berbew | 2afad1fd1854c7281ad32d970b65e54991ced51202c3e7a65148ff8bb4bd4d8d

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2afad1fd1854c7281ad32d970b65e54991ced51202c3e7a65148ff8bb4bd4d8d.exe
Size 319KB
Sample260830-1sz7ja1bnd
SHA256 2afad1fd1854c7281ad32d970b65e54991ced51202c3e7a65148ff8bb4bd4d8d
MD5 c78aac800679fcf590c686d3bcbf6933
SHA1 dc8d37ea469c6f3d7234ea5aa6b55e4087343536
SHA512 b001b977b9c0e74e3e63e7a867cbd27b76cced079ff0c92870e4e2812b51a1876ba6404746141de365420853ddf16342a8dbe1ddd3fb09d50430a15219b8c638
SSDEEP 6144:G69pRsRHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:G4C7YxxC/NcZ7/N
TLSH
T11F646AE6BBF47EC1EC1FF5B814A2C47280C9D5BA01EAF14F6F309A554A6638CACC5605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pagbaglh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdaniq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boihcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgegd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnoddcef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Palklf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apodoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Palklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adcjop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cponen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojhpimhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmjdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdoacabq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amcehdod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckebcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhmbqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paiogf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjbcplpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qacameaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkgeainn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cncnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdjgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjmjdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppolhcnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafppp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahdob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdenmbkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhpofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2afad1fd1854c7281ad32d970b65e54991ced51202c3e7a65148ff8bb4bd4d8d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Panhbfep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjfmkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjpfjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfmmplad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgcihgaj.exe

Executes dropped EXE 64 IoCs

pid	Process
1888	Ogjdmbil.exe
1456	Ojhpimhp.exe
3152	Omgmeigd.exe
4148	Oabhfg32.exe
3872	Ohlqcagj.exe
3988	Pfoann32.exe
5104	Pjkmomfn.exe
548	Pmiikh32.exe
4796	Ppgegd32.exe
1708	Pccahbmn.exe
2684	Pfandnla.exe
4920	Pjmjdm32.exe
3964	Pmlfqh32.exe
924	Pagbaglh.exe
3524	Pdenmbkk.exe
3492	Phajna32.exe
3148	Pjpfjl32.exe
2388	Pnkbkk32.exe
2896	Paiogf32.exe
836	Pplobcpp.exe
1732	Phcgcqab.exe
1284	Pffgom32.exe
1916	Pjbcplpe.exe
2124	Pmpolgoi.exe
3172	Palklf32.exe
1168	Ppolhcnm.exe
4156	Pdjgha32.exe
552	Pfiddm32.exe
1540	Pjdpelnc.exe
2324	Pnplfj32.exe
2020	Panhbfep.exe
1464	Pdmdnadc.exe
3848	Qfkqjmdg.exe
864	Qjfmkk32.exe
4304	Qmeigg32.exe
3412	Qaqegecm.exe
432	Qdoacabq.exe
4692	Qfmmplad.exe
1884	Qjiipk32.exe
2892	Qmgelf32.exe
4184	Qacameaj.exe
2076	Qdaniq32.exe
4296	Ahmjjoig.exe
2316	Akkffkhk.exe
3256	Aogbfi32.exe
2888	Aaenbd32.exe
1536	Adcjop32.exe
3788	Ahofoogd.exe
640	Aknbkjfh.exe
1172	Amlogfel.exe
5064	Aagkhd32.exe
2272	Adfgdpmi.exe
4392	Agdcpkll.exe
1232	Aokkahlo.exe
216	Aajhndkb.exe
2560	Apmhiq32.exe
2996	Ahdpjn32.exe
4728	Aggpfkjj.exe
4836	Aonhghjl.exe
2824	Aaldccip.exe
1112	Apodoq32.exe
4348	Ahfmpnql.exe
560	Akdilipp.exe
2936	Amcehdod.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bgnffj32.exe	Bdojjo32.exe
File opened for modification	C:\Windows\SysWOW64\Cpdgqmnb.exe	Cnfkdb32.exe
File created	C:\Windows\SysWOW64\Ekaacddn.dll	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Pnkbkk32.exe	Pjpfjl32.exe
File created	C:\Windows\SysWOW64\Pjdpelnc.exe	Pfiddm32.exe
File created	C:\Windows\SysWOW64\Qjiipk32.exe	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Chkobkod.exe	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Dddjmo32.dll	Panhbfep.exe
File opened for modification	C:\Windows\SysWOW64\Phajna32.exe	Pdenmbkk.exe
File opened for modification	C:\Windows\SysWOW64\Qjiipk32.exe	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Lngqkhda.dll	Pjbcplpe.exe
File opened for modification	C:\Windows\SysWOW64\Bgnffj32.exe	Bdojjo32.exe
File created	C:\Windows\SysWOW64\Chnlgjlb.exe	Cpfcfmlp.exe
File opened for modification	C:\Windows\SysWOW64\Cgqlcg32.exe	Chnlgjlb.exe
File created	C:\Windows\SysWOW64\Pagbaglh.exe	Pmlfqh32.exe
File created	C:\Windows\SysWOW64\Qjfmkk32.exe	Qfkqjmdg.exe
File opened for modification	C:\Windows\SysWOW64\Qfmmplad.exe	Qdoacabq.exe
File opened for modification	C:\Windows\SysWOW64\Qacameaj.exe	Qmgelf32.exe
File created	C:\Windows\SysWOW64\Ahfmpnql.exe	Apodoq32.exe
File opened for modification	C:\Windows\SysWOW64\Boihcf32.exe	Bgbpaipl.exe
File created	C:\Windows\SysWOW64\Ekiapmnp.dll	Cpfcfmlp.exe
File created	C:\Windows\SysWOW64\Pjbcplpe.exe	Pffgom32.exe
File opened for modification	C:\Windows\SysWOW64\Palklf32.exe	Pmpolgoi.exe
File created	C:\Windows\SysWOW64\Aogbfi32.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Aagkhd32.exe	Amlogfel.exe
File created	C:\Windows\SysWOW64\Gjecbd32.dll	Bmjkic32.exe
File created	C:\Windows\SysWOW64\Olaafabl.dll	Cammjakm.exe
File created	C:\Windows\SysWOW64\Mkfoeejd.dll	Ogjdmbil.exe
File created	C:\Windows\SysWOW64\Pfoann32.exe	Ohlqcagj.exe
File opened for modification	C:\Windows\SysWOW64\Pjkmomfn.exe	Pfoann32.exe
File opened for modification	C:\Windows\SysWOW64\Pjpfjl32.exe	Phajna32.exe
File opened for modification	C:\Windows\SysWOW64\Pfiddm32.exe	Pdjgha32.exe
File opened for modification	C:\Windows\SysWOW64\Adcjop32.exe	Aaenbd32.exe
File opened for modification	C:\Windows\SysWOW64\Ahofoogd.exe	Adcjop32.exe
File created	C:\Windows\SysWOW64\Cpkhqmjb.dll	Cncnob32.exe
File opened for modification	C:\Windows\SysWOW64\Pmiikh32.exe	Pjkmomfn.exe
File opened for modification	C:\Windows\SysWOW64\Pccahbmn.exe	Ppgegd32.exe
File created	C:\Windows\SysWOW64\Phlepppi.dll	Amcehdod.exe
File created	C:\Windows\SysWOW64\Bdmmeo32.exe	Aaoaic32.exe
File opened for modification	C:\Windows\SysWOW64\Bmeandma.exe	Bkgeainn.exe
File opened for modification	C:\Windows\SysWOW64\Bdfpkm32.exe	Bahdob32.exe
File opened for modification	C:\Windows\SysWOW64\Dojqjdbl.exe	Dgcihgaj.exe
File opened for modification	C:\Windows\SysWOW64\Dhbebj32.exe	Ddgibkpc.exe
File opened for modification	C:\Windows\SysWOW64\Ahdpjn32.exe	Apmhiq32.exe
File created	C:\Windows\SysWOW64\Bkgeainn.exe	Bgkiaj32.exe
File created	C:\Windows\SysWOW64\Ebggoi32.dll	Bklomh32.exe
File created	C:\Windows\SysWOW64\Oabhfg32.exe	Omgmeigd.exe
File opened for modification	C:\Windows\SysWOW64\Pmpolgoi.exe	Pjbcplpe.exe
File created	C:\Windows\SysWOW64\Akkffkhk.exe	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Fomnhddq.dll	Cnhgjaml.exe
File opened for modification	C:\Windows\SysWOW64\Ddgibkpc.exe	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Bpcaaeme.dll	Ahmjjoig.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bphgeo32.exe
File opened for modification	C:\Windows\SysWOW64\Cpmapodj.exe	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Ogjdmbil.exe	2afad1fd1854c7281ad32d970b65e54991ced51202c3e7a65148ff8bb4bd4d8d.exe
File created	C:\Windows\SysWOW64\Ojjhjm32.dll	Pnplfj32.exe
File opened for modification	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Bdojjo32.exe	Bpdnjple.exe
File created	C:\Windows\SysWOW64\Hlfpph32.dll	Bdojjo32.exe
File created	C:\Windows\SysWOW64\Jhijep32.dll	Chnlgjlb.exe
File created	C:\Windows\SysWOW64\Omgmeigd.exe	Ojhpimhp.exe
File created	C:\Windows\SysWOW64\Occmjg32.dll	Palklf32.exe
File created	C:\Windows\SysWOW64\Pdmdnadc.exe	Panhbfep.exe
File created	C:\Windows\SysWOW64\Aggpfkjj.exe	Ahdpjn32.exe

Program crash 1 IoCs

pid	pid_target	Process
5472	2444	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2afad1fd1854c7281ad32d970b65e54991ced51202c3e7a65148ff8bb4bd4d8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amlogfel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaldccip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oabhfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phcgcqab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmmplad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adfgdpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paiogf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pffgom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdoacabq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmgelf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qacameaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boenhgdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdagpnbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohlqcagj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdmmeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgbpaipl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfkdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaqegecm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdfpkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgcihgaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmlfqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgkiaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhmbqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cponen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmjdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmpolgoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boihcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omgmeigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppolhcnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkphhgfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaoaic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aajhndkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pccahbmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjbcplpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfkqjmdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cammjakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cncnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhpimhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfoann32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfandnla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkgeainn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdaniq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaenbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apmhiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akdilipp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckgohf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokkahlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogjdmbil.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfoann32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boihcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlkidpke.dll"	Ckebcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dddllkbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojhpimhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idaiki32.dll"	Pdjgha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkhqmjb.dll"	Cncnob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmpolgoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifaohg32.dll"	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaoaic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpenegb.dll"	Phajna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epopbo32.dll"	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gelfeh32.dll"	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dllfqd32.dll"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnpkdp32.dll"	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppcbba32.dll"	Pffgom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkgohbq.dll"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnbddbhk.dll"	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaoaic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkicbhla.dll"	Ckgohf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qjiipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijikdfig.dll"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalhik32.dll"	Dafppp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhhmleng.dll"	Ojhpimhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Giidol32.dll"	Pagbaglh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Panhbfep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahofoogd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aajhndkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjpfjl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cponen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfoeejd.dll"	Ogjdmbil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pccahbmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcaaeme.dll"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqppgj32.dll"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lngqkhda.dll"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okddnh32.dll"	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdfpkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chnlgjlb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 1888	3352	2afad1fd1854c7281ad32d970b65e54991ced51202c3e7a65148ff8bb4bd4d8d.exe	85
PID 1888 wrote to memory of 1456	1888	Ogjdmbil.exe	86
PID 1456 wrote to memory of 3152	1456	Ojhpimhp.exe	87
PID 3152 wrote to memory of 4148	3152	Omgmeigd.exe	88
PID 4148 wrote to memory of 3872	4148	Oabhfg32.exe	89
PID 3872 wrote to memory of 3988	3872	Ohlqcagj.exe	90
PID 3988 wrote to memory of 5104	3988	Pfoann32.exe	91
PID 5104 wrote to memory of 548	5104	Pjkmomfn.exe	92
PID 548 wrote to memory of 4796	548	Pmiikh32.exe	93
PID 4796 wrote to memory of 1708	4796	Ppgegd32.exe	94
PID 1708 wrote to memory of 2684	1708	Pccahbmn.exe	95
PID 2684 wrote to memory of 4920	2684	Pfandnla.exe	96
PID 4920 wrote to memory of 3964	4920	Pjmjdm32.exe	97
PID 3964 wrote to memory of 924	3964	Pmlfqh32.exe	98
PID 924 wrote to memory of 3524	924	Pagbaglh.exe	99
PID 3524 wrote to memory of 3492	3524	Pdenmbkk.exe	100
PID 3492 wrote to memory of 3148	3492	Phajna32.exe	101
PID 3148 wrote to memory of 2388	3148	Pjpfjl32.exe	102
PID 2388 wrote to memory of 2896	2388	Pnkbkk32.exe	103
PID 2896 wrote to memory of 836	2896	Paiogf32.exe	104
PID 836 wrote to memory of 1732	836	Pplobcpp.exe	105
PID 1732 wrote to memory of 1284	1732	Phcgcqab.exe	106
PID 1284 wrote to memory of 1916	1284	Pffgom32.exe	107
PID 1916 wrote to memory of 2124	1916	Pjbcplpe.exe	108
PID 2124 wrote to memory of 3172	2124	Pmpolgoi.exe	109
PID 3172 wrote to memory of 1168	3172	Palklf32.exe	110
PID 1168 wrote to memory of 4156	1168	Ppolhcnm.exe	111
PID 4156 wrote to memory of 552	4156	Pdjgha32.exe	112
PID 552 wrote to memory of 1540	552	Pfiddm32.exe	113
PID 1540 wrote to memory of 2324	1540	Pjdpelnc.exe	114
PID 2324 wrote to memory of 2020	2324	Pnplfj32.exe	115
PID 2020 wrote to memory of 1464	2020	Panhbfep.exe	116
PID 1464 wrote to memory of 3848	1464	Pdmdnadc.exe	117
PID 3848 wrote to memory of 864	3848	Qfkqjmdg.exe	118
PID 864 wrote to memory of 4304	864	Qjfmkk32.exe	119
PID 4304 wrote to memory of 3412	4304	Qmeigg32.exe	120
PID 3412 wrote to memory of 432	3412	Qaqegecm.exe	121
PID 432 wrote to memory of 4692	432	Qdoacabq.exe	122
PID 4692 wrote to memory of 1884	4692	Qfmmplad.exe	123
PID 1884 wrote to memory of 2892	1884	Qjiipk32.exe	124
PID 2892 wrote to memory of 4184	2892	Qmgelf32.exe	125
PID 4184 wrote to memory of 2076	4184	Qacameaj.exe	126
PID 2076 wrote to memory of 4296	2076	Qdaniq32.exe	127
PID 4296 wrote to memory of 2316	4296	Ahmjjoig.exe	128
PID 2316 wrote to memory of 3256	2316	Akkffkhk.exe	129
PID 3256 wrote to memory of 2888	3256	Aogbfi32.exe	130
PID 2888 wrote to memory of 1536	2888	Aaenbd32.exe	131
PID 1536 wrote to memory of 3788	1536	Adcjop32.exe	132
PID 3788 wrote to memory of 640	3788	Ahofoogd.exe	133
PID 640 wrote to memory of 1172	640	Aknbkjfh.exe	134
PID 1172 wrote to memory of 5064	1172	Amlogfel.exe	135
PID 5064 wrote to memory of 2272	5064	Aagkhd32.exe	136
PID 2272 wrote to memory of 4392	2272	Adfgdpmi.exe	137
PID 4392 wrote to memory of 1232	4392	Agdcpkll.exe	138
PID 1232 wrote to memory of 216	1232	Aokkahlo.exe	139
PID 216 wrote to memory of 2560	216	Aajhndkb.exe	140
PID 2560 wrote to memory of 2996	2560	Apmhiq32.exe	141
PID 2996 wrote to memory of 4728	2996	Ahdpjn32.exe	142
PID 4728 wrote to memory of 4836	4728	Aggpfkjj.exe	143
PID 4836 wrote to memory of 2824	4836	Aonhghjl.exe	144
PID 2824 wrote to memory of 1112	2824	Aaldccip.exe	145
PID 1112 wrote to memory of 4348	1112	Apodoq32.exe	146
PID 4348 wrote to memory of 560	4348	Ahfmpnql.exe	147
PID 560 wrote to memory of 2936	560	Akdilipp.exe	148

C:\Users\Admin\AppData\Local\Temp\2afad1fd1854c7281ad32d970b65e54991ced51202c3e7a65148ff8bb4bd4d8d.exe
"C:\Users\Admin\AppData\Local\Temp\2afad1fd1854c7281ad32d970b65e54991ced51202c3e7a65148ff8bb4bd4d8d.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\Ogjdmbil.exe
  C:\Windows\system32\Ogjdmbil.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\Ojhpimhp.exe
    C:\Windows\system32\Ojhpimhp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\SysWOW64\Omgmeigd.exe
      C:\Windows\system32\Omgmeigd.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3152
    - - C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4148
      - C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2936
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2404
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        70⤵
        Modifies registry class
        
        PID:1424
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        71⤵
        Drops file in System32 directory
        
        PID:3088
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        72⤵
        Drops file in System32 directory
        
        PID:3080
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        73⤵
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3804
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3752
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        76⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3568
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        78⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        79⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        80⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5280
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5320
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        86⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        89⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        90⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        91⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5720
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        95⤵
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        99⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        100⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        102⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        103⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        104⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3560
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        111⤵
        Modifies registry class
        
        PID:3996
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3400
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        113⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        115⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 400
        118⤵
        Program crash
        
        PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2444 -ip 2444
1⤵
PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Oabhfg32.exe

Path C:\Windows\SysWOW64\Oabhfg32.exe
Size 319KB
SHA256 1916e927690a45085798875ef9711325cadc4e69bc76af5d5979c69ecf420561
MD5 ff6b7efcbddd48a44b722c4f35d71f03
SHA1 70bab3193d1dbc34a327ca73c22b12f7d1c22442
SHA512 43aa3ecc19f029da6eb5e90577c417d728c1060c42df706c3b2520033d2e28410a39fe83be0deb7642af89b27db16d3e48bc268eb70632ded93aa9459e450723
SSDEEP 6144:IeglT+qpAHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:DgJ+qa7YxxC/NcZ7/N
TLSH
T11D645AE1BB717EC1E49FF7B894A3D4B281C2CA7A01E6744F6F309BA5C67E1888C85511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogjdmbil.exe

Path C:\Windows\SysWOW64\Ogjdmbil.exe
Size 319KB
SHA256 cd0adb04b6c6b3f51ed1209551a013e71433e3962d600b44ae88ef470d613fb4
MD5 e895e3fe1556757d8090728ed4fbc507
SHA1 a887626c14b0b9e8b21bb81a774e6970b6b4f39b
SHA512 92240b4edd70703607677ced97dfc5acb8a988061f7aaa56c571a1a9df8d8aef412dc55d79beb6aa566466349c71ccaf950208a1a9f06863bec978936355a9dd
SSDEEP 6144:p+H7dyYUgHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:pE73v7YxxC/NcZ7/N
TLSH
T137645BEDBBB7AEC1E46FF1B110B2D43A88D5C93B23E6704F6F30AB4586651849E85131
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ohlqcagj.exe

Path C:\Windows\SysWOW64\Ohlqcagj.exe
Size 319KB
SHA256 32f55a784ac1b3ea4d16f7e8209f514d5740c820b0a7f29d395263e6da074737
MD5 b3d9684d819815d2cd385f0f92659521
SHA1 380e0069c5bc0064332a13b58e8d45325cd36e87
SHA512 55215982422054e257178be203e0dd68bf479a29757b8b27b84fdef114b37218ab1a4e3aed9564b6508728155c452993e3b5015787490eb8e4bf0ff53550d451
SSDEEP 6144:yXT8V3pGNHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:OT8rk7YxxC/NcZ7/N
TLSH
T1D4647CE1BBB17ECBE03FF1B110A3E472B1D1D93B01EA724F6F309A5D166A1A49C85611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojhpimhp.exe

Path C:\Windows\SysWOW64\Ojhpimhp.exe
Size 319KB
SHA256 d253509b7bd28e29cece6ca9a9d84762e4698d533da8cca5c6285d4fc5d8a46b
MD5 7fccd972bc1423d668f78a097a54a433
SHA1 819ac4e4e726855d9000ca8a8d75ef98165040da
SHA512 1b34f96ee23b8f9fd44301237ca0dc4a5235f859bab5a5bc13addace76400a1a3b09eb6aff27faa159f1812e2f1e9076c410b62f56c7e3e883b921d5ea1ed92f
SSDEEP 6144:1zknAsWZGeWj8d6rvHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:1zk2ZGejd6L7YxxC/NcZ7/N
TLSH
T1CC646AE6BB706EC1E41FF5B710A2CCF280E3D57B02FA744F6F30AA591A7A1949C85905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Omgmeigd.exe

Path C:\Windows\SysWOW64\Omgmeigd.exe
Size 319KB
SHA256 66bc3c9fd752935287e3b87a5eabe797d5eb375d890bc02d5fb7e507375456d8
MD5 79d65d6dabfc75d959d95773e2ed91ef
SHA1 239e7b2514895febee0cab9cc23b1e5a26928d81
SHA512 4ab01af96b8299829d03c806244c4d411ec2eb0061fb34a7b82997409e3e05394560fdd466cc15fd312e0131047018caf0a9c43da981c0ad9b9717f8735833b1
SSDEEP 6144:anKZ3QLX7mqeHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:anKVLL7YxxC/NcZ7/N
TLSH
T18C647CE5FB716EDAE42FF0B590A2C43281C1F97BC9E6304F6F309E474AA294C9CA5511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pagbaglh.exe

Path C:\Windows\SysWOW64\Pagbaglh.exe
Size 319KB
SHA256 cc7bee674b0cf5c5872f6ed7d0c23a522de0d3fb2fd890b553b07ac1b432aaec
MD5 dfa11aac8853d9f8c676a64e2bb2ffec
SHA1 24bac5254aef91016a9700d773c15a83515bdac6
SHA512 133ba4e0ff52941aeec593ed3919c77fc78a8c1ee8682dc0d55eca37bc7891176fc8a3f05a9e20cf88a563eca31832698b3deabfbf38c47fbbec3b84393cfa4e
SSDEEP 6144:wheBW2bRHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:wheVd7YxxC/NcZ7/N
TLSH
T196646AFDBBB47ED1E45FF5B210AA847A81C5E93B02EE704FFF309A950A661948C8D501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Paiogf32.exe

Path C:\Windows\SysWOW64\Paiogf32.exe
Size 319KB
SHA256 dc0972a9c8b4448c2ccbf4abcd1fbeabcd8da6ddf9e833745c884636c1c544aa
MD5 9a915f848be9355f8fef50330b414f0d
SHA1 71f1aa538a34434796cbc718325589b189866802
SHA512 b2f6fac41decfd318431203e278a271eceec107446a40306d3ae196cf2f64572b54c4b020b61f98bd7a720e5cdf6d18ea5a9b46b9f72308645edce988a5b6e89
SSDEEP 6144:PzJILbHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:PzG7YxxC/NcZ7/N
TLSH
T1BD646AE5BBB66ED9E41FF1BC14A2C43281C1D57B01EF704F6F30AB658E6A1A49C85503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Palklf32.exe

Path C:\Windows\SysWOW64\Palklf32.exe
Size 319KB
SHA256 2462c93167e35c3e47ac857e9b1852ad3a807e2ea9c6afbaba3d7a8401aa968a
MD5 80a6ca8fc466c1d5c23aee2eb1e3615c
SHA1 6846f26d51b0ae5d4de94d684fcf395cfefaa8d7
SHA512 2b5ca7a689b61b13533d92881a73b13ac59f5580e372c2f7b0d1e898e59d60857f6dca047425d310525431333dcba14d2bc9ed1553238be290d8bf7e650396a6
SSDEEP 6144:nITHHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:Ib7YxxC/NcZ7/N
TLSH
T1D2646AF5BB706EC1E45FF1B228F2D4B282C1D67B01EA314F6FB4AAC546661849C8D781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Panhbfep.exe

Path C:\Windows\SysWOW64\Panhbfep.exe
Size 319KB
SHA256 4a901cdb8cb16575f55741b042998e14cac3546d8a2625512803563fcf62be52
MD5 0d42dd7c1697bc120a5147e5dcab2fbe
SHA1 f63d2e0536f96e4c2e68b1638073bbf4c1a229b1
SHA512 341eb57bc42de3f41e54759076d821b1fffa72c2bebce3d3a330a487dc4736fec65e3befb87bd4961ae459c7819a7a0b8d739a2b7f24aea6d217239f44414267
SSDEEP 6144:egtPoJDjAUrxHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:eghcZ7YxxC/NcZ7/N
TLSH
T1C3646AE2BB767FC1E45FF1B010B2C5B280C1D57B81F632AFEF389A5646E61849C85606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pccahbmn.exe

Path C:\Windows\SysWOW64\Pccahbmn.exe
Size 319KB
SHA256 525e42dc2006da2276ba7c9ba8e6661eb71574851d1fb0665ab152c037e54c90
MD5 ee4251bc9eaa5ec26da4b0a8e0254f45
SHA1 61e0ec4706693788c6524823acfc500cd446c673
SHA512 26d3e64b9f14bfbd775024f4e67768e3af73a07f97765cb0e2e9ba843bf039845d1e73a70d9fa0c852efc3b65172be45b655f8dfde76b81eebf00090eecdf246
SSDEEP 6144:SLaJdRzfbNYmghBWLEabs5SrHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:S2JdlNYmghBWLEab4S7YxxC/NcZ7/N
TLSH
T1D6646CE4FB736EC3E41FF2B420A2C43181CBD57B01EA746F6F30AA571A667869D85205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pdenmbkk.exe

Path C:\Windows\SysWOW64\Pdenmbkk.exe
Size 319KB
SHA256 41bd131dce4c9206c7d837b5a3d41514fc61f01318b4df892e8abc04bbeeadab
MD5 dd0a53c50a3f2c11d97eae035c5d7384
SHA1 f06782b35cbedcf8337f47f899f21c128ec93136
SHA512 d654a7bde4d19afb1c1021720d4c9b1f484dfa967ed1b00427a0e27b9da806fdead16adfafaf2ee7871158c7033e6112176af512056a4928ec0681bee082df9e
SSDEEP 6144:9HhxHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:9T7YxxC/NcZ7/N
TLSH
T1EC6459E6BBB06EC1E46FF5B418A2C07290D1D93B02EA714F7F30BA5746673989C87611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pdjgha32.exe

Path C:\Windows\SysWOW64\Pdjgha32.exe
Size 319KB
SHA256 d65edb7af99d9e28336642ab56def0d601d226e8fd256a56293c7ed64356758b
MD5 2282b37a8f7f63fdec1fcdfbae20a3f6
SHA1 79225557cae141409391505d1f17d4cbc7f25449
SHA512 7794b681cf8cd2bf51bcc9c1f04b8c45f39321d1bbf160189c03a2f1a3fbb231fcb4a3e0764e913e3949306e1f602545169110560ef510d0f566c33402575470
SSDEEP 6144:cOu84zlHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:XJC7YxxC/NcZ7/N
TLSH
T15A647BE1BBB5BEC1E46FF1B41CA2C432C1C1C93F02EA714FAF349E554AAA9949DC5112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pdmdnadc.exe

Path C:\Windows\SysWOW64\Pdmdnadc.exe
Size 319KB
SHA256 bd8bbb40156c480c6bf992dac37b1c6b083384946554984db0b2a9f1a61a9b80
MD5 181eb6e758138c0d95d7244836e5b587
SHA1 4db1e976b34dacee8913dbcaa40ec9f000f4b74c
SHA512 e388b833409c233381ae11edb7daca81c77e52388ca766264634284b3021ab60463f499b918bd3fd30422da2bb2da28b07c0a4d8ac89732cad7a97dfbd367f15
SSDEEP 6144:Q10GiAtPmiBHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:sTdN7YxxC/NcZ7/N
TLSH
T1E26459E1FB747ED1E45FFDF014A294BAC0C6E53B09EB708E6F30AA568A671849CC5601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfandnla.exe

Path C:\Windows\SysWOW64\Pfandnla.exe
Size 319KB
SHA256 577dbf11b587880f208b088bcc4c99971c5099b92d3d20da46442363cbcc996c
MD5 ddffe26451ae8df81ef80c0e2b0be969
SHA1 ef5586343f249764df04b51da4d0c6258d059617
SHA512 e5577d63928ac4ccf5bb93d8ae209989aef711ea57c9ecff2ef6d227be7e0d1c4ebafe882e320575c5f96895e6c8379dd3fcfb5f9bdb6af604f97b3c04611419
SSDEEP 6144:32x/SxPz2Hlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:3eaxPK7YxxC/NcZ7/N
TLSH
T109646AE4BBB17ED9F61FF5B040A2F232B1D1D7BA01EA744F7F30BA45466A1948C85281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pffgom32.exe

Path C:\Windows\SysWOW64\Pffgom32.exe
Size 319KB
SHA256 2021ba62ac2da112ea5e3455ce7ec9165b0c2554a632f1627a79b5a7205a4de1
MD5 1d3cd335a8607db3a6571cbc3c1d8726
SHA1 cf973bf13830f45d588d1795e66dd1966202e38e
SHA512 bb151c254c15b536c1234bc6fed81b0affca47eaf048ca421eb7648cce7d6f8d53087a5e45f7cef196898807727aa9f7f63da8d0c60c74332554675da0511c7e
SSDEEP 6144:u5zhkAxHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:YzhL7YxxC/NcZ7/N
TLSH
T1DF646BECBB74AFD2E46FF1B510A2E572A1C1E5BB01E6704FEF309E4586E61C48E85601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfiddm32.exe

Path C:\Windows\SysWOW64\Pfiddm32.exe
Size 319KB
SHA256 01b1e669a94da4ed688604d2827b155ce6ad2f175ecca62db16ba9eba86dc5e5
MD5 d0f494958d15ef9dedc940a8f3bb6278
SHA1 4b5b43791a665658eaa3216bea328d2f137b7840
SHA512 04d63d2796423b5637933fd50517235d94e65f9bb3744afe5d9e64f0c8695491a2194d068d333c69153b0d4392e9201fef022f87384ae873b31c6c21d1722f8c
SSDEEP 6144:AIqE6Bx3tdknNuHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:aE6Bxj7YxxC/NcZ7/N
TLSH
T16D648CF5FBB47DC2E67FF1B614B2C43281C1C93B02EA708F6F30AA654AA61749C85195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfoann32.exe

Path C:\Windows\SysWOW64\Pfoann32.exe
Size 319KB
SHA256 e2435e7c94e4c2dd7e27fefaf054759bfa51623abe82db3953d856d8f87f85ba
MD5 c010b2f2e565e902746c43f728c70525
SHA1 a206ec06ea41e514b8db2619841f586bc4d0279c
SHA512 5c8fb28eeea5b074b68c3275b5af0902f836aac5537404dac2dffc525a3bc5033ebfc54c3d508084c1ff730581b66ddd8d392757646fc921a62a254d5f0bf29d
SSDEEP 6144:6VNq1vrdHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:Mqx7YxxC/NcZ7/N
TLSH
T1F5646BE2BB756ED3E45FF1B014B2C47280CAF57B01EA318F6F30AAE506762449C89D91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Phajna32.exe

Path C:\Windows\SysWOW64\Phajna32.exe
Size 319KB
SHA256 0311de1c0399367cedb95682c0b1584504016bc014c9a1aef8818127b892c35b
MD5 22fc8b417fbdfd5f51d0a90af703c903
SHA1 f978980a799b3c9be478f31ef863b630d71aeecd
SHA512 ad0d151b65b26d75eef6852a47a2d3f44ff9010465cc8fac4785620c9ba3dbfbd2dfb88d013476b47e7689e674d22d816263e10c786fce08c436e2e0c42badda
SSDEEP 6144:CVwQNHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:O7YxxC/NcZ7/N
TLSH
T19F6459F5BB747FC1E46FF1B010E2D97281C1D97A21EBB08F6F3CAA410AAA1949C87505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Phcgcqab.exe

Path C:\Windows\SysWOW64\Phcgcqab.exe
Size 319KB
SHA256 5a8df150ee683714007861a9ac076ab08a0c0ad7d5b04126260232889f557639
MD5 ea1863cc245dba2e75216957ca18e1c0
SHA1 51fd66834f9c62805c1382002992b16125262653
SHA512 4b05389fe3fa710150ce61f566c3ce0d533bc716c82e044e80f5b23056f39a4c91a9dda563a88e643ce7f01aa90d337db8a16b772d1d05fa65d6f9de353ce794
SSDEEP 6144:OOoA6mwmHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:Oe1B7YxxC/NcZ7/N
TLSH
T17B647CF5BB717EC1E06FF1BC90A2C47281DAF53B01EA718F6F32BA4517A6184AC85611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjbcplpe.exe

Path C:\Windows\SysWOW64\Pjbcplpe.exe
Size 319KB
SHA256 49a57952b4b717be078c64943fcd974ec528c14c3221c6c8ce5e0a44bf9d6f2d
MD5 eaca81d946a3a3246b70bf55f246240e
SHA1 f392e4ecc8560ee459c0c34e1b91d0fbc6166014
SHA512 79afd861a9f48a2ef365a08a9e2e28b508318b53813086a4c9a82d747dbfb2c74ff1307118afc444566f21e1e59e56fd13b0c59007a97f11fcb6cfa2ace13747
SSDEEP 6144:cP72iHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:O7n7YxxC/NcZ7/N
TLSH
T18B647BE1BBB17EC1E82FF3B914B2C53289D5C53B09EAF18F6F309A55466E1848E87105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjdpelnc.exe

Path C:\Windows\SysWOW64\Pjdpelnc.exe
Size 319KB
SHA256 345b51b79aa679f5348e8c8948527a3cc52c6916a098452c414d913f2d2e1343
MD5 63e63dc0d6819daa1a212a88bfb29dae
SHA1 60e40794397d860568224642e3f6a206cdd13c0a
SHA512 739490f9016aadb9971665919f0f04099402f33fe0c1588659668beaa5b57b01cc9cd4fd14cb132894d7034561d0d37173860ab7bbb9a6289cfd7e857e3ddc74
SSDEEP 6144:AuQ9Z0Ef9kj9Hlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:Ang7YxxC/NcZ7/N
TLSH
T1CD647CE5FF707ED1E46FF6B610B2C53280D2D53B81EA708F6FB0EA9646671849C89601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjkmomfn.exe

Path C:\Windows\SysWOW64\Pjkmomfn.exe
Size 319KB
SHA256 fb8eaab510d83d59d8949e4cfa72853b69c3e0fdbb3d061ee3d99dd7b181dc82
MD5 9652bb425b906bc323e60d0018ab8f8c
SHA1 0ace949a0948835dac37ee0339316e13611c9da7
SHA512 075d48131db9895649fa835739f1ca3c45142f21e6d9feef2641a3a239bec1b1e352c6cfea645d30af9538aeac5f3cbb9d2ef877d476af672141331d6012fe92
SSDEEP 6144:BSlzAHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:wm7YxxC/NcZ7/N
TLSH
T174645BF5FBB06EC1E8BFF1B114E2D43281C1D97B02EA744F6F30AE564A661889C89D51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjmjdm32.exe

Path C:\Windows\SysWOW64\Pjmjdm32.exe
Size 319KB
SHA256 e280df4562a18edee6fe3576965d3261da72d319191be327dd0d5245325307a8
MD5 956d15e3ca23a54cb82f1ceeefd88278
SHA1 0f661da3fa9e428786ebdfb31a139d2cc1ea5122
SHA512 1c1932b65e7d1739923f1efc19ecffa9159db7ae972dc1b95a1930a6df22901fcbecb0a68abe767de778b6be0fe2e80ba6a6ec99f7d0aedbf806a1871a30e79c
SSDEEP 6144:ZCjf4bsFx5OCHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:ZCjfcs35L7YxxC/NcZ7/N
TLSH
T1FC646AE5BB716EC1E81FF9B030B2847282D1D93A03EA714F6F30AA5567669CC8F87115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjpfjl32.exe

Path C:\Windows\SysWOW64\Pjpfjl32.exe
Size 319KB
SHA256 85896f3a42e0b73944933cbc37a156223120977286785e77c496a8c50129d1f5
MD5 fff48196e382757f6477bb1855914780
SHA1 0f83c037e027be65fc967b7908aeb632af775e80
SHA512 cf18f1edb26f705b89cc071b05dfb0c9e66fbcffe91209dd04efd016a69061c7bc089304f20613562bf39f52a6442e4c6a1d92b0574527f5e68b442c73de88d3
SSDEEP 6144:v0qfHx1tHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:vnHxH7YxxC/NcZ7/N
TLSH
T1BC646BE5BBB46EC9E47FF8B414A2C772C2C3E57B01E6F08F6F309A455AE62848C85505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmiikh32.exe

Path C:\Windows\SysWOW64\Pmiikh32.exe
Size 319KB
SHA256 8573af8ab7aa92a75167fe132e12ddd74590e5949df785a522e1d2fb680364a4
MD5 266bbbeaa44b711dd4b96291797fe703
SHA1 b7147be72e00a2e1b20e60d9810901fb023436ae
SHA512 08a81c2870e9084f48d8d809c94175ad61bedec48f311d7e2632502d5530e93268eba11316e798c2a8079030d126f7e260a9f75248fa416396c0c6f5c51b960d
SSDEEP 6144:zmZWOvbHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:SWOL7YxxC/NcZ7/N
TLSH
T19E6459E5BB7DBEF1E41FF1B410A2C47381C5DABA01EB704F6FB0AA95676619C8C86101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmlfqh32.exe

Path C:\Windows\SysWOW64\Pmlfqh32.exe
Size 319KB
SHA256 0ddfce6e6d57b7e539afe05cabc844f7a754e1d0a49f5a50176ad8a8fbebfd05
MD5 01f1646666e516efbd44bc822efef860
SHA1 f2971be06e14dc209ee336d69eedca0798ff0a9a
SHA512 6541c43fba18f112895cd5656b9e5424d45599317adc221ee130ad3064880a4c134b640897e14d384e5f4c2fbf16c9d757ed9787e968ddb2a7332955759f0b81
SSDEEP 6144:P4vRFfZwHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:Pojm7YxxC/NcZ7/N
TLSH
T1FD646AE1FB75EEC1EC1FF4B112AAC63280C5E93A01E6714F7F30DA559B66286CC9A501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmpolgoi.exe

Path C:\Windows\SysWOW64\Pmpolgoi.exe
Size 319KB
SHA256 6b4207f98ce980aa58e3b3cdff989932547b33b269f8736ed9ef071dcc3d6048
MD5 baeeccf3fc7d37475c9779636be954e3
SHA1 57e7987b5b238c38fa85b7316203e14aab58c7ba
SHA512 dcb79c5f2e254bc0c18d5cfacbeeea20e691981baf0923df58bb493a0d77767ff9a8996f25de48447e091d3228c2d43e6eca0246c34a7a7f1bb2f42822e0b5ef
SSDEEP 6144:UWJZO3rs6Hlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:UsZO3F7YxxC/NcZ7/N
TLSH
T108647CE5BB74EEC1E05FF1B410F2E5B280D1EA7B01FA784F6F30BA565E662449C85281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pnkbkk32.exe

Path C:\Windows\SysWOW64\Pnkbkk32.exe
Size 319KB
SHA256 d05704d3d2b7bb5fb3a9b57ab7a6702bf3c6bda507d8797767adfa43036a1405
MD5 d1a48b90e278999165ed445621f9894e
SHA1 de786e2aeb7d19711803295802d384f377377d9a
SHA512 6843d07eba3088c32a19bde57f573f9bc54f755fadc6fc8948cac27e6bb63520fe0c65d157c270a36258028a54896e372b40a05168fe3c8e13e4633fef75a2ce
SSDEEP 6144:yPcG7QNiKHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:57YxxC/NcZ7/N
TLSH
T1316459E1BF756FD1E02FF1F590A2C83280C6DA7B01EA714F7FB0AA5786672848D85605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pnplfj32.exe

Path C:\Windows\SysWOW64\Pnplfj32.exe
Size 319KB
SHA256 1c9f846caaabdcc1060e4de047a4687b4efe7bedc4aeaa10b5c96e9776daa8a3
MD5 c7c113afd776ffb21781bf1c3903db9b
SHA1 31bb4f37dab5cd6a6a723f310bfc59b08dc89fd6
SHA512 69640b9fee586c899fee97a1df31a872c6ac9d89f0af45d221b3ac958d6a05f6dc1c6a79980f9f614e0c12b11fc5e72f501033d2c223df517ebe41d024da845e
SSDEEP 6144:81pgwL/PxXHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:CuGB7YxxC/NcZ7/N
TLSH
T148646AE1FB726EC2F61FF1B130A2C4B683EDD53B02E6708F6F349A565E661449D85202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppgegd32.exe

Path C:\Windows\SysWOW64\Ppgegd32.exe
Size 319KB
SHA256 6814c2477db4b41881ff485a4270a0cf4f3ffb9068e086796db6904be4c9d933
MD5 b85c7ae7c419367e37fd3910579be9cc
SHA1 1c8b301f2ded51ed88336ec1997586c9dee03093
SHA512 d7aa4dd1ab3822213c594ea028f4ffb85b5bb81d03bc733d5d70c47861c66ca2d21fd59a2151b55cf4f297f474f9645ef1434e22c010e32233bd3d70ad1f6452
SSDEEP 6144:VwJqsLEIpvXLwerHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:VuvAIpvXLwS7YxxC/NcZ7/N
TLSH
T18E646AE5FF716FE1E46FF5B054A2C47380C2D9BB01EAB8AF6F30AA451A631849CC5911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pplobcpp.exe

Path C:\Windows\SysWOW64\Pplobcpp.exe
Size 319KB
SHA256 1fda8b222b16fe1c50d73f443a3e88fed10fcc86b179e46ca39eb094b3ce6449
MD5 4384f1028c318e36e1c8b8d46a1735ff
SHA1 e527d6a3f04acb21ffb4c5f3b2f3d91007a19bad
SHA512 e5a8402de01f545eadedd18b546c92ef5e249eab7f49cad012621a343d5f6ca335ec7c18facd9724b6507a1a740a5fb1be1c831fa25c15be8aee6da7eb8732a5
SSDEEP 6144:PqGHHHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:vH7YxxC/NcZ7/N
TLSH
T113646AF4FF71BEE1E46FF1B014A2C07281C6F97B01EA708FAF30AA5656A6194CD85116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppolhcnm.exe

Path C:\Windows\SysWOW64\Ppolhcnm.exe
Size 319KB
SHA256 378699b4e5b9b625e42100e4e082300f3e455f9b461635dcbd3847b0e74820f5
MD5 d8f95f871d9eb59ee75308ba098a1a4b
SHA1 72d969896368acdca1b5d7f7883af3acf9498d4b
SHA512 c4395033a5fec9e188be97c65f8848b62bd7166016390083057b62e6503fefd51ab85ef33cd00c13cbabd6de187f19c548b85f6882b4550cfe3954a2ec2c5c5c
SSDEEP 6144:Gy8vHlp4PlXj4IyqrQ///NR5fLYG3eujPQ///NR5f:GyI7YxxC/NcZ7/N
TLSH
T1BA647BF1BB736EC1E42FF1B410A2D17281C2D57B02EAF44F6F309A554A663869D8E613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-393-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/548-586-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/548-70-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/552-701-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/552-229-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/560-440-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/640-357-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/836-654-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/836-165-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/864-272-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/924-622-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/924-118-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1112-428-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1168-213-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1172-363-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1232-387-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1284-665-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1284-181-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1340-469-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1456-549-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1456-17-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1464-260-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1536-345-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1540-707-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1540-237-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1708-598-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1708-86-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1732-173-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1884-299-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1888-538-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1888-13-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1916-672-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/1916-189-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2020-719-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2020-252-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2076-317-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2124-197-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2124-678-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2272-375-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2316-329-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2324-713-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2388-149-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2560-399-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2684-604-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2684-94-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2892-305-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2896-157-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2936-446-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/2996-405-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3080-485-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3148-141-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3152-29-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3152-555-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3172-205-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3172-684-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3352-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/3352-532-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3352-0-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3412-283-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3492-633-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3524-126-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3568-509-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3752-503-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3788-351-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3804-497-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3848-266-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3872-46-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3872-568-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3880-666-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3964-616-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3964-110-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3988-54-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/3988-574-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4148-38-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4148-561-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4156-695-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4156-221-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4172-491-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4184-311-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4292-463-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4296-323-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4348-434-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4392-381-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4728-411-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4796-592-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4796-77-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4836-417-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4920-610-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4920-102-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/4992-457-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/5064-369-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/5104-61-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/5104-580-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/5164-520-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/5200-526-0x0000000000400000-0x0000000000451000-memory.dmp

Download

memory/5436-562-0x0000000000400000-0x0000000000451000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads