berbew | 3d6a18a410ce49233a4076257db3f206af36cee37d970a40282302fcfa6fe8ea

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/09/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d6a18a410ce49233a4076257db3f206af36cee37d970a40282302fcfa6fe8ea.exe
Size 128KB
Sample260904-spa48stfqa
SHA256 3d6a18a410ce49233a4076257db3f206af36cee37d970a40282302fcfa6fe8ea
MD5 a39e89893c614d2da37856ddb3b33881
SHA1 f609a060344e845fab65c4eda8fe2b77cde22695
SHA512 26c90b5b48881c7eba211de9f5cd5af8b6419bb13e14c9f0717a618d0ff4a7c55f116284336f5d44bba67bff1258c7bef233aa6a6ba0d580ffffac703655c84c
SSDEEP 3072:tVOTt/KeszNO2DgH3Om9DrLXfzoeqarm9mTKpAImA:LOJ/psz02DgemRXfxqySSKpRmA
TLSH
T196D39E0A9A045E73CBE4D330120B8546362CD5AF52ACCEA675D79F59B20F93463BBAC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aphnnafb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coqncejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpeahb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnoddcef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agimkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgpcliao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpkdjofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cggimh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qacameaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpdgqmnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adhdjpjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aonhghjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aajhndkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amcehdod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnlhncgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpmapodj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adcjop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfkqjmdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akpoaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chnlgjlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdfpkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chiblk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afbgkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baegibae.exe

Executes dropped EXE 64 IoCs

pid	Process
4908	Qfkqjmdg.exe
4624	Qaqegecm.exe
1316	Qhjmdp32.exe
5856	Qmgelf32.exe
5204	Qacameaj.exe
4648	Qpeahb32.exe
2248	Ahmjjoig.exe
5416	Akkffkhk.exe
3684	Aogbfi32.exe
5128	Amjbbfgo.exe
3300	Aaenbd32.exe
2412	Aphnnafb.exe
4676	Adcjop32.exe
4812	Afbgkl32.exe
3880	Aknbkjfh.exe
1536	Aoioli32.exe
2500	Amlogfel.exe
4900	Aagkhd32.exe
5764	Adfgdpmi.exe
1540	Agdcpkll.exe
3592	Akpoaj32.exe
6084	Aokkahlo.exe
368	Amnlme32.exe
4808	Aajhndkb.exe
5236	Adhdjpjf.exe
2292	Ahdpjn32.exe
6128	Aggpfkjj.exe
4092	Aonhghjl.exe
548	Amqhbe32.exe
4388	Apodoq32.exe
5996	Adkqoohc.exe
1600	Agimkk32.exe
4868	Akdilipp.exe
3876	Amcehdod.exe
5172	Aaoaic32.exe
5316	Apaadpng.exe
4600	Bhhiemoj.exe
5792	Bgkiaj32.exe
1572	Bobabg32.exe
5340	Bmeandma.exe
5108	Baannc32.exe
5612	Bdojjo32.exe
5500	Bgnffj32.exe
3832	Bkibgh32.exe
5364	Bmhocd32.exe
4488	Bacjdbch.exe
5900	Bdagpnbk.exe
1036	Bhmbqm32.exe
1144	Bgpcliao.exe
3792	Bogkmgba.exe
5036	Baegibae.exe
1288	Bphgeo32.exe
592	Bddcenpi.exe
1952	Bgbpaipl.exe
5104	Bknlbhhe.exe
676	Bnlhncgi.exe
5536	Bpkdjofm.exe
948	Bdfpkm32.exe
3068	Bgelgi32.exe
4336	Boldhf32.exe
4380	Bnoddcef.exe
4236	Cpmapodj.exe
3784	Cdimqm32.exe
2296	Cggimh32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bhhiemoj.exe	Apaadpng.exe
File created	C:\Windows\SysWOW64\Ofkhal32.dll	Bgnffj32.exe
File opened for modification	C:\Windows\SysWOW64\Cdkifmjq.exe	Cammjakm.exe
File created	C:\Windows\SysWOW64\Agdcpkll.exe	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Chnpamkc.dll	Aggpfkjj.exe
File created	C:\Windows\SysWOW64\Oblknjim.dll	Cgqlcg32.exe
File opened for modification	C:\Windows\SysWOW64\Aokkahlo.exe	Akpoaj32.exe
File created	C:\Windows\SysWOW64\Kdebopdl.dll	Aokkahlo.exe
File opened for modification	C:\Windows\SysWOW64\Bgkiaj32.exe	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Mnpofk32.dll	Dhphmj32.exe
File created	C:\Windows\SysWOW64\Dahmfpap.exe	Dnmaea32.exe
File opened for modification	C:\Windows\SysWOW64\Aphnnafb.exe	Aaenbd32.exe
File created	C:\Windows\SysWOW64\Adfgdpmi.exe	Aagkhd32.exe
File opened for modification	C:\Windows\SysWOW64\Amqhbe32.exe	Aonhghjl.exe
File created	C:\Windows\SysWOW64\Eehnaq32.dll	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Dnmaea32.exe	Dkndie32.exe
File created	C:\Windows\SysWOW64\Jkmjlphl.dll	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Oingap32.dll	Akkffkhk.exe
File opened for modification	C:\Windows\SysWOW64\Aaenbd32.exe	Amjbbfgo.exe
File opened for modification	C:\Windows\SysWOW64\Cpfcfmlp.exe	Cnhgjaml.exe
File created	C:\Windows\SysWOW64\Jilpfgkh.dll	Dkndie32.exe
File created	C:\Windows\SysWOW64\Afbgkl32.exe	Adcjop32.exe
File opened for modification	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Qnbidcgp.dll	Bobabg32.exe
File created	C:\Windows\SysWOW64\Bogkmgba.exe	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Cgqlcg32.exe	Chnlgjlb.exe
File created	C:\Windows\SysWOW64\Opjghl32.dll	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Bgnffj32.exe	Bdojjo32.exe
File opened for modification	C:\Windows\SysWOW64\Baegibae.exe	Bogkmgba.exe
File opened for modification	C:\Windows\SysWOW64\Bgbpaipl.exe	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Cpkhqmjb.dll	Cncnob32.exe
File created	C:\Windows\SysWOW64\Eignjamf.dll	Adcjop32.exe
File created	C:\Windows\SysWOW64\Gcgplk32.dll	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Adhdjpjf.exe	Aajhndkb.exe
File created	C:\Windows\SysWOW64\Apodoq32.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Oeeape32.dll	Bgpcliao.exe
File opened for modification	C:\Windows\SysWOW64\Bphgeo32.exe	Baegibae.exe
File created	C:\Windows\SysWOW64\Lahoec32.dll	Boldhf32.exe
File opened for modification	C:\Windows\SysWOW64\Cglbhhga.exe	Chiblk32.exe
File created	C:\Windows\SysWOW64\Eepmqdbn.dll	Aogbfi32.exe
File opened for modification	C:\Windows\SysWOW64\Bobabg32.exe	Bgkiaj32.exe
File opened for modification	C:\Windows\SysWOW64\Cnaaib32.exe	Ckbemgcp.exe
File opened for modification	C:\Windows\SysWOW64\Dafppp32.exe	Cogddd32.exe
File created	C:\Windows\SysWOW64\Akpoaj32.exe	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Bobabg32.exe	Bgkiaj32.exe
File created	C:\Windows\SysWOW64\Bddcenpi.exe	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Cdkifmjq.exe	Cammjakm.exe
File created	C:\Windows\SysWOW64\Cnhgjaml.exe	Coegoe32.exe
File created	C:\Windows\SysWOW64\Dafppp32.exe	Cogddd32.exe
File created	C:\Windows\SysWOW64\Hhblffgn.dll	3d6a18a410ce49233a4076257db3f206af36cee37d970a40282302fcfa6fe8ea.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Hlfpph32.dll	Bdojjo32.exe
File created	C:\Windows\SysWOW64\Bacjdbch.exe	Bmhocd32.exe
File opened for modification	C:\Windows\SysWOW64\Bhmbqm32.exe	Bdagpnbk.exe
File created	C:\Windows\SysWOW64\Baegibae.exe	Bogkmgba.exe
File opened for modification	C:\Windows\SysWOW64\Cammjakm.exe	Cnaaib32.exe
File opened for modification	C:\Windows\SysWOW64\Chiblk32.exe	Cpbjkn32.exe
File opened for modification	C:\Windows\SysWOW64\Akkffkhk.exe	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Adcjop32.exe	Aphnnafb.exe
File opened for modification	C:\Windows\SysWOW64\Aajhndkb.exe	Amnlme32.exe
File created	C:\Windows\SysWOW64\Dpiplm32.exe	Dafppp32.exe
File created	C:\Windows\SysWOW64\Nchkcb32.dll	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Adnbpqkj.dll	Bacjdbch.exe
File created	C:\Windows\SysWOW64\Nflnbh32.dll	Ckbemgcp.exe

Program crash 1 IoCs

pid	pid_target	Process
1464	3120	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chiblk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d6a18a410ce49233a4076257db3f206af36cee37d970a40282302fcfa6fe8ea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpeahb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmhocd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cglbhhga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnlgjlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aagkhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akpoaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokkahlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhmbqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhphmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhjmdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgkiaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdfpkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpmapodj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgifbhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkndie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aogbfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agdcpkll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdojjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bogkmgba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnhgjaml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adhdjpjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apodoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfkdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjbbfgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aajhndkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaoaic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baegibae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bknlbhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpdgqmnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coegoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgbpaipl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaenbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amlogfel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdkifmjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coqncejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaqegecm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adkqoohc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apaadpng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahmjjoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adcjop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnlme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bobabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cammjakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamhbhe.dll"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcdqdie.dll"	Qacameaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkamodje.dll"	Bogkmgba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cncnob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oingap32.dll"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqppgj32.dll"	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cammjakm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgfl32.dll"	Cammjakm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkicbhla.dll"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehojko32.dll"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Boldhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfgomdnj.dll"	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnpamkc.dll"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeeape32.dll"	Bgpcliao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghgmioe.dll"	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndikch32.dll"	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qpeahb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiapmnp.dll"	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnpofk32.dll"	Dhphmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnbidcgp.dll"	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhal32.dll"	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciipkkdj.dll"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlobem32.dll"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcccepbd.dll"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bobabg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckbemgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fomnhddq.dll"	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepmqdbn.dll"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjamidgd.dll"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bdfpkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dafppp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehmok32.dll"	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcaaeme.dll"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkmjlphl.dll"	Adfgdpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilpfgkh.dll"	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmbgla32.dll"	Aaenbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmpockdl.dll"	Amlogfel.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 4908	6108	3d6a18a410ce49233a4076257db3f206af36cee37d970a40282302fcfa6fe8ea.exe	86
PID 4908 wrote to memory of 4624	4908	Qfkqjmdg.exe	87
PID 4624 wrote to memory of 1316	4624	Qaqegecm.exe	88
PID 1316 wrote to memory of 5856	1316	Qhjmdp32.exe	89
PID 5856 wrote to memory of 5204	5856	Qmgelf32.exe	90
PID 5204 wrote to memory of 4648	5204	Qacameaj.exe	91
PID 4648 wrote to memory of 2248	4648	Qpeahb32.exe	92
PID 2248 wrote to memory of 5416	2248	Ahmjjoig.exe	93
PID 5416 wrote to memory of 3684	5416	Akkffkhk.exe	94
PID 3684 wrote to memory of 5128	3684	Aogbfi32.exe	95
PID 5128 wrote to memory of 3300	5128	Amjbbfgo.exe	96
PID 3300 wrote to memory of 2412	3300	Aaenbd32.exe	97
PID 2412 wrote to memory of 4676	2412	Aphnnafb.exe	98
PID 4676 wrote to memory of 4812	4676	Adcjop32.exe	99
PID 4812 wrote to memory of 3880	4812	Afbgkl32.exe	100
PID 3880 wrote to memory of 1536	3880	Aknbkjfh.exe	101
PID 1536 wrote to memory of 2500	1536	Aoioli32.exe	102
PID 2500 wrote to memory of 4900	2500	Amlogfel.exe	103
PID 4900 wrote to memory of 5764	4900	Aagkhd32.exe	104
PID 5764 wrote to memory of 1540	5764	Adfgdpmi.exe	105
PID 1540 wrote to memory of 3592	1540	Agdcpkll.exe	106
PID 3592 wrote to memory of 6084	3592	Akpoaj32.exe	107
PID 6084 wrote to memory of 368	6084	Aokkahlo.exe	108
PID 368 wrote to memory of 4808	368	Amnlme32.exe	109
PID 4808 wrote to memory of 5236	4808	Aajhndkb.exe	110
PID 5236 wrote to memory of 2292	5236	Adhdjpjf.exe	111
PID 2292 wrote to memory of 6128	2292	Ahdpjn32.exe	112
PID 6128 wrote to memory of 4092	6128	Aggpfkjj.exe	113
PID 4092 wrote to memory of 548	4092	Aonhghjl.exe	114
PID 548 wrote to memory of 4388	548	Amqhbe32.exe	115
PID 4388 wrote to memory of 5996	4388	Apodoq32.exe	116
PID 5996 wrote to memory of 1600	5996	Adkqoohc.exe	117
PID 1600 wrote to memory of 4868	1600	Agimkk32.exe	118
PID 4868 wrote to memory of 3876	4868	Akdilipp.exe	119
PID 3876 wrote to memory of 5172	3876	Amcehdod.exe	120
PID 5172 wrote to memory of 5316	5172	Aaoaic32.exe	121
PID 5316 wrote to memory of 4600	5316	Apaadpng.exe	122
PID 4600 wrote to memory of 5792	4600	Bhhiemoj.exe	123
PID 5792 wrote to memory of 1572	5792	Bgkiaj32.exe	124
PID 1572 wrote to memory of 5340	1572	Bobabg32.exe	125
PID 5340 wrote to memory of 5108	5340	Bmeandma.exe	126
PID 5108 wrote to memory of 5612	5108	Baannc32.exe	127
PID 5612 wrote to memory of 5500	5612	Bdojjo32.exe	128
PID 5500 wrote to memory of 3832	5500	Bgnffj32.exe	129
PID 3832 wrote to memory of 5364	3832	Bkibgh32.exe	130
PID 5364 wrote to memory of 4488	5364	Bmhocd32.exe	131
PID 4488 wrote to memory of 5900	4488	Bacjdbch.exe	132
PID 5900 wrote to memory of 1036	5900	Bdagpnbk.exe	133
PID 1036 wrote to memory of 1144	1036	Bhmbqm32.exe	134
PID 1144 wrote to memory of 3792	1144	Bgpcliao.exe	135
PID 3792 wrote to memory of 5036	3792	Bogkmgba.exe	136
PID 5036 wrote to memory of 1288	5036	Baegibae.exe	137
PID 1288 wrote to memory of 592	1288	Bphgeo32.exe	138
PID 592 wrote to memory of 1952	592	Bddcenpi.exe	139
PID 1952 wrote to memory of 5104	1952	Bgbpaipl.exe	140
PID 5104 wrote to memory of 676	5104	Bknlbhhe.exe	141
PID 676 wrote to memory of 5536	676	Bnlhncgi.exe	142
PID 5536 wrote to memory of 948	5536	Bpkdjofm.exe	143
PID 948 wrote to memory of 3068	948	Bdfpkm32.exe	144
PID 3068 wrote to memory of 4336	3068	Bgelgi32.exe	145
PID 4336 wrote to memory of 4380	4336	Boldhf32.exe	146
PID 4380 wrote to memory of 4236	4380	Bnoddcef.exe	147
PID 4236 wrote to memory of 3784	4236	Cpmapodj.exe	148
PID 3784 wrote to memory of 2296	3784	Cdimqm32.exe	149

C:\Users\Admin\AppData\Local\Temp\3d6a18a410ce49233a4076257db3f206af36cee37d970a40282302fcfa6fe8ea.exe
"C:\Users\Admin\AppData\Local\Temp\3d6a18a410ce49233a4076257db3f206af36cee37d970a40282302fcfa6fe8ea.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Windows\SysWOW64\Qfkqjmdg.exe
  C:\Windows\system32\Qfkqjmdg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\Qaqegecm.exe
    C:\Windows\system32\Qaqegecm.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\SysWOW64\Qhjmdp32.exe
      C:\Windows\system32\Qhjmdp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5856
      - C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5204
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5416
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5128
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5764
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6084
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5236
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6128
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5996
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5172
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5316
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5792
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5340
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5612
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5500
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5364
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5900
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:592
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5536
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2296
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3096
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1984
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:3728
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1220
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1156
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        79⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        80⤵
        Modifies registry class
        
        PID:3312
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1412
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        85⤵
        Drops file in System32 directory
        
        PID:4728
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:860
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2584
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        88⤵
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4052
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:856
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        92⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 412
        96⤵
        Program crash
        
        PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3120 -ip 3120
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aaenbd32.exe

Path C:\Windows\SysWOW64\Aaenbd32.exe
Size 128KB
SHA256 e21d5ad97427a03f6963769b592045f121106b34e0b5b8c1450c628a7a37305f
MD5 824d8b4374b5e8900b83cf135e25e94d
SHA1 76af091a782108ab419f05f025d47c3d7ab2b6b6
SHA512 11a778694ca38d08b8198534ca9a93b249dba0abc7b3436e8f756ab92c51f02e13fabf9caec23e9de2067d62aa4e5c03e9f6a1e92f4910488ef55721c30c1356
SSDEEP 3072:p8Wga5Dg9Xs9/TgAQPFqDrLXfzoeqarm9mTKpAImA:p8Wgahg989UBPFUXfxqySSKpRmA
TLSH
T136D3AEDA66BD5FE2EEE9D2B0160B46872F29F458C3BFC653111CD0CA510FCA1237A960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aagkhd32.exe

Path C:\Windows\SysWOW64\Aagkhd32.exe
Size 128KB
SHA256 3753e6a09225f5e9b3aff35dfcadcae1bf12f6acfdb2129aabb4b8fa89ab0a54
MD5 6630eac260c7d1dd4e18edee820ed121
SHA1 79a919f850c73d2763a141db6f4a1f0f91aaa00d
SHA512 08d2e82af5fd49156689720dedc72a31fc58c2c34d5ddb9db59d8724a1a4d2a073d97b010d220edec23757b83bd16f4914df091a612308329ebb431a2bcc01be
SSDEEP 3072:4kKXa9ysbrk1OvaeBAy74Y/aYDrLXfzoeqarm9mTKpAImA:OIOMyeWo4qa6XfxqySSKpRmA
TLSH
T138D37CFA92999D75FBC50370E20FF5473BACD13A126BC6714114903866079232FFABA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aajhndkb.exe

Path C:\Windows\SysWOW64\Aajhndkb.exe
Size 128KB
SHA256 dabe0fd697c8c7d74cc524133728a579350426845c207e8f73f9f886c6059bd2
MD5 8775f6e3d9893108d9bd55164e3dc04f
SHA1 1eeedc6687247a25a1e2407ce917d4219ed1ef6c
SHA512 947d7386fa1d9c754d7619ed1004bf923282c24a7daa642f8ad903ed9db135a0a4dc36f10b114f74c90cb4e2a45a96906330e9a43ad08223b67197bae4300a21
SSDEEP 3072:jbMs8sQIb4y52t0jHZ3wL7cWDrLXfzoeqarm9mTKpAImA:jAqQIb4U+7TXfxqySSKpRmA
TLSH
T155D3CF5A53A95C63D2D713F41907CECBB36C8A18C3698B9D21D8C43A118B21DB3B6AF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adcjop32.exe

Path C:\Windows\SysWOW64\Adcjop32.exe
Size 128KB
SHA256 9fdcb4c04434370037d06dcd87b8cbe205dd6abbcb0575e2331e5be5c0b43206
MD5 05cec6ee88e8b7cd41a820633245d540
SHA1 a44f95ada7d84717f03329c9fc9afc481421dc58
SHA512 3230bf9ca0ef5bee07f317ab2a3a9c01c859098a5e095cfa0d1abfc0bf9dd6e4801649b366316ed2141d81da3eb7011ee3db21a25b1b440b22be944d7ffd4093
SSDEEP 3072:61o8pMIG9HPFaev9AO+6tDrLXfzoeqarm9mTKpAImA:66uLsHdR1/zBXfxqySSKpRmA
TLSH
T14BD3AE0FEA396EA6FFD500BC31CE8DCB2269C26D125799D13520DD0FC68BCE512B9691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adfgdpmi.exe

Path C:\Windows\SysWOW64\Adfgdpmi.exe
Size 128KB
SHA256 2c14020e5604cec32e57ed878d652d7667e5278281880efd2ae128b477b4d4ad
MD5 a7cb9862dff62d3afbf570c90d4baa6d
SHA1 579ed7a4a2527bee66f56aee32b273553c93e7b7
SHA512 3855dd65d684bbcb1b0dcfdcba9b86dc3028d0c7237587cd0c87cc3b4aabbb1333c0df658b3d8b4d015513c58c09f9543d5490a23c0ea877fa6e52c9e3849d0e
SSDEEP 3072:XuW+lgCwwg5LPRMQUusUGwD8DrLXfzoeqarm9mTKpAImA:XuMP5LJsUxD2XfxqySSKpRmA
TLSH
T143D39E0A49120FB3CDCEEFB4220BE78B2659F11B40F78152E850DF163A7AE67E675191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adhdjpjf.exe

Path C:\Windows\SysWOW64\Adhdjpjf.exe
Size 128KB
SHA256 d77ee08d14214511568e3d0611d8131324538fd7531f214db436950f9aefe0d4
MD5 389cd38691a9ccba20653e0605934c8c
SHA1 4447212d6164bcb8cc2e21510a8784daf715257d
SHA512 0e65a36eb264603ed0d5a62553fa58f6219d428e388847dd18307bb2bac6f7bd45b1ff2ef4181de58971dcdfd2d41faef981c1b4813ac6e140e2acbc996a2685
SSDEEP 3072:l42MHT07gjDpfRkqoSHDmrrrrrrrrrSIDrLXfzoeqarm9mTKpAImA:y2MHT07C7hoSCrrrrrrrrrSqXfxqySSQ
TLSH
T159D3A00F4E116FB5DBD654B022FBBA4BEA6ED011D1938991B146841B200F8127BBF977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adkqoohc.exe

Path C:\Windows\SysWOW64\Adkqoohc.exe
Size 128KB
SHA256 7b62102f9faff6e2874cb026935a0b3efd3c497fbd23cb90cceba68f2ade8158
MD5 16132c0fd81e3e963d09ed3c7bf74911
SHA1 74438d4eb969f680043d264d73606b1884b5eea4
SHA512 7788c4f4e00363f4c46b60da7b92836b0d7c67ce5a29ef6e64ca68786d9a7800e7cce26da7a9192a89f5a00bf7f1b9b9a992064100c3319535b64b6a0cebdc74
SSDEEP 3072:5OgIU2gDohvdkTG3pzR4LpgajHoDrLXfzoeqarm9mTKpAImA:51fxD0vdkTG3v4LppKXfxqySSKpRmA
TLSH
T1CED3B0F7E11AEE62EBCC30F12E17D5537BAC836931B4C17D11648088124E9A91AB7DE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Afbgkl32.exe

Path C:\Windows\SysWOW64\Afbgkl32.exe
Size 128KB
SHA256 6d3742d56eacb174e203168c2fad9a889aa1f63a018b16ed5705d60dad0d70f9
MD5 c0ce5cc7e11f2fe7030468dd1526c71c
SHA1 c844f91263f45659002ab12800ab17bd4084c248
SHA512 86b34a3490f7208d33a40e216b9d3ff6c87c831f1cd2bd17600282f7a0dec09765ddf3ecd3a3557ac0129dacee2d1f898c01806571c6c74a814c12720dd80f5d
SSDEEP 3072:3KUDg5cIvm9dGcmyEb8kiDIxDrLXfzoeqarm9mTKpAImA:Ym7EyEQzDI9XfxqySSKpRmA
TLSH
T1EED3AF6E90158EA6C9D91270120FB2952716442901ADFD9E1B49C0DFDF0FAB02FBFED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agdcpkll.exe

Path C:\Windows\SysWOW64\Agdcpkll.exe
Size 128KB
SHA256 7a35f1e95aca1c2e1fc239e8991728c48c9a0498ba138eb563da88997e99b251
MD5 3f14e4c2b3d3a9204af660033bd8cac4
SHA1 432b1b4ef6f0bd28ec449b17ba8e7bed4b3a3a8b
SHA512 b63596413312af668cf97a2314ea9e9a1d16bd3bf6c08a597b277bb90e55372fae5bd18dfbb435b33b8de2de4c213beae1c488ff7ba2113806f37e8774aeea83
SSDEEP 3072:7cDgTpETYyGN5enytDrLXfzoeqarm9mTKpAImA:70uN5enyBXfxqySSKpRmA
TLSH
T1A2D3BF2B9207AEF2DBC120B5174E5283272BC5D041FCA692D56D8E28131BCD7A37E9C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aggpfkjj.exe

Path C:\Windows\SysWOW64\Aggpfkjj.exe
Size 128KB
SHA256 7aa30f648fc03d3105de22a00dbe7b96f435fd7ef3680dba6b101ff62308bed1
MD5 85e57a5544e6362b19366faa0da7934b
SHA1 987ae624dce3bc6542ce105ae19f895aa4245c90
SHA512 d485fe67ce8f3faf1c5d36261d7c1d1ca7e4887d1e7ef43b2b1cbe53dc0212a2ded6d65c0cc4a0e09356bcbca729125029e704480aad35576126a1c1d59a228f
SSDEEP 3072:E+W8H4GtuHAUEPUSgtsKu9aeNgWBkkDrLXfzoeqarm9mTKpAImA:bWfiuHAU/SgtY9Bp2uXfxqySSKpRmA
TLSH
T12AD3AE2AD1E3ED73F6D901B1231BB34A2A5B88E87375CA7536148486100F9987FBDAC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agimkk32.exe

Path C:\Windows\SysWOW64\Agimkk32.exe
Size 128KB
SHA256 602adcd3bc1a495fb80e925a217c5323922ec23f88bd034b5cdab72f35b2deec
MD5 41b002b410689c45d4d08a20709f29e5
SHA1 7d7428a00ad1a2b5bfedf51bc02cc78d5f27efa1
SHA512 09a8d794505f3837b2a1ce7a22c33f5be93d16d448ba7db55c60431284b3d738ee65982f2faad40e67dcbc6c34cd026e1e413a779da3a66db4a33de22e232e2d
SSDEEP 3072:xM9XqEOu/fHk1z4IDsACDrLXfzoeqarm9mTKpAImA:xqaa//kd4IDsA8XfxqySSKpRmA
TLSH
T197D3BF075D6A7D6ACAD91FB0071BB3C76B6CB1668076E5A20A50843F030BC56267BF73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahdpjn32.exe

Path C:\Windows\SysWOW64\Ahdpjn32.exe
Size 128KB
SHA256 bb4b18d9381a116c97e3dba6440d39cf346d0226e69a3818cd5b236c0f600a57
MD5 1023a87e70f261ff8562481d1a63a202
SHA1 705114fdd4066ae9d72a5064b3e0c44e211e7726
SHA512 3716a9ab951201e677f9222f78a31e96628e62da6dcb351b606db74541268ce8ddf190a5b5f87de33d4dd18529bc7612c604e84f27860633ead97ab73e2378b4
SSDEEP 3072:p27JbqGq+EX2ZsqGbxVW5DrLXfzoeqarm9mTKpAImA:p27Jbbq2ZsqigVXfxqySSKpRmA
TLSH
T155D39C4E9D118FE7CBED1570090BC7962AD8DE15B2F5C9BE264480DD060BD6123BAFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahmjjoig.exe

Path C:\Windows\SysWOW64\Ahmjjoig.exe
Size 128KB
SHA256 e574fea1826146fa37940bb66c28d23084408eb96239ebd2e2986698998e8e22
MD5 41ce9474d3eea8b2b2116bf938cb0e0d
SHA1 532b1302ec48959b6e863060110ee241404e5441
SHA512 12b638580a63c2be1022adc94d07e731751a47eb3f1ba84d48614add903bc972b2021f4ff43e7ace5118043561751195a185f0a3e823140c58e8a7383da30ee7
SSDEEP 3072:GMY6Tfyq91X9yiCfASSlDrLXfzoeqarm9mTKpAImA:GbgyqZKADpXfxqySSKpRmA
TLSH
T124D3BF1F7460AFA2D6D621B1272FC28F6B59E6A582F8C562152CC30E04CFC65177F6A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Akkffkhk.exe

Path C:\Windows\SysWOW64\Akkffkhk.exe
Size 128KB
SHA256 4d4dcf911295c2e791021a13e1d99ac11c2ffe2257ee515072a665a1cdfe0b27
MD5 32d5a3cd033dc408b58fa913753804d6
SHA1 08f68543e0990c3c977305fae7b9544f2bed6e1c
SHA512 bc22add595b61ab971159691e2fc36d31b0b6a05538c52b3b28a7b2fcdb8949a7991682d1cd782d9dfbfed4715751fcc99d7c23617c67df5b7c5319e1ec5e6b6
SSDEEP 3072:xgISO1t04LOiL/7DvDrLXfzoeqarm9mTKpAImA:xgISOn/7DbXfxqySSKpRmA
TLSH
T1C6D39ECA724C6EAFFAD616B4F30FA68BE726C01A53749A91C3F2804B6217C111776DD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aknbkjfh.exe

Path C:\Windows\SysWOW64\Aknbkjfh.exe
Size 128KB
SHA256 7578f3b2ccc6bc1759e7c54605f97906692cef623b8728279bc2b84945261cb3
MD5 b562cc98d8e96ea576d46b54142de0e2
SHA1 0dc2657afb781072443b8d2b9f81f212046a3c44
SHA512 52134a74265391299bffccea89ca3f9e70832923c2ffd56a6c48d8e89c41df816a0079fc567d013b07b8aa03c2e50f3a2002b4d4b8be8fc7e0b010576ed8590f
SSDEEP 3072:4l19sEaap7mypTP+lgDrLXfzoeqarm9mTKpAImA:e9fo+CyXfxqySSKpRmA
TLSH
T174D39E6786C92F72F9CE217C7B0BA24B3379DC6540B8D7629E18D54C260F61063B6ED2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Akpoaj32.exe

Path C:\Windows\SysWOW64\Akpoaj32.exe
Size 128KB
SHA256 4bc3cd999265e24c03d658356690422042473f0923ac2a93bf955bb8e256c597
MD5 2f6d49a682ffb238c96803d6f5372ac8
SHA1 91096cd22bebde477a204ec3e835a35e1389ea4b
SHA512 354a699b42cead5cbe415b7c7ae90557f4b1cc044a61b2dc489f56a1692924f0ab4cd816d2ab7cfdeb96d9e010c32470fb15ae8dce28c92112aba5b89b2a8375
SSDEEP 3072:km/p3hFrqVcgiZlKqysWokB6qDrLXfzoeqarm9mTKpAImA:RXjgiXK1sWNkUXfxqySSKpRmA
TLSH
T150D3BF2BE5952E72F6F711F3370B628E325DD43D52FB96810642E084124F864C77FA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amjbbfgo.exe

Path C:\Windows\SysWOW64\Amjbbfgo.exe
Size 128KB
SHA256 2d091dc633d975e53f8ea95878b7aca7b2ff8cd0c4d2e015f24ade85300ab1cb
MD5 ccdd5b510bc7b9fd3f1d8aa5afac5708
SHA1 6d36e864525d449ff6b2ca8b07c190320afdb176
SHA512 28834a9cf2fa148f13235672c1e69b50f47ddea1c21eafb23af0cb4bf642c88975ec271198c973ad3e98c0714feac2d4156200bc1cc79dc5acd2997727960368
SSDEEP 3072:0lXpMfL6D63gz8uTc1rEDrLXfzoeqarm9mTKpAImA:SULG63gIH1rOXfxqySSKpRmA
TLSH
T18AD39E1B51B77E5EDBFE16B3D20F9EC76319A5F403B4CA951EA4A008224BC07277B981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amlogfel.exe

Path C:\Windows\SysWOW64\Amlogfel.exe
Size 128KB
SHA256 3fce9566e406afe26f1ad12af0551c23b6dc04828319053370be844fe4543d96
MD5 8b1c3d1a9f68973ff6b1f5d6b0551261
SHA1 c1381df6d9746c8268dfd748b041fd0fb8b98e73
SHA512 740cfd5491a61c270b407c4aa441c30d24ef31a3b9704b0fb605b3f1f888bbf45fd47cdbcde0d7cfed16d6424421166015153be316d17d08b1bc348d6f18c867
SSDEEP 3072:v+nVPR6Pk4HbgdSPowDrLXfzoeqarm9mTKpAImA:v+VPR6/Hb7PoCXfxqySSKpRmA
TLSH
T120D3AE0BD41D0E93FAD91EB517F7E4DB1B24C0EA113E8B590167A24F260BD6C32F6A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amnlme32.exe

Path C:\Windows\SysWOW64\Amnlme32.exe
Size 128KB
SHA256 424cdb1436a5ce34e93cdebf3074c4710d4c32b2e1ae3cf2a0dc25899c7930c8
MD5 c7e4ba1d549ab145f7ed731502391a55
SHA1 a1a6d0ef45da1ef9e85532d8b8b2a7a9f7df1c80
SHA512 bc3e2983dbc795f72c5e839f0ce2e322b825dd6be0c8bf044a73017f7a2ae7902764f0951c9f68607bd7c454b42efc35160ff0cff341f5b3620b6f616d191b53
SSDEEP 3072:3tE1muv9rMleJgUQSjUxSlDrLXfzoeqarm9mTKpAImA:smuFQleJt1jUxSpXfxqySSKpRmA
TLSH
T133D39DAF9515AEE1DEF7D2F4620ACD83F619877D41B8F2E0110284F9114B89533BE9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amqhbe32.exe

Path C:\Windows\SysWOW64\Amqhbe32.exe
Size 128KB
SHA256 31ae5c2c3c88d597bb02ddc2232104493c521b1a47dfe8330807ed1027f11095
MD5 a5fc73c787960d5aa92cd39720d2c65e
SHA1 5500a4a0c6f518ada7cfb7ebb54c57aaee4f6047
SHA512 76abb64bf75eda49f9925cfe15107201456bc6826bfc42b390e426529aff63b5c836f97a7792e29d82c901dec4560250fa07a3e3868dad6121901981b71ba4f2
SSDEEP 3072:v/c6pVvAnzb2wQONkNOT1j/4tDC3DrLXfzoeqarm9mTKpAImA:vUW0v6CTXfxqySSKpRmA
TLSH
T118D3AF1A530E5FB2C8F214B1153FA787A27DC4D641A6C7BA5AE9811B000FD74B37A9E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aogbfi32.exe

Path C:\Windows\SysWOW64\Aogbfi32.exe
Size 128KB
SHA256 30a8b68cbb0ee35b97cdc03b54ad87ae1803e543aa45c7452ce4553331f09145
MD5 12cc5968de76c97331ad34490ab1aed7
SHA1 de0f401ea8b7e61e59772b9d02fbdc2bd0b42105
SHA512 ef86226c2dc076cb0cf4a8c7586fd578fb8b0ecf7993e6d230b0ae0ed1dde87d258bb503402643f582ffb45e927050cdb318fb0b05fa4f7e9c045381d6e769a7
SSDEEP 3072:9ifUziYQ8rtkQsqenhnM7Rox3DrLXfzoeqarm9mTKpAImA:9S0O8LohnMeTXfxqySSKpRmA
TLSH
T171D3BF2E97B09D95CBF61275214F9997A3289C5B72F4CC813524D01AA3FB94123FE4E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aoioli32.exe

Path C:\Windows\SysWOW64\Aoioli32.exe
Size 128KB
SHA256 3f73d81d86c3482b569121f33b18d05e5e2e46cfdeedd5db2b115aa05f6c5c3c
MD5 d8efca69f253d8f3669439efd4977036
SHA1 08d91bdfd84ffa30a8afe4e09e8de707681e5ac8
SHA512 87135fd803bb35c3a63d3633d5e2bf75468a56ff4150c58a9f17dcb0ef1074bd9c757df853fc0caf214910675f53aed43e364dd75e46256f438dc5b330257087
SSDEEP 3072:LhG6lFlaOG0EoW2nQaYk1QQhgN2DrLXfzoeqarm9mTKpAImA:LhGOBCZYuQuIXfxqySSKpRmA
TLSH
T146D39D8AF6005FA5FEFA2130560ED58A3268C11F9168D7F88311DFFC630AAD916F6752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aokkahlo.exe

Path C:\Windows\SysWOW64\Aokkahlo.exe
Size 128KB
SHA256 b1c0ed49d3d321d73d130abccb5e79265a87368ac5eb6e91f8d4d7e8ffcc6b2c
MD5 0f795ebae59fbb9de8bbf12a0404a645
SHA1 b07595ece3cec580bbdf4d3cdc754e5b1d683714
SHA512 63617f821f504ee9fe328d57faa87ccc93a6564138e8dd4d7a620558ef4e44cbf47899c1663d5800e541d58ba894795ea6dcb6dc939849f5f4d000506f24fa80
SSDEEP 3072:M9IKiPc64H7h8/VKDrLXfzoeqarm9mTKpAImA:0ITy76N0XfxqySSKpRmA
TLSH
T178D3AFDA5A393E72CAD923F2171F4EC63358AC10B17CC6A52672C19C113B97753A3BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aonhghjl.exe

Path C:\Windows\SysWOW64\Aonhghjl.exe
Size 128KB
SHA256 bf9bfe3f47982b3f56bab32947a9092bbdf2569e2777b7ac0e3ca7bc9beba119
MD5 767e7701673353104785245c0607ddd1
SHA1 b3b53f46b34d093f65d23c1803f00db733d619aa
SHA512 5ab222a477dbf217ec9879d2e5f1f8e05296380ca07904c54ecc30387e6cca8a64ec20545ce515ef0ee0eee19b07955f72e0cb5303c88ebae5952aca4fe0dc2b
SSDEEP 3072:fUSo6rFrp1cmyBw3xeH/5PLoe9tbxl9X0DrLXfzoeqarm9mTKpAImA:8So2kbBwMRPEe3Vl9+XfxqySSKpRmA
TLSH
T1C6D3AE1FF6B78F72DB970170163E96C26F2984A50D75E7A15204B01B02CBEB427BB592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aphnnafb.exe

Path C:\Windows\SysWOW64\Aphnnafb.exe
Size 128KB
SHA256 b6aa652cd53655789c42070c346953866e4db62af312c6547d7ee128a33edef3
MD5 d4b9465420a8fc20a6ce92bf30ffdf60
SHA1 46e245342efb94f62a32baebd0fd4b8b7f5b78b4
SHA512 26f9d0699e3dedb6e2f5742a09b267b4a91554f7e97b568df56a9f7e231b5e27fd9e77637f53b46b45dbef5a681ff07581965b830f0c5ded6f1422dca8ec0f10
SSDEEP 3072:lQkwHdSUBrlNF1k3Tm3DrLXfzoeqarm9mTKpAImA:lQkw9pBrlNzDTXfxqySSKpRmA
TLSH
T110D3CF5788644FA5C7FF06B02B0BD3C7A6A4D629B2ACCCA24738D014535B8DA61FF4B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apodoq32.exe

Path C:\Windows\SysWOW64\Apodoq32.exe
Size 128KB
SHA256 99845d8f73ae0c75cf555aeb13c5badc7501ad01230ce66e7b0c5cf4642fe0a8
MD5 ca39c0ac52899fc6c653a511edcb0658
SHA1 591b7c9cb08d4ef2b6dab68a71865ef1ae8d1dc6
SHA512 1bcd23e0e6a0a4840726a94aa0c44ac590a173cce97700100c1dca8f14ffd530cb3d63b679a559c09d174f8d8bcc3fdf7bdf87d58046bc9d2d73d0d4978266b5
SSDEEP 3072:ADI/pmhRSf9pQPXl5T/+m1WNM3jb2DrLXfzoeqarm9mTKpAImA:AupLVM3jbIXfxqySSKpRmA
TLSH
T19CD3BF4F92A65FA3C7D971751E4ED2FB323AC065D1A8CA8008BCF40D596F90DE379262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hockka32.dll

Path C:\Windows\SysWOW64\Hockka32.dll
Size 7KB
SHA256 82297608b4c0ff4ee48692e2023949351f2bd19caf0384d1dbd6bddcf978e844
MD5 345e3a6e8e00d86afe008f2ffd8b18e5
SHA1 c04d6e061389becce2afe949d688ad1a664595d3
SHA512 3a61bd5778b3fcecc3f94d9c38089b80d78e0edc61d1e59e6ab648b955c0368e492e216d0e10b335be4e02cb1b92bec5c04ff6d4f96e3bed295ec08b2fd60b83
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWXbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPtq3qX5S2hV
TLSH
T100E13593FA4041BFC09D057912FF29229B7D663426D96009BB809A210CDDBDFFF38545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qacameaj.exe

Path C:\Windows\SysWOW64\Qacameaj.exe
Size 128KB
SHA256 45f87edda0ea95bfc0e34abac58f23e89f59e9cd2a3302817a3f06a143d92dce
MD5 8b6cff978b704e29c1ddf8141215aee7
SHA1 99bfd100674dfffaf40ec2d45597f9e815f64fa4
SHA512 77a79ce7cb96eef1f5a91734ff4dc9f51cbd8d51bc241ca4faadbf09f4e818c826ed2dddfcf59c6ae5b37f2ba370bf41088485a9064ba6d2e19eeadbe373c6db
SSDEEP 3072:kSQfVScIoHwv/6+wVo0DrLXfzoeqarm9mTKpAImA:kSiVScIoHwv/65o+XfxqySSKpRmA
TLSH
T1C3D3BF9BC5438F75CAF7207A37C792837E79A5A1212AA2913404806C63CEB7573BE7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qaqegecm.exe

Path C:\Windows\SysWOW64\Qaqegecm.exe
Size 128KB
SHA256 d6934cc37342152ea8e6e62fdae89000009a323df4ebf2dc9f44bcdfa561a6c3
MD5 051d9753eceec037753fcf18015326f9
SHA1 430e8389aa94a8289208d6dd9ab5cb604d590559
SHA512 bbe6abc9cf0fc5865ef6abd4ea539b97b6dbb022e55e15f9a706100ed912e8d04aaecb96aea54dc1b4a8cdc08090e3e946713057545404b2d5acf74ad19dc24e
SSDEEP 3072:9LGSg7SFn7+BwicPm880DrLXfzoeqarm9mTKpAImA:dpbFKBwicu88+XfxqySSKpRmA
TLSH
T16DD3AE4AE3124F7ACBF211F2291F538B6F6CF0577279CA520174E00C225BDA69EB6761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qfkqjmdg.exe

Path C:\Windows\SysWOW64\Qfkqjmdg.exe
Size 128KB
SHA256 3f7343714134580c914f58997f0f65240404c4b92b4ef8ecf95ff281109ba486
MD5 e979d57a8c537f83d160ef2cf79308a9
SHA1 8f76c6dec448336f5f384cfa1cb0e980a49abfe6
SHA512 eb883006e16700e22a155081a2468977a14ec3e33124620ad767b171e23f59ef00cb91a397540f9e0f42877b9b6973a113d672ba7f5dc1b02f0725e0f31fd04d
SSDEEP 3072:zBQ+/GZ7neDDI9PXp/L8sJ8bDrLXfzoeqarm9mTKpAImA:i++Z7ne/oz8s8vXfxqySSKpRmA
TLSH
T165D3AF1E961C5E63CFC533B5D71A8A972B15C1F2CDA8A16122A3D31C0E3AD580BBDE53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qhjmdp32.exe

Path C:\Windows\SysWOW64\Qhjmdp32.exe
Size 128KB
SHA256 298b869f251f58698e7f81b276131b3ab7cd77e7fa440931514ba43ced7adf8e
MD5 4941124a73f8046018a76170d33a66f4
SHA1 a20b38b9d9065667edcff4e25493db14cf1fce02
SHA512 4ea5f97f0a636a8557fc8cfe11fda55b98a02b4b85cb7b301fb4ac635c4b095aa8217cec2532b2c00a8918f3ff18e761ff1d131c5217bbbf24c9ae93ee45fb75
SSDEEP 3072:P39AbqyumFO2z8lHa5QrI7tJ/Ksz09mDrLXfzoeqarm9mTKpAImA:P39AbqXwO/6qM7Fza4XfxqySSKpRmA
TLSH
T1B5D3AE5B92245EA6C5C63EB2121B83CB3219E57B92BDC9D5A260C30F040BB6DC7FE951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qmgelf32.exe

Path C:\Windows\SysWOW64\Qmgelf32.exe
Size 128KB
SHA256 2dc973d563392dea249c2a522b44e55c9b2d41707e7c98c66ea3cd66dabe38eb
MD5 532b1b5260fcc779234eecbebb8e3fe3
SHA1 02516a9fead5423758b7805cc47e7e28c19b146a
SHA512 d0521c270f1e36db1eb2f21f567b36ae7777e3a66768e7692d59d826fd806063afe7c1026ae703d0d709251f489b069d9d267d82e4add7dc7fe84326d9306f72
SSDEEP 3072:ZbxhrAnf6sBYqkkza4IKGyskfn7QJZd20cDrLXfzoeqarm9mTKpAImA:Z/rCHBYgzamyHWXfxqySSKpRmA
TLSH
T11FD3AF0A9311DDF7C6FB0EB02607ED8ABB98A2DD0359C7E41B24950C06CEC5D3AB569C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qpeahb32.exe

Path C:\Windows\SysWOW64\Qpeahb32.exe
Size 128KB
SHA256 982e60950bdf33bbc4d68eb53620dffdd089ee5d8f3b4eb2643ecc435e983176
MD5 d48d57697347bcee7c4b6a0ec0170020
SHA1 73b45ca8a64d31d471ebce943a93b6eb119c35a2
SHA512 6b70ec78eb861f275a778b1f36c7d2802172cfc12609f12d07e7556ebed76bf2ed528ee98e9b513ff3298f7538e08555df6486eff12c0e0c8eea3be31ad49cf4
SSDEEP 3072:SociEx7R3MOwelOZDrLXfzoeqarm9mTKpAImA:SocHFXE1XfxqySSKpRmA
TLSH
T1C6D38C3AD2391E72F6F605775A4BCA8F7B1CA46DB370C4F11CE8D04A810B9992377982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-188-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/548-236-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/592-386-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/676-404-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/856-607-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/860-583-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/948-416-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1036-356-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1144-363-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1156-530-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1220-518-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1288-380-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1316-23-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1316-569-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1412-570-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1536-132-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1540-164-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1572-302-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1600-260-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1952-392-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1984-500-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2248-60-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2292-212-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2296-452-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2308-595-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2412-100-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2500-140-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2584-589-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2872-506-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3068-422-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3096-464-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3300-92-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3312-542-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3592-172-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3684-76-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3728-512-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3784-446-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3792-368-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3832-332-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3876-272-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3880-124-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4052-601-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4092-228-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4236-440-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4336-428-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4380-434-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4388-244-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4488-344-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4600-290-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4624-16-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4624-562-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4648-52-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4676-108-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4684-536-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4728-576-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4808-196-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4812-116-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4868-266-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4900-148-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4908-555-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4908-7-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4980-476-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5036-374-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5056-549-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5104-398-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5108-314-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5128-84-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5172-278-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5188-524-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5204-582-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5204-40-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5220-613-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5236-204-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5316-284-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5340-308-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5364-338-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5416-68-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5420-482-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5424-556-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5500-326-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5536-410-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5592-470-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5612-320-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5764-156-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5792-296-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5856-39-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5888-494-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5900-350-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5944-488-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5996-252-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/6076-563-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/6084-180-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/6100-458-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/6108-548-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/6108-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/6128-220-0x0000000000400000-0x0000000000441000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads