berbew | 5272bdb33057d60c5754ac87e94d2ef0f1b9e16b71c317c30370987e67a34c7a

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5272bdb33057d60c5754ac87e94d2ef0f1b9e16b71c317c30370987e67a34c7a.exe
Size 85KB
Sample260910-wvprcstdph
SHA256 5272bdb33057d60c5754ac87e94d2ef0f1b9e16b71c317c30370987e67a34c7a
MD5 076e5d2ecf2f04166069af68e7c2c7a0
SHA1 f0ed3c0fe342ce6d387769965eb9029dea567984
SHA512 80e95395c6535f7e990e8af26622bd41d698b0d4dd0e4af8f2204709a10d187afcfd6d1a84a5dfe45ad374e4d48f35a89ba9f7b3c0b069d3d6b8eb5e169e09c6
SSDEEP 1536:+G91KYzlWuWmD/1hmXKt3tYI2LHqMQ262AjCsQ2PCZZrqOlNfVSLUK+:+G91KuDbDdgYYZHqMQH2qC7ZQOlzSLUN
TLSH
T1AD836BCB77241F61CC480E75181A0A86F62690F9E77B81A4D47CC1AD2237E6C85BBB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Debnjgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aidomjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apngjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdlhgpag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbhbbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cehlcikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clijablo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddcogo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cepadh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbcbnlcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmimdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbhbbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cplckbmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cidgdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apkjddke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abjfqpji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aehbmk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcicjbal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhofnpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcnleb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbalaoda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmfqngcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bliajd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bimach32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdjlap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdjlap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmmgof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbjogmlf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cifdjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmahknh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpefaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfonnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfonnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmifkecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apkjddke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmagch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfjllnnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmddihfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbalaoda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbefln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpifeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cefoni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acbmjcgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cibkohef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dedkogqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abgjkpll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alpnde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpifeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cefoni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Defheg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlqpaafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apimodmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aehbmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfoegm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmimdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpnpqakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cepadh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afeban32.exe

Executes dropped EXE 64 IoCs

pid	Process
1856	Acbmjcgd.exe
1836	Apimodmh.exe
940	Abgjkpll.exe
4124	Afceko32.exe
1516	Aeffgkkp.exe
4012	Ammnhilb.exe
1540	Alpnde32.exe
4572	Apkjddke.exe
4896	Abjfqpji.exe
4672	Afeban32.exe
3680	Aehbmk32.exe
2068	Aidomjaf.exe
2164	Apngjd32.exe
1888	Bcicjbal.exe
2600	Bblcfo32.exe
3144	Bfhofnpp.exe
3800	Bifkcioc.exe
1632	Bmagch32.exe
3916	Bldgoeog.exe
3164	Bclppboi.exe
5104	Bboplo32.exe
204	Bfjllnnm.exe
4556	Bihhhi32.exe
2752	Bmddihfj.exe
5028	Blgddd32.exe
4832	Bpbpecen.exe
3084	Bcnleb32.exe
4920	Bbalaoda.exe
3352	Beoimjce.exe
4876	Bikeni32.exe
5016	Bmfqngcg.exe
3884	Bliajd32.exe
1732	Bcpika32.exe
3284	Bbcignbo.exe
4960	Bfoegm32.exe
2168	Bimach32.exe
1372	Bmimdg32.exe
920	Bpgjpb32.exe
4416	Bbefln32.exe
4224	Bfabmmhe.exe
1804	Bipnihgi.exe
2888	Bmkjig32.exe
4588	Cpifeb32.exe
3452	Cdebfago.exe
4912	Cbhbbn32.exe
416	Cefoni32.exe
2020	Cibkohef.exe
4308	Cmmgof32.exe
1060	Cplckbmc.exe
3828	Cdgolq32.exe
4152	Cbjogmlf.exe
1724	Cehlcikj.exe
4732	Cidgdg32.exe
4404	Cmpcdfll.exe
224	Cpnpqakp.exe
4024	Cdjlap32.exe
408	Cfhhml32.exe
4848	Cifdjg32.exe
3136	Cleqfb32.exe
2640	Cdlhgpag.exe
1088	Cfjeckpj.exe
1552	Ciiaogon.exe
4868	Cmdmpe32.exe
4352	Clgmkbna.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Qpiidi32.dll	Bifkcioc.exe
File created	C:\Windows\SysWOW64\Elgide32.dll	Bfabmmhe.exe
File opened for modification	C:\Windows\SysWOW64\Cpifeb32.exe	Bmkjig32.exe
File created	C:\Windows\SysWOW64\Cbhkkpon.dll	Cibkohef.exe
File opened for modification	C:\Windows\SysWOW64\Cbjogmlf.exe	Cdgolq32.exe
File created	C:\Windows\SysWOW64\Dinjjf32.exe	Debnjgcp.exe
File opened for modification	C:\Windows\SysWOW64\Bcicjbal.exe	Apngjd32.exe
File created	C:\Windows\SysWOW64\Abdagi32.dll	Bblcfo32.exe
File created	C:\Windows\SysWOW64\Pimdleea.dll	Bfjllnnm.exe
File created	C:\Windows\SysWOW64\Ndfchkio.dll	Cbjogmlf.exe
File created	C:\Windows\SysWOW64\Abbbel32.dll	Dinjjf32.exe
File created	C:\Windows\SysWOW64\Dedkogqm.exe	Dbfoclai.exe
File created	C:\Windows\SysWOW64\Boipkd32.dll	Bmddihfj.exe
File opened for modification	C:\Windows\SysWOW64\Dipgpf32.exe	Dedkogqm.exe
File created	C:\Windows\SysWOW64\Hkjfpp32.dll	Cidgdg32.exe
File opened for modification	C:\Windows\SysWOW64\Ciiaogon.exe	Cfjeckpj.exe
File opened for modification	C:\Windows\SysWOW64\Dmifkecb.exe	Dinjjf32.exe
File opened for modification	C:\Windows\SysWOW64\Dbkhnk32.exe	Ddhhbngi.exe
File opened for modification	C:\Windows\SysWOW64\Cbhbbn32.exe	Cdebfago.exe
File created	C:\Windows\SysWOW64\Gpngef32.dll	Dfonnk32.exe
File created	C:\Windows\SysWOW64\Defheg32.exe	Dgdgijhp.exe
File created	C:\Windows\SysWOW64\Gjgmjh32.dll	Bpbpecen.exe
File created	C:\Windows\SysWOW64\Agccao32.dll	Bbalaoda.exe
File created	C:\Windows\SysWOW64\Cdgolq32.exe	Cplckbmc.exe
File created	C:\Windows\SysWOW64\Cpnpqakp.exe	Cmpcdfll.exe
File opened for modification	C:\Windows\SysWOW64\Cdnelpod.exe	Clgmkbna.exe
File opened for modification	C:\Windows\SysWOW64\Cfmahknh.exe	Cbaehl32.exe
File opened for modification	C:\Windows\SysWOW64\Blgddd32.exe	Bmddihfj.exe
File opened for modification	C:\Windows\SysWOW64\Cdjlap32.exe	Cpnpqakp.exe
File opened for modification	C:\Windows\SysWOW64\Cdlhgpag.exe	Cleqfb32.exe
File opened for modification	C:\Windows\SysWOW64\Alpnde32.exe	Ammnhilb.exe
File created	C:\Windows\SysWOW64\Cibkohef.exe	Cefoni32.exe
File created	C:\Windows\SysWOW64\Bclppboi.exe	Bldgoeog.exe
File created	C:\Windows\SysWOW64\Bihhhi32.exe	Bfjllnnm.exe
File created	C:\Windows\SysWOW64\Cmpcdfll.exe	Cidgdg32.exe
File created	C:\Windows\SysWOW64\Befogbik.dll	Cfmahknh.exe
File created	C:\Windows\SysWOW64\Clijablo.exe	Cmgjee32.exe
File opened for modification	C:\Windows\SysWOW64\Defheg32.exe	Dgdgijhp.exe
File created	C:\Windows\SysWOW64\Bpbpecen.exe	Blgddd32.exe
File created	C:\Windows\SysWOW64\Beoimjce.exe	Bbalaoda.exe
File created	C:\Windows\SysWOW64\Lgkkbg32.dll	Cbhbbn32.exe
File opened for modification	C:\Windows\SysWOW64\Cibkohef.exe	Cefoni32.exe
File created	C:\Windows\SysWOW64\Cbjogmlf.exe	Cdgolq32.exe
File created	C:\Windows\SysWOW64\Ladlqj32.dll	Cleqfb32.exe
File created	C:\Windows\SysWOW64\Dgdgijhp.exe	Dbhlikpf.exe
File opened for modification	C:\Windows\SysWOW64\Dgdgijhp.exe	Dbhlikpf.exe
File opened for modification	C:\Windows\SysWOW64\Cmpcdfll.exe	Cidgdg32.exe
File created	C:\Windows\SysWOW64\Cfhhml32.exe	Cdjlap32.exe
File created	C:\Windows\SysWOW64\Neiiibnn.dll	Cifdjg32.exe
File created	C:\Windows\SysWOW64\Ggiipk32.dll	Clgmkbna.exe
File created	C:\Windows\SysWOW64\Ibinlbli.dll	Afeban32.exe
File created	C:\Windows\SysWOW64\Fmbcdide.dll	Bmkjig32.exe
File created	C:\Windows\SysWOW64\Idbgcb32.dll	Dipgpf32.exe
File opened for modification	C:\Windows\SysWOW64\Bihhhi32.exe	Bfjllnnm.exe
File created	C:\Windows\SysWOW64\Mondkfmh.dll	Ciiaogon.exe
File created	C:\Windows\SysWOW64\Eicfep32.dll	Clijablo.exe
File created	C:\Windows\SysWOW64\Dpgbgpbe.exe	Dmifkecb.exe
File created	C:\Windows\SysWOW64\Naefjl32.dll	Ddhhbngi.exe
File created	C:\Windows\SysWOW64\Dggkcakg.dll	5272bdb33057d60c5754ac87e94d2ef0f1b9e16b71c317c30370987e67a34c7a.exe
File opened for modification	C:\Windows\SysWOW64\Apkjddke.exe	Alpnde32.exe
File opened for modification	C:\Windows\SysWOW64\Aehbmk32.exe	Afeban32.exe
File created	C:\Windows\SysWOW64\Bfhofnpp.exe	Bblcfo32.exe
File created	C:\Windows\SysWOW64\Hiagoigj.dll	Cpnpqakp.exe
File opened for modification	C:\Windows\SysWOW64\Ddcogo32.exe	Dpgbgpbe.exe

Program crash 1 IoCs

pid	pid_target	Process
5800	5712	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbcignbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfoegm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpgjpb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cehlcikj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpnpqakp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bboplo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cleqfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmdmpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abgjkpll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cplckbmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmpcdfll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmkcpdao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlqpaafg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afeban32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcpika32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabmmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpllbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apimodmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfjllnnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beoimjce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bipnihgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpifeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbjogmlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciiaogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmifkecb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aidomjaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcicjbal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bihhhi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbalaoda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bliajd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cibkohef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfhhml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dipgpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apkjddke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bifkcioc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blgddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdgolq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpjompqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddhhbngi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeffgkkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aehbmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apngjd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclppboi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpbpecen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmimdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdjlap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clgmkbna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abjfqpji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmagch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bikeni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bimach32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cifdjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbhlikpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defheg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdebfago.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdlhgpag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdnelpod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfonnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dedkogqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhofnpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cefoni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbcbnlcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dibdeegc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcnleb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beoimjce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmbcdide.dll"	Bmkjig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdjlap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Debnjgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifgeebem.dll"	Apimodmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppbeie32.dll"	Blgddd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bikeni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bimach32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbcbnlcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gofndo32.dll"	Bpgjpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfabmmhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqhqndlf.dll"	Cdgolq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afeban32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbalaoda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgpoahbe.dll"	Dbhlikpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfdnkk32.dll"	Cfjeckpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhkja32.dll"	Ddcogo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Famnbgil.dll"	Afceko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcicjbal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpgjpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cplckbmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	5272bdb33057d60c5754ac87e94d2ef0f1b9e16b71c317c30370987e67a34c7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdnelpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddhhbngi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eobepglo.dll"	Ammnhilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plmiie32.dll"	Alpnde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbjogmlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbhlikpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acbmjcgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcpika32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naefjl32.dll"	Ddhhbngi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcpika32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cepadh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oihlnd32.dll"	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	5272bdb33057d60c5754ac87e94d2ef0f1b9e16b71c317c30370987e67a34c7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aehbmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiagoigj.dll"	Cpnpqakp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdlhgpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clgmkbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihmeahp.dll"	Debnjgcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmdmpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaepkejo.dll"	Cdnelpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ammnhilb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aehbmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kipiefce.dll"	Bcicjbal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pimdleea.dll"	Bfjllnnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfoegm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpifeb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pndjmkng.dll"	Bliajd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdogqi32.dll"	Aidomjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdqcf32.dll"	Bfhofnpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeffgkkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apngjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aahgec32.dll"	Bmfqngcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cefoni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cidgdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpnpqakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bldgoeog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bboplo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1856	1380	5272bdb33057d60c5754ac87e94d2ef0f1b9e16b71c317c30370987e67a34c7a.exe	84
PID 1856 wrote to memory of 1836	1856	Acbmjcgd.exe	85
PID 1836 wrote to memory of 940	1836	Apimodmh.exe	86
PID 940 wrote to memory of 4124	940	Abgjkpll.exe	87
PID 4124 wrote to memory of 1516	4124	Afceko32.exe	88
PID 1516 wrote to memory of 4012	1516	Aeffgkkp.exe	89
PID 4012 wrote to memory of 1540	4012	Ammnhilb.exe	90
PID 1540 wrote to memory of 4572	1540	Alpnde32.exe	91
PID 4572 wrote to memory of 4896	4572	Apkjddke.exe	92
PID 4896 wrote to memory of 4672	4896	Abjfqpji.exe	93
PID 4672 wrote to memory of 3680	4672	Afeban32.exe	94
PID 3680 wrote to memory of 2068	3680	Aehbmk32.exe	95
PID 2068 wrote to memory of 2164	2068	Aidomjaf.exe	96
PID 2164 wrote to memory of 1888	2164	Apngjd32.exe	97
PID 1888 wrote to memory of 2600	1888	Bcicjbal.exe	98
PID 2600 wrote to memory of 3144	2600	Bblcfo32.exe	99
PID 3144 wrote to memory of 3800	3144	Bfhofnpp.exe	100
PID 3800 wrote to memory of 1632	3800	Bifkcioc.exe	101
PID 1632 wrote to memory of 3916	1632	Bmagch32.exe	102
PID 3916 wrote to memory of 3164	3916	Bldgoeog.exe	103
PID 3164 wrote to memory of 5104	3164	Bclppboi.exe	104
PID 5104 wrote to memory of 204	5104	Bboplo32.exe	105
PID 204 wrote to memory of 4556	204	Bfjllnnm.exe	106
PID 4556 wrote to memory of 2752	4556	Bihhhi32.exe	107
PID 2752 wrote to memory of 5028	2752	Bmddihfj.exe	108
PID 5028 wrote to memory of 4832	5028	Blgddd32.exe	109
PID 4832 wrote to memory of 3084	4832	Bpbpecen.exe	110
PID 3084 wrote to memory of 4920	3084	Bcnleb32.exe	111
PID 4920 wrote to memory of 3352	4920	Bbalaoda.exe	112
PID 3352 wrote to memory of 4876	3352	Beoimjce.exe	113
PID 4876 wrote to memory of 5016	4876	Bikeni32.exe	114
PID 5016 wrote to memory of 3884	5016	Bmfqngcg.exe	115
PID 3884 wrote to memory of 1732	3884	Bliajd32.exe	116
PID 1732 wrote to memory of 3284	1732	Bcpika32.exe	117
PID 3284 wrote to memory of 4960	3284	Bbcignbo.exe	118
PID 4960 wrote to memory of 2168	4960	Bfoegm32.exe	119
PID 2168 wrote to memory of 1372	2168	Bimach32.exe	120
PID 1372 wrote to memory of 920	1372	Bmimdg32.exe	121
PID 920 wrote to memory of 4416	920	Bpgjpb32.exe	122
PID 4416 wrote to memory of 4224	4416	Bbefln32.exe	123
PID 4224 wrote to memory of 1804	4224	Bfabmmhe.exe	124
PID 1804 wrote to memory of 2888	1804	Bipnihgi.exe	125
PID 2888 wrote to memory of 4588	2888	Bmkjig32.exe	126
PID 4588 wrote to memory of 3452	4588	Cpifeb32.exe	127
PID 3452 wrote to memory of 4912	3452	Cdebfago.exe	128
PID 4912 wrote to memory of 416	4912	Cbhbbn32.exe	129
PID 416 wrote to memory of 2020	416	Cefoni32.exe	130
PID 2020 wrote to memory of 4308	2020	Cibkohef.exe	131
PID 4308 wrote to memory of 1060	4308	Cmmgof32.exe	132
PID 1060 wrote to memory of 3828	1060	Cplckbmc.exe	133
PID 3828 wrote to memory of 4152	3828	Cdgolq32.exe	134
PID 4152 wrote to memory of 1724	4152	Cbjogmlf.exe	135
PID 1724 wrote to memory of 4732	1724	Cehlcikj.exe	136
PID 4732 wrote to memory of 4404	4732	Cidgdg32.exe	137
PID 4404 wrote to memory of 224	4404	Cmpcdfll.exe	138
PID 224 wrote to memory of 4024	224	Cpnpqakp.exe	139
PID 4024 wrote to memory of 408	4024	Cdjlap32.exe	140
PID 408 wrote to memory of 4848	408	Cfhhml32.exe	141
PID 4848 wrote to memory of 3136	4848	Cifdjg32.exe	142
PID 3136 wrote to memory of 2640	3136	Cleqfb32.exe	143
PID 2640 wrote to memory of 1088	2640	Cdlhgpag.exe	144
PID 1088 wrote to memory of 1552	1088	Cfjeckpj.exe	145
PID 1552 wrote to memory of 4868	1552	Ciiaogon.exe	146
PID 4868 wrote to memory of 4352	4868	Cmdmpe32.exe	147

C:\Users\Admin\AppData\Local\Temp\5272bdb33057d60c5754ac87e94d2ef0f1b9e16b71c317c30370987e67a34c7a.exe
"C:\Users\Admin\AppData\Local\Temp\5272bdb33057d60c5754ac87e94d2ef0f1b9e16b71c317c30370987e67a34c7a.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\Acbmjcgd.exe
  C:\Windows\system32\Acbmjcgd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\Apimodmh.exe
    C:\Windows\system32\Apimodmh.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Windows\SysWOW64\Abgjkpll.exe
      C:\Windows\system32\Abgjkpll.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\Windows\SysWOW64\Afceko32.exe
        
        C:\Windows\system32\Afceko32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4124
      - C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\SysWOW64\Alpnde32.exe
        
        C:\Windows\system32\Alpnde32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Afeban32.exe
        
        C:\Windows\system32\Afeban32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\SysWOW64\Aehbmk32.exe
        
        C:\Windows\system32\Aehbmk32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\SysWOW64\Apngjd32.exe
        
        C:\Windows\system32\Apngjd32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Bcicjbal.exe
        
        C:\Windows\system32\Bcicjbal.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Bblcfo32.exe
        
        C:\Windows\system32\Bblcfo32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Bifkcioc.exe
        
        C:\Windows\system32\Bifkcioc.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Bclppboi.exe
        
        C:\Windows\system32\Bclppboi.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Bfjllnnm.exe
        
        C:\Windows\system32\Bfjllnnm.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:204
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\SysWOW64\Blgddd32.exe
        
        C:\Windows\system32\Blgddd32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Bpbpecen.exe
        
        C:\Windows\system32\Bpbpecen.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\Beoimjce.exe
        
        C:\Windows\system32\Beoimjce.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\SysWOW64\Bikeni32.exe
        
        C:\Windows\system32\Bikeni32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Bmfqngcg.exe
        
        C:\Windows\system32\Bmfqngcg.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Bliajd32.exe
        
        C:\Windows\system32\Bliajd32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Bcpika32.exe
        
        C:\Windows\system32\Bcpika32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SysWOW64\Bbcignbo.exe
        
        C:\Windows\system32\Bbcignbo.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Bbefln32.exe
        
        C:\Windows\system32\Bbefln32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\Bfabmmhe.exe
        
        C:\Windows\system32\Bfabmmhe.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\SysWOW64\Bipnihgi.exe
        
        C:\Windows\system32\Bipnihgi.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\SysWOW64\Cdebfago.exe
        
        C:\Windows\system32\Cdebfago.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\SysWOW64\Cibkohef.exe
        
        C:\Windows\system32\Cibkohef.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Cplckbmc.exe
        
        C:\Windows\system32\Cplckbmc.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Cdgolq32.exe
        
        C:\Windows\system32\Cdgolq32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\Cidgdg32.exe
        
        C:\Windows\system32\Cidgdg32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Cmpcdfll.exe
        
        C:\Windows\system32\Cmpcdfll.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SysWOW64\Cpnpqakp.exe
        
        C:\Windows\system32\Cpnpqakp.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Cdjlap32.exe
        
        C:\Windows\system32\Cdjlap32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Cfhhml32.exe
        
        C:\Windows\system32\Cfhhml32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\SysWOW64\Cifdjg32.exe
        
        C:\Windows\system32\Cifdjg32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        67⤵
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:444
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4392
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3860
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3504
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2576
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3028
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        80⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        85⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        91⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        93⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 400
        94⤵
        Program crash
        
        PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5712 -ip 5712
1⤵
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Abgjkpll.exe

Path C:\Windows\SysWOW64\Abgjkpll.exe
Size 85KB
SHA256 ca7157327514ef1d8e09c544dd775f3d1616ddb1f9c8d572b06a6b50ea482ce9
MD5 067421c32357fb10ae353daf583639d6
SHA1 c1922dc6ba5615603032b9a43b8f9d91a474f8e2
SHA512 b0b51b6357bdbfc98c1776cf72b66a7d92ea3d8fcb6589f461c8c4fd95ab63053694fffc559520ed927fe6dbf0b097658eccadef407285e14f2dec8557607548
SSDEEP 1536:T8qQNjGQ+d6EoQc1vrsm9vSsNTRauIo2LHstMQ262AjCsQ2PCZZrqOlNfVSLUK+:QqNJd6EoQCgm9vSsNT0uI5HGMQH2qC7T
TLSH
T1A9834A5BA9242F33C6433237191F8EC2F71643E5532AB59C6B69C0CC26376558DBEAC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Abjfqpji.exe

Path C:\Windows\SysWOW64\Abjfqpji.exe
Size 85KB
SHA256 c2b4333add3642de9c7f6a564dc4d966980bfbb2133c4d0e055f832730953fe7
MD5 7228b9db85720ef56362ae58e4a76064
SHA1 a224f193a2b76f72aee6bc8f231964c557b85e56
SHA512 ed4235d388c43c6ff080efdf5a1cd7d0607ca59e602ade96f9000138455c5c2e67c4f6ca687120209b59465abda0e132b244d0475da1bacc63bb2ecdb41bf462
SSDEEP 1536:RnRLE3Ur3Y9GGOSBc2LHhMQ262AjCsQ2PCZZrqOlNfVSLUK+:RFE3UjYfBVHhMQH2qC7ZQOlzSLUK+
TLSH
T1B5836A0A73B01F72D8020277656B05A6FB2981B9B33AC155A054C31F277F91DA2FEF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acbmjcgd.exe

Path C:\Windows\SysWOW64\Acbmjcgd.exe
Size 85KB
SHA256 5c2aee343a3cc3b48cf75160a3e5a69af807add3de4c847a52ecbb52ee5b9e60
MD5 e6470ca26cadaf3edfb6ab1b52c1480d
SHA1 568d366ac3755b34dd56827ae4e3ffd538e32965
SHA512 949145a8b90e41cf6919558584b9854f5c37dbd9f2ecf24c0b115850fe60f3a7be55e3c66b228d29dea5944e985f710c2ac017743f7de3f5dbf4b69a78fbb292
SSDEEP 1536:pLy/bDhPfsVBHlyKiXt/ShjWk3jyr/1qeJ/82LHYMQ262AjCsQ2PCZZrqOlNfVSc:pLy/Hhcfid/SXiqeJ/1HYMQH2qC7ZQOt
TLSH
T1B3836B96B3581F62C5450F7BF05A89D2FF2741BBE22AC2253868D10C1277BF8E1B9785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aeffgkkp.exe

Path C:\Windows\SysWOW64\Aeffgkkp.exe
Size 85KB
SHA256 ee471b81389f6051c72d161cc986bec7aadc49023546cf9a52a6d47ec3da29de
MD5 b7ef418d9b91ac273f91ba796340c90a
SHA1 eb9a7529e7b0664f7b40092042ef51a4cff74dcf
SHA512 785dbec9f45abc3f59d26d38366432389df0c6c48099900c5fada27fb3e061058ee94ae2112a02e61fa39e22500c5244666a8d7934657d9e890ae3f9e0ffc13f
SSDEEP 1536:2kPJav6+DGaClI52izgtLfOx2LHMMQ262AjCsQ2PCZZrqOlNfVSLUK+:2OKClFCIrJHMMQH2qC7ZQOlzSLUK+
TLSH
T15D835A9775981F23C88AC3B11A2F0AD5E7D8507973AE82972578C30C3353A5A85FF792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aehbmk32.exe

Path C:\Windows\SysWOW64\Aehbmk32.exe
Size 85KB
SHA256 567fd7c2f6309f942be119707163644ba398638ed4c9faaa4f62ca1b11bc72fb
MD5 258620fa3542a127cdf3edd891d4c259
SHA1 aff1e1648bf816a2935b78a7513a2e9b5d691048
SHA512 f1d465aadd9146550fe9d34932e9475d06410164a085652716cc771620f4d6b75e574aae77f1d24ed8e0a9870255c197215154fcaab1be3cf7af05b951fb98b9
SSDEEP 1536:TuHZhviJGvDBlba40o/sla2LH2MQ262AjCsQ2PCZZrqOlNfVSLUK+:Tkvy+/m+ElnH2MQH2qC7ZQOlzSLUK+
TLSH
T1C3834B2B772C0FE3D64103B4346E69C6E33415E9BE6FC156E019C2881367E7A81AA7F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Afceko32.exe

Path C:\Windows\SysWOW64\Afceko32.exe
Size 85KB
SHA256 d14df48ce74e935f05045a43d905afeecb34cd4be35d7c367fd06c4e67e009cd
MD5 ad95204a2a84a251234360282df50819
SHA1 b26c631fa4e08325d7294627965770bf07c4b4ac
SHA512 2555a3570391d6a2766468867c55cd31bfdd0c811274c2a4714b50a6ba90927de58d9bc04cc87cbb8b9e3b603c77701d8c8bc3fb4d71b27dd009935d7de619e0
SSDEEP 1536:Ft9FlkBeqYXkzev8t4KvcREKIT2LHcp3MQ262AjCsQ2PCZZrqOlNfVSLUK+:LjWkqYXkzw8t4KkRYwHC3MQH2qC7ZQOt
TLSH
T19A835ACEB1781F3EC58C0A7D211EB882F2663DB522EA81765974C1CC43375D895BA68F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Afeban32.exe

Path C:\Windows\SysWOW64\Afeban32.exe
Size 85KB
SHA256 222c0e3029c5b2ec11ce15f4baafc8c485e0a8f9d9668268abcdad2793fcc99a
MD5 4d73cd5be0e4a206e1e679d9074f560b
SHA1 5ba63e8ffd37d7976836580c231f5f0032d13618
SHA512 8af32b3bd182fabcf026f966e22844c51538ab9cb5428c0e315b6f4fc37eb7734afde7e4c1892ff70838cb40334a5102d1d86f7d9e357d02c9fd86bbb3f512c5
SSDEEP 1536:uBtNQti6PsW6V9cEdiCPGwAHIhPFcmhai8s46N14EmK2LHsMQ262AjCsQ2PCZZr/:zsW9EFPGRHePFNN1MXHsMQH2qC7ZQOl3
TLSH
T1F2836E6A72E85FB1C9C501BA233FC4D6F3198BA9537681504C7BD06B1337A6491BEBC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aidomjaf.exe

Path C:\Windows\SysWOW64\Aidomjaf.exe
Size 85KB
SHA256 dedabac1f4dda5b794bfd135309d901f1b995c349d5ca8960585b5ea8a7211a1
MD5 e33d9a48f28aeed24cfb8ab4c8db3cd6
SHA1 92cc59d8fa086e235813b554ceecfc4263009d5a
SHA512 c3cac6619096edd01bea470e34f55b21d3a437af0d0f39c05bccf029098ac014e4e219453ffe93a4d76b7b27384b029bf701306afa594b1ae7b59d3e605b602d
SSDEEP 1536:7WHe+bqLkiQD1LbNo1g8j2LH1pMQ262AjCsQ2PCZZrqOlNfVSLUK+:UkIiQDJ/HLMQH2qC7ZQOlzSLUK+
TLSH
T1C6834A4BA1255FA3CA0142B9192A1DD3E329CBBD523EC7F91444C75C222796D81BFBCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Alpnde32.exe

Path C:\Windows\SysWOW64\Alpnde32.exe
Size 85KB
SHA256 7e6ea91ccafeb82c3d5426ca227c7fa995ecab26211aae55fff561173c8f9d39
MD5 abbbc9821e4999564f002cb37373a244
SHA1 b14ca9f2615b0368a9911e936cf4bc739879fc65
SHA512 d249a1afbfca1fea2084efbb6ec2c399ab751f1b372ae16337e66765831a9e51f57232e667c5fea42a74e7eefdc4a956c0e933d231c3093f752370b79295d7c0
SSDEEP 1536:6xK4Rh1DE68NYg3kshZeoUb1LnvVqno2LHwMQ262AjCsQ2PCZZrqOlNfVSLUK+:6Uwh1DE6uYg3k/1bYn5HwMQH2qC7ZQOt
TLSH
T1D2836B7BB2A86FB2C582027520170DCAEF4901BD62BAF6D15498C04D62F3E64D1FDBD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ammnhilb.exe

Path C:\Windows\SysWOW64\Ammnhilb.exe
Size 85KB
SHA256 79ba4a424243af51e1699d126317dd665a18f3e85b83ffbf1364e470899a25ab
MD5 824d3911baed76fe448857b3da92194c
SHA1 ec09048ff15827a79bb68f18cc82c59a90389135
SHA512 980c32a7b2582efd3fb620d8e8b78a0bf7e2fe01cad567813224c6e20e6c52c2b56fb9fc2897d14229a7025578e6c333d6c2d4131291e2f1c52c4cb01d853f9a
SSDEEP 1536:6lhs6jHbijdmKPIyUbaDtbJ2LH4MQ262AjCsQ2PCZZrqOlNfVSLUK+:6fvjHOj3PIKNCH4MQH2qC7ZQOlzSLUK+
TLSH
T1EE836B1F791A0F72D48502B5A1179DC3E31983A9722BCD661D88C02E7327ED985BE78F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apimodmh.exe

Path C:\Windows\SysWOW64\Apimodmh.exe
Size 85KB
SHA256 8bfee69a23c572ad999aa75b62bf8537c6a0ec0307ae419d881f3f4cfb36ddc1
MD5 bd4d236308f85e24dca9c34b1d673688
SHA1 0abfea882b7f5ff494709300e78b3c05949fbc15
SHA512 98112802ab648530f0f91cb5c6562fea24b03153ba857625c22844107d1015b0c8e69dd60df67935314f6dc9937970bd2e77a41ec105adf0465a0b69ab02b06b
SSDEEP 1536:SqIsyv+ID3u/NXA/L2LHb4MQ262AjCsQ2PCZZrqOlNfVSLUK+:nUS/NwwHkMQH2qC7ZQOlzSLUK+
TLSH
T159835B5E7150BFB6C3D6037A32EF45D5F3BA88A8E3699F551018C20C1327A68877A78D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apkjddke.exe

Path C:\Windows\SysWOW64\Apkjddke.exe
Size 85KB
SHA256 3edf3038b947891fcf39b791d8f1fc434f9d59480f99ff4071e97b222a5b599b
MD5 cbdb8064380a81effdaa8e11ff51a73b
SHA1 2c69573e2fc2a79fcac623133440e380c05ea6db
SHA512 65f4397fd450512719ba4c6daf127e6e13ce56179df740c64808d12250fd416684bb2881aded5fb10b3c4f1154fb8de984cda92c97b4aedbe5f7fb9eefee8f35
SSDEEP 1536:s/RpaYm3LAsYsEmznXfDD342LHSMQ262AjCsQ2PCZZrqOlNfVSLUK+:IRQqVYzPDlHSMQH2qC7ZQOlzSLUK+
TLSH
T1A88339DA31A91FF3C28402B5245F1CE6F37945685DEF89F418D4C0481FB3A68A77EAA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apngjd32.exe

Path C:\Windows\SysWOW64\Apngjd32.exe
Size 85KB
SHA256 3f196fbdf7937637b6a0449455bb3d999f963d49189ab1ce073d902bf5a24ccb
MD5 a3fd4c09c55c3535ffdf96dda914f907
SHA1 22834d59994aa425100c6eaf01f4f63b04b3e255
SHA512 c062d10291463f54266bd4e183be40aec67725715240e52291358424ab3dfa38297164c32f89e8c2dfbc033293377fcd875bc357dd70a0f25a9b604b2e0eb1df
SSDEEP 1536:vibUGFDIWfvizeAwtU6WEQlko/2LHumMQ262AjCsQ2PCZZrqOlNfVSLUK+:0U+DWeAwtu5EH9MQH2qC7ZQOlzSLUK+
TLSH
T1EC836B1E71365FB1C6020E3F21AB89E6FF1540FD737B86692498C14D22A3EB585BA6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bbalaoda.exe

Path C:\Windows\SysWOW64\Bbalaoda.exe
Size 85KB
SHA256 ebb4b528a1bac236a2c9ec939270a3bf3b6f2c01b996713abec233074a4c8ac4
MD5 0130a825d9ef5c0e986725be5f27d098
SHA1 adb7e3952b6b259cf7b7355e6e1bac59c1fbe09f
SHA512 266764e40c4433d2a7a9d91e2c157c9e84391024d9abd131d4bf4fe6daede40af1ddf8a05aab2dc3f58591482ee24e29092616797e58b9702cf912cbea04eb95
SSDEEP 1536:qE6ps5s8cFfP/AMfAoDE8T3ygK2LH5MQ262AjCsQ2PCZZrqOlNfVSLUK+:wpYs1/AUvY8+MH5MQH2qC7ZQOlzSLUK+
TLSH
T1C3833A5FB0281FB2D941037011DB0B9AF3C9406DE2269396D768D19C67E37846ABEBC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bblcfo32.exe

Path C:\Windows\SysWOW64\Bblcfo32.exe
Size 85KB
SHA256 9c5fbed0396f7a6f6c0018146ebc7c14b06e0477c59cba56251253f7f3fa6896
MD5 d108458807bdaac8522ea6328a8c70e2
SHA1 4c05560461fa84478d64196a44ad70d936238f79
SHA512 10279593cf440a8fa00a995354c183a27d49e7cc775b4dc816a0b10c6db00b6e4741b0e03c5a2bb565d7cafac232ee201999aff80ba44aa3732ca0c72e051007
SSDEEP 1536:wTegKnivcenUt1Wr61T09lvl2LHpOMQ262AjCsQ2PCZZrqOlNfVSLUK+:7qUXiO1T09l+HpOMQH2qC7ZQOlzSLUK+
TLSH
T140836B5F26241FB1D9B00272249B1B85E71E87A51626CAD7631FC17C3323E588ABF7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bboplo32.exe

Path C:\Windows\SysWOW64\Bboplo32.exe
Size 85KB
SHA256 11b86e2fc69e9c7bf03764ddb751ab66b1bd9654e0d155c6b2d0652ab6da9984
MD5 c468e3a07c96ab71ecdf8bc4ee03ebbe
SHA1 4747765f48f86aec0228f68e283e176ac6e0f441
SHA512 f1a728af65881989ed27edeeb3bb2c24a2482f410ce8ec885ff583e3618e1525f07862d790fd92db391efd7ebb4f82138111a95f66070f606da33c0560336593
SSDEEP 1536:vEjT/2LPwziTyAXiKPMZPa2LHLMQ262AjCsQ2PCZZrqOlNfVSLUK+:vwTyMAXiKPwHLMQH2qC7ZQOlzSLUK+
TLSH
T13E836BFB76350F71CE40027A225FA5C1EB3BB5A91336C69A1899C1180337E5FA4B6BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bcicjbal.exe

Path C:\Windows\SysWOW64\Bcicjbal.exe
Size 85KB
SHA256 90eff54769e7e2b6819582c5fd5951c90e04cb0ec415655eec270d2b00309cf8
MD5 5dd575d5ed68d6e2c68f6556276abfa1
SHA1 b22d3953bf7a3c08f3bfeefdbeffb0f25792a6c9
SHA512 4b52e12c00ea38d702b7cce9110aa922075d24b6629acb22521771c49391f377380e77275f2f977a8406ff617ea5c5b8e9a942222e17f8c170a1a7a223fb5df8
SSDEEP 1536:nyexiKqHUQOOOdQaNtCqgwMc342LHhcMQ262AjCsQ2PCZZrqOlNfVSLUK+:ZAkJH+MQH2qC7ZQOlzSLUK+
TLSH
T12C835B5B69610FB2C74A02B9371F7886F2E941FF72FBB291F544C18C232F25585BA690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bclppboi.exe

Path C:\Windows\SysWOW64\Bclppboi.exe
Size 85KB
SHA256 e1317e24a8e6d5ebab7d5fe37b6d35143eff30c3d645376a5bf046a5c824dc19
MD5 00b1a4770d508bf7b12558dbada39c89
SHA1 17e9b8d33a9992ca6a3c4ab363f8a068e1c34ec0
SHA512 1884bc080a94f40cd1f3ac3498b47a7b9b16e403fee75c124cfb1ca6b9f47f0ddfaaf946cb57b5d6444d0370429e4ad08fc3b8eaebcde823015b59a77fa3fbf2
SSDEEP 1536:SeU/b1bYHgPDeY+dGD/qF1+QT+px6zJ7qHK2LHDMQ262AjCsQ2PCZZrqOlNfVSLA:S3qmD5+G/mX9AHDMQH2qC7ZQOlzSLUK+
TLSH
T193835C4B783A4F63CEC10379A37A2D96F35B48F9623F80A51814F21D21E35599DFBA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bcnleb32.exe

Path C:\Windows\SysWOW64\Bcnleb32.exe
Size 85KB
SHA256 e495e006190283c2025befba61b3717511ec91461d1605fe8274c0d09f55ae9f
MD5 0561e71105109ea511ba0377c72ba701
SHA1 82f1f101c18a88dc41f2903f4b02b30ffe12e622
SHA512 366787c1351d9925f460c60c7c8a61b16940f07eb5edcf10c1b0544cc7ad5c38f7f841aee23e1565b056c45625dc2fbc39425e13aa485f89c8475c0412a5557b
SSDEEP 1536:TVVeCELeNlLFdYBiXxOckd+9uh2LHrMQ262AjCsQ2PCZZrqOlNfVSLUK+:vlL3Ywgck36HrMQH2qC7ZQOlzSLUK+
TLSH
T12E836D1FE228CF6DC68D063B116B4E9EFF160065637685A45764C73E1E23B98A0BD783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Beoimjce.exe

Path C:\Windows\SysWOW64\Beoimjce.exe
Size 85KB
SHA256 d6efe08c62335e1e7431e27cd80fe68d2d4eabd5951f8637f3ab5565a0a6fb08
MD5 5209cd9f5726a997c41492fa9a3ad9d0
SHA1 a10b1cebcc4fb4cdd9708a46686730318cca1b32
SHA512 375fc5eb0510fba6310100d8a009aa348c9276685df365b5514978db6da0938bb6a848d5a32f05c70945e79fcc41db7007196d702b9a1c72e0fedb132df488e8
SSDEEP 1536:ncWZ5JzbQfnDOX7NCUPIhJgu02LHhMQ262AjCsQ2PCZZrqOlNfVSLUK+:ncqzbQ6XJCJlHhMQH2qC7ZQOlzSLUK+
TLSH
T180836D5B62240F63C6F0C37821DB49C2F6DD476A56AD87993858D30E232FBA8907779C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bfhofnpp.exe

Path C:\Windows\SysWOW64\Bfhofnpp.exe
Size 85KB
SHA256 2aa3872da766b2846faa80c3b8538639d279309d60be4a5bcbd4e0ab5c153ca9
MD5 d9accc32e6d5061b0793a2e6f59a0631
SHA1 e279ac9d7c2b1e850816cd5b8134bbf00525cc68
SHA512 5e06657c3a5c523d3f82a4ef2a6e7efe144c8e23e34253eb5c19fab24c37d6a28fce61230f66d7ada432d2a4b102e45150ff906b0f6be09d45d94b34e4771c52
SSDEEP 1536:KfhNCN9EMnO8GgQPV1IaW/cPPfM542LHCMQ262AjCsQ2PCZZrqOlNfVSLUK+:KzEnOQQ/bWUPPfM5JHCMQH2qC7ZQOlzb
TLSH
T11C835A2EED278FF3C249027A1CEBD5D3FA198EE4637945EA2518F50C073252694BA7D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bfjllnnm.exe

Path C:\Windows\SysWOW64\Bfjllnnm.exe
Size 85KB
SHA256 139562d5f3ee3ef1c1452b851c8d9903244a40a85b37604c850fb7d5a6640d92
MD5 fdca02ad549106ce6b69387e5ccd24a0
SHA1 3cfd8a4ed718a796e59296a71f683f131609dd51
SHA512 7886cd27909d6bb16516f6d23ab504162b7f21afd887a42c8c5f1cc4201b120a88c36df998fa0dd4fa56066970d7f68165d2d26211cf6a6fd7d5668ca87be4ce
SSDEEP 1536:PHOEz7Xvh0UU40EmnXOyOYPmw9X1mX9caJMM2LHYMQ262AjCsQ2PCZZrqOlNfVSc:hzvhe4Cv9ElJSHYMQH2qC7ZQOlzSLUK+
TLSH
T1D3834BE676D41F62F5C201BA225B8CC5E3F92479837DC5A86428DD8C13F7E58C27A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bifkcioc.exe

Path C:\Windows\SysWOW64\Bifkcioc.exe
Size 85KB
SHA256 495953f3d768f071c6339074866a868623c58c7851b6a568e2e6354ce41a03fd
MD5 43df62650b70e386dfbf63ce581b8151
SHA1 3963ea684a86ebd8028d28bad84c64aa9e3a6f68
SHA512 8c0027840e97e984e70beed7afc84a8cee3e8ea2b3deaab17917db6c7a4447e4b12937fc5cf6b130176e6daccb43ae4cb7583f5d69734df00e182ae9de2fa96a
SSDEEP 1536:scbaG8+JgAF/cwCzJwNwAyM7ZrK2LHOaMQ262AjCsQ2PCZZrqOlNfVSLUK+:P/a20JwNlHOaMQH2qC7ZQOlzSLUK+
TLSH
T1D1835D2B64241FA1F187023723BBA4D2E71D867B73EAC1D05894C16D136791BC6FABB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bihhhi32.exe

Path C:\Windows\SysWOW64\Bihhhi32.exe
Size 85KB
SHA256 01c9e594f4f9f970dbb3a67fe3b4249511b3d5d9717300be1880f5dbd9b40a45
MD5 06cf9865292329e4a5ca1eefdc13fb49
SHA1 198acf5e7855c161ba356e34a7e72dfb960d3532
SHA512 f1a46f21476a8e3fe3d02f966fe70308097bf3fccddcc0427be629e6b3f852a896a0bd29f3f14481482b2eae449845e754cb71727f037b71952e5abc199e4142
SSDEEP 1536:Z1TjceEV0OVzgY/QuMRCc2LHIYMQ262AjCsQ2PCZZrqOlNfVSLUK+:ZZcp+YAAVHhMQH2qC7ZQOlzSLUK+
TLSH
T177835B9BB2201FB3D5710375125F19FAF65A40EF92FAC0D5E458C1CD2B67E8980BA788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bikeni32.exe

Path C:\Windows\SysWOW64\Bikeni32.exe
Size 85KB
SHA256 1a872e19b64340d71264b17539524168e16417bd64ca8c92b099e2803de01a30
MD5 b780968821d2024f7b5228b3156135b4
SHA1 c656990f5cfab4ec9a422f026e784fafaf3e60ce
SHA512 60d2ddc52bb60c5dfc237e0a07a12acb3ab51d1579a9a514f138600ac666a34b27b8d4de79d24861d7f591b2069cfa4f4f40d0aabed359ea3635f93014cda8a0
SSDEEP 1536:7JXeqRd0evEcLYOJAwy1y6P55mA2LH9MQ262AjCsQ2PCZZrqOlNfVSLUK+:89elbyNTmxH9MQH2qC7ZQOlzSLUK+
TLSH
T1E7836D2A72691FF6D5810EB4323B4CD6E72A8479D277C0BA1BB085DC1327668C37E785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bldgoeog.exe

Path C:\Windows\SysWOW64\Bldgoeog.exe
Size 85KB
SHA256 607962c7f6746b9a4951aa4813be0c37f39f253a1d2aeca316e7dac8f583ea51
MD5 5f95d16e603593037ab4ebd43f0f039c
SHA1 84753f639f9000adc0c117e1dfb76745d4196557
SHA512 dd8d7961aa7e2a45cf42b7dcda6dbfe616de4440c8c1ae7f1d1c8a0b07f7f3cb1844b84d80db95548413dc842746b5d35f94d1a6fdcb440bf37911cecdca3148
SSDEEP 1536:5L3aulfXONOU41XXRx3XywdeP9Zpd3LoKeAZi+hCt2LHyMQ262AjCsQ2PCZZrqOt:5L3blm6XRxnDeJeAZJA+HyMQH2qC7ZQA
TLSH
T135835B1F79341F73F7760372116A359AF21B10BAA336C188176CD14D5ABBA1982BE783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Blgddd32.exe

Path C:\Windows\SysWOW64\Blgddd32.exe
Size 85KB
SHA256 485572647e3b449a3037dc0b1735f32cd934a63329fd5925fc2eff492f26f896
MD5 2010b44c387d990d7c55c1e60b120c29
SHA1 d0288ac8e64a48016f271a1ef2e3157962649c47
SHA512 f893374c1ff6d044da6d103805bf824ccdabc1dcce5c671d028cdaf82acb61de805576683042fb9c92f57786b938a7db2c29f4130bf5695dee59d6667dcf73c2
SSDEEP 1536:eqNBUceF45WA7RSAhFZWmXCU2LHRMQ262AjCsQ2PCZZrqOlNfVSLUK+:ehDFj2RhFk5tHRMQH2qC7ZQOlzSLUK+
TLSH
T102837CEFB1F51F76CD0C037A21AB4881E61E00BA5F29E7584564C18E1367A698EFB2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bliajd32.exe

Path C:\Windows\SysWOW64\Bliajd32.exe
Size 85KB
SHA256 c2b0484252f91920245055c5e9a672702805bc2b162349ae2af3f2dc394d4286
MD5 2920b470afd1473d808e50ab79a569e1
SHA1 8796f53d99bc39e58d11cac32bc5d3ae89d4e059
SHA512 06876e6865cee2c83f9b716206c2f8bf07f51b0e6918768134f4baa41d1314bdbb4cd9da717f818f731fd63ed0b9d23ba983ba391b7a28bc9d60247acfcbd45d
SSDEEP 1536:nc1np+4xyyrmK2LHGMQ262AjCsQ2PCZZrqOlNfVSLUK+:nAnp7xpUHGMQH2qC7ZQOlzSLUK+
TLSH
T1F5836DDF65361F61C69103B7357E59DBF75960AA2269CFE01418C11C2E37B2882BABF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmagch32.exe

Path C:\Windows\SysWOW64\Bmagch32.exe
Size 85KB
SHA256 87e8d1c30e72b84196e92a5221d32864b6c9bbb804ed1a9d6d4faac8b0ca3916
MD5 954eb5c36afb338447e8b06f961e4642
SHA1 cddd86fedf44c9319805a8b1a5e5314e4f4994f2
SHA512 a6e51d7db0b7d55761d60d1698546eeb49a63cec156979b3bacfeb927d94df596e0682e7a4bfe31b1382c980ebe39d683290bd5c9f010548b05c155af1fa4c64
SSDEEP 1536:C9XubQbxYTpIWcN0sTkS2tu5WlZN2LHmMQ262AjCsQ2PCZZrqOlNfVSLUK+:GZxey0sF5WlZeHmMQH2qC7ZQOlzSLUK+
TLSH
T112833AFF76358F62C4B203B016678AD1E73987AF517A81665848C01F2F2FA65C0FA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmddihfj.exe

Path C:\Windows\SysWOW64\Bmddihfj.exe
Size 85KB
SHA256 337299cd6db7756c86d06525daea7c8551ba38cdc3def51c51cc890ef0c38970
MD5 202836dd9c2fb4388989c0dcbb82e166
SHA1 e7a1e1267dca1b39c33b8f0594702f3b352b8908
SHA512 5250ccc31589559ab076a844fd8e0761f501dffcf71fdd067078d0ce4690590bb3bebf3d2d32fd4358a20c4f548dd7a2cddaab97c8f1ab8c0e479dd308855d30
SSDEEP 1536:N3GNKiX72wQWWMHRTwQ3+rZY7PJYCk72LHFpMQ262AjCsQ2PCZZrqOlNfVSLUK+:AkiX70WWMHRTwRUJYCkYHPMQH2qC7ZQA
TLSH
T142836C0EB3545FA1CD84337EFC9AD486E21970B81236C57908E4C57F1E63A21FAB9B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmfqngcg.exe

Path C:\Windows\SysWOW64\Bmfqngcg.exe
Size 85KB
SHA256 a9f16da2c070f8685f93ff59724e822a13964d607d077c8a17ef7f1b675c4bce
MD5 f510ec82579373df72c5c96941bc1df1
SHA1 f3a988291637dc3e54a721dc8e42ab849f73a377
SHA512 5b87043d51963078e2aecc5d4901e7822659615a3932db7111b5f14cd822dc36154b1d2302819bcfb7c00c8e28c4c51bf2ab3b5ca2d95be320343b6515c3fc90
SSDEEP 1536:mrId9U07ksU/A5T2pq5sZS+SC2LHWMQ262AjCsQ2PCZZrqOlNfVSLUK+:0E9P7mY5T2pqqZQHWMQH2qC7ZQOlzSLA
TLSH
T1DA836D5BBDA81F61D75DC375312A18E6FB2D48AD322A85F8541BC19C1333728CABE781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bpbpecen.exe

Path C:\Windows\SysWOW64\Bpbpecen.exe
Size 85KB
SHA256 cc76b14466802fe1878e0617944a73d5be8a85d7fe25120c7ef537effed768e5
MD5 02f96352dfbd657aadd07cfa43202eed
SHA1 9aaf00d14dab63fc1efd1854a067ab06eeaacd59
SHA512 698258a65d6bc88bc9391ae04cd7482be58c317ad8a24281f30a1a515c0360e9060735d6e112109a9e049ba551b67f5419f6ebda188232f82af599e79445b331
SSDEEP 1536:S/97lCaWZjYCVWgC7tCt1EZkbRWrb292LHFMQ262AjCsQ2PCZZrqOlNfVSLUK+:g0aakCRMYt1E6NOHFMQH2qC7ZQOlzSLA
TLSH
T15A83391A62251F32C9C003341536C786F70572BBA275F46617E4FECE22A3929B3FAB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-186-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/224-404-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/408-416-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/416-350-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/444-482-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/812-464-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/920-302-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/940-29-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1060-368-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1088-440-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1372-296-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1380-77-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1380-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/1380-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1516-129-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1516-41-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1540-61-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1552-446-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1632-154-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1724-386-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1732-271-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1792-512-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1804-320-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1836-104-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1836-16-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1856-94-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1856-9-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1888-121-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2020-356-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2068-105-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2164-113-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2168-290-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2416-506-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2448-470-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2576-530-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2600-130-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2640-434-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2752-202-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2888-326-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3028-536-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3084-226-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3136-428-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3144-138-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3164-169-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3284-278-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3352-242-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3452-338-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3504-524-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3680-96-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3800-146-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3828-374-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3860-500-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3884-266-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3916-162-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4012-53-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4024-410-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4124-40-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4152-380-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4224-314-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4308-362-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4352-458-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4392-494-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4404-398-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4416-308-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4456-488-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4464-476-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4556-194-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4572-70-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4588-332-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4672-86-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4732-392-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4764-518-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4832-218-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4848-422-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4868-452-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4876-250-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4896-79-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4912-344-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4920-234-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4960-284-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5016-258-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5028-210-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5104-178-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5152-542-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5192-548-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5232-554-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5272-560-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5312-566-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5352-572-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5392-578-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5432-584-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5472-590-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5512-596-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5552-602-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5592-608-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5632-614-0x0000000000400000-0x0000000000441000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads