berbew | 2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
Size 96KB
Sample260910-nb2b2sv1et
SHA256 2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6
MD5 f7a455d5d5b97827949b89364ec959eb
SHA1 6677f4a3533f02f2fe24133fea625fefa2728e38
SHA512 1e458490defa2128b8da9142551258c4617405b8dc5e64a30e7df24905295006c08996d2b1828dfe628e36665e286d2b9991e34929da3426d362833f474b6ff7
SSDEEP 1536:lIFw5itAh+DzuOaT052Lk1hVPXuhiTMuZXGTIVefVDkryyAyqX:2FwIDaYyahVPXuhuXGQmVDeCyqX
TLSH
T17FA38D5F66684F31F6CB3238026F14C1F2D961680767C9692126E07D9F33AD5937E788
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pimfpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oikjkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pimfpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcgdhkem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oikjkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbjddh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjcikejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocihgnam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oihmedma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqbala32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbcncibp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Padnaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfagighf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjlcjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmmlla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Padnaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbjddh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqklkbbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjlcjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmmlla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfccogfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcgdhkem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocihgnam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppnenlka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqklkbbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfepdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmphaaln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppnenlka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfojdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcegclgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pciqnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmphaaln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojhiogdd.exe

Executes dropped EXE 33 IoCs

pid	Process
2416	Oqklkbbi.exe
1516	Ocihgnam.exe
4976	Oophlo32.exe
2948	Oihmedma.exe
4204	Oflmnh32.exe
4280	Ojhiogdd.exe
3424	Oikjkc32.exe
4552	Pqbala32.exe
636	Ppdbgncl.exe
2344	Pbcncibp.exe
548	Pfojdh32.exe
3808	Pimfpc32.exe
3208	Padnaq32.exe
4852	Ppgomnai.exe
1676	Pfagighf.exe
4940	Pjlcjf32.exe
3656	Pmkofa32.exe
4212	Pafkgphl.exe
2988	Pcegclgp.exe
632	Pfccogfc.exe
560	Pjoppf32.exe
4216	Pmmlla32.exe
4684	Paihlpfi.exe
3856	Pcgdhkem.exe
1232	Pbjddh32.exe
3404	Pfepdg32.exe
3432	Pidlqb32.exe
1552	Pmphaaln.exe
2800	Ppnenlka.exe
4264	Pciqnk32.exe
2868	Pblajhje.exe
2404	Pjcikejg.exe
4192	Pififb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gbhibfek.dll	Pfepdg32.exe
File created	C:\Windows\SysWOW64\Mpiedk32.dll	Pciqnk32.exe
File created	C:\Windows\SysWOW64\Oqklkbbi.exe	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
File created	C:\Windows\SysWOW64\Oophlo32.exe	Ocihgnam.exe
File opened for modification	C:\Windows\SysWOW64\Oihmedma.exe	Oophlo32.exe
File created	C:\Windows\SysWOW64\Oikjkc32.exe	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Nhoped32.dll	Padnaq32.exe
File created	C:\Windows\SysWOW64\Pjlcjf32.exe	Pfagighf.exe
File opened for modification	C:\Windows\SysWOW64\Pidlqb32.exe	Pfepdg32.exe
File created	C:\Windows\SysWOW64\Pimfpc32.exe	Pfojdh32.exe
File opened for modification	C:\Windows\SysWOW64\Pafkgphl.exe	Pmkofa32.exe
File opened for modification	C:\Windows\SysWOW64\Pjoppf32.exe	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Pidlqb32.exe	Pfepdg32.exe
File opened for modification	C:\Windows\SysWOW64\Oikjkc32.exe	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Bmgjnl32.dll	Ppdbgncl.exe
File opened for modification	C:\Windows\SysWOW64\Pmkofa32.exe	Pjlcjf32.exe
File created	C:\Windows\SysWOW64\Mpagaf32.dll	Pmmlla32.exe
File created	C:\Windows\SysWOW64\Pfepdg32.exe	Pbjddh32.exe
File created	C:\Windows\SysWOW64\Ppgomnai.exe	Padnaq32.exe
File created	C:\Windows\SysWOW64\Pfagighf.exe	Ppgomnai.exe
File created	C:\Windows\SysWOW64\Cohddjgl.dll	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Gcilohid.dll	Ppnenlka.exe
File created	C:\Windows\SysWOW64\Aeodmbol.dll	Pblajhje.exe
File created	C:\Windows\SysWOW64\Hpoejj32.dll	Oophlo32.exe
File created	C:\Windows\SysWOW64\Pqbala32.exe	Oikjkc32.exe
File opened for modification	C:\Windows\SysWOW64\Pbcncibp.exe	Ppdbgncl.exe
File created	C:\Windows\SysWOW64\Pjcikejg.exe	Pblajhje.exe
File opened for modification	C:\Windows\SysWOW64\Pjcikejg.exe	Pblajhje.exe
File created	C:\Windows\SysWOW64\Oflmnh32.exe	Oihmedma.exe
File created	C:\Windows\SysWOW64\Fllhjc32.dll	Oflmnh32.exe
File created	C:\Windows\SysWOW64\Kpqgeihg.dll	Pfagighf.exe
File created	C:\Windows\SysWOW64\Pcegclgp.exe	Pafkgphl.exe
File opened for modification	C:\Windows\SysWOW64\Pbjddh32.exe	Pcgdhkem.exe
File created	C:\Windows\SysWOW64\Pmphaaln.exe	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Mlmadjhb.dll	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Nnndji32.dll	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
File created	C:\Windows\SysWOW64\Ojhiogdd.exe	Oflmnh32.exe
File created	C:\Windows\SysWOW64\Pmkofa32.exe	Pjlcjf32.exe
File created	C:\Windows\SysWOW64\Fknofqcc.dll	Pmkofa32.exe
File opened for modification	C:\Windows\SysWOW64\Pmmlla32.exe	Pjoppf32.exe
File opened for modification	C:\Windows\SysWOW64\Pcgdhkem.exe	Paihlpfi.exe
File created	C:\Windows\SysWOW64\Nohjfifo.dll	Pbjddh32.exe
File opened for modification	C:\Windows\SysWOW64\Pblajhje.exe	Pciqnk32.exe
File created	C:\Windows\SysWOW64\Icbcjhfb.dll	Oihmedma.exe
File created	C:\Windows\SysWOW64\Pbcncibp.exe	Ppdbgncl.exe
File opened for modification	C:\Windows\SysWOW64\Padnaq32.exe	Pimfpc32.exe
File created	C:\Windows\SysWOW64\Pmmlla32.exe	Pjoppf32.exe
File opened for modification	C:\Windows\SysWOW64\Paihlpfi.exe	Pmmlla32.exe
File created	C:\Windows\SysWOW64\Pciqnk32.exe	Ppnenlka.exe
File opened for modification	C:\Windows\SysWOW64\Pififb32.exe	Pjcikejg.exe
File created	C:\Windows\SysWOW64\Lhnoigkk.dll	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Ppdbgncl.exe	Pqbala32.exe
File created	C:\Windows\SysWOW64\Chjjqebm.dll	Pcegclgp.exe
File created	C:\Windows\SysWOW64\Pencqe32.dll	Paihlpfi.exe
File created	C:\Windows\SysWOW64\Gaaklfpn.dll	Pjcikejg.exe
File opened for modification	C:\Windows\SysWOW64\Ocihgnam.exe	Oqklkbbi.exe
File created	C:\Windows\SysWOW64\Jjgkan32.dll	Pqbala32.exe
File created	C:\Windows\SysWOW64\Kjmgil32.dll	Pbcncibp.exe
File created	C:\Windows\SysWOW64\Pafkgphl.exe	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Pififb32.exe	Pjcikejg.exe
File created	C:\Windows\SysWOW64\Ocihgnam.exe	Oqklkbbi.exe
File opened for modification	C:\Windows\SysWOW64\Pfagighf.exe	Ppgomnai.exe
File created	C:\Windows\SysWOW64\Paihlpfi.exe	Pmmlla32.exe
File opened for modification	C:\Windows\SysWOW64\Pmphaaln.exe	Pidlqb32.exe

Program crash 1 IoCs

pid	pid_target	Process
4392	4192	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmphaaln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfojdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjoppf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oophlo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfagighf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmkofa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pciqnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pblajhje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pififb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcegclgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmmlla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbjddh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqklkbbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbala32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbcncibp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Padnaq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocihgnam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppdbgncl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgomnai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paihlpfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcgdhkem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfepdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pidlqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflmnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhiogdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oikjkc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pimfpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfccogfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oihmedma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjlcjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pafkgphl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppnenlka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcikejg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoejj32.dll"	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oikjkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmmlla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpagaf32.dll"	Pmmlla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmmlla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbjddh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqklkbbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lodabb32.dll"	Ocihgnam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpkdfd32.dll"	Oikjkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fknofqcc.dll"	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pencqe32.dll"	Paihlpfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocihgnam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcgdhkem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcilohid.dll"	Ppnenlka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pblajhje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqklkbbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpqgeihg.dll"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbjddh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhibfek.dll"	Pfepdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppnenlka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpiedk32.dll"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjcikejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fllhjc32.dll"	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oikjkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmgjnl32.dll"	Ppdbgncl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cohddjgl.dll"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icbcjhfb.dll"	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqbala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajgdm32.dll"	Pjlcjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pblajhje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhnoigkk.dll"	Ojhiogdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Padnaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmadjhb.dll"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjcikejg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojgljk32.dll"	Pimfpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Padnaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfgbakef.dll"	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nohjfifo.dll"	Pbjddh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnndji32.dll"	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhoped32.dll"	Padnaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfccogfc.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2416	4928	2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe	86
PID 2416 wrote to memory of 1516	2416	Oqklkbbi.exe	87
PID 1516 wrote to memory of 4976	1516	Ocihgnam.exe	88
PID 4976 wrote to memory of 2948	4976	Oophlo32.exe	89
PID 2948 wrote to memory of 4204	2948	Oihmedma.exe	90
PID 4204 wrote to memory of 4280	4204	Oflmnh32.exe	91
PID 4280 wrote to memory of 3424	4280	Ojhiogdd.exe	92
PID 3424 wrote to memory of 4552	3424	Oikjkc32.exe	93
PID 4552 wrote to memory of 636	4552	Pqbala32.exe	94
PID 636 wrote to memory of 2344	636	Ppdbgncl.exe	95
PID 2344 wrote to memory of 548	2344	Pbcncibp.exe	96
PID 548 wrote to memory of 3808	548	Pfojdh32.exe	97
PID 3808 wrote to memory of 3208	3808	Pimfpc32.exe	98
PID 3208 wrote to memory of 4852	3208	Padnaq32.exe	99
PID 4852 wrote to memory of 1676	4852	Ppgomnai.exe	100
PID 1676 wrote to memory of 4940	1676	Pfagighf.exe	101
PID 4940 wrote to memory of 3656	4940	Pjlcjf32.exe	102
PID 3656 wrote to memory of 4212	3656	Pmkofa32.exe	103
PID 4212 wrote to memory of 2988	4212	Pafkgphl.exe	104
PID 2988 wrote to memory of 632	2988	Pcegclgp.exe	105
PID 632 wrote to memory of 560	632	Pfccogfc.exe	106
PID 560 wrote to memory of 4216	560	Pjoppf32.exe	107
PID 4216 wrote to memory of 4684	4216	Pmmlla32.exe	108
PID 4684 wrote to memory of 3856	4684	Paihlpfi.exe	109
PID 3856 wrote to memory of 1232	3856	Pcgdhkem.exe	110
PID 1232 wrote to memory of 3404	1232	Pbjddh32.exe	111
PID 3404 wrote to memory of 3432	3404	Pfepdg32.exe	112
PID 3432 wrote to memory of 1552	3432	Pidlqb32.exe	113
PID 1552 wrote to memory of 2800	1552	Pmphaaln.exe	114
PID 2800 wrote to memory of 4264	2800	Ppnenlka.exe	115
PID 4264 wrote to memory of 2868	4264	Pciqnk32.exe	116
PID 2868 wrote to memory of 2404	2868	Pblajhje.exe	117
PID 2404 wrote to memory of 4192	2404	Pjcikejg.exe	118

C:\Users\Admin\AppData\Local\Temp\2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe
"C:\Users\Admin\AppData\Local\Temp\2bb8c2c0937e3ceccf8b2d4880607da188983489b32a82d10cf44392476da9d6.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\Oqklkbbi.exe
  C:\Windows\system32\Oqklkbbi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\Ocihgnam.exe
    C:\Windows\system32\Ocihgnam.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\SysWOW64\Oophlo32.exe
      C:\Windows\system32\Oophlo32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:632
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 400
        35⤵
        Program crash
        
        PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4192 -ip 4192
1⤵
PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ocihgnam.exe

Path C:\Windows\SysWOW64\Ocihgnam.exe
Size 96KB
SHA256 4aeb4b9ea4e4f5e326c312c318c0fa463d7acf02e46a2f5f13ff108b9d33520e
MD5 c20699aee01a5b157aa39cbadad5d728
SHA1 1891107779677bbb4688f4a1d9b1d4df1655625d
SHA512 d656d49345f4cf59d85f65332aedf9f7238c3ed6adda618bf77e4c76120d64b09ae6987ac14232e6a8b8e82d70b3e110f1f672f3916da8460b5252eb878d2224
SSDEEP 1536:NIqzxHxCDrFGjgQ4T+PWgf5NkSz92Lk1tPXuhiTMuZXGTIVefVDkryyAyqX:BzzCDrFBQ4T+OWjPSatPXuhuXGQmVDe0
TLSH
T158A36CB726620FE1C78D327D127F8FE9E71DB1A593278655F434800913ABAD840BAF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oflmnh32.exe

Path C:\Windows\SysWOW64\Oflmnh32.exe
Size 96KB
SHA256 6a69ce9a6373fff3058c5f5695a8c925a26746f5a3a99dfe967f39ddae616740
MD5 b3a35061a90b2d1d23f364570bd1a18a
SHA1 41ce3657ad80d0fba06bb822f7591c418303d583
SHA512 21eea06471e9f9acbdfbe385514f6f2ef16c96bfced45b50df2fecfb76f1ff6e314f8146d6eb9b895f1269907f1f1140dfa098ece2faa7c1344943000828e4eb
SSDEEP 1536:baTVJstfErkRHs385rmndWg6Q2Lk1IrPXuhiTMuZXGTIVefVDkryyAyqX:b6VWt8rU5rESacPXuhuXGQmVDeCyqX
TLSH
T166A37C0FF5F60F2ECA5A0275126E069AE63C409F5EEBCCA7235AD07D1E23B194179394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oihmedma.exe

Path C:\Windows\SysWOW64\Oihmedma.exe
Size 96KB
SHA256 7a78d98e423d8f00199a850954bd2677c6f634e3f5be381ffd49811c2f055b7a
MD5 dddbcb91277ab843f15fbaf6db386cf1
SHA1 6dc8789bc5758dc54fa4efaa9b68478f15fed0ed
SHA512 e7fc408077d304960c1d58ce182a8b802b79bdd2459bb2c83f408576d3cda4a773353055443b7d9f54aee40fc382141530a96315d5f5a4079d079eeab2e573ec
SSDEEP 1536:6OSqPbSEmiiWeSqYjZMkhfC3B33SSSzg52Lk1iPXuhiTMuZXGTIVefVDkryyAyqX:86SSk6aiPXuhuXGQmVDeCyqX
TLSH
T1CBA37ED722145FB2CA890376317F6693E769816963668BEC4124C0384B73A79F63FB4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oikjkc32.exe

Path C:\Windows\SysWOW64\Oikjkc32.exe
Size 96KB
SHA256 03a3ac29d104ccd8874ecded150f07f94dc112993eabcccd33f39b3192e04c5f
MD5 20c5f9fec14d1d5911f3787916d29f71
SHA1 0c386fb454ec88907762ef300d33176955e54d12
SHA512 654fb8036a5cf6e99863fb64ae84f2649c2a164221cb9b2d6a51a4df4489f6391d1a84db1cdf1c94b6671790481331bb44f900dd14fe6de266432e90439b3741
SSDEEP 1536:XgARVXIXRc9aJF+0eJmKkiHDDyn2Lk1QjPXuhiTMuZXGTIVefVDkryyAyqX:XRRRSRFJF+LJmKki5aiPXuhuXGQmVDe0
TLSH
T11CA37CEB267C1FA2C44402751CDE5585FF0A40EA537ACBA526E0CD4E13BFB989DB6384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojhiogdd.exe

Path C:\Windows\SysWOW64\Ojhiogdd.exe
Size 96KB
SHA256 219af51d56fb138c32b85c8416c618607397aae62cd91238ae7a46bec56d4f80
MD5 555bedeb2925dac262f37ca3067131b9
SHA1 240bf4902fbda0a20ba58fed3e34852a912a8be3
SHA512 3d111e19e4fd17275e5b3ac8c79499c799c2377f7d4e1e84e535cd619d431f956ce345c405bd9a8dde63cec6e1c58457ac4016fba3284daaee42f3b96ada4a96
SSDEEP 1536:hnWoN2svWwqUJQwJYutImq2Lk1hwPXuhiTMuZXGTIVefVDkryyAyqX:hWoBWW3YeIm3aGPXuhuXGQmVDeCyqX
TLSH
T1E2A38D4B7E619FB2C1BDF1F1119E9A93E68E409602A955E27018F58FE33263CC1BD784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oophlo32.exe

Path C:\Windows\SysWOW64\Oophlo32.exe
Size 96KB
SHA256 498963c8eea03adf4d9332c33f2f871d489abb12d78bf101cd7c8f79a3564253
MD5 2dc6172eb9a79c5441adff3e76eaae81
SHA1 7e12831c099cda4541d38a8a1388697487a3ec77
SHA512 33917ca10d74da6d5852604a086105ff3461de2d3830e0181e2fa49c9b8898d596f225544b3d97fbabe9b734c2cfb124fcf6969845795ac837c1c78fccf6766f
SSDEEP 1536:J3Yj2zkhu9yyyx6IQD4TwwuiFfPt/6UpVqBiIySa2Lk1SPXuhiTMuZXGTIVefVDf:JouH9K6YPRXlRaBiIySnaSPXuhuXGQmV
TLSH
T176A38C8A66F00F31C68E0135315BB7F2E26E60E983A7C681B826919B0737568CD7E757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oqklkbbi.exe

Path C:\Windows\SysWOW64\Oqklkbbi.exe
Size 96KB
SHA256 c006711aa09efdf18140e3f0d67693785cffd343ffbcc794541e47e732907683
MD5 ed12bf4c35e0006bc60d4e2ddb3450a3
SHA1 894689c93b18909c019f28ea486328d93212e344
SHA512 9e02896bb8fb0ba30595881e7066cdcfdbed8e93680a26ef4c6984854b5af4d637c89922cf3474db6a9c330c6e839274d7ac6387b2face437308552042f280c5
SSDEEP 1536:P+Vb/ZT0zBPD32AeLv0bTG2Lk14PXuhiTMuZXGTIVefVDkryyAyqX:2b/kBPD32AOOTra4PXuhuXGQmVDeCyqX
TLSH
T154A38D0BA6111F22C74E3338257B0596F2E904791EEAC3781094CD99D36FFE891AA7D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Padnaq32.exe

Path C:\Windows\SysWOW64\Padnaq32.exe
Size 96KB
SHA256 07fe38b8072d4e3f3863e9897ec29aa1fb5ad115180055f844d13e51fd84a9a9
MD5 ebde3741c34e9067e1b050c45a7ae1eb
SHA1 e1e3c612acf74d61763ff1a7b968d595e77e0ef9
SHA512 716c1669a086e8ef3258a726d8857d2b982f7cffb408fa9731479be32f729677a74d36ba8d61d2c26a634e40046c6ed0cc943da757f7dc0152f220443ad29aef
SSDEEP 1536:zKj9INLLvom4CEYVX2Lk1fPXuhiTMuZXGTIVefVDkryyAyqX:E9INZ8afPXuhuXGQmVDeCyqX
TLSH
T1F5A38C1FA166DF32C9A50D7B3C9A25C1A32D80EE113E99A86597CF0C2F6776C85BC710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pafkgphl.exe

Path C:\Windows\SysWOW64\Pafkgphl.exe
Size 96KB
SHA256 077fd294e08f99227702e2eb895a3ce02a11e3ba3a07a12b6c5d84c5ef45663d
MD5 7746bf9c468e84b683ec6fdb5dcfec92
SHA1 078ac4675bd67beac7bc0c543c7dffcdd5c04074
SHA512 1f1fdf19dfe44454b5b8f0365efe0124c406f0e401f32e3b78388df80343fff53d2621ac23e3e648cecee6bdb8ebc772feb97d3acd0401e760b63d0113db9e5e
SSDEEP 1536:QTZsmwh5ZQPcDUOd0w314U0wvFpx2Lk14PXuhiTMuZXGTIVefVDkryyAyqX:lT6PcDU0JRzKa4PXuhuXGQmVDeCyqX
TLSH
T119A37C6F75264F72C986123A30DB3DC2F378846812AA85C83568CF7D23E7659D0B9783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Paihlpfi.exe

Path C:\Windows\SysWOW64\Paihlpfi.exe
Size 96KB
SHA256 46ea87599540129414540c10d3e36b5a8ae6168031e216a20ba5442891a24b11
MD5 5d1974d2c8553a3671b3291ffabb1d2e
SHA1 97aacf5a6119e2b52f8843d08c780c9db5a1c6cd
SHA512 826aa5c4baf6f51081ded120da7cbe33af51a2a9ea74c0f4a8dd74faa41b229a5a0c374445b16cbf7cb511173bc8686bed0a5fe96d08e4529f6cdb0a7a955a60
SSDEEP 1536:OYvSg1iu9joKLzDvMhAVm782Lk19PXuhiTMuZXGTIVefVDkryyAyqX:x6g1n9coDSJa9PXuhuXGQmVDeCyqX
TLSH
T1F6A39E8B65600FA2CED402FB116A35CFF398C139522A96D1C61BCF4DA37396881B5B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pbcncibp.exe

Path C:\Windows\SysWOW64\Pbcncibp.exe
Size 96KB
SHA256 1c7822e1725317f2cfbb6eab7b4120e167fe2dca3c104f68bbfa95924b335226
MD5 6c706a3fedb88d2c4bcaa66bee8bd260
SHA1 e1c8fce52d73fe9f0370ea356be3c52a3913761c
SHA512 89fcee41d13c13728f029d525d6372fa7977cbfed7269d5f9e0e35d8df334199e27ebc96c691266491e69d0d3b72b4d894d4ea68b23199a1e4cf37f3ea790970
SSDEEP 1536:l3KlY3wb29Pm/eiyDQjMSRCP+kn908ziWn2Lk19PXuhiTMuZXGTIVefVDkryyAyW:tKygb29KeiyDQjbRO+m08ziWMa9PXuhZ
TLSH
T162A35A6B32751FB2F28ADE79272B39B3E3584165662EF9B03534810E17336688D3B744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pbjddh32.exe

Path C:\Windows\SysWOW64\Pbjddh32.exe
Size 96KB
SHA256 14573324727a73691ce8488a137e4af2e386177907f11bf51f6eb033a6f631ee
MD5 4aea8435eab4738f6d37df0f24327b8e
SHA1 975a651c6de4b206fe87824f68c0128161d787d4
SHA512 6b7a5e945735ed7c7fbdebfc1d001bc64a93915901908aa6301c437fe139301788efa8585153d5d519a9acb33954127af92834c5a766fb49e0d28a36d6bc9a59
SSDEEP 1536:m30BjmIcAJoB5eWmQ04Nvkq8fnLB9SBOggHE2Lk1fPXuhiTMuZXGTIVefVDkryy6:F7Q0okqAB9S0HdafPXuhuXGQmVDeCyqX
TLSH
T12EA37C1B67235F62EE8A33B5613F14D7F3AD71EC426A8A9F0564C1BF1323960807A748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pblajhje.exe

Path C:\Windows\SysWOW64\Pblajhje.exe
Size 96KB
SHA256 1b63a8d61a74c9c22199e09ef4c0ddc55e38162ebfed66a65b0ccf3d2d6fc001
MD5 fa6c59e241f90ac75d8571d701147192
SHA1 d8040048359efa1f6369bde91a14ad2f4439cbd2
SHA512 ea77fd73f92c28e9d5ffd44fb08eedd282f128640718854aab8918d5cdf42a0924823ca13849c92c2b3361b38d9a0d65113e52f532567127765b3c5490a67ed3
SSDEEP 1536:+uqYyj7ixm9PPWcbXS92OFC6VAar/R5HNx2Lk1tPXuhiTMuZXGTIVefVDkryyAyW:+ujG7ixqhba2yVAarp5H0atPXuhuXGQi
TLSH
T1EFA37D2BE9283FF1CE85D2B5205AD999B26B80D953ADCDD00715F008236BBB8C57F794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcegclgp.exe

Path C:\Windows\SysWOW64\Pcegclgp.exe
Size 96KB
SHA256 2512e6307d5955d2a64447c414cd9dbed183dfbae6ad9097e74c6dc7105279be
MD5 d95c37a15ea594d48e24b8692b28cf2c
SHA1 966a8b900d61a5e2a38636b6fbd54466b6c4be65
SHA512 f78d00c3487151b430389eebac414789de69fdf5a261b771323ba783779bbba1ea1f2046e7523b4afeb679f1069a29fbb9946889b168b3947014ce0e7e1a8185
SSDEEP 1536:ScPrn/pHpntSFv+XvUfaI2Lk12PXuhiTMuZXGTIVefVDkryyAyqX:SIRl4eWea2PXuhuXGQmVDeCyqX
TLSH
T178A36A5AA512FF72CF4403BA11EB1C90F71DB1AC167AC674171CC1AB0666EA7C1BB742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pcgdhkem.exe

Path C:\Windows\SysWOW64\Pcgdhkem.exe
Size 96KB
SHA256 5b9a88c19ea13fe0f1a00c724595841faab414bcd2f235fa0e4b73835733e90a
MD5 bd5c86f9bbbf2d82f330bdc594041cc4
SHA1 1f013adce0b0e27a4fe77c8147c181e9f0bd8af3
SHA512 d347ecdbb0c6db3ecbcf35688640040b4facbd8d4c3cdd22b6f83c21c3fb43ca07dd27b8e4e31ccf0c01c702caa98ecb2d50760c0e568e62d802c45622d424e1
SSDEEP 1536:5qsu7gZOzKbSsZkvCypXnwyfG2Lk1mQPXuhiTMuZXGTIVefVDkryyAyqX:5qNsZOUSsAp35fra5PXuhuXGQmVDeCyW
TLSH
T189A35B5E66656F72CAC502752426724EE3BB526E7327CEA42310C00C1E7FD6892FBB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pciqnk32.exe

Path C:\Windows\SysWOW64\Pciqnk32.exe
Size 96KB
SHA256 42b709f1aba12bf7f708f96e16522f350dfe47577cf8bb0319757b920e6e0eeb
MD5 4ca7f562493c54638fc82af14550b7b1
SHA1 6d3a1e4271b1c73d2f10e2e286fcc14023abeec7
SHA512 f557596f728def7a05efeb92be4665c01e1351ba0083045c496d1ae59566f13a7eafdb2aa9be39f30940977551194d7830f2fee5e6becd20bd7d80931bb0ea0c
SSDEEP 1536:OFEnAStWO5RUXxBFD8SoA62Lk1jPXuhiTMuZXGTIVefVDkryyAyqX:0En9tTRUVno4ajPXuhuXGQmVDeCyqX
TLSH
T19DA38D4F31261F6EC98502B7111B4A45F2DBC0BC9E3EC9D41AA4E07D23B39B986BD794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfagighf.exe

Path C:\Windows\SysWOW64\Pfagighf.exe
Size 96KB
SHA256 3c92fabb7c6f83ff1d8ca2c22a9100e4fa9e1513d470db9283ba7f139503adb7
MD5 b15128e60e11d0cabfa899f6c303576d
SHA1 02c5a1a3cf392148b2e83c440aff804c3f378859
SHA512 087ab2397367bd090083eae0c2115543439f9bb9b6e2e3df88a42dfda0d1a327a0addd64c2e9eef6ce845ba36e950d0538720aa7464dc6fe1a6f4f43a86edbe7
SSDEEP 1536:UmZkx+rptMflgcDlGLqJtq080KAGxrpd9vr2Lk1q2PXuhiTMuZXGTIVefVDkryy6:LKflgch5Jtq0S7YaRPXuhuXGQmVDeCyW
TLSH
T1A1A38C0BB23C1FB2C285D376115B799BE29C407F9EF9A9D4951B800E3323676883D765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfccogfc.exe

Path C:\Windows\SysWOW64\Pfccogfc.exe
Size 96KB
SHA256 0f6578c953558af7983ad2f0e178d35ee41e51f73a9e7a8d6277665606b37e4a
MD5 027b21a3d392faf94da1a80fae6b88c9
SHA1 b10dd80b48fcfb5a32474b8c26bf056a9f3270d8
SHA512 367d4c8d674cee68eca893fe2956e687914ef8074314cafe6fbfffb95edfaf65a60fa8e8c5eebcf8cbfec8cf32b925556d3e705665e862475ee732edbbac1d8d
SSDEEP 1536:WUr8vzor9tizXwKtjt7pjvf82Lk1APXuhiTMuZXGTIVefVDkryyAyqX:WUrGor9tizgKtjt5X1aAPXuhuXGQmVDf
TLSH
T1F2A36C5AAE740F12C94A03F6322BFDB5FB7880A95366D7F41927D04F4323A2883B9755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfepdg32.exe

Path C:\Windows\SysWOW64\Pfepdg32.exe
Size 96KB
SHA256 3845514ea7635f009150a9c3f0060ec16fd6862e6ae8cc118046ab17dce175eb
MD5 7cb36cfed8decbfd8e239d27060ef455
SHA1 60bc3019b48e1992fa3b72883ca79022921abf4d
SHA512 a334c65e2b39cb819c36ce6592ce4bf5e4027c0aaf9dcb5471dc9443cf8b1c79112f8fa6d80707d336cd435c27c57ee706a31c268f1fcfa929f0875d5777bb54
SSDEEP 1536:gZGE9loPCRW8vysalIIk8e8nvpr2Lk1xPXuhiTMuZXGTIVefVDkryyAyqX:g0E92HIINe8nvpIaxPXuhuXGQmVDeCyW
TLSH
T168A3AF1765795FB2DD8513BD1AAE069EF619C8E80376C6E1F428C09C1233A2583FE39D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfojdh32.exe

Path C:\Windows\SysWOW64\Pfojdh32.exe
Size 96KB
SHA256 052d0bd0b5d4371a6da38f403bb3b5d9a0c059ac7ce46aaa6c5b7935c4b6eea5
MD5 75c04e124a89b797a382acf283631781
SHA1 9fa67e9c543499b95063965144358b7b5aa1896f
SHA512 e3bc9c6179f4ca886b15621bf3b20cf7113b3f68eee652d206efaca949f94d72f6427c7b5d5903a7210192769afdbef245b8c37ac75e7333fc8132126c0b5c59
SSDEEP 1536:TiD1rTUb/f1fs0xU119NNHUA/KwKHv2Lk1MPXuhiTMuZXGTIVefVDkryyAyqX:mDlUb/+0x09N9UsZKH0aMPXuhuXGQmVT
TLSH
T173A37B67A6236F73D3853231376B06DCE66A81587F3999B5E428C33813FF6289239741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pidlqb32.exe

Path C:\Windows\SysWOW64\Pidlqb32.exe
Size 96KB
SHA256 51a589f25cdbd3d46f08812f1865a772bb9ec1be9800293e73e4625c7848922c
MD5 1aa6766004d35df39f2e584a6d11a4b3
SHA1 1154fb7cae6f975be04952e990492f6ba4f1bdf3
SHA512 cc99cfd93034197988770910df7428499fc7f60da3785072bcc0be5c8810a27dfab3e1fe30f24f7f09084fd4adb87f7eb661ca5a4bc17ffef188e7ec04129a94
SSDEEP 1536:Rnhimwe80UzgfJtRhji51vW+3Z42Lk1ZPXuhiTMuZXGTIVefVDkryyAyqX:Nx8fzgBtRhO5syZJaZPXuhuXGQmVDeCv
TLSH
T1B6A37D5B62577F62FD82017ED26E0BD6D21C80AB07E6C4ACB228C19E07735A6837B745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pimfpc32.exe

Path C:\Windows\SysWOW64\Pimfpc32.exe
Size 96KB
SHA256 b64b703263ab034f5709864a7cc1f3b2a76cce6c45de1c88e3dff219aeb557b0
MD5 124160091423a5684808c1d3f68a4917
SHA1 abffde464760ad00988e5dbb1610b8c5addc0382
SHA512 054cd20fef1e0833630e46fcee63f5cfedbf7f6f7d7e3e3607ce14002332f8733c7f9e801865712517cb6d06719f539fbd4e8fcf34c88120084a1bead2f37e2d
SSDEEP 1536:bs83ry/XeFup84aLnyI6XCtS2Lk19PXuhiTMuZXGTIVefVDkryyAyqX:A8b6Zp8HTva9PXuhuXGQmVDeCyqX
TLSH
T190A37B6B76B54F21DF45023510BBB9D3B3595EBAD66AE9E02310C01913238EC8EBD76C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjcikejg.exe

Path C:\Windows\SysWOW64\Pjcikejg.exe
Size 96KB
SHA256 ab68ce0f3caa0e9a823c09d3b146f7dc0968a74f9decc7e9483e8f6b9c7a10cb
MD5 d7e0ba003e3fcfbaabc10fefbe407635
SHA1 2cbabc01045a552c484de1c8c40d55db392e9f05
SHA512 ad6b6301d30c23e4a7d8394bb84a0585442e31ed98710ee1e6b403e6469a9ffb57ecef2bc7f99b1f30c58523eb54d39b0ffc2c4aa79b8aa906fcf4397d00f582
SSDEEP 1536:f0+HghLfOsiNF2TTWvHn3D2Lk1rPXuhiTMuZXGTIVefVDkryyAyqX:8zFbaF2vsH3garPXuhuXGQmVDeCyqX
TLSH
T17BA38D4B65273FE3F9C91F397CDE0645F229C5A5466EC1A53824C18D23B3B2581BAF88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjlcjf32.exe

Path C:\Windows\SysWOW64\Pjlcjf32.exe
Size 96KB
SHA256 31befe23f420f3309744aadb5f6d59b368b08d2d56dc25dbb3c5272b19d7991f
MD5 be48ac378095bc8287c17b8f0c98e1ce
SHA1 59747104f048345d0bf0f4086cfb6d0d8ea1dbfc
SHA512 85d425ca85f336df8656359d880be8bf54118906b31503645dfac3526869072e91325d7c637944cdbfc1cd0c6cb8f46fee77e9875eb78f2bc6b176d70a9082e1
SSDEEP 1536:Umf/cmsvinGNaNKga7GOxnU518ifHhjDg2Lk1atPXuhiTMuZXGTIVefVDkryyAyW:Umf/TAfaNKL64nU518GHhjNasPXuhuXs
TLSH
T110A37C8F7124DFE1F785037834B6659DB39999E93EF6C5A0256F8C8E0223C68863C746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjoppf32.exe

Path C:\Windows\SysWOW64\Pjoppf32.exe
Size 96KB
SHA256 dcd329ac3983cc1631dfc53e3f6b262da511b48f3dfe0d59c64cbd5449321f31
MD5 f5750a9ac0ec993cc0c3206a17f21833
SHA1 7e3e8ae7e2f757e61e83789d704b2ea17babe892
SHA512 240fdfe9e42580ac776094188611780ac4a4de899fd9893d04028551e39e1489e8a498ed8b659f83723c8d7f478eb63810651202ccdeac64795c3389fcfe993d
SSDEEP 1536:1EXc5jqZtdehbjTzev2EfWZaP1D+M2Lk1rPXuhiTMuZXGTIVefVDkryyAyqX:2c1qZtde9jT25lD+FarPXuhuXGQmVDe0
TLSH
T1AFA39D2B77AD2F61EE850235112BC58BF2DC60E41367CA612A65CC7B03B379AB13539D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmkofa32.exe

Path C:\Windows\SysWOW64\Pmkofa32.exe
Size 96KB
SHA256 f1ece74a77fc9b4b6c35f1887516e515c2e70e7a6a700e5e2fe161908857e443
MD5 776969cb828c06b3a0357ec2815bb2c0
SHA1 e354deefdc85be780adae29e1a7a8745f8f3342a
SHA512 034ba15ddfebeb044ed501109ce6b176acf19c3a815da6b81c7444006ddcc5f3985db3d054baf1aa18e9bfc2a414982846368426733436e837ec5bceded2fb21
SSDEEP 1536:Bd6/9PzT/eaMxGHZL0jPjIVcYUn75lU2Lk1uPXuhiTMuZXGTIVefVDkryyAyqX:Hm9P/eaMxG5LuLIVEtauPXuhuXGQmVDf
TLSH
T107A37D5F61141FF2D5CA02FE156BC895E6EF44B93F6B80862168C81D23A3AE4D27E7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmmlla32.exe

Path C:\Windows\SysWOW64\Pmmlla32.exe
Size 96KB
SHA256 04ce3a72f04ae2aa294f9c39988eb89d792ed45349d2d09f34faeeb507e83a32
MD5 b586172b35be803e88767152fcd31416
SHA1 dfc4cd7d77dab866a051e3145dcc9e231a734d1a
SHA512 623e3a12899335e282e961ecca8d763f6786a6da3b55b6211518e373178ac84fca0d19db12922fc46689919cc1698d0ca57b69440d7b790faa418c38e824ac83
SSDEEP 1536:sf9tzsKI3ENmzMowH2Lk1CPXuhiTMuZXGTIVefVDkryyAyqX:eZsKIEmzMrsaCPXuhuXGQmVDeCyqX
TLSH
T1F3A39E5E67A30FF3DD4903B8201BD6FAAE1881E70766C6980464D14F3F7356B927A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pmphaaln.exe

Path C:\Windows\SysWOW64\Pmphaaln.exe
Size 96KB
SHA256 a42cebafd1851bf1ee463710951c0c59b2cf53618f801c1da740823af0b7c7ea
MD5 1a41d84969facb4fdfbb48e96d3c1cb3
SHA1 8f3b624185cb841dc2571b26bb3d18016951fd92
SHA512 b5553be4e46ba40e72e42b0d66636c8657c6ff9a5c95e62ff09cfafd950b774d41734a2d95a4c76f4d4362e14a75db6bc4c319a19c3b8a2917ffcacba20af922
SSDEEP 1536:gvBoLBpaUxRnboOzySYhwhdWnx80jIQu2Lk1rPXuhiTMuZXGTIVefVDkryyAyqX:gvq7aoq7SYhagnx80j/arPXuhuXGQmVT
TLSH
T1A7A3AD6B25651FA3DE860FB221EB04D1F7B9487E2333DD9528C4D04C8377A6892B97C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppdbgncl.exe

Path C:\Windows\SysWOW64\Ppdbgncl.exe
Size 96KB
SHA256 c472a8f0f91b9e38a0cdff8419cc8c545b5dcec9ddb53f3c6838070148b1a972
MD5 34a7c45c81e0c1a0f9033c4beb499c0f
SHA1 8ca2c85a30b693021815d23b83d5a08c8065feef
SHA512 c66d420cfcc1801b5ab379e661f9fab8cf1d291cf0e13de6b931c0154b8bac5166b9a96e71841c53f9a563fb3f4bf389ecb9f0ec3ac82e609f95e939456d8ad9
SSDEEP 1536:Kxpaj99OzlOCfBdv4D25XS2Lk1tPXuhiTMuZXGTIVefVDkryyAyqX:1uOGbK29atPXuhuXGQmVDeCyqX
TLSH
T1A4A37B1FB5751F22C68D02F920BA57D2F3698AFCC3269695184CC05D07F3AA8CE7A790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppgomnai.exe

Path C:\Windows\SysWOW64\Ppgomnai.exe
Size 96KB
SHA256 2dbb468a58788d1dede51d9c7de62f3c00c45f10f2173c71daf8b5ca9f885ec0
MD5 e06cb4ca84b11320a008a4d26e9b0362
SHA1 d39f84f3ce6cbec3f687655a85c8202661ecc1e5
SHA512 7b9c6fa9fd7ecbb0060ffcd051a1447950913a8fad14ec790c187aa710b6883118cafcc7ee7f93bded9724a3e53fecd5d1eb6bd99cf6149bb8b6d5c71ad63fca
SSDEEP 1536:AqKxew76cFb2X/N5Jbc/n8Pl41lN9M2Lk1eYPXuhiTMuZXGTIVefVDkryyAyqX:AhB6cFb2X/N5Jc/n8P4lNvaLPXuhuXG9
TLSH
T1BDA36C1E7A711FE2CD7722BB2CDA09FFF625907D722AD8BC1568C24D32239988535352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppnenlka.exe

Path C:\Windows\SysWOW64\Ppnenlka.exe
Size 96KB
SHA256 ed0b10ece231cd5ce3dc5b6e20f7e299f2eda4b295a1771967a5fe6fd2dfe667
MD5 077d74b2c3f93b2943f16f2718d127ab
SHA1 6ad19371a03f99162de8d08f7b2d2197f0d4e969
SHA512 cd4d33e670910a3e25e3888561c4c9aa1d13a697503b7ea1735afa48c4374ba305c6bb0d893210f44b3e71a91069a6806efda0dcd0846d17ca1fb5c2adf99007
SSDEEP 1536:uyrG9TXSfk6MbyZu7TeyfQej7Eh2Lk1SPXuhiTMuZXGTIVefVDkryyAyqX:jCwfk6MbuOyCj7E6aSPXuhuXGQmVDeCv
TLSH
T11EA38D1FEB26DFE1D6C60276DF670982F75B90A53B6F81915568C00C0233AE7817EB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pqbala32.exe

Path C:\Windows\SysWOW64\Pqbala32.exe
Size 96KB
SHA256 1f883af5eeb9293380a97bcfbbac0609aaa4a6045ae1a44e6a4ecc88012da4a3
MD5 cb692724fb245eb2b06af5c4c389ee65
SHA1 f35db33105e41cd645318786658d9f9ed7572e29
SHA512 47a0f8fee3eeb30002094489516436582bcad407214e4fb895b0e6533cd530d1987e13ac56ee7b4efc5afa92c50f60526c1602068a327c5a7910ab1fdd8750e8
SSDEEP 1536:TZgn7h09etkQCp7SlCZ1WXtELbPoTIUiIASAhXBV3oiA2Lk1z4PXuhiTMuZXGTIY:TZt9etkQESluWXCwTIUiIAvFB1aUPXuD
TLSH
T181A37C9F7539CF72C58903799D6A0592FEA9E4E9832DDEB11D4CC05C1223A28D33AF64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-94-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/560-174-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/632-166-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/636-78-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1232-206-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1516-16-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1516-267-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1552-230-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1676-126-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2344-86-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2404-262-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2416-9-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2416-268-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2800-238-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2868-254-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2948-265-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2948-33-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2988-158-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3208-110-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3404-214-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3424-62-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3432-222-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3656-142-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3808-102-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3856-198-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4192-263-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4204-46-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4212-150-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4216-182-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4264-246-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4280-264-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4280-49-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4552-69-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4684-190-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4852-118-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4928-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4928-5-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/4928-269-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4940-134-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4976-266-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4976-24-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads