berbew | 1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a.exe
Size 159KB
Sample260825-vsdewaab39
SHA256 1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a
MD5 e9e5aebe0121a72a1dc7bd02c452374e
SHA1 22ff0f034565171a8603006cbbd99a59e6fb1418
SHA512 13a1f8deb581e684c5546f937512c2e214113e9355ccf540bc4852f8e1989b81059c0c583955ed792a9555849805e3eea9e2165c753df8a1bad5a47fddf45cd4
SSDEEP 3072:QtgRfuJ16ztVUMcTnO0ofPH9bwf1nFzwSAJB8FgBY5nd/M9dAQ:+gRfuJ16ztOMcloHG1n6xJmPM9dAQ
TLSH
T1F2F38D66B3281C7DC6BEB77C546EE2AC72D2E035B1BD417F9B0D4945E84A96308CE603
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afappe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apggckbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bpedeiff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baepolni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fklcgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daeifj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkedonpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkcpql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgiaemic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbhildae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fncibg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdmaoahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afhfaddk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkedonpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enhifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enjfli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Adjjeieh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbdpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnqcfjae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egnajocq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkgillpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqdbdbna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dggkipii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjcmngnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbanq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epdime32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecikjoep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Famhmfkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fgiaemic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fdmaoahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gqkhda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnohnffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfkbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Egpnooan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ejagaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpqjjjjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccppmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckidcpjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eahobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fncibg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmbnnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bpqjjjjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjfogbjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdmoafdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dahfkimd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkjfakng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdcmkgmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bbhildae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdjblf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dggkipii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ggccllai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnqcfjae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Egkddo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eajlhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkcpql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkgillpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggccllai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gjcmngnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gggmgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhfaddk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eahobg32.exe

Executes dropped EXE 61 IoCs

pid	Process
4812	Abcgjg32.exe
4392	Apggckbf.exe
3856	Abfdpfaj.exe
3984	Afappe32.exe
876	Amnebo32.exe
5116	Ajaelc32.exe
332	Adjjeieh.exe
5088	Afhfaddk.exe
772	Bmbnnn32.exe
4980	Bpqjjjjl.exe
4748	Bfkbfd32.exe
2520	Bjfogbjb.exe
3772	Bmdkcnie.exe
5056	Bpedeiff.exe
1232	Bbdpad32.exe
3252	Baepolni.exe
2956	Bdcmkgmm.exe
3620	Bbhildae.exe
5008	Cdjblf32.exe
2372	Cdmoafdb.exe
2524	Ccppmc32.exe
3332	Ckidcpjl.exe
4436	Dgpeha32.exe
2196	Daeifj32.exe
3904	Dgbanq32.exe
2392	Dahfkimd.exe
4008	Dgdncplk.exe
1736	Dnngpj32.exe
4728	Dggkipii.exe
1884	Dnqcfjae.exe
3688	Dkedonpo.exe
4372	Egkddo32.exe
3416	Epdime32.exe
2400	Egnajocq.exe
2124	Enhifi32.exe
4180	Egpnooan.exe
4892	Enjfli32.exe
4124	Ejagaj32.exe
1796	Eahobg32.exe
5012	Ecikjoep.exe
2924	Eajlhg32.exe
4528	Edihdb32.exe
4196	Fkcpql32.exe
2452	Famhmfkl.exe
1440	Fgiaemic.exe
2288	Fkemfl32.exe
1680	Fncibg32.exe
2652	Fdmaoahm.exe
3136	Fkgillpj.exe
4520	Fqdbdbna.exe
4596	Fgnjqm32.exe
32	Fkjfakng.exe
2232	Fdbkja32.exe
3080	Fklcgk32.exe
4644	Fbfkceca.exe
2976	Ggccllai.exe
1556	Gqkhda32.exe
4612	Gjcmngnj.exe
3728	Gnohnffc.exe
2396	Gggmgk32.exe
4704	Gbmadd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cdjblf32.exe	Bbhildae.exe
File created	C:\Windows\SysWOW64\Lcckiibj.dll	Afappe32.exe
File created	C:\Windows\SysWOW64\Afhfaddk.exe	Adjjeieh.exe
File created	C:\Windows\SysWOW64\Ldbhiiol.dll	Bjfogbjb.exe
File opened for modification	C:\Windows\SysWOW64\Famhmfkl.exe	Fkcpql32.exe
File opened for modification	C:\Windows\SysWOW64\Fgnjqm32.exe	Fqdbdbna.exe
File opened for modification	C:\Windows\SysWOW64\Fdbkja32.exe	Fkjfakng.exe
File opened for modification	C:\Windows\SysWOW64\Afappe32.exe	Abfdpfaj.exe
File created	C:\Windows\SysWOW64\Leldmdbk.dll	Bmdkcnie.exe
File created	C:\Windows\SysWOW64\Hmafal32.dll	Bbdpad32.exe
File opened for modification	C:\Windows\SysWOW64\Dgdncplk.exe	Dahfkimd.exe
File opened for modification	C:\Windows\SysWOW64\Apggckbf.exe	Abcgjg32.exe
File opened for modification	C:\Windows\SysWOW64\Bjfogbjb.exe	Bfkbfd32.exe
File created	C:\Windows\SysWOW64\Bbdpad32.exe	Bpedeiff.exe
File created	C:\Windows\SysWOW64\Ofjljj32.dll	Eajlhg32.exe
File created	C:\Windows\SysWOW64\Fdmaoahm.exe	Fncibg32.exe
File created	C:\Windows\SysWOW64\Gqkhda32.exe	Ggccllai.exe
File opened for modification	C:\Windows\SysWOW64\Afhfaddk.exe	Adjjeieh.exe
File opened for modification	C:\Windows\SysWOW64\Ckidcpjl.exe	Ccppmc32.exe
File created	C:\Windows\SysWOW64\Okkbgpmc.dll	Famhmfkl.exe
File created	C:\Windows\SysWOW64\Djojepof.dll	Fncibg32.exe
File created	C:\Windows\SysWOW64\Fbfkceca.exe	Fklcgk32.exe
File opened for modification	C:\Windows\SysWOW64\Gbmadd32.exe	Gggmgk32.exe
File created	C:\Windows\SysWOW64\Apggckbf.exe	Abcgjg32.exe
File created	C:\Windows\SysWOW64\Lpcgahca.dll	Ckidcpjl.exe
File created	C:\Windows\SysWOW64\Nlkppnab.dll	Daeifj32.exe
File created	C:\Windows\SysWOW64\Nailkcbb.dll	Fgiaemic.exe
File created	C:\Windows\SysWOW64\Dilcjbag.dll	Bpedeiff.exe
File opened for modification	C:\Windows\SysWOW64\Cdmoafdb.exe	Cdjblf32.exe
File created	C:\Windows\SysWOW64\Bhkacq32.dll	Epdime32.exe
File created	C:\Windows\SysWOW64\Enhifi32.exe	Egnajocq.exe
File created	C:\Windows\SysWOW64\Hmcipf32.dll	Fkjfakng.exe
File created	C:\Windows\SysWOW64\Fpiedd32.dll	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Baepolni.exe	Bbdpad32.exe
File opened for modification	C:\Windows\SysWOW64\Bmbnnn32.exe	Afhfaddk.exe
File created	C:\Windows\SysWOW64\Bmdkcnie.exe	Bjfogbjb.exe
File created	C:\Windows\SysWOW64\Bpedeiff.exe	Bmdkcnie.exe
File opened for modification	C:\Windows\SysWOW64\Bpedeiff.exe	Bmdkcnie.exe
File created	C:\Windows\SysWOW64\Cdmoafdb.exe	Cdjblf32.exe
File created	C:\Windows\SysWOW64\Icembg32.dll	Egnajocq.exe
File created	C:\Windows\SysWOW64\Bpqjjjjl.exe	Bmbnnn32.exe
File created	C:\Windows\SysWOW64\Ikfbpdlg.dll	Dahfkimd.exe
File opened for modification	C:\Windows\SysWOW64\Fkcpql32.exe	Edihdb32.exe
File created	C:\Windows\SysWOW64\Ckidcpjl.exe	Ccppmc32.exe
File opened for modification	C:\Windows\SysWOW64\Egkddo32.exe	Dkedonpo.exe
File opened for modification	C:\Windows\SysWOW64\Enjfli32.exe	Egpnooan.exe
File created	C:\Windows\SysWOW64\Eahobg32.exe	Ejagaj32.exe
File created	C:\Windows\SysWOW64\Gggmgk32.exe	Gnohnffc.exe
File created	C:\Windows\SysWOW64\Egnajocq.exe	Epdime32.exe
File created	C:\Windows\SysWOW64\Fncibg32.exe	Fkemfl32.exe
File created	C:\Windows\SysWOW64\Fjinnekj.dll	Fdmaoahm.exe
File created	C:\Windows\SysWOW64\Hhdjkflc.dll	Abcgjg32.exe
File created	C:\Windows\SysWOW64\Adjjeieh.exe	Ajaelc32.exe
File created	C:\Windows\SysWOW64\Caaimlpo.dll	Bfkbfd32.exe
File created	C:\Windows\SysWOW64\Bdcmkgmm.exe	Baepolni.exe
File opened for modification	C:\Windows\SysWOW64\Ejagaj32.exe	Enjfli32.exe
File created	C:\Windows\SysWOW64\Fqdbdbna.exe	Fkgillpj.exe
File created	C:\Windows\SysWOW64\Fdbkja32.exe	Fkjfakng.exe
File opened for modification	C:\Windows\SysWOW64\Daeifj32.exe	Dgpeha32.exe
File opened for modification	C:\Windows\SysWOW64\Edihdb32.exe	Eajlhg32.exe
File created	C:\Windows\SysWOW64\Begndj32.dll	Fkemfl32.exe
File created	C:\Windows\SysWOW64\Gajlgpic.dll	Fkgillpj.exe
File created	C:\Windows\SysWOW64\Fklcgk32.exe	Fdbkja32.exe
File created	C:\Windows\SysWOW64\Gjcmngnj.exe	Gqkhda32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4184	4704	WerFault.exe	146

System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckidcpjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbanq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdmoafdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccppmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnngpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egkddo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baepolni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daeifj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgdncplk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eajlhg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgnjqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gggmgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbmadd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enjfli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edihdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfogbjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmdkcnie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahfkimd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epdime32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkbfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eahobg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdbkja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpedeiff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdcmkgmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Famhmfkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkgillpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnebo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egnajocq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecikjoep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbfkceca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apggckbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdjblf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egpnooan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqdbdbna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbnnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkemfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fncibg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdmaoahm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fklcgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhfaddk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpqjjjjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnqcfjae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkedonpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnohnffc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgpeha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggccllai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjcmngnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajaelc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enhifi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkcpql32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkjfakng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqkhda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abfdpfaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adjjeieh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afappe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dggkipii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejagaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgiaemic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcgjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbdpad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbhildae.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmqkimh.dll"	Bpqjjjjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmdkcnie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdmoafdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ccppmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dnqcfjae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkcpql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bbhildae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Egkddo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Egpnooan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Famhmfkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdmaoahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkgillpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajaelc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caaimlpo.dll"	Bfkbfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkedonpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eajlhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okkbgpmc.dll"	Famhmfkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbfkceca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckidcpjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokmd32.dll"	Dgpeha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgdncplk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dnngpj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dggkipii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ecikjoep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ecikjoep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nailkcbb.dll"	Fgiaemic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjfogbjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bbdpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dahfkimd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgdncplk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eahobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dodfed32.dll"	Eahobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djojepof.dll"	Fncibg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckidcpjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Binfdh32.dll"	Egpnooan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fqdbdbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcipf32.dll"	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpiedd32.dll"	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogeigbeb.dll"	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Apggckbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmbnnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofjljj32.dll"	Eajlhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Edihdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fklcgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ggccllai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajbfciej.dll"	Apggckbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baepolni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qecffhdo.dll"	Bbhildae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgpeha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Begndj32.dll"	Fkemfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkemfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efoomp32.dll"	Amnebo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfkbfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dnngpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Egkddo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Epdime32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Enjfli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abcgjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfbjkg32.dll"	Afhfaddk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bbhildae.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4812	4572	1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a.exe	86
PID 4812 wrote to memory of 4392	4812	Abcgjg32.exe	87
PID 4392 wrote to memory of 3856	4392	Apggckbf.exe	88
PID 3856 wrote to memory of 3984	3856	Abfdpfaj.exe	89
PID 3984 wrote to memory of 876	3984	Afappe32.exe	90
PID 876 wrote to memory of 5116	876	Amnebo32.exe	91
PID 5116 wrote to memory of 332	5116	Ajaelc32.exe	92
PID 332 wrote to memory of 5088	332	Adjjeieh.exe	93
PID 5088 wrote to memory of 772	5088	Afhfaddk.exe	94
PID 772 wrote to memory of 4980	772	Bmbnnn32.exe	95
PID 4980 wrote to memory of 4748	4980	Bpqjjjjl.exe	96
PID 4748 wrote to memory of 2520	4748	Bfkbfd32.exe	97
PID 2520 wrote to memory of 3772	2520	Bjfogbjb.exe	98
PID 3772 wrote to memory of 5056	3772	Bmdkcnie.exe	99
PID 5056 wrote to memory of 1232	5056	Bpedeiff.exe	100
PID 1232 wrote to memory of 3252	1232	Bbdpad32.exe	101
PID 3252 wrote to memory of 2956	3252	Baepolni.exe	102
PID 2956 wrote to memory of 3620	2956	Bdcmkgmm.exe	103
PID 3620 wrote to memory of 5008	3620	Bbhildae.exe	104
PID 5008 wrote to memory of 2372	5008	Cdjblf32.exe	105
PID 2372 wrote to memory of 2524	2372	Cdmoafdb.exe	106
PID 2524 wrote to memory of 3332	2524	Ccppmc32.exe	107
PID 3332 wrote to memory of 4436	3332	Ckidcpjl.exe	108
PID 4436 wrote to memory of 2196	4436	Dgpeha32.exe	109
PID 2196 wrote to memory of 3904	2196	Daeifj32.exe	110
PID 3904 wrote to memory of 2392	3904	Dgbanq32.exe	111
PID 2392 wrote to memory of 4008	2392	Dahfkimd.exe	112
PID 4008 wrote to memory of 1736	4008	Dgdncplk.exe	113
PID 1736 wrote to memory of 4728	1736	Dnngpj32.exe	114
PID 4728 wrote to memory of 1884	4728	Dggkipii.exe	115
PID 1884 wrote to memory of 3688	1884	Dnqcfjae.exe	116
PID 3688 wrote to memory of 4372	3688	Dkedonpo.exe	117
PID 4372 wrote to memory of 3416	4372	Egkddo32.exe	118
PID 3416 wrote to memory of 2400	3416	Epdime32.exe	119
PID 2400 wrote to memory of 2124	2400	Egnajocq.exe	120
PID 2124 wrote to memory of 4180	2124	Enhifi32.exe	121
PID 4180 wrote to memory of 4892	4180	Egpnooan.exe	122
PID 4892 wrote to memory of 4124	4892	Enjfli32.exe	123
PID 4124 wrote to memory of 1796	4124	Ejagaj32.exe	124
PID 1796 wrote to memory of 5012	1796	Eahobg32.exe	125
PID 5012 wrote to memory of 2924	5012	Ecikjoep.exe	126
PID 2924 wrote to memory of 4528	2924	Eajlhg32.exe	127
PID 4528 wrote to memory of 4196	4528	Edihdb32.exe	128
PID 4196 wrote to memory of 2452	4196	Fkcpql32.exe	129
PID 2452 wrote to memory of 1440	2452	Famhmfkl.exe	130
PID 1440 wrote to memory of 2288	1440	Fgiaemic.exe	131
PID 2288 wrote to memory of 1680	2288	Fkemfl32.exe	132
PID 1680 wrote to memory of 2652	1680	Fncibg32.exe	133
PID 2652 wrote to memory of 3136	2652	Fdmaoahm.exe	134
PID 3136 wrote to memory of 4520	3136	Fkgillpj.exe	135
PID 4520 wrote to memory of 4596	4520	Fqdbdbna.exe	136
PID 4596 wrote to memory of 32	4596	Fgnjqm32.exe	137
PID 32 wrote to memory of 2232	32	Fkjfakng.exe	138
PID 2232 wrote to memory of 3080	2232	Fdbkja32.exe	139
PID 3080 wrote to memory of 4644	3080	Fklcgk32.exe	140
PID 4644 wrote to memory of 2976	4644	Fbfkceca.exe	141
PID 2976 wrote to memory of 1556	2976	Ggccllai.exe	142
PID 1556 wrote to memory of 4612	1556	Gqkhda32.exe	143
PID 4612 wrote to memory of 3728	4612	Gjcmngnj.exe	144
PID 3728 wrote to memory of 2396	3728	Gnohnffc.exe	145
PID 2396 wrote to memory of 4704	2396	Gggmgk32.exe	146

C:\Users\Admin\AppData\Local\Temp\1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a.exe
"C:\Users\Admin\AppData\Local\Temp\1b10a428ccf8d3f71cc7c46bdce5ff9fcb3b453b979ab85186380919a11ca18a.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\Abcgjg32.exe
  C:\Windows\system32\Abcgjg32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\Apggckbf.exe
    C:\Windows\system32\Apggckbf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\SysWOW64\Abfdpfaj.exe
      C:\Windows\system32\Abfdpfaj.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3984
      - C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:332
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\SysWOW64\Egkddo32.exe
        
        C:\Windows\system32\Egkddo32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Eajlhg32.exe
        
        C:\Windows\system32\Eajlhg32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2288
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:32
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Gnohnffc.exe
        
        C:\Windows\system32\Gnohnffc.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 216
        63⤵
        Program crash
        
        PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4704 -ip 4704
1⤵
PID:2108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Abcgjg32.exe

Path C:\Windows\SysWOW64\Abcgjg32.exe
Size 159KB
SHA256 a29ffc5bc1af27ff33917a784e85ab83cc12709f5c454de6c03aefedabc8b8f4
MD5 c8d39a2aece8572753a514ab65e57036
SHA1 515f102af176b7ac4fea3695146d35ddd9b5974e
SHA512 5012411ee190710082e572c249de22a2db851aeb54add7fe27bdf2ae9c8fbde0d08aa97de56d3ec0be5f494551f79dde57a21e238fe75e021a55c4fee1b33511
SSDEEP 3072:OaQ44r8MbQdM65KUBOi7O8fQX8XUSbwf1nFzwSAJB8FgBY5nd/M9dAQ:+br82lS57jQX8XUP1n6xJmPM9dAQ
TLSH
T1C8F3AEA6B2721E55CDBE7B3C105EFDE17275F021F1BA023B8F298D56EDCAB221581502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Abfdpfaj.exe

Path C:\Windows\SysWOW64\Abfdpfaj.exe
Size 159KB
SHA256 3879e1b2959751bf4c93f358e9c2974c6ed5d0ba7f891c6d2907bdba4c046b95
MD5 2460b8bea4e377c8fad3e7db8ce8d7d9
SHA1 f7023e62885955093afbda5cade8a00d35b420f7
SHA512 372691ba1f410f0bb759761e2736626b40cb22fd32c432962ae6f203b9405d2993e236c64fb08e4aa3e57a4b0b2507d70303b8685209083659e0a08461b9a6eb
SSDEEP 3072:4IwLZ0j824tJqbwf1nFzwSAJB8FgBY5nd/M9dAQ:49LZ0I24XH1n6xJmPM9dAQ
TLSH
T10AF38C22B52A2D95C5BA777C044EBFB3372DDD31B0A9813BFB4B4BA5E94A5E30411123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adjjeieh.exe

Path C:\Windows\SysWOW64\Adjjeieh.exe
Size 159KB
SHA256 5f00bfc4687188e0c258fd4a98e03460061aa1be3df1ee9a32ee4f0e5800acd5
MD5 81c270789e6d47c999ed57379b862dc6
SHA1 3be7ec6f6bf4792c6eca12cfb3aca05015d3890c
SHA512 de2da273641fc8bc20dc56476fbd02797f8934072c99baa3bb5dcbb4958ac9fb85f17b543a574ba7023043405a66a295adc53ad3fbd56ff20aa177e185173501
SSDEEP 3072:+iJJKhKnjhXFr2VtWChj55T55r55T55T557557557557X5555555555S055f555W:+8JPhXx2VAu2xg1n6xJmPM9dAQ
TLSH
T1B7F38CAABF192D65C074377C098EBD667251F230B4BB8C3B274D8E54E8096FE0573626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Afappe32.exe

Path C:\Windows\SysWOW64\Afappe32.exe
Size 159KB
SHA256 6445ee6ace7fd0705506c6672891a3d90697ad79b0e87af4e48ac26f1975bd97
MD5 5b4d590e2f48c056756f1d90c7ee5729
SHA1 dfe64a81d6320e0a26139560a06c158f007afe70
SHA512 d404409c456391223cd0f3f8ed57fdf6ed6a47e5a2e30c7f53ed8c13dc45a3890d19bb165ff2cfe01ae86d5ac07cbfa75bcfdd88f56a48ed8d228473ea25906a
SSDEEP 3072:pP8GCHGGtPBdWbF4GbRbwf1nFzwSAJB8FgBY5nd/M9dAQ:pP8LvtqbF4Wq1n6xJmPM9dAQ
TLSH
T1B4F37C67F6753E65DEF97F3C1F6FA2683656E011B0FD41BB8B038858F84A60209065A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Afhfaddk.exe

Path C:\Windows\SysWOW64\Afhfaddk.exe
Size 159KB
SHA256 4cec120651506e83f7667a3f61c6b1b4a1dea210ca87374396da568e951f1f55
MD5 b50bc6bb6d6dbd2c19bb99d889f6cfe5
SHA1 c92b20635c478c399b923947882cfcc1445c0f33
SHA512 da437383407f2bae47d53a486c47d7702c4559be18854dbef1d87a5843460ca7ac557476936bf1d6863431ab66e5ef47b6cc6154dd94cf797cf67474fb352c80
SSDEEP 3072:9yFGGkED2j/Byzqbwf1nFzwSAJB8FgBY5nd/M9dAQ:9Wr0wzH1n6xJmPM9dAQ
TLSH
T1F4F36C66B6693DB5C6B8737C210EE27572F1D024F4A970FB0B308A7CE8895F34709A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ajaelc32.exe

Path C:\Windows\SysWOW64\Ajaelc32.exe
Size 159KB
SHA256 bdc7d73285c1400b9387b231e17db2ee7b317295880422009c292b5be8ae2f80
MD5 4ab2ab3b7dd5963e3f088ef593140cf8
SHA1 ea1cbf9d176b5d9efe9da2bffbf987430e366159
SHA512 4e9e12b5793fe2230de79d385f874c4d8ce29e4076771620c52d300f679016644e0305abbd840f82e5fc8cbd017fb1d2f015e07da77eb16381ea317c10ae2ef0
SSDEEP 3072:9laeOX+xrwFynfOmMXFB3XGTGbwf1nFzwSAJB8FgBY5nd/M9dAQ:9keOORwFyfOmMXDoD1n6xJmPM9dAQ
TLSH
T116F39E96F3E81EA9D27CB33C905EA6FD3F52D033B1A8403B8B058A27EDDDD561901612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amnebo32.exe

Path C:\Windows\SysWOW64\Amnebo32.exe
Size 159KB
SHA256 932b01f8d71a542910f754c09162d4ee136cab76d4849dd4b5b163870a2543eb
MD5 668c7007d7d66aa28ec78164b58abb24
SHA1 763efa3fef33413bdd438111040af7bdad577343
SHA512 159337afddf9a10420809eb120a38d0bd679c3cac042fe91e0d55e272d981eb6d36fbf4a83b90d252029fcccb347db799c18e5b39bd096dd6e630c6971898a95
SSDEEP 3072:i6aOYsjevsc+5yf6KQbwf1nFzwSAJB8FgBY5nd/M9dAQ:JOsjCsc+rKR1n6xJmPM9dAQ
TLSH
T115F38D63BE652D65C179773C19FEE3A67706F422F0A981BFF7428D48E84EA22D81D401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apggckbf.exe

Path C:\Windows\SysWOW64\Apggckbf.exe
Size 159KB
SHA256 27821f16934de0f654e2dfbe7cb79a52c6c0454ecf2f609f382a343e09157952
MD5 8c708ebd0553998b558b3cc144ac58d3
SHA1 446fcf186f8f7140c97dc64088c9c0785ca2f5b7
SHA512 da1650ab21eb8bd90f5d9e9cfe7b8da0b21d4e875d6da721afa1c1b38abd67310cb47af5414dfe363831e8c468421426fcc70e32b29e42bbd95f418f131a355c
SSDEEP 3072:4DHZ/VSOMyN5lwrsi7jZfNM+bwf1nFzwSAJB8FgBY5nd/M9dAQ:4zZ/VSOfhni7jZfNMb1n6xJmPM9dAQ
TLSH
T1C8F3ADAFB5723D6BCABEB7FC5C4D50ACF326D022F0FEB237471589A1D44A16A5512802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Baepolni.exe

Path C:\Windows\SysWOW64\Baepolni.exe
Size 159KB
SHA256 67cf03b6cbe706c92119e4dcb9af8a59c368019b09597b020c2c01ed5db74194
MD5 539019d3845571582eee70db970c36a2
SHA1 41039e18c526a3042e36f06d5a6a34a2e010b2db
SHA512 5e18c39db017525c844832c3ea2e79daf32a20e2eed6a467df758e7270dcea9d2ce1c352dd83110c1492d6ca6ebc2ac0022b775a0c93bcf1c8dc37b84a82dfc4
SSDEEP 3072:72wpWxNAB6ExaSYm9XcEpnbwf1nFzwSAJB8FgBY5nd/M9dAQ:72iaAMExaSpeEp01n6xJmPM9dAQ
TLSH
T1DEF38CA2F26B1D6DC2B9773D120E6267B343DC2DF1FA40FBB701C888E91E952C925519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bbdpad32.exe

Path C:\Windows\SysWOW64\Bbdpad32.exe
Size 159KB
SHA256 c1b7ece9f9102aba3c40dbea108ff5fe4bca6af1c67621eeef34bb12b73b020f
MD5 a0253669ec779e3ac30f9d50d416bf63
SHA1 8c9b0fdf6ef0bbac10f8a549793c32da6fcf3972
SHA512 c9f0d642e6016da8ef034e1b91d8ad900b2e1a91718a47949a3c6dec805f9d31500929d22911b7854f34f6fb136d3c583c5f053c1c03766fa2fa92e7d232ee53
SSDEEP 3072:7TnbTTSEmdb+Y6AWbwf1nFzwSAJB8FgBY5nd/M9dAQ:7Tnbxg+DAT1n6xJmPM9dAQ
TLSH
T1A7F38C66B3753DE5C2BAB33C004EE9B0B235D215F0BD427B97C0BAB5F91AA12171E512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bbhildae.exe

Path C:\Windows\SysWOW64\Bbhildae.exe
Size 159KB
SHA256 fe7e8ec51bf88dd750a2e9e2fa305a1c06e843b3ae48b4ddbd0736b9cabbc69e
MD5 947635175c7356e24c563f16178f8011
SHA1 352500483140022e763eff4b5c815708be790534
SHA512 ffe30b6923c7fe781d140af04a098b3ba4865e9309cbc6498680b51cc7db50badedba958ddc7f6b08bcc2e4ee0290ab081d6e50cdc775f1e107285b6d034baad
SSDEEP 3072:WkTjOwwoC6Ld8Zbwf1nFzwSAJB8FgBY5nd/M9dAQ:Wk2S1n6xJmPM9dAQ
TLSH
T148F3AEA77224DD76C6797F3C0D8EB2AB7275E07FB579803BCF049988ED452A20817612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdcmkgmm.exe

Path C:\Windows\SysWOW64\Bdcmkgmm.exe
Size 159KB
SHA256 01f745304d378b5d217a925e68fb9219752e35e4f6d11a224a686cb16a2969a9
MD5 31ab093251cb25fbc74abc8c1607f531
SHA1 b33408d32911b16374f5e93c32d1060e34d8df18
SHA512 cd5dbd25bbd954e2f7447f5030c5b8ad2448ff20dbf690d36b25138b618c97916346929064b6f715458b0f9306d3c993891007e5f4f4864d6618ede3d3f09ab9
SSDEEP 3072:jx40WfTmsm3UFcunbwf1nFzwSAJB8FgBY5nd/M9dAQ:jOhT7Fcu01n6xJmPM9dAQ
TLSH
T1ABF39E52B72D3CF6C6B5B37C26CEA1A4731AD369F0AD417B8707BE58E94AEE30541402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bfkbfd32.exe

Path C:\Windows\SysWOW64\Bfkbfd32.exe
Size 159KB
SHA256 5c6a1a0bbbb9ea1d99aedb83053d3b2ea3d2125d88db6902128a70c8ee918f96
MD5 7db2b5471eaa521f2f0a89d2e77b0381
SHA1 ee7b9d8fc75cb9ac7666300ab699b8419482ffb4
SHA512 42b28097dc74bb18469d3855978ddae9810f05c33c91162dee02d79dce21c55af469474c791833cb562c9bae73f062a7b464bfbc7024e1c48986be0eca50dfd5
SSDEEP 3072:qrIG2HVVjXpiZWaYbwf1nFzwSAJB8FgBY5nd/M9dAQ:qrIljoW01n6xJmPM9dAQ
TLSH
T1F1F3ADB6B3AD2C9AC2B8777F056E92603399DD34F2B84F3F87359944EA0D5320827512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bjfogbjb.exe

Path C:\Windows\SysWOW64\Bjfogbjb.exe
Size 159KB
SHA256 e21c7ffe4b251899471ae127ea25ef6551323dde24ae1de407ed12d42f941f58
MD5 b21111f6ec900b376c4e1a17e84e629f
SHA1 82aeb180c074aad2431ab0c4f25d243b7e018787
SHA512 fed44f3195b772dac6a872e1c9ca55dbd2de94c792259c0cbd4fd56ed873b256a82374539ada8471c1498bc9219f20476a8cd64996542420c00e35b6f88a4652
SSDEEP 3072:GBup30w/RVew1Ksbwf1nFzwSAJB8FgBY5nd/M9dAQ:G8eweIKN1n6xJmPM9dAQ
TLSH
T186F39C627E64EEA5F2B6733C164EBABC3261D011B0BE53778BC17AD5E549E1E0903D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmbnnn32.exe

Path C:\Windows\SysWOW64\Bmbnnn32.exe
Size 159KB
SHA256 39aa7398097d0f6593e16164038b050c5247e0b8ccc459322245b7800e9c6acd
MD5 f62773101f8757053e819ca569ca31bf
SHA1 342e4671270169a891fa054de1cb157b889cceab
SHA512 a154a5515add537e8322642074f8469f93082d5086373d5bf30088b59cd1ecdf40533167b7d4c33e9a524f4463a5271999a9ec7db060c8ea86951c6364a324cf
SSDEEP 3072:C30AFOH5L5iAtZfBvMbwf1nFzwSAJB8FgBY5nd/M9dAQ:C30AK2Cf5t1n6xJmPM9dAQ
TLSH
T102F37C72713F6CE5D3B87BFCD94EAAA1B319D021F3BE403B4B549944EE4A90B59024C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmdkcnie.exe

Path C:\Windows\SysWOW64\Bmdkcnie.exe
Size 159KB
SHA256 486ad0427847fc81befc6badac23dc3fd7837707db342712ca06c9ce732ee17e
MD5 6323d69cb73d5f2334070856cb3849b4
SHA1 221aea8961f542948ba31017e9ffd9afee0e2295
SHA512 f45ad767386bb10e668a1e2810355d7d63c6b9a35945cec37c46c9d5e62498731303c467389811630688dda1e6726993a445cee71274bdb7229ef0250f39c3cc
SSDEEP 3072:ZgYYTyCqwfhkzpsiQobwf1nFzwSAJB8FgBY5nd/M9dAQ:VcyCUpsnp1n6xJmPM9dAQ
TLSH
T190F36A6FB2642D96CE77733E104EA5B13367D721F0FDC23B8BD58EC5E94AA520402662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bpedeiff.exe

Path C:\Windows\SysWOW64\Bpedeiff.exe
Size 159KB
SHA256 750ee0ae63555ebf138d2dcb421b3d082d0d6f081c4c82b656c881dedf90d979
MD5 f982222e96154972ea3e4c09890db0c6
SHA1 08f91c98418a7681705beeaa25a4e00a27f31582
SHA512 a8a76616da790af656ef2e8f54f0d13b6a6df118f9170f54cb3dda977f4176f87618d6af65b05b7305023a159f51ffaa14d271d36b7ca0bd33eb2a51868f54a2
SSDEEP 3072:tEegm+ANgZrmsF5JdvDbwf1nFzwSAJB8FgBY5nd/M9dAQ:uS+ANgBDFHdvQ1n6xJmPM9dAQ
TLSH
T1EEF39E73B52A2CAFD27DBF3C076EADA57B68D021B0BA8D7B87048D44EB49B630D05511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bpqjjjjl.exe

Path C:\Windows\SysWOW64\Bpqjjjjl.exe
Size 159KB
SHA256 e9536c237fff0f5663cd1e623193f78a724d931212712eeb76745b6eefdb9591
MD5 048110568eadc5ccdceef7dadd2cb009
SHA1 a2f7f1bf5c87ce560fc59746ea99d2329be21e22
SHA512 1eab4df0c9a2d3a4c0f4b2cfbce117257bb68c35ee4e15cfc8ed8024190bbfd6f89eaca70aaf942856a4a2626912eef06b4546aced8758869b74a15d1b6663c4
SSDEEP 3072:QlthSl0JNNPkYY+bwf1nFzwSAJB8FgBY5nd/M9dAQ:QlfSgSb1n6xJmPM9dAQ
TLSH
T137F39DE6B26A2C69C5BA733D64BD91B977C1F720B0A9493B6B049970E9CFF31C1011D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ccppmc32.exe

Path C:\Windows\SysWOW64\Ccppmc32.exe
Size 159KB
SHA256 efe0c23a0334fca23ea42d3140be7b56c2b35877dd20b3247c6dbc905434f75e
MD5 7ff9f3c5732d78da8dc2613f94dd32b2
SHA1 5e2bb2818903deb806ac53917af2b019489d9268
SHA512 57ad53917aaf06f5e88dde82c9ff71f10ec5a2e11bac9aa4d5ffbf929a3cd7ddde5003fb0e99d4bc72700035a1526407d34082fcb552b67a19c38844a516046b
SSDEEP 3072:E2xS2BGAdjclIya3/IWMbwf1nFzwSAJB8FgBY5nd/M9dAQ:EULd6Iykt1n6xJmPM9dAQ
TLSH
T1BCF3AE63F2396D9AC578B73C295DA7E0FF16D429B0BE413B8B118989EC4A3771910F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cdjblf32.exe

Path C:\Windows\SysWOW64\Cdjblf32.exe
Size 159KB
SHA256 4756d722e700320cdc978a348243d6a988730d9e379a1c854d93db8c38fa4c50
MD5 ce21bee28468c3581b91812fa6120575
SHA1 73c9584b2bd096f77463e2e2bda4da511f1a6528
SHA512 282abfb15c56af6dd9031c4adfac912cac0a2cd3f4b7b161bb8d1a7332c0534205a8276bcb38d7558511870bcf1d187656d63ccb13bfd836f61d7667b8f1c071
SSDEEP 3072:+8YgTrgmlTvJ6GwF4OmxeYsK/Ryl3nVbwf1nFzwSAJB8FgBY5nd/M9dAQ:+G1TJ6GaNmoI/k1e1n6xJmPM9dAQ
TLSH
T11DF39D63B6581CE5C2B933FC558EEFA6B3B1D123F0AA82FB57424984EDC7562C931502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cdmoafdb.exe

Path C:\Windows\SysWOW64\Cdmoafdb.exe
Size 159KB
SHA256 cbe620371131c3775a56c8305c75d527c2d0f628321960295190937b438cfa0c
MD5 152684f059301db0c9972e3422a35650
SHA1 5245a493b4910516202711e03a1f0efa80252cdc
SHA512 26696860401fb2772ed39cf65da9d815d1984e92224a61793214520925ed63cd13fbfc218e9a2edc6b3a608a0ca96a81871335f25f5190905632304ad7bdd7c4
SSDEEP 3072:PSjy3ECE5rij3oY2bwf1nFzwSAJB8FgBY5nd/M9dAQ:e2oMz1n6xJmPM9dAQ
TLSH
T15CF39E61B26D3EBEC1BAF73C359DB2A17301C120F5698E7B8F008A98ECCD69D591511E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ckidcpjl.exe

Path C:\Windows\SysWOW64\Ckidcpjl.exe
Size 159KB
SHA256 d0788d4d0e0ad50521a9458a4c9c9929b395d843e55cd075c4b1dbfd251ef60d
MD5 d9456fb1cc3a65d4c3f3f3ca01d51381
SHA1 327e112578e533fbb8acb2dd90fcf69c3866fcec
SHA512 3c4e0f2630ebab657e26253c2c8cd83206f3cee2db2dba044099baa7ff98ac6f6c19e89831c8704bd5917593fdcfe946ab6027239cd4c8280260ae5f90d6de33
SSDEEP 3072:Rh9i5P32ZLh4INHeZWv99999999999999q99999913999999TcJbwf1nFzwSAJBP:Re5PseINHeZW99999999999999q9999i
TLSH
T119F39EA272269FA6C7B57B7C110E7FA6F205D052F5BE83778F048D84E97E6224D12B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Daeifj32.exe

Path C:\Windows\SysWOW64\Daeifj32.exe
Size 159KB
SHA256 c4f265dbf289f578cc669a1132188ab62c49bf60b307e1e0406f46260cc6f97c
MD5 112a51098b4f2f6f30e0352683e3023d
SHA1 2463970bcefbcefec9eb69c857c232c207c7692c
SHA512 3655a56fd7c623e097a1ff70384613c6f266f38dde06daffad0d963e202e30bc8a676d67a1d406deb55c99e8908a8129699306ae5a1672b79e54ae32fc3bc78e
SSDEEP 3072:x1rmyJz5yLKYxflD4lOSdibwf1nFzwSAJB8FgBY5nd/M9dAQ:xzJzMD4lff1n6xJmPM9dAQ
TLSH
T1F3F37BA6F6290DDAC7F8733C1D8EA9BCB645C412BCB845778300BA78EDFA67249111C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dahfkimd.exe

Path C:\Windows\SysWOW64\Dahfkimd.exe
Size 159KB
SHA256 fb19efabbf7207e63617bab2a118929684e79ebf33fbcb1374048dfbba464e29
MD5 d17b61ceeca5a973ef2168c06129a033
SHA1 e9b4547136c1547a7df0bde410eb79272e27c5d4
SHA512 8d1a01832cb92d22092bd88d8603609529f968d22bfb39352e635a65268bed0cb39238dcd6dba8ce91677a896794798d5ad5843c884458b97a3e3979d7db8126
SSDEEP 3072:01N5bziTaZN/Xao03l1ThOHbwf1nFzwSAJB8FgBY5nd/M9dAQ:mN5bbZNCr1TsU1n6xJmPM9dAQ
TLSH
T10CF38D557A7D2D99D27D333C264ED2BE721EE421F0BAB23BFB068944E84E9D20713641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dgbanq32.exe

Path C:\Windows\SysWOW64\Dgbanq32.exe
Size 159KB
SHA256 6d96e060a880e58b77992928cef48f293b9f517c0f95a0f3480fa8687395c64d
MD5 b9d54d2513510fbdf0000a90ff38ad7b
SHA1 5ed1227154df179fbe91a69599fa86ec5c371ddf
SHA512 23467c3e522cc20292869645e472b173425d0c6427d0e11bbda4849b8a5d1100a6c242d84a8846a826eb92919f87f9db581672ed474e3961e9a25ef637893ace
SSDEEP 3072:0x3Y4Y9vDEdsoSbwf1nFzwSAJB8FgBY5nd/M9dAQ:0x7YudsoP1n6xJmPM9dAQ
TLSH
T1A4F38C66B3783D61F1B7B77C129EA6AF3312F071F1B96F77CB008984E859A620D05821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dgdncplk.exe

Path C:\Windows\SysWOW64\Dgdncplk.exe
Size 159KB
SHA256 b3f03f59d6bea163521a59e97d212d6b70e7655bf8cf6b49d6fd0702f576ecb8
MD5 17eb00422d65385ff9e21c82f05df108
SHA1 81bf53487d01ecfb5267ee5570923ba24ac88d98
SHA512 1c8a942036635b80679ae6011ca95e055f42e85c3ba81f0c0df6a725c896c30029fc48257124360c7cd796c84a157c8666ec17f52f480b6e1340664081301bcb
SSDEEP 3072:texytwLKCKWTQlZMfpM2jObwf1nFzwSAJB8FgBY5nd/M9dAQ:0EI2ipMEr1n6xJmPM9dAQ
TLSH
T187F38C32B2E81DB5F2BB333C6D9DA5A63605F434BFF8457B4B1649B9E84EB220B01501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dggkipii.exe

Path C:\Windows\SysWOW64\Dggkipii.exe
Size 159KB
SHA256 f4122209381aeba63c9ec6cfbf00b34a3cf4df09e2dd37038e2bbde9a41455fe
MD5 e98d070eb839d3175323c51b65a0d9e0
SHA1 ebbb714637728098b3d35251941a3f3af1642121
SHA512 4b031141f04d7fc4fedf3fa4bfaef8c0bbf2c855710f25c8077969936b4207dffff5f367a3d43b751926ccf5edc27452d85cad2623f6499537d2f61aea50afef
SSDEEP 3072:0sGMc/COVBTzwIKFOKRSAcM7oLbwf1nFzwSAJB8FgBY5nd/M9dAQ:0sGZ/CMQlSAcMs41n6xJmPM9dAQ
TLSH
T10DF3BDAFB1B91D65D2BD333C194ED9E436C2DE21F4BD803B4F058AD4EE06922D5A6423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dgpeha32.exe

Path C:\Windows\SysWOW64\Dgpeha32.exe
Size 159KB
SHA256 ceb73ec81d02cfdbc96b3bc23296110593231e15204306e15dcb3ee67a17f443
MD5 2123ab55d1fb5e792af97cf483294be8
SHA1 874814b76e2f172bfdb47422a121708b6e0ae7a3
SHA512 a11cbaa731ea14fa4b51faf43324e7321136cc5fc909a1ca81cf4312d33150443aa2e47146e1bc6cf95cfacb5dd6b41f1efe976f60129e135a678c057f46b08a
SSDEEP 3072:Sl4T7mlDC1Wnz82ZtC4NJEYgmIebwf1nFzwSAJB8FgBY5nd/M9dAQ:SO7mFXBXNwmI71n6xJmPM9dAQ
TLSH
T116F37B6AB3642DD3D1BA7B3E375EA6B4F214D031F1ADB13B870C9E44EBBA54E0912111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dkedonpo.exe

Path C:\Windows\SysWOW64\Dkedonpo.exe
Size 159KB
SHA256 f8739721b47a2f1faafbcef5977e1af5d610b27bb4428e763b97d1653b9e5e67
MD5 ae53586d333fa8c4aaa44e2c5ea6f505
SHA1 297da5d8177bda51a42fa74e37432992e086c788
SHA512 7d540425b54c9de297abfb8421babea2df3b0d5c1d9e6c44482928e023bb74350b9e4363acbdd6fe30e26f74f7447288b417034b06878e0be91ff1b93fbaeeb3
SSDEEP 3072:Wn9MsoAsVdTrHELBMrtybwf1nFzwSAJB8FgBY5nd/M9dAQ:+MsoTdTrq8v1n6xJmPM9dAQ
TLSH
T1FEF37C6372152C68E5F9773CEDBDA5BDF208E0F0B8BE41779B558A88E909BDE4401123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dnngpj32.exe

Path C:\Windows\SysWOW64\Dnngpj32.exe
Size 159KB
SHA256 5620b8b2cfb9ec3fa14c39855b0c559e46dd11270aecc8ee755ecd58e52703a1
MD5 18c6cd645ca9fd05bba7f9836c8e113b
SHA1 0a18092048973f10e0c377cb5bd38975a5fa9702
SHA512 446bfbf1824aeaa0823988d048c5292493c6317bcac777f0a1275ffc6135689176b8c1dd572a8b994cdaa651a7751b5a7420e8ff0c1f04f54d744075485a432d
SSDEEP 3072:FrV4FsxYSELg2QkfDVyI0bwf1nFzwSAJB8FgBY5nd/M9dAQ:lV4FsxYSCXDVyI11n6xJmPM9dAQ
TLSH
T14DF3AE63F2226E91C1B873BC510FA2A43216F17EB4BF81FB5B05C984F85AF961916371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dnqcfjae.exe

Path C:\Windows\SysWOW64\Dnqcfjae.exe
Size 159KB
SHA256 401f6cf02b6e5ed6297b798e7746dc951f3b0e9888aa625ed23ec52905e45ca6
MD5 c85822fee51fbffd35a5bdbb8502442e
SHA1 a2f25917022a02f44a97547122f05d122ba2c579
SHA512 cfc1b13282af128d375b46f497b0dac5c182eb18b9149738caf7fd856ce41fe77203c2ed8a79fe4ed8f4c5a83f7f35ded7e9d109ff4726ffe48e5b2dd43738fc
SSDEEP 3072:kOzJ2QcMCBXO/7lIHHUbwf1nFzwSAJB8FgBY5nd/M9dAQ:k5B+/78HV1n6xJmPM9dAQ
TLSH
T11CF38C92F3BC2CA7C67C773C108EE5E67606E022F6BD023B87119DA8EB09592C5565CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eahobg32.exe

Path C:\Windows\SysWOW64\Eahobg32.exe
Size 159KB
SHA256 d1ece02e6ad44b813a380275e53d520a476056e15f86a4731e41a29ef3ca01da
MD5 84537a2ad48c6544873df74f654429e1
SHA1 3439294bc5778ce43b11373d4af61091ee2a9f93
SHA512 16bf6bc36a0c351141e5044126249d1ccbde86c7c82e01262f72bae027e68d5f020bfbbad650c201113e0b1df7c90990694a292ca3f3752863ea68342baf8253
SSDEEP 3072:pYsJsK/yJxMuduLeEpz3bwf1nFzwSAJB8FgBY5nd/M9dAQ:CMHLP5E1n6xJmPM9dAQ
TLSH
T10BF38CA6F2251EA6CABB377C23CEE1A57715D431B5BE81378F248F84EE89D211501B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egkddo32.exe

Path C:\Windows\SysWOW64\Egkddo32.exe
Size 159KB
SHA256 d7c24b09163f9d1225bb0c1ef29e5aeb47cbcda4746f52e7517510f0a6824961
MD5 96722b4ad013ff5946266821827bd2c9
SHA1 e86ee238bd1aaa74a8ead341080ec0ec9e1e3f85
SHA512 6037460b17dc6942f5d91ec3b99cc08347d95244256602a612ce45135d1f8e7cc42b7c471d0fa41446e35d11cefd145227b9524a372fff34c8bf26aacb444a24
SSDEEP 3072:UI1p6QvswM5xN3Iuz2Q1Ejk9xbwf1nFzwSAJB8FgBY5nd/M9dAQ:Us6Q0j5xCg/b81n6xJmPM9dAQ
TLSH
T192F38E66BB59DCD5D2FA3F3C1D4FB1B0F211E460B879B23BCB78B664E8456A10922413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egpnooan.exe

Path C:\Windows\SysWOW64\Egpnooan.exe
Size 159KB
SHA256 dfa5b7db30b26972e2b81c964fcaa124c5b54fc36fd12f701c43e15a0a82502c
MD5 c491828fbf2320805476e24a9dafe257
SHA1 aaf99b8fb249dc141e73444e6a7674c6411023fa
SHA512 5bd6a7b93d660385b3755235234831b2433a9b334b045a234b2361d6e42d4d0a038d2d47286d1fd9c110bbdfde399c0798aece97e32d3249d225017153d2afd6
SSDEEP 3072:nQaNSHh2J6wmut2y0BroonknwMmZbwf1nFzwSAJB8FgBY5nd/M9dAQ:QaNSH49d8jBro12S1n6xJmPM9dAQ
TLSH
T10AF39DE6F6A9BCEBC975737C144ED1E97346C421F4EDF07B43488A48E8096A6340E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbfkceca.exe

Path C:\Windows\SysWOW64\Fbfkceca.exe
Size 159KB
SHA256 5205f575d18b839009370c0c3733f46a4c45749ce4c4da3cfa2b31a1b985e3f6
MD5 c6d4190849b9c2c14041ffcae2042e56
SHA1 a35da524ed7f9f5d3e032ed5d08ddf8f160fb95d
SHA512 f887d5b0e9d3cf398f36199c97526eeb929895b05e4e524ed819ec04256dc14a094764e0ff36d5f847ea6217a557bc66bdc7d5bca1c26b392c34763f9cdd3d4a
SSDEEP 3072:XSliyV+syZ/fFaK+Jps+nPbwf1nFzwSAJB8FgBY5nd/M9dAQ:Xy2fFaK+Z81n6xJmPM9dAQ
TLSH
T1C9F38DE5BE156FA6C57B733C298E9BF0F356D020F5BE427B470D8E91E80A6120A15F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdbkja32.exe

Path C:\Windows\SysWOW64\Fdbkja32.exe
Size 159KB
SHA256 f9fab0d9cd5ab7c876035dfa3f45249e98a68a6bc71ec1b94444a1eb2f59e60c
MD5 dd126d6c450ec992ff8a2f71d066cd67
SHA1 01c6a59b30955e9d5b640f0a08d2065418951f58
SHA512 b6cd1d663dae927864c2c6832c35811f7544ec9c99891adfe663b9f32c6b3faf3ca32f97b4184d80b7873d862102d9f47c87cc9af3425d1b76398486b4efd0e8
SSDEEP 3072:C9v+cNGfobfNzy3QgYZQSM3RANbG8bwf1nFzwSAJB8FgBY5nd/M9dAQ:C9v+csf+fNzy3QgEHM3RANKd1n6xJmPA
TLSH
T1BFF38BA7F12EFCB7C6F9773C6C0FA5AA7612E411F1B9403B8B44BA84E9C88D60914C51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkcpql32.exe

Path C:\Windows\SysWOW64\Fkcpql32.exe
Size 159KB
SHA256 a735b9915bec60b8c25e4490e110423ef195ec6773203c498fd841b47c3eacda
MD5 bc5401fe0ef09c792ea35d1d1641584c
SHA1 3aae79fa885521d3bceaf6963bec2ca8f5472223
SHA512 09d21eeafbd36b78b793ce708df092edb3d11faa2faa9d9559f0dffc0d1099f36038aeadeed5f582164aaec377fee8ffb1b1222848669221775bc07b8b45c99c
SSDEEP 3072:PaJuEQAj8hdhMMq6yrbbbXUZBPSjQCeMeR9WjBbwf1nFzwSAJB8FgBY5nd/M9dAQ:PaJJj8hdhM8yrHj6BPAQCeMeR2a1n6xr
TLSH
T1F3F3ADB3B2E55DEAC679333D654DA7F53202C061F4B976BFB7038954EA0EE623606402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkgillpj.exe

Path C:\Windows\SysWOW64\Fkgillpj.exe
Size 159KB
SHA256 1aebcad67f1b7bf31dd0ee9483b51f78d961421acb9dba8f49ca6ae0df7ee143
MD5 4f8a0c9fb023c8d023c59340419791db
SHA1 d9012eb6c5a9a6eb10ee89b714948e4ea242a8c9
SHA512 81efb74d60272d9977c4da42e01e881fc8aff2813513cd32ba9fc8c8f0f6b71404cda4c0b01738fff994d9cef7d9a880417e7d225d3a151936e48493c520646c
SSDEEP 3072:3h44aFQrXTQYGhbwf1nFzwSAJB8FgBY5nd/M9dAQ:3h4dQLsYG61n6xJmPM9dAQ
TLSH
T12CF38D6271361C69D7B9BF3C369FE078F212EC15B57982FB4B114919EB09A138B02D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gggmgk32.exe

Path C:\Windows\SysWOW64\Gggmgk32.exe
Size 159KB
SHA256 bcd3e299599a9825cc6f311fcb2ed96441c6285aadbdd71caaa7609d02b6e71f
MD5 92f620cafae8f8f5766019012e7a086c
SHA1 b37f8224137149c9129ca883e0a1d18431a1292c
SHA512 fb732ea3654ec29dbd210440c1c830a398e25fe518dbb3efb44e343e0baf4450f12bacc749de1a0611967ca8f679833dcd5fd52edab1f711a6276bf5e6cea82a
SSDEEP 3072:6/EvJqIYEWEuAz9zzqHrh1215919S4U9mCbwf1nFzwSAJB8FgBY5nd/M9dAQ:1q6xz9vKrh1215919S1m/1n6xJmPM9dP
TLSH
T10DF37A22B6662DE3DEB9B33D404E75B8B216C42CF8AA417B57068DCDF94DA160B113D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gqkhda32.exe

Path C:\Windows\SysWOW64\Gqkhda32.exe
Size 159KB
SHA256 ffb68ac22b5b56d7a5307ccb14b4a56ab2cfc4bea90e88bb5e4ef5dcb32942d9
MD5 33247472adcc91b65c23a3b1c4d32aa1
SHA1 7a92db84a3433e7e569faeadec9491d35eec6210
SHA512 fdeba454420440c03c290f1e1e8e06797507433f09edf658cdd57deb35172bbcc863fef94538849d4b38de47c429f0019d16cf7b97e4de8fd9f02cf83c078e1f
SSDEEP 3072:XdOETd9tMeQ+vn121tZSxkRXM7bwf1nFzwSAJB8FgBY5nd/M9dAQ:tOETd9tMeQ51CxkJMo1n6xJmPM9dAQ
TLSH
T1A9F37CA2B1AF6C66C6FA7F3FD27F93B67216E120BCBD513BBB088546E8029755403411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lcckiibj.dll

Path C:\Windows\SysWOW64\Lcckiibj.dll
Size 7KB
SHA256 30f9bfef8b106073cc597953c3c5ecef980d3eab035e0145afe3abce409dedb0
MD5 ccc68ff6bf554d313641b77f7c2b9275
SHA1 725b7e6ed64b05a488de71d8dfdb829b9587aaa9
SHA512 0eeb665fcd24b5690d4da1bfb1333f43a6d52960e178f879028fc9a71a9d020cb11ba544e7d3f7e358a1ab7efe91eb8ec1a0bfefdd92cdb909270b755232ce9b
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW7FbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPWaq3qX5S2hV
TLSH
T1F0E13593F94041BFC09D097912FF29229B7D663426D96009AB809A210CDDBDFFF38549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/32-376-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/32-450-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/332-55-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/772-71-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/876-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1232-125-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1440-334-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1440-464-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1556-406-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1556-440-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1680-460-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1680-346-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1736-224-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1736-498-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1796-298-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1796-476-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1884-494-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1884-240-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2124-484-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2124-274-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2196-192-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2232-448-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2232-382-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2288-462-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2288-340-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2372-159-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2392-208-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2396-424-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2396-433-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2400-268-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2400-486-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2452-328-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2452-466-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2520-100-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2524-167-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2652-352-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2652-458-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-472-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2924-310-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2956-136-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2976-442-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2976-400-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3080-388-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3080-446-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3136-456-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3136-358-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3252-132-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3332-176-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3416-488-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3416-262-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3620-148-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3688-492-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3688-248-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3728-418-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3728-436-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3772-104-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3856-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3904-200-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3984-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4008-215-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4124-292-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4124-478-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4180-482-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4180-280-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4196-322-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4196-468-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4372-256-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4372-490-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4392-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4436-184-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4520-454-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4520-364-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4528-316-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4528-470-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4572-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4596-452-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4596-370-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4612-412-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4612-438-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-444-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4644-394-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4704-434-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4704-430-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4728-496-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4728-232-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4748-88-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4812-7-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4892-480-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4892-286-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4980-85-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5008-152-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5012-474-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5012-304-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5056-111-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5088-68-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5116-47-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads