berbew | 6e23b7e13eb619bbf86ba0cacb7c9a97b257fe11aa0e2b76d6f999c22f2caf4c

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e23b7e13eb619bbf86ba0cacb7c9a97b257fe11aa0e2b76d6f999c22f2caf4c.exe
Size 89KB
Sample260908-j3gphavhnd
SHA256 6e23b7e13eb619bbf86ba0cacb7c9a97b257fe11aa0e2b76d6f999c22f2caf4c
MD5 8554cceb6da26f7d68d0a93d966bb3a5
SHA1 e9d356557dfa7c1735067489114fa89351a5452e
SHA512 334252723c4c3344023ee046949b83abd1c854890d8d58afd2721dc1094f3211f8db2de51bb4dbe7eed486510a326f0111dd811d4cbb8b537cb3733c3b9e2ac0
SSDEEP 1536:kkehKFJnRTAsBPSfYLGj/7pNZNeO73A56OcU4lExkg8F:LFNRT7BafYLGj4cU4lakgw
TLSH
T19D938C4CE8232FABCBC40FB010027EF7B67229EE4377C8155759A18A16575A472EFA53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfgklkoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nijqcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncpeaoih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocdnln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmphaaln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjidgkog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llnnmhfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljdkll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Loacdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqcejcha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjlcjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppikbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjggal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhoahh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhckcgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nhegig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqfbpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppikbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lojmcdgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcfbkpab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfihbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Piocecgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfepdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njljch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmjfodne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obnehj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofjqihnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pimfpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcfbkpab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nijqcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obgohklm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oonlfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfldgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfnamjhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nofefp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ooibkpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocgkan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oikjkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	6e23b7e13eb619bbf86ba0cacb7c9a97b257fe11aa0e2b76d6f999c22f2caf4c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcdeeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niojoeel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjoppf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcgdhkem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppnenlka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llnnmhfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljdkll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nofefp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcdeeq32.exe

Executes dropped EXE 64 IoCs

pid	Process
1812	Lojmcdgl.exe
2244	Laiipofp.exe
1236	Llnnmhfe.exe
3232	Lakfeodm.exe
3520	Lplfcf32.exe
2576	Ljdkll32.exe
2196	Loacdc32.exe
1580	Mjggal32.exe
728	Mcoljagj.exe
4324	Mjidgkog.exe
4552	Mcaipa32.exe
1968	Mhoahh32.exe
4644	Mcdeeq32.exe
1700	Mlljnf32.exe
4376	Mcfbkpab.exe
2068	Mfenglqf.exe
2424	Mhckcgpj.exe
1428	Mqjbddpl.exe
3352	Momcpa32.exe
1808	Nciopppp.exe
3096	Nfgklkoc.exe
736	Nhegig32.exe
740	Nmaciefp.exe
3540	Nqmojd32.exe
3256	Nckkfp32.exe
4960	Nbnlaldg.exe
4372	Nfihbk32.exe
3388	Nhhdnf32.exe
1012	Nmcpoedn.exe
2220	Nqoloc32.exe
4264	Ncmhko32.exe
3712	Nfldgk32.exe
2732	Nijqcf32.exe
3688	Nqaiecjd.exe
2144	Nodiqp32.exe
448	Ncpeaoih.exe
4416	Nfnamjhk.exe
1760	Njjmni32.exe
3708	Nimmifgo.exe
4284	Nqcejcha.exe
3208	Nofefp32.exe
2628	Nbebbk32.exe
1444	Nfqnbjfi.exe
1984	Njljch32.exe
4864	Niojoeel.exe
3904	Nmjfodne.exe
3532	Nqfbpb32.exe
2896	Ooibkpmi.exe
3084	Ocdnln32.exe
1148	Obgohklm.exe
4776	Ofckhj32.exe
4744	Oiagde32.exe
4900	Ommceclc.exe
3752	Oqhoeb32.exe
960	Ookoaokf.exe
2904	Ocgkan32.exe
3720	Ofegni32.exe
412	Oonlfo32.exe
4648	Oophlo32.exe
312	Obnehj32.exe
3348	Ofjqihnn.exe
1844	Ojemig32.exe
1852	Omdieb32.exe
1616	Oqoefand.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ommceclc.exe	Oiagde32.exe
File opened for modification	C:\Windows\SysWOW64\Ofjqihnn.exe	Obnehj32.exe
File opened for modification	C:\Windows\SysWOW64\Oikjkc32.exe	Oflmnh32.exe
File created	C:\Windows\SysWOW64\Ipdbmgdb.dll	Lplfcf32.exe
File created	C:\Windows\SysWOW64\Emkbpmep.dll	Nmjfodne.exe
File created	C:\Windows\SysWOW64\Ppnenlka.exe	Pmphaaln.exe
File created	C:\Windows\SysWOW64\Mhckcgpj.exe	Mfenglqf.exe
File opened for modification	C:\Windows\SysWOW64\Nckkfp32.exe	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Igkilc32.dll	Ncmhko32.exe
File opened for modification	C:\Windows\SysWOW64\Oqoefand.exe	Omdieb32.exe
File created	C:\Windows\SysWOW64\Kpqgeihg.dll	Pbekii32.exe
File opened for modification	C:\Windows\SysWOW64\Momcpa32.exe	Mqjbddpl.exe
File opened for modification	C:\Windows\SysWOW64\Pfojdh32.exe	Pbcncibp.exe
File created	C:\Windows\SysWOW64\Nhhdnf32.exe	Nfihbk32.exe
File created	C:\Windows\SysWOW64\Nlhego32.dll	Nqcejcha.exe
File created	C:\Windows\SysWOW64\Oflmnh32.exe	Obqanjdb.exe
File created	C:\Windows\SysWOW64\Bmgjnl32.dll	Ppdbgncl.exe
File created	C:\Windows\SysWOW64\Iheocj32.dll	Pjlcjf32.exe
File opened for modification	C:\Windows\SysWOW64\Pififb32.exe	Pfhmjf32.exe
File created	C:\Windows\SysWOW64\Nckkfp32.exe	Nqmojd32.exe
File opened for modification	C:\Windows\SysWOW64\Ocdnln32.exe	Ooibkpmi.exe
File created	C:\Windows\SysWOW64\Maenpfhk.dll	Ocgkan32.exe
File created	C:\Windows\SysWOW64\Pfigmnlg.dll	Nodiqp32.exe
File opened for modification	C:\Windows\SysWOW64\Nbebbk32.exe	Nofefp32.exe
File created	C:\Windows\SysWOW64\Pidlqb32.exe	Pfepdg32.exe
File opened for modification	C:\Windows\SysWOW64\Loacdc32.exe	Ljdkll32.exe
File created	C:\Windows\SysWOW64\Ogmeemdg.dll	Obgohklm.exe
File opened for modification	C:\Windows\SysWOW64\Oqhoeb32.exe	Ommceclc.exe
File created	C:\Windows\SysWOW64\Cknmplfo.dll	Ofegni32.exe
File opened for modification	C:\Windows\SysWOW64\Ppgomnai.exe	Pimfpc32.exe
File created	C:\Windows\SysWOW64\Piocecgj.exe	Pjlcjf32.exe
File created	C:\Windows\SysWOW64\Pencqe32.dll	Paihlpfi.exe
File opened for modification	C:\Windows\SysWOW64\Mhoahh32.exe	Mcaipa32.exe
File created	C:\Windows\SysWOW64\Mcdeeq32.exe	Mhoahh32.exe
File opened for modification	C:\Windows\SysWOW64\Mhckcgpj.exe	Mfenglqf.exe
File created	C:\Windows\SysWOW64\Ohfkgknc.dll	Mjggal32.exe
File created	C:\Windows\SysWOW64\Fpgkbmbm.dll	Nfqnbjfi.exe
File opened for modification	C:\Windows\SysWOW64\Pbekii32.exe	Ppgomnai.exe
File created	C:\Windows\SysWOW64\Llnnmhfe.exe	Laiipofp.exe
File created	C:\Windows\SysWOW64\Ljdkll32.exe	Lplfcf32.exe
File created	C:\Windows\SysWOW64\Momcpa32.exe	Mqjbddpl.exe
File created	C:\Windows\SysWOW64\Fknofqcc.dll	Piocecgj.exe
File created	C:\Windows\SysWOW64\Gbhibfek.dll	Pfepdg32.exe
File opened for modification	C:\Windows\SysWOW64\Lakfeodm.exe	Llnnmhfe.exe
File opened for modification	C:\Windows\SysWOW64\Ljdkll32.exe	Lplfcf32.exe
File created	C:\Windows\SysWOW64\Njljch32.exe	Nfqnbjfi.exe
File created	C:\Windows\SysWOW64\Jdockf32.dll	Ooibkpmi.exe
File created	C:\Windows\SysWOW64\Pqolaipg.dll	Ocdnln32.exe
File created	C:\Windows\SysWOW64\Pninea32.dll	Mcdeeq32.exe
File opened for modification	C:\Windows\SysWOW64\Nciopppp.exe	Momcpa32.exe
File created	C:\Windows\SysWOW64\Nqfbpb32.exe	Nmjfodne.exe
File opened for modification	C:\Windows\SysWOW64\Nfihbk32.exe	Nbnlaldg.exe
File opened for modification	C:\Windows\SysWOW64\Pidlqb32.exe	Pfepdg32.exe
File opened for modification	C:\Windows\SysWOW64\Mjggal32.exe	Loacdc32.exe
File created	C:\Windows\SysWOW64\Ghcfpl32.dll	Nfgklkoc.exe
File created	C:\Windows\SysWOW64\Pjphcf32.dll	Oiagde32.exe
File created	C:\Windows\SysWOW64\Oophlo32.exe	Oonlfo32.exe
File created	C:\Windows\SysWOW64\Ljgmjm32.dll	Opbean32.exe
File created	C:\Windows\SysWOW64\Icbcjhfb.dll	Obqanjdb.exe
File created	C:\Windows\SysWOW64\Nhoped32.dll	Pimfpc32.exe
File created	C:\Windows\SysWOW64\Pmphaaln.exe	Pidlqb32.exe
File opened for modification	C:\Windows\SysWOW64\Mcfbkpab.exe	Mlljnf32.exe
File opened for modification	C:\Windows\SysWOW64\Mfenglqf.exe	Mcfbkpab.exe
File opened for modification	C:\Windows\SysWOW64\Ncpeaoih.exe	Nodiqp32.exe

Program crash 1 IoCs

pid	pid_target	Process
2124	644	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcoljagj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcdeeq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqfbpb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obnehj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqoefand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppikbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laiipofp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlljnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Momcpa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppnenlka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqcejcha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pimfpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcaipa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqjbddpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbnlaldg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhhdnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opbean32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflmnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljdkll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjggal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ookoaokf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oikjkc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhoahh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjmni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofefp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofegni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omdieb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbcncibp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfojdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmaciefp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfldgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ommceclc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbhgoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcgdhkem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e23b7e13eb619bbf86ba0cacb7c9a97b257fe11aa0e2b76d6f999c22f2caf4c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llnnmhfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loacdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqmojd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nodiqp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdnln32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oonlfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pafkgphl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nckkfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lojmcdgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplfcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhegig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgkan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofjqihnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgomnai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmmlla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfenglqf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfgklkoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqoloc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Niojoeel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppdbgncl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfepdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfihbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmcpoedn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncmhko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nimmifgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhoeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbekii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjoppf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqaiecjd.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjidgkog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pencqe32.dll"	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbnpn32.dll"	Mhoahh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfgbakef.dll"	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjcakafa.dll"	Lakfeodm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcoljagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhibfek.dll"	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcfbkpab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pimfpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcgdhkem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfhmjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nckkfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocdnln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfigmnlg.dll"	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocdnln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icbcjhfb.dll"	Obqanjdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emlmcm32.dll"	Lojmcdgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llnnmhfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofljo32.dll"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpgkbmbm.dll"	Nfqnbjfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Obqanjdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqobhgmh.dll"	Momcpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nijqcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ildolk32.dll"	Nqaiecjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njljch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nmjfodne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcndmiqg.dll"	Loacdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdockf32.dll"	Ooibkpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phgibp32.dll"	Ookoaokf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqmojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnaqob32.dll"	Nfihbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nimmifgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbebbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lplfcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nhegig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nmaciefp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nfldgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njogfipp.dll"	Nbebbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nfqnbjfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbekii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igkilc32.dll"	Ncmhko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oiagde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ofjqihnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anlkecaj.dll"	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcdeeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojqhdcii.dll"	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Momcpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llgdkbfj.dll"	Nfldgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfhmjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mfenglqf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ooibkpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnkibcle.dll"	Pfojdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pidlqb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 1812	4148	6e23b7e13eb619bbf86ba0cacb7c9a97b257fe11aa0e2b76d6f999c22f2caf4c.exe	86
PID 1812 wrote to memory of 2244	1812	Lojmcdgl.exe	87
PID 2244 wrote to memory of 1236	2244	Laiipofp.exe	88
PID 1236 wrote to memory of 3232	1236	Llnnmhfe.exe	89
PID 3232 wrote to memory of 3520	3232	Lakfeodm.exe	90
PID 3520 wrote to memory of 2576	3520	Lplfcf32.exe	91
PID 2576 wrote to memory of 2196	2576	Ljdkll32.exe	92
PID 2196 wrote to memory of 1580	2196	Loacdc32.exe	93
PID 1580 wrote to memory of 728	1580	Mjggal32.exe	94
PID 728 wrote to memory of 4324	728	Mcoljagj.exe	95
PID 4324 wrote to memory of 4552	4324	Mjidgkog.exe	96
PID 4552 wrote to memory of 1968	4552	Mcaipa32.exe	97
PID 1968 wrote to memory of 4644	1968	Mhoahh32.exe	98
PID 4644 wrote to memory of 1700	4644	Mcdeeq32.exe	99
PID 1700 wrote to memory of 4376	1700	Mlljnf32.exe	100
PID 4376 wrote to memory of 2068	4376	Mcfbkpab.exe	101
PID 2068 wrote to memory of 2424	2068	Mfenglqf.exe	102
PID 2424 wrote to memory of 1428	2424	Mhckcgpj.exe	103
PID 1428 wrote to memory of 3352	1428	Mqjbddpl.exe	104
PID 3352 wrote to memory of 1808	3352	Momcpa32.exe	105
PID 1808 wrote to memory of 3096	1808	Nciopppp.exe	106
PID 3096 wrote to memory of 736	3096	Nfgklkoc.exe	107
PID 736 wrote to memory of 740	736	Nhegig32.exe	108
PID 740 wrote to memory of 3540	740	Nmaciefp.exe	109
PID 3540 wrote to memory of 3256	3540	Nqmojd32.exe	110
PID 3256 wrote to memory of 4960	3256	Nckkfp32.exe	111
PID 4960 wrote to memory of 4372	4960	Nbnlaldg.exe	112
PID 4372 wrote to memory of 3388	4372	Nfihbk32.exe	113
PID 3388 wrote to memory of 1012	3388	Nhhdnf32.exe	114
PID 1012 wrote to memory of 2220	1012	Nmcpoedn.exe	115
PID 2220 wrote to memory of 4264	2220	Nqoloc32.exe	116
PID 4264 wrote to memory of 3712	4264	Ncmhko32.exe	117
PID 3712 wrote to memory of 2732	3712	Nfldgk32.exe	118
PID 2732 wrote to memory of 3688	2732	Nijqcf32.exe	119
PID 3688 wrote to memory of 2144	3688	Nqaiecjd.exe	120
PID 2144 wrote to memory of 448	2144	Nodiqp32.exe	121
PID 448 wrote to memory of 4416	448	Ncpeaoih.exe	122
PID 4416 wrote to memory of 1760	4416	Nfnamjhk.exe	123
PID 1760 wrote to memory of 3708	1760	Njjmni32.exe	124
PID 3708 wrote to memory of 4284	3708	Nimmifgo.exe	125
PID 4284 wrote to memory of 3208	4284	Nqcejcha.exe	126
PID 3208 wrote to memory of 2628	3208	Nofefp32.exe	127
PID 2628 wrote to memory of 1444	2628	Nbebbk32.exe	128
PID 1444 wrote to memory of 1984	1444	Nfqnbjfi.exe	129
PID 1984 wrote to memory of 4864	1984	Njljch32.exe	130
PID 4864 wrote to memory of 3904	4864	Niojoeel.exe	131
PID 3904 wrote to memory of 3532	3904	Nmjfodne.exe	132
PID 3532 wrote to memory of 2896	3532	Nqfbpb32.exe	133
PID 2896 wrote to memory of 3084	2896	Ooibkpmi.exe	134
PID 3084 wrote to memory of 1148	3084	Ocdnln32.exe	135
PID 1148 wrote to memory of 4776	1148	Obgohklm.exe	136
PID 4776 wrote to memory of 4744	4776	Ofckhj32.exe	137
PID 4744 wrote to memory of 4900	4744	Oiagde32.exe	138
PID 4900 wrote to memory of 3752	4900	Ommceclc.exe	139
PID 3752 wrote to memory of 960	3752	Oqhoeb32.exe	140
PID 960 wrote to memory of 2904	960	Ookoaokf.exe	141
PID 2904 wrote to memory of 3720	2904	Ocgkan32.exe	142
PID 3720 wrote to memory of 412	3720	Ofegni32.exe	143
PID 412 wrote to memory of 4648	412	Oonlfo32.exe	144
PID 4648 wrote to memory of 312	4648	Oophlo32.exe	145
PID 312 wrote to memory of 3348	312	Obnehj32.exe	146
PID 3348 wrote to memory of 1844	3348	Ofjqihnn.exe	147
PID 1844 wrote to memory of 1852	1844	Ojemig32.exe	148
PID 1852 wrote to memory of 1616	1852	Omdieb32.exe	149

C:\Users\Admin\AppData\Local\Temp\6e23b7e13eb619bbf86ba0cacb7c9a97b257fe11aa0e2b76d6f999c22f2caf4c.exe
"C:\Users\Admin\AppData\Local\Temp\6e23b7e13eb619bbf86ba0cacb7c9a97b257fe11aa0e2b76d6f999c22f2caf4c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\Lojmcdgl.exe
  C:\Windows\system32\Lojmcdgl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\Laiipofp.exe
    C:\Windows\system32\Laiipofp.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\SysWOW64\Llnnmhfe.exe
      C:\Windows\system32\Llnnmhfe.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1236
    - - C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3232
      - C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:448
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3708
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:312
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:804
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        67⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1480
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4860
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:552
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:432
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3184
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:828
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:732
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4676
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4176
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1816
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2148
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1188
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1716
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4020
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        89⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        90⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        91⤵
        
        PID:644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 412
        92⤵
        Program crash
        
        PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 644 -ip 644
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hjcakafa.dll

Path C:\Windows\SysWOW64\Hjcakafa.dll
Size 7KB
SHA256 b1bc2b914ebd1237cea64faa75089691e89fc2def844cf97525444b08f0fc8cf
MD5 93d6c62e64ae9f897a5712927884d407
SHA1 47b76cd19f738206d04a7ff5568b1f6f642ae476
SHA512 3532b6ee3a5f50e52cf107d4dbc9fc546d012d79130435c648ced4eea39116ced98b8975da346b5a6d2aa3d077c81d62731ae07cd3aefd42ed1bb3a7090bad46
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWubABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbP4q3qX5S2hV
TLSH
T10BE11493FA4041BFC09D057912FF29229B7D663426D96009AB809A251C9DBDFFF38545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Laiipofp.exe

Path C:\Windows\SysWOW64\Laiipofp.exe
Size 89KB
SHA256 ee5a719fe0a6347bac3383d9e2a136dbed7066cf9445a13c496d16649c871bb9
MD5 1743cbb1a2723bfb0f5cfe7ba20fd564
SHA1 1acf256e6f92e5a457ea06e23362192f7d366c06
SHA512 53b3e7eb57902962e33202b33696ab1eb4a7a143fa7e67f6f01d9a2bdb56358ee1bd1ddff764a4d135b976c4879b3bf2cd339be0951f03d3a0001d72302d9d6a
SSDEEP 1536:/JZ+TzToGc9T/rBAHuBCNNh2XDVkWHiehcwlExkg8F:/uTo99TbBCNNAquiecwlakgw
TLSH
T1CD938D66A3442EB2FEC105381E085FBD663E3D3513E5C9CE3644998ED7CBA3E0567682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lakfeodm.exe

Path C:\Windows\SysWOW64\Lakfeodm.exe
Size 89KB
SHA256 c7aaa0463c71bc36ed9cab0f394331f5fa7706512770c02a57c4dc858b4f1165
MD5 a468588e2be945f16fc95306298e7265
SHA1 a9ed5e6ac466852763e5789b671e0916e867fca6
SHA512 772b965fdf25eb262d3b4c13772b078880f4c35018fa5f4fabac7dd6df663232d6ae6d0a82eedcaefed79e90919d20b04389bdbe856094b9b49726809153e262
SSDEEP 1536:h/pIKxN6QqgruVJzKoZAE1+UdbDp9+EkNn/k7/caglExkg8F:FpJTiLz/MCoMc/lakgw
TLSH
T136939E036ABC0FF2EE8CD17A68C7CA437A529525D2D1CDB27750812F1977B0886B9DB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljdkll32.exe

Path C:\Windows\SysWOW64\Ljdkll32.exe
Size 89KB
SHA256 5559541c6e498a895c2ca732cf1753cba8c14616fe76d86421ad4098bebccc9d
MD5 b27c46919d7bea79aa4fd460cfb69593
SHA1 c03c64fc60c422fc817b5fabff4e0dc460d115c9
SHA512 487a0551a67fa375707e33ca0a630ced926d0a41fcd8967bfc543820d3ca78b31dc44a33811c7cb0e95a2b1803e0ff253b212c638ee8dee70852fd46666dcc91
SSDEEP 1536:h6eXUi5KAB6yPt3IvzqcstBgs+V2oDQxrDoYcplExkg8F:MiU2B6eNSmm7sHcplakgw
TLSH
T15B937DD572502E92EF451734E63EC95CB2A14FB642A5F70B0D3087B422BFEDC85AE942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Llnnmhfe.exe

Path C:\Windows\SysWOW64\Llnnmhfe.exe
Size 89KB
SHA256 8ef7bbc25509a564f713f498bb26c8a3f72ccd3606e53ed65352e55fc5655869
MD5 e7e29c3319bfa82f567a795323cc695a
SHA1 d95a2fc5fc63cff47b5131a9c326a5d5b0ba82f9
SHA512 5eed56563531fdafc7b8906f1b1f56702c3b645775d16769789747f95a47cc9795c9c120786de52cd6852fa8cb01842b78207674a5abce7165e91ed7448a0b4e
SSDEEP 1536:rLsXmD6WmWBW4TzCgy4yiDQwanqI+5a8jkUJIvcylExkg8F:kXATmJ4pzQq35a0kUivcylakgw
TLSH
T157938C67F7947EE3DE6503710C63D7623A128C2DD3B4C2A25B9C886D73C363A459AE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loacdc32.exe

Path C:\Windows\SysWOW64\Loacdc32.exe
Size 89KB
SHA256 132a6d1ab83bfe1abaa2a87e9e58408309b439a182a303520e02a67be63f4ffb
MD5 4bce64c544530d3de6af0ed8bad6bb43
SHA1 dbd34403be9e5d468831a2195677bed0d14e3f1c
SHA512 e2647f2376eab40fd3e37d35bda5ad36d0323fc4d67ceb198502dabef2f06caef5a0e39e07ef57a5c3451b3a90137af7e9596bfa98fe370ec4c9ac90bd10fee1
SSDEEP 1536:wx7yKBvxLfvINp0XWbCjYEk0KCyZPjz+qYSz8Cf1RhGA02Nv4m05IQcUlExkg8F:wx7XvpoNIWbWYxCyZ7qq1V1Hj02NSeQ5
TLSH
T1C9938DCB82631FA2C7C7427624C3418F796E20BCC2B88627585957DC829EF9577F7A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lojmcdgl.exe

Path C:\Windows\SysWOW64\Lojmcdgl.exe
Size 89KB
SHA256 8e7a45eb8d86ed1075653d1ffdb555645e08ddee9b8e7f389ad6e5024c7f92eb
MD5 ebd9c1ee954dd9496e626b9a64e6d544
SHA1 f8bbb3a3074c9dcd0c157bd1bd8ea306691b080e
SHA512 289baa82b486dea6e27a055ee260997bdd87a051a58b23bc4fbc72345526ed4b962179050ee70480a364561f5bfb2d7519905b3c21c076303474ec0c23920c75
SSDEEP 1536:MW5c/GF2XC+WE8ucC6Kj3uOF6AcZm0Sy23BqYbsGwuLLcElExkg8F:4ucDW1ucC1j3uarP0cLTBcElakgw
TLSH
T16C93AFBA52841DC1FFD0123E705E5731610C2DA953B6C2E25AABD4EC3257E3983A6DBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lplfcf32.exe

Path C:\Windows\SysWOW64\Lplfcf32.exe
Size 89KB
SHA256 5dd6c6afd324441ca7e2e9263ac148d3b53b8fb03e665a6581331f0d9ae8fcc1
MD5 8ac0c067688f042016821e49553100aa
SHA1 212a81e007b01a037a09d252efd794b341adcb18
SHA512 6f0d176a32e91ee5d5910b89bc67b1b7ce6d641d5debc2c94365149c4e318ea2c2bfb451d88cc41583944a6951e815f8631fb6b5e6cb861d5282f56fe1b10bc3
SSDEEP 1536:AgwhQvNYx/jrafy0994tYqbfXTIpccj+7I9cnlExkg8F:AgwyvStjGy0Yhcj+7I9cnlakgw
TLSH
T119937D3FB6F57F72CDC204B21D026199A9C8C598539DCE238C45A72C576AB170A6FF90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcaipa32.exe

Path C:\Windows\SysWOW64\Mcaipa32.exe
Size 89KB
SHA256 09087d49cdf1e93275e208bf55f004bb2be8994b2ef77451f560f3c10b18e17a
MD5 0446cbd41477f992a0822f4b47b330eb
SHA1 2b1927e76fecf6aaf5b2af303999fb1f540570f9
SHA512 ed67cc5b8d18fd0e78575ac3f9fda17a9a8760b75c238254cfff930053a45ec30fd740158d96cd07db2ace820485934f3c963040f5a54aaec633df2427050cff
SSDEEP 1536:35PDew6xclCfyt9qYEhI6uAkl7c/M5PYo5znbwcAlhou3c59m69sBcJtlExkg8F:3Mw6xcYaqYgWPxAlho5mZBcnlakgw
TLSH
T104938D1693801FE1C5C90DBA2E3D61975D4E5F2D31BDC8A30A80CB6A312BF964B7E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcdeeq32.exe

Path C:\Windows\SysWOW64\Mcdeeq32.exe
Size 89KB
SHA256 94ce6a3c8bfb35d23fd61096c98ef4b60c313ebdcad1db122e3e2dc3408a69ed
MD5 93f0b964549e76e2bf70d320da5c7c39
SHA1 0eff5dd8f80d5a0bf58b88e31b0d3c8de5be67f7
SHA512 ed2b29a63f0514bf898b34e58132d7b10f9c03e6f946956c2fc6c099d3aecb33c62ead32c39877c1018e21879251f3953a01a8c1ea98f6371555c6f618e3c45d
SSDEEP 1536:Hqo2YP4C3xC7bmo0ym7yfocshX2f2VHFnT/OA62OxEKmzcWlExkg8F:/2pC3xCGorAybshXrHd/OA63xEKmzcWp
TLSH
T10C937CA2F2D40DD2EE9443724D6EEF537130613F419DE4827A8C54DA286292F83AFE5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcfbkpab.exe

Path C:\Windows\SysWOW64\Mcfbkpab.exe
Size 89KB
SHA256 0e94d85adf8bbc0cf369712fa9c8d469ef464a46debedaa523801e5a90b9276d
MD5 906a73792ab358da16e72d8989327019
SHA1 a021d9a27cab64e07f1d4497cab828fd2eed9559
SHA512 84e71e967aa62bf2e405a26b5cc69ef772ec7101bc32783d524d730830e699d5f593267f591b06d925347688c6a52d4ed4b758552dc7560d487629889ebc0fa4
SSDEEP 1536:Eo4CH5cSD/m3KNisADPJQGD2+/31xC/CXWvpfGcNTzNckzlExkg8F:iHiisAD4+TqCXWBecNTzNcIlakgw
TLSH
T1B9937D4FC1E00EA1DFC4F13406CA33A6E969450A8175D99DC7F66878363AF49C2FB989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcoljagj.exe

Path C:\Windows\SysWOW64\Mcoljagj.exe
Size 89KB
SHA256 ca0314a514e41f04a9e5e1ae11ad21933c15b6ac7a8b8ab9840914391e18b859
MD5 e3315d615d2bb4db3545bfa9cf0dd94b
SHA1 e5233c4af4604c1de4dd7772f8eb56aa9354e3ab
SHA512 723d86294786049df3cfa4ca76150bb54409f19405840e1cf9a6707632ac2a0acd12250f07618f121cb70b2a2c86e0a85caa48eb6cb283d23bc946845637fa5f
SSDEEP 1536:AzhO0m8MYzCEi7PuuW8DLV4zm68+d78/GZmzJNkiqviy4cilExkg8F:AdaPuSXWzmh+Y2g71Q54cilakgw
TLSH
T18D937D027B379EA3CBF400F115070AB6B9749E7671F88872AD5E4D49051E3E84BAF627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfenglqf.exe

Path C:\Windows\SysWOW64\Mfenglqf.exe
Size 89KB
SHA256 0eab052a6844b8c3e03909c75f2ccfd839949fcb4b2c7f35005e13238859b529
MD5 bc702733f4643c22bd5876bda353dded
SHA1 e5cb85a53eab21a68c5cad4ebaf89a1a5e78c082
SHA512 051ad40b83547371bd9694833c057e14312361fa60ad69346a98651ec56b42421fda0b6b663277d1bda6e178fac242f58b19d3a73b7e7deee9a9e3474f5f144b
SSDEEP 1536:ttG6dK/eOCfSIjTXmJFokTYXXJ8wZDPyyHdc4LEyc7lExkg8F:3G6dK5wSIfu+zJ8If9T5c7lakgw
TLSH
T1EE937C6690AF7FEDDFC30FF421455D48A27D2428C395CAB5345BB2C43A6A9C881AFE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mhckcgpj.exe

Path C:\Windows\SysWOW64\Mhckcgpj.exe
Size 89KB
SHA256 65d23d0f49c0ea8b594801d4f852b7dfce7af2a6dac75d5d3577194979523cbe
MD5 9a64027d5f4bbf4260187c4f128dfd5c
SHA1 d2799805d1340baa16f0e0afd82ff3b81582eece
SHA512 4a265cc58fac1badd979656ed862f52566fdeb6a7c76a3176c29b594fe6e987f3261bee886cce96c6458f26ce9952638e00b171bf244934b574d14dce8685b46
SSDEEP 1536:LQ3ydaUhTTROYT4pGDvA27R24hWLAoQdbOg+jNDicycLlExkg8F:c3YaKTROY2W7A7QdbP8N+/cLlakgw
TLSH
T1EA938DA9DFA41DE2EECFBEB497125A61F32460E6C29F847E14488C081347F36927E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mhoahh32.exe

Path C:\Windows\SysWOW64\Mhoahh32.exe
Size 89KB
SHA256 84da6e0395beeff8d3ee3b2bf2de95b38df8ae00d2080a733268445aaff39c79
MD5 e673116cfe6f2cf992f38bcd1e39c7c8
SHA1 d001a74b6a67aa9a514114680df2ddeed793f256
SHA512 eca3ad2479005fe17ecd40e31ee45bec5850a0d7d45687085bdfbfab7b8d27c66d8a139a95c402ba6857f6b7a9adce8852756b92f51ced66f2e85c244f26f4f6
SSDEEP 1536:W9PJkU22L/2peDk9Ywb3B4rmeDaN4rHrjvbcXlExkg8F:W9PJkoLepewmWN4DbcXlakgw
TLSH
T1B3937A23B582DDE2C68380F55617B3A6BF36CCBF9654C0256414841FCAF25089EF6EAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mjggal32.exe

Path C:\Windows\SysWOW64\Mjggal32.exe
Size 89KB
SHA256 e5ec1474cd11805954d921933d62d4e250591778873256dd1f44cd21e3263b76
MD5 451072ce41e1ccc84d69b5bcbce894a3
SHA1 21e92305594e32ab1e5bbaec3be1baf96c5ba637
SHA512 66a816024c6aafc035c846721a66cd1904ff42bc4d3c9b8b3f2b22737c5902ee4cd60ead34afa8e58ee7383bd951202b59f661f3ce83e18f47a8f0a6fa412567
SSDEEP 1536:V4ZTJlWnGJ1RjurC5u6T8BggUMqh0p9ZF5czIlExkg8F:IT681EG5utBhUMqhm9ZF5cklakgw
TLSH
T1BA936C2FF67E2D32E9C341B2720A3A0D33046C6B72ADC19A29E5D0CD1D167251B6B7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mjidgkog.exe

Path C:\Windows\SysWOW64\Mjidgkog.exe
Size 89KB
SHA256 e4e6a632b8dd2270b1c1bc9118851f619ca831243fda3db826c5762ebf1a779b
MD5 e237d8cfe1350992b90053bbce921633
SHA1 c2ec33efc31fbbd3f12fb04e6027b731e94491dd
SHA512 b2e47920e84ebc12a98379fcb87103b13d432ed14147876b48fedf085dfff06589fc6e221b6ee37e70eda9477b541a8c7126494ef5b2f6e4461f4992a98fa1ad
SSDEEP 1536:bSagWtdXhGve9o9N355FnLXFQihsUrg6/auaBUBPW3c/lExkg8F:I4dXIiwj3nLFFhssa61Cc/lakgw
TLSH
T149939DEBE172EF71DE8D0231341156BC345480ECE1EEC17ECA88DA0A671725E66EBD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mlljnf32.exe

Path C:\Windows\SysWOW64\Mlljnf32.exe
Size 89KB
SHA256 2abdb9e6350e4972dc79e9ff9cfa973624e2d7e7e1dfca4125be5a7d0e7bb269
MD5 42f13d68ede00c376c1d0979ff0a7cd1
SHA1 d13b50da3ad050d2cbbbf43674028e6da1b59cf3
SHA512 9191eb263df06f33baf3fbdeeb6af7f543a15b2aca1cf83595dc289403070c8894dad0146c550cb1493b26ed4e6491550fef933abcd4d89cad2460332b5463ab
SSDEEP 1536:qlwt0hmbIF8BjtZuX7CT+DQi2AoYIxxBXKRTgt8Mf/A8HcFilExkg8F:qet0hxIhZzLd93aZgt8mA+cglakgw
TLSH
T181936B5BE26C2FA0DFC602723A3F96E3EAEE552C31ECF376169444440743685BF96861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Momcpa32.exe

Path C:\Windows\SysWOW64\Momcpa32.exe
Size 89KB
SHA256 47a11e090a71bad8e12c45be966cd5549b4610382d19ef5fb9d23119164d302f
MD5 7f6e14301c74f33ae06d8ec64025354d
SHA1 5ede95f936bae17c9b61d2290b485a349693d8fc
SHA512 7696a71853ee33b24364aeaa660d3dc6f9bc826cd4ac0d358972722e5874b67aaa119922232daead948777c165cf5c21d9dea46797e55ee0f91e16a1c49de2b2
SSDEEP 1536:7IucX6XuFm7uQhAihaRKAA9SA7h3PG7lzmq6uzIYl3ZcSlExkg8F:7ozyAiIKAA9Tq6uzIYl3ZcSlakgw
TLSH
T103938DCE51D31F58DFA743BA1522D917BB04F2308AE548354E9743D51B8BE0B8A7EEA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mqjbddpl.exe

Path C:\Windows\SysWOW64\Mqjbddpl.exe
Size 89KB
SHA256 339f5dca8e04c4fd904663d4bcf2a68b9f42737220fa9aa36b27bd18b636b484
MD5 38a466113481f9ad79910035467c2c42
SHA1 88437cfa1b741b197b9990e80ec387e072ce5f4c
SHA512 de711e1cc27fa05d34f1bdab4362864321409c82895ae31e67ddead7a4d905e6ee2a9c84f87d2e56d6f22f9f45a7661dc1e572058ddb677d02f57c4e8930da95
SSDEEP 1536:zMbijy16Ur1syYln5/NhU4bCYHXz2ACPuuPM37vu6uV6lpcv9tD2h1LD8qOmU0i7:zlji6Ur1syYl5/3U4FJCWum7vu6uolpC
TLSH
T19A936AD594041EDECAA701F6DA39C17A702CB528D39CCD224A375BCF022BA5BD2BDB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nbnlaldg.exe

Path C:\Windows\SysWOW64\Nbnlaldg.exe
Size 89KB
SHA256 2dd161fc568dda713eef9374643aa47580d007e937047cfdf2a3af6e7f95c097
MD5 d13b4189c7ce80cb5cd7032d217ad85a
SHA1 f1fde8bc3ae540117fbdbb48e704316ebddd271c
SHA512 708895b2197ef3c1a1bffd1e5ce9fdd552b38eac6819ae4ac3c1f637080db81c180743c71a668e81289019ccfe064860089d7f72fb65550721367bf49c707795
SSDEEP 1536:joPNmrvmMEe0oD2H+Apv1b5Y4dURgRgJbjBoQ7y0jxqIFDebsdoleFCcqlExkg8F:jOOO1+D2H791b5Y42ROWvkIFD2GFCcqp
TLSH
T16C939E26E61B2DA1DB50EFFC5437F48466356073409AC8123D1FD24D5DABECB2EA2E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nciopppp.exe

Path C:\Windows\SysWOW64\Nciopppp.exe
Size 89KB
SHA256 bb2b1790ae88c6d473b8e31a235387e4341f70312f4fbe57d3491b191d313175
MD5 7a03a8dd6fceeae2890bb370a44fec13
SHA1 45415b2227d4ef6b322d9a5ac4b8d72f1d384045
SHA512 f4e8b1f731b9d68ecf8008bf04b9953e456922f9453cadfc326009545d16306afe29295389cb383443b64414482791ab369b5a4e2f37c18a1b27d77ff5e9547a
SSDEEP 1536:Z0hwQLsYXuzrRAZtqUoxH5ebSF++dTeup5eI/s4cIlExkg8F:Z0fYYXuzrRAZtoxH5eb+dTcJ4cIlakgw
TLSH
T19C938D4BE3582DF3DEA133F63512D1E9E223126252A9873254584D1BF01BF1A733EE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nckkfp32.exe

Path C:\Windows\SysWOW64\Nckkfp32.exe
Size 89KB
SHA256 555bc953ffd9a2d32598badbde8788fdf010749b17cef374bd5ea5c7b0d30119
MD5 2711ec4bc1a60787051e7d7326c57e35
SHA1 712ca181f60a6bf360feb3786a89362aa6db1673
SHA512 07c0c36965169214a5ded80cd92f23bf20ac5d171b4616ed68b066cfae8cf59908d68d249dbd23c3e558ef3e0757e831dc5d7fd8bdfad8167b183369c7c1d1a6
SSDEEP 1536:SHRd0GZTG0pW91Lu7qSfq+uzSUbB7lL+2Vg+lj5Vbda/gR9cVlExkg8F:SHX0GZTNpW95u7Jy+3UVBL+26+rxR9cf
TLSH
T1EF938E3766F12D61C5BD00B00E77AA9EABD43E7591BBC0A369A85004D54BBD4733BAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncmhko32.exe

Path C:\Windows\SysWOW64\Ncmhko32.exe
Size 89KB
SHA256 2d42d9198fd1bc57b9631ce3b21b13e799584ad46c325dac8f7018f985681aed
MD5 e3e92a953f36496a19e865a0b6fdcb5d
SHA1 f33adb491b187d72959bdeaebbf9b53bef02fae6
SHA512 626c26d969e18630ed81f0c1f7f58fd6869f365365f6a693aba8b98b69441e157b033bc77d9f70634f5ea16c1108c88ee94eb491184b10664fd4a538421be428
SSDEEP 1536:tY+b0acBxQpvugzJxOY2Rj+6fm3de3hGhRtJbM9+cqlExkg8F:tPb/cTSHzJcRjHm83o7ZM9+cqlakgw
TLSH
T1A1937C8E60582EE2FFCD01F85502F1B969A47764B3ECD57251B7409EF4CEAA0252E873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nfgklkoc.exe

Path C:\Windows\SysWOW64\Nfgklkoc.exe
Size 89KB
SHA256 dd8aeee3d30e7f3fb795c3d3d5b67dafef625e30aedb3884154ee39ac29ad5c4
MD5 5d82fb173da0ec94847211622aea4839
SHA1 94df0779795e305920fe1b4b986001ea7d9de788
SHA512 87bb9dda761277e4e50ce5853979c43cc3cc77f4f0dff9449ad286a5fbd553cf5064c48471bdb4eeca0c35189c05ec3510dd190fb2f27338df3e8d8f884d757b
SSDEEP 1536:/BTo9VmoyWG4BZLU1uaFd6PLIfBjeQLqQYmWGHT72g6RFcvlExkg8F:dobfGSLaFd6PLcjeoqQYUHTCxFcvlakh
TLSH
T148935B6A93592EA3F6C7013B6F026E96ABB59078C4ECC025D188F04862F37DE41E7D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nfihbk32.exe

Path C:\Windows\SysWOW64\Nfihbk32.exe
Size 89KB
SHA256 7a18f85b5f56e605702eff5df11fa452dc177be5f5185de868e154056b9c0736
MD5 075353c10aa4df6408ba934951bb23e3
SHA1 3cf3151f03e0e6b72fcddd3067711d9b39a3dcba
SHA512 c68130416fce419e8b9688754f26d26c76d20eb5faae9cd04a75ea8c7ea4bf095b8e147a911f88ac40847264f54a9ca5e7929a3cf43637d7984c0a7e9584ec6a
SSDEEP 1536:eHDuepe2pNXSlGPSdujExLFqQiMYbjwcmlExkg8F:eH1pfXSlGPzICVbjwcmlakgw
TLSH
T122938D4770A45FF6CBC45AFAB21695E3BB31722902BDCC43F42C425D52BB6219B3A4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nfldgk32.exe

Path C:\Windows\SysWOW64\Nfldgk32.exe
Size 89KB
SHA256 005b5982c8e7174509317fe150353f1426604c9e4cbc93b545d56b96ce73dbd6
MD5 9cc59c20a842b385b81e04b5c93e3014
SHA1 70a84d7c7e4aae06568654749a30effddd25bd47
SHA512 be07e45d24da613f3dd04b2db83879f85da83c88be1afbe082d6d179031de710d1005f36ee0121cc0a42d742992d1465544d5967685b4cdd4800166ea47a345b
SSDEEP 1536:g2vy3XoLwL/3INCh7/5zA1HQ0LPtLnHhjmcft5KhbCdAy5fcA2lExkg8F:g0y3XoLU/cCN/JYw07tLyeNxcjlakgw
TLSH
T1F0938D77D31A6FA3DB80047CB126A3C37F298765427E8791BC0C44793A9A60D5BBF521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nhegig32.exe

Path C:\Windows\SysWOW64\Nhegig32.exe
Size 89KB
SHA256 94ce970fe5c65f58f1530b2a53d278904d528c97620180fa83a578602b160c47
MD5 405f736045a56d1cab85b26a936c8842
SHA1 c4a9bdae91db5b121115d7f7368ec619bc462c58
SHA512 bc32e040eb8afc7c14481e0ac2d4f1fab104bbcb9c11e530f95ffa8e1a51f4b3e9d5f2594e71a0681d5ed0039dd8c8459386f2c987c03c5f9ef532d1af9fe714
SSDEEP 1536:/u75NriH94IpI4awuXJRx8xnFfvju/cCl/R3QhvQ9cWGlExkg8F:u5Nr6I4awujm1vju/cCjQhvOc7lakgw
TLSH
T11C938DCBD3215F93DDF880B625C1AFBE7A1E8115C1EC84B26F075068A277A7745BE980
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nhhdnf32.exe

Path C:\Windows\SysWOW64\Nhhdnf32.exe
Size 89KB
SHA256 b35226fb801ba254b2784a6c57a38fc8a9c615c97d0436de342579cde85745d3
MD5 4b7cd1e94e7f69da89e052b69d17cd56
SHA1 df924cfecff9e3d66e87ba96eac0443d6d40e339
SHA512 114e4d087f671efb8d0b1f5dfbaf69b25cf01663f86f382176fe500dc7fa3df0b6099e0d385b63ce81ba690c451c6e44915c9de8908665a765113c2d9abb43b0
SSDEEP 1536:lgOWAvI44mZ1dME+EVFl46YL+FyeRoPKJVudIVWK8cehpn6czlExkg8F:XWAvvXt4YFIIVWK8cehpn6czlakgw
TLSH
T1C1939D0EEA759E23DD440FB1D54374BAB918C13B4278E7770E079F6C845BE2812AA673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nmaciefp.exe

Path C:\Windows\SysWOW64\Nmaciefp.exe
Size 89KB
SHA256 7777424568156ca501bc1fd83c47b915452bc8889d726f6673657f36a52104b7
MD5 ebdae25ec63c4afe016c472dac8ea3dc
SHA1 e54a980dbf4aef1debeb2cdf5ab7b4c3aea33720
SHA512 2ba63f2c3cd89df2257696dd9fbb39ac2c431c7564c32b0f3301258a19dd0344e2b136b999ec6316108d500606c034130f535cb1309619e2da313b3aecd89fe6
SSDEEP 1536:SLE5ivsfLa4Bfkc4IFbvNnZW4e6uYOn+MeFcoTlExkg8F:SLE5ivsfe6kc4aZW4e6t/FcQlakgw
TLSH
T17393AF1EDBA54FD3DE24C6721E7B0A8DBAE6B1F9C1B484050028DCE81A67B273D7B541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nmcpoedn.exe

Path C:\Windows\SysWOW64\Nmcpoedn.exe
Size 89KB
SHA256 1d1c4478b2749aa9a55639ca24ec5dbbd6c661a97a005eafda21eb15700a0d86
MD5 59883948355427afdb7d3243daa1a686
SHA1 d5586258e073d4f570e9da70e430df9afca24218
SHA512 b4e267022e2c907965747b44b710117069b3f4c7f64a03eea44abb395f7a9622e6828809c30d2eb11dc29e9caaa2e11dc5c638294550c3540929953afdbe98e8
SSDEEP 1536:xcWLDo5asO4FO8YEcuvNZdeH2yztSd5A8hFSGlsSiMRLcDlExkg8F:xcs77WO8YEc02zcnA4siLcDlakgw
TLSH
T1BE937D27412F0FA1EEC001F22AC2ABDDF9C650E90369D5534DB9CF6D42A751ACABB741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nqmojd32.exe

Path C:\Windows\SysWOW64\Nqmojd32.exe
Size 89KB
SHA256 cb101f489023202b9605c0f200708c5e1736e98ca5ce7073d1aadd57575b28d3
MD5 3f34e4636e824ecf8f779c6276a9ec25
SHA1 48214cb53273bb1e9db7b377bd4e4be25535832e
SHA512 f81b80ad5faae4921651e48bc8a151e381f564fc90ee8feabe05cef879ace04b8ca65cc39c2b17947b9a8783c14cd2569cd5c6d80196be5df014ed5db3739c02
SSDEEP 1536:3c1s7oVIHkoGvUiWTdX+ksVSUCSbYPPIW6BI8KLlOYhcB7lExkg8F:3MskVIEowUDdXDznPgW6BEcNlakgw
TLSH
T18E938DCBB36C0E97CEC20EB42B81D9957507746B83EC91DD46A4B47E3A8E98C456EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nqoloc32.exe

Path C:\Windows\SysWOW64\Nqoloc32.exe
Size 89KB
SHA256 8237ed0c62414c30c1fa81359f14e4167e976fd856d16f5186a141a8a218c9b0
MD5 ad1d5038908cdd690ea8903cd7b5948e
SHA1 9a2c111057e0dd2302b124898ffe3932cac01b9f
SHA512 1c330b6803383963254fce5e70420e7e8864876ff13a17d65152a9270ae9c4138a455b78e41c8624a5922026057f235f64ed4624c9abee2e33c230f30ae2a629
SSDEEP 1536:BYIEhphhSq+Om5a2i0ICWuCFIVzOcflExkg8F:yI+p/Sq+OyoVCWuS+zOcflakgw
TLSH
T1EA938CFA62861EE2EFD309FC3526DC77F206B83413DD85A250E1105D606EE7C5E2BA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/312-454-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/412-452-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/432-494-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/448-382-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/552-476-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/644-604-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/728-74-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/728-609-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/732-512-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/736-273-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/740-274-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/804-463-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/828-507-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/960-450-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1012-281-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1148-445-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1188-572-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1236-24-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1372-536-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1428-162-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1444-387-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1480-464-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1580-67-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1616-462-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1684-584-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1700-605-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1700-112-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1716-578-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1760-468-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1808-272-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1812-8-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1816-548-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1844-456-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1852-459-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1968-607-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1968-95-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1984-389-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2068-160-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2084-542-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2136-488-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2144-381-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2148-560-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2196-56-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2220-285-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2244-20-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2424-466-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2516-602-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2576-52-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2628-386-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2732-379-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2896-442-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2904-451-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3084-443-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3096-467-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3184-500-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3208-385-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3232-32-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3252-482-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3256-277-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3348-455-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3352-271-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3388-280-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3472-530-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3520-39-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3532-439-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3540-276-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3688-380-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3708-469-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3712-378-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3720-470-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3752-449-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3904-436-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4020-590-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4148-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4168-567-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4176-524-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4264-377-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4284-384-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4324-79-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4324-608-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4372-279-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4376-125-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4416-383-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4552-92-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4644-606-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4644-103-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4648-453-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4676-518-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4692-596-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4744-447-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4776-446-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4860-471-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4864-435-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4900-448-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4960-278-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5044-554-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads