da1b2ffaae03405f587982a8aecc92a6
SHA1 b2e17e9d836d4d24248471041cd48f472309d86b
SHA512 e4f989f079dd5c882917d09e49c300e475e86bec830a37c7550b45767e8f041e4b32d23a52a58c9f5a1da4a3d46d69e2cde997c357f09802a899947e4fe5e3dd
SSDEEP 1536:MO8ES3+ZwkqH/D9s4XtGQ9c9DrTEznYiGzBn2rq15bLSwiHr/:MOXNjTQ9+rTEznYfzB9BSwW
TLSH
T181D38D2AA1890F7EC28202F15D0B967BB6189228136983D3165DCCDD13E7FDD72B63B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fjmfmh32.exe

Path C:\Windows\SysWOW64\Fjmfmh32.exe
Size 128KB
SHA256 99191c72b92e7aa94b5f552dc9ee4c5032aa61a1b0d7eed20d1ed999f305aafc
MD5 94b86fa631909f6742bf55ceab4c93ca
SHA1 8408ab6382982005b3faad2850f879f740855f37
SHA512 563dd12de7e048a71a7b9c3cea72bb570f7a77c57e67e0d4626b1d189276fca229d2d80b80157a4e7dc96c41f50a41f992c171f5efd3a9b4f178150a8cde9ab4
SSDEEP 3072:KdP/OIkm2E8I+Qks+vnrnEznYfzB9BSwW:KdnC1B0z+vrnYOzLc
TLSH
T18FD34BFE624C1FE2C6923D752E0E54827726E52A2365C6D37C54C33E012EEDB427A6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkemfl32.exe

Path C:\Windows\SysWOW64\Fkemfl32.exe
Size 128KB
SHA256 42bfe7b52ffc49eaf6c1f4bfeb1b3657f99d79a08e3530e0ae4edfd87c391892
MD5 9303ba0c4f6d5b53e077dbd5a7c9b2c3
SHA1 f4ca85ac2fb6ba6440e0de414afb40db63e82745
SHA512 2c2cf8a461ffc1534b67e72cba90ee981cb0a539518ef7a45496c8d22e33fa2e400829deb113a627121ffb65ca79052ffe4816d235fc92e7af1d6d00f64f79fa
SSDEEP 3072:tSFzxbRiPL4rco90zaJui6/rUfAaarYEznYfzB9BSwW:tSFzTrNCW6/rUfAaarYYOzLc
TLSH
T1D1D35C5AF6894FF2C28301B1250F59C7B23C55FE13A585EB94688C4E0766EE8D2FB781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkjfakng.exe

Path C:\Windows\SysWOW64\Fkjfakng.exe
Size 128KB
SHA256 a232edd4f9411a17988f32cee7bdb17b5fbe979ad998cbea708cc72a32c80ce1
MD5 fb168464930a01852e68533f25ac8749
SHA1 1cefb11b106de5f1fc535776da7da37c72c7b980
SHA512 333c77be9783ce9d4c590d494093c9ace0627552c0f79a90e46048163953a56b634a50a6e3b2fc9dcb3eca81e478ab3060403a4841f9f5f34264ebce198afcec
SSDEEP 3072:19v+cNGfobfNzy3QgYZQSM3RANbNrJEznYfzB9BSwW:19v+csf+fNzy3QgEHM3RANhrJYOzLc
TLSH
T134D35B6BF11AFFB3C6C102B13D0B99CBB61A542973AA84D75888B40C52D6CDD477AED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fklcgk32.exe

Path C:\Windows\SysWOW64\Fklcgk32.exe
Size 128KB
SHA256 a23a3c2e172692d412c27f324da77a379489d425ec5039c8abf366874f127608
MD5 5acf7955a70b72f8d3916e970cbd7c72
SHA1 438ea7da33cce886375652d674edf51ad107cfa7
SHA512 8468f3e45723a6ed7c7cb6b57c15868b8b79b781f9a939eb0653b0eba22f888f2c19a6e991d345a2c1dd2aa7d91ecd7a05e9c288c2e56c26e11d0e3add622c7e
SSDEEP 3072:4SliyV+syZ/fFaK+Jps+srMEznYfzB9BSwW:4y2fFaK++rMYOzLc
TLSH
T127D36DEAAE050FB2C65302B23E4A5FE6F72E513923BE85D3005D88190513ED957BAFC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fnalmh32.exe

Path C:\Windows\SysWOW64\Fnalmh32.exe
Size 128KB
SHA256 ce77a0e8227775c1001b64cf02f5895b7cf72fd084c794a1437108a8a5bae46f
MD5 97c00dfebe26cd9cd71c9d295cda4470
SHA1 ba91127ac987e9ab8c10d304ac902cb82e8fad55
SHA512 d5eedf9184f62a78bde18e16ac27fe6416e1352d5a03a4851c27bf5144a4106d21a25a984a565717830f6fd710c6021a753e885cca34b9b5aa56e7edd5124038
SSDEEP 3072:mIJoUXvwwBVQmhAm1uw8u+odsYnQQrVEznYfzB9BSwW:tJoUfVQLYFQQrVYOzLc
TLSH
T1C7D36E1ABEF2DFB2C64602F13509E4C776174F79A7A9C9F3186CB20D0192DDA537A281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkcghg32.dll

Path C:\Windows\SysWOW64\Kkcghg32.dll
Size 7KB
SHA256 376db4b42edab392e0ea23c6a34593da39f14e5ac337a39677965b8b0a1ef61b
MD5 09912be9dcf110f4ebff1a76c9559d03
SHA1 3b80ab783ab959c56a1634f51d44334aa6b75301
SHA512 d8c27a904a723ed55aa4f35c45fc3dfca3ab9ed1a130e082e6a16a5653ac1d117df433e6481024838c8f2e31e81c4417f3865c8d2031f03d04243038d887f535
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWcbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbP+q3qX5S2hV
TLSH
T123E11593F94041BFC09D097912FF2922AB7E663426D96009AB809A251CDDBDFFF38545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-156-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/436-100-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/956-236-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/988-180-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1016-260-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1088-204-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1160-276-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1160-8-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1196-108-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1216-274-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1220-228-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1288-188-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1356-116-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1452-164-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1616-172-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1944-60-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2108-266-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2116-212-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2120-148-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2132-124-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2236-76-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2300-220-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/2420-140-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3068-69-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3080-196-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3264-278-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3264-0-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3440-28-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3448-252-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/3548-92-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4144-44-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4196-15-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4196-277-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4420-52-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4500-84-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4520-32-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4520-275-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4736-132-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4804-272-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/4816-244-0x0000000000400000-0x0000000000444000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads