dda93ffe9488ee1e925deeea50b50c0712e2130b2e573dd28c797c7ff8037462

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe
Size

432KB
MD5

4feffb8e211b25bb1b3c94f8a7e32740
SHA1

21430e94003d5097cc351895d822c93b05344ec2
SHA256

dda93ffe9488ee1e925deeea50b50c0712e2130b2e573dd28c797c7ff8037462
SHA512

42afff850a17ac441bc4e5515c96bf63e68e162d8930a6b0490148fd06dd20665cd40f40e1ab2152769bffbcccd74d66aac6070feb022a73a2fb15a58714e40d
SSDEEP

12288:N+P7yO5t6NSN6G5tsLc5t6NSN6G5tgA1F:N+P7yhc6TTc6tA1F

Score

10^/10

dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpebpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imdgqfbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbhfjljd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nngokoej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhfjljd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bagflcje.exe

Malware Backdoor - Berbew 64 IoCs

Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.

persistence dropper trojan

resource	yara_rule
behavioral2/memory/4752-0-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x00040000000006e5-6.dat	family_berbew
behavioral2/files/0x00040000000006e5-8.dat	family_berbew
behavioral2/memory/2676-7-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022dfd-14.dat	family_berbew
behavioral2/memory/2016-17-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e02-23.dat	family_berbew
behavioral2/files/0x0006000000022e04-30.dat	family_berbew
behavioral2/files/0x0006000000022e04-31.dat	family_berbew
behavioral2/memory/396-34-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/4944-39-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e06-40.dat	family_berbew
behavioral2/files/0x0006000000022e06-38.dat	family_berbew
behavioral2/files/0x0006000000022e08-47.dat	family_berbew
behavioral2/memory/4808-48-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e08-46.dat	family_berbew
behavioral2/files/0x0006000000022e0a-54.dat	family_berbew
behavioral2/memory/4440-24-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e02-22.dat	family_berbew
behavioral2/files/0x0007000000022dfd-15.dat	family_berbew
behavioral2/memory/4920-56-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e0c-63.dat	family_berbew
behavioral2/files/0x0006000000022e0c-62.dat	family_berbew
behavioral2/files/0x0006000000022e11-76.dat	family_berbew
behavioral2/files/0x0006000000022e11-77.dat	family_berbew
behavioral2/files/0x0006000000022e0e-70.dat	family_berbew
behavioral2/files/0x0006000000022e0e-69.dat	family_berbew
behavioral2/files/0x0006000000022e0a-55.dat	family_berbew
behavioral2/memory/4312-78-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/4316-79-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/1304-80-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0007000000022dfe-86.dat	family_berbew
behavioral2/files/0x0007000000022dfe-87.dat	family_berbew
behavioral2/memory/4468-95-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e15-94.dat	family_berbew
behavioral2/memory/4880-88-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e15-96.dat	family_berbew
behavioral2/files/0x0006000000022e17-103.dat	family_berbew
behavioral2/files/0x0006000000022e17-102.dat	family_berbew
behavioral2/memory/3416-104-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e19-110.dat	family_berbew
behavioral2/files/0x0006000000022e1c-118.dat	family_berbew
behavioral2/files/0x0006000000022e1c-119.dat	family_berbew
behavioral2/memory/3268-123-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/4596-128-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e1e-127.dat	family_berbew
behavioral2/files/0x0006000000022e1e-126.dat	family_berbew
behavioral2/memory/1420-112-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/memory/2824-140-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e22-142.dat	family_berbew
behavioral2/files/0x0006000000022e20-135.dat	family_berbew
behavioral2/files/0x0006000000022e20-134.dat	family_berbew
behavioral2/files/0x0006000000022e19-111.dat	family_berbew
behavioral2/memory/4676-148-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e24-152.dat	family_berbew
behavioral2/files/0x0006000000022e26-159.dat	family_berbew
behavioral2/memory/4660-160-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e26-158.dat	family_berbew
behavioral2/memory/3724-151-0x0000000000400000-0x000000000043D000-memory.dmp	family_berbew
behavioral2/files/0x0006000000022e24-150.dat	family_berbew
behavioral2/files/0x0006000000022e22-143.dat	family_berbew
behavioral2/files/0x0006000000022e28-167.dat	family_berbew
behavioral2/files/0x0006000000022e28-166.dat	family_berbew
behavioral2/files/0x0006000000022e2a-175.dat	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
2676	Imdgqfbd.exe
2016	Ibqpimpl.exe
4440	Ilidbbgl.exe
396	Jfoiokfb.exe
4944	Jmhale32.exe
4808	Jlnnmb32.exe
4920	Jbhfjljd.exe
1304	Jlpkba32.exe
4312	Jbjcolha.exe
4316	Jmpgldhg.exe
4880	Lpebpm32.exe
4468	Lingibiq.exe
3416	Mmlpoqpg.exe
1420	Mdehlk32.exe
3268	Mibpda32.exe
4596	Mlampmdo.exe
2824	Miemjaci.exe
4676	Mdmnlj32.exe
3724	Miifeq32.exe
4660	Ncbknfed.exe
4276	Nngokoej.exe
2592	Nphhmj32.exe
4932	Neeqea32.exe
4548	Nckndeni.exe
1124	Ocnjidkf.exe
1104	Opakbi32.exe
624	Ocbddc32.exe
3492	Onhhamgg.exe
220	Ojoign32.exe
4052	Pqknig32.exe
2548	Pfhfan32.exe
3052	Pqmjog32.exe
4332	Pjeoglgc.exe
1248	Pqpgdfnp.exe
3620	Pcncpbmd.exe
3840	Pdmpje32.exe
4124	Pqdqof32.exe
1356	Pgnilpah.exe
2996	Qnhahj32.exe
1680	Qgqeappe.exe
1628	Qnjnnj32.exe
3288	Qcgffqei.exe
1432	Ageolo32.exe
4992	Ajckij32.exe
212	Aclpap32.exe
1000	Ajfhnjhq.exe
4168	Amddjegd.exe
940	Agjhgngj.exe
1180	Andqdh32.exe
1240	Acqimo32.exe
4204	Aadifclh.exe
2072	Accfbokl.exe
428	Bagflcje.exe
4336	Bfdodjhm.exe
1352	Baicac32.exe
5084	Bchomn32.exe
3368	Balpgb32.exe
1452	Bgehcmmm.exe
3660	Banllbdn.exe
2004	Bhhdil32.exe
4036	Bnbmefbg.exe
2144	Cjinkg32.exe
4788	Cabfga32.exe
3504	Cdabcm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mdmnlj32.exe	Miemjaci.exe
File opened for modification	C:\Windows\SysWOW64\Pdmpje32.exe	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Jdbnaa32.dll	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Acqimo32.exe	Andqdh32.exe
File opened for modification	C:\Windows\SysWOW64\Bgehcmmm.exe	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Mlampmdo.exe	Mibpda32.exe
File opened for modification	C:\Windows\SysWOW64\Nckndeni.exe	Neeqea32.exe
File created	C:\Windows\SysWOW64\Elocna32.dll	Ojoign32.exe
File opened for modification	C:\Windows\SysWOW64\Lpebpm32.exe	Jmpgldhg.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Miemjaci.exe	Mlampmdo.exe
File created	C:\Windows\SysWOW64\Bhicommo.dll	Cabfga32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Onhhamgg.exe	Ocbddc32.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Bnecbhin.dll	Lingibiq.exe
File opened for modification	C:\Windows\SysWOW64\Ageolo32.exe	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Amddjegd.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Aomaga32.dll	Jmpgldhg.exe
File opened for modification	C:\Windows\SysWOW64\Ncbknfed.exe	Miifeq32.exe
File opened for modification	C:\Windows\SysWOW64\Pjeoglgc.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aadifclh.exe
File created	C:\Windows\SysWOW64\Jmpgldhg.exe	Jbjcolha.exe
File opened for modification	C:\Windows\SysWOW64\Mdehlk32.exe	Mmlpoqpg.exe
File created	C:\Windows\SysWOW64\Jocbigff.dll	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Jfoiokfb.exe	Ilidbbgl.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Aadifclh.exe	Acqimo32.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Gnchkk32.dll	NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe
File created	C:\Windows\SysWOW64\Ocnjidkf.exe	Nckndeni.exe
File created	C:\Windows\SysWOW64\Mbpfgbfp.dll	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Jbhfjljd.exe	Jlnnmb32.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Ajckij32.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cabfga32.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Ncnaabfm.dll	Jlpkba32.exe
File created	C:\Windows\SysWOW64\Knkkfojb.dll	Miifeq32.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Igjnojdk.dll	Pqknig32.exe
File created	C:\Windows\SysWOW64\Ciopbjik.dll	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Ickfifmb.dll	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Jbjcolha.exe	Jlpkba32.exe
File created	C:\Windows\SysWOW64\Lpebpm32.exe	Jmpgldhg.exe
File opened for modification	C:\Windows\SysWOW64\Neeqea32.exe	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Oadacmff.dll	Ocnjidkf.exe
File opened for modification	C:\Windows\SysWOW64\Imdgqfbd.exe	NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe
File created	C:\Windows\SysWOW64\Ncbknfed.exe	Miifeq32.exe
File created	C:\Windows\SysWOW64\Pgnilpah.exe	Pqdqof32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Ibqpimpl.exe	Imdgqfbd.exe
File created	C:\Windows\SysWOW64\Pemfincl.dll	Nngokoej.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5760	5696	WerFault.exe	174

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnchkk32.dll"	NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgefkimp.dll"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmphmhjc.dll"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndkqipob.dll"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjbedgde.dll"	Jbhfjljd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkfcej32.dll"	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clbcapmm.dll"	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmpmkplp.dll"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igjnojdk.dll"	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdlci32.dll"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olcjhi32.dll"	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffcnippo.dll"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajckij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miemjaci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbnaa32.dll"	Qnjnnj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2676	4752	NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe	86
PID 4752 wrote to memory of 2676	4752	NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe	86
PID 4752 wrote to memory of 2676	4752	NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe	86
PID 2676 wrote to memory of 2016	2676	Imdgqfbd.exe	87
PID 2676 wrote to memory of 2016	2676	Imdgqfbd.exe	87
PID 2676 wrote to memory of 2016	2676	Imdgqfbd.exe	87
PID 2016 wrote to memory of 4440	2016	Ibqpimpl.exe	88
PID 2016 wrote to memory of 4440	2016	Ibqpimpl.exe	88
PID 2016 wrote to memory of 4440	2016	Ibqpimpl.exe	88
PID 4440 wrote to memory of 396	4440	Ilidbbgl.exe	89
PID 4440 wrote to memory of 396	4440	Ilidbbgl.exe	89
PID 4440 wrote to memory of 396	4440	Ilidbbgl.exe	89
PID 396 wrote to memory of 4944	396	Jfoiokfb.exe	92
PID 396 wrote to memory of 4944	396	Jfoiokfb.exe	92
PID 396 wrote to memory of 4944	396	Jfoiokfb.exe	92
PID 4944 wrote to memory of 4808	4944	Jmhale32.exe	90
PID 4944 wrote to memory of 4808	4944	Jmhale32.exe	90
PID 4944 wrote to memory of 4808	4944	Jmhale32.exe	90
PID 4808 wrote to memory of 4920	4808	Jlnnmb32.exe	91
PID 4808 wrote to memory of 4920	4808	Jlnnmb32.exe	91
PID 4808 wrote to memory of 4920	4808	Jlnnmb32.exe	91
PID 4920 wrote to memory of 1304	4920	Jbhfjljd.exe	93
PID 4920 wrote to memory of 1304	4920	Jbhfjljd.exe	93
PID 4920 wrote to memory of 1304	4920	Jbhfjljd.exe	93
PID 1304 wrote to memory of 4312	1304	Jlpkba32.exe	95
PID 1304 wrote to memory of 4312	1304	Jlpkba32.exe	95
PID 1304 wrote to memory of 4312	1304	Jlpkba32.exe	95
PID 4312 wrote to memory of 4316	4312	Jbjcolha.exe	94
PID 4312 wrote to memory of 4316	4312	Jbjcolha.exe	94
PID 4312 wrote to memory of 4316	4312	Jbjcolha.exe	94
PID 4316 wrote to memory of 4880	4316	Jmpgldhg.exe	96
PID 4316 wrote to memory of 4880	4316	Jmpgldhg.exe	96
PID 4316 wrote to memory of 4880	4316	Jmpgldhg.exe	96
PID 4880 wrote to memory of 4468	4880	Lpebpm32.exe	97
PID 4880 wrote to memory of 4468	4880	Lpebpm32.exe	97
PID 4880 wrote to memory of 4468	4880	Lpebpm32.exe	97
PID 4468 wrote to memory of 3416	4468	Lingibiq.exe	99
PID 4468 wrote to memory of 3416	4468	Lingibiq.exe	99
PID 4468 wrote to memory of 3416	4468	Lingibiq.exe	99
PID 3416 wrote to memory of 1420	3416	Mmlpoqpg.exe	100
PID 3416 wrote to memory of 1420	3416	Mmlpoqpg.exe	100
PID 3416 wrote to memory of 1420	3416	Mmlpoqpg.exe	100
PID 1420 wrote to memory of 3268	1420	Mdehlk32.exe	108
PID 1420 wrote to memory of 3268	1420	Mdehlk32.exe	108
PID 1420 wrote to memory of 3268	1420	Mdehlk32.exe	108
PID 3268 wrote to memory of 4596	3268	Mibpda32.exe	101
PID 3268 wrote to memory of 4596	3268	Mibpda32.exe	101
PID 3268 wrote to memory of 4596	3268	Mibpda32.exe	101
PID 4596 wrote to memory of 2824	4596	Mlampmdo.exe	102
PID 4596 wrote to memory of 2824	4596	Mlampmdo.exe	102
PID 4596 wrote to memory of 2824	4596	Mlampmdo.exe	102
PID 2824 wrote to memory of 4676	2824	Miemjaci.exe	103
PID 2824 wrote to memory of 4676	2824	Miemjaci.exe	103
PID 2824 wrote to memory of 4676	2824	Miemjaci.exe	103
PID 4676 wrote to memory of 3724	4676	Mdmnlj32.exe	104
PID 4676 wrote to memory of 3724	4676	Mdmnlj32.exe	104
PID 4676 wrote to memory of 3724	4676	Mdmnlj32.exe	104
PID 3724 wrote to memory of 4660	3724	Miifeq32.exe	105
PID 3724 wrote to memory of 4660	3724	Miifeq32.exe	105
PID 3724 wrote to memory of 4660	3724	Miifeq32.exe	105
PID 4660 wrote to memory of 4276	4660	Ncbknfed.exe	106
PID 4660 wrote to memory of 4276	4660	Ncbknfed.exe	106
PID 4660 wrote to memory of 4276	4660	Ncbknfed.exe	106
PID 4276 wrote to memory of 2592	4276	Nngokoej.exe	107

C:\Users\Admin\AppData\Local\Temp\NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4feffb8e211b25bb1b3c94f8a7e32740.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\Imdgqfbd.exe
  C:\Windows\system32\Imdgqfbd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\Ibqpimpl.exe
    C:\Windows\system32\Ibqpimpl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\Ilidbbgl.exe
      C:\Windows\system32\Ilidbbgl.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4440
    - - C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:396
      - C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4944

C:\Windows\SysWOW64\Jlnnmb32.exe
C:\Windows\system32\Jlnnmb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\Jbhfjljd.exe
  C:\Windows\system32\Jbhfjljd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\Jlpkba32.exe
    C:\Windows\system32\Jlpkba32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\SysWOW64\Jbjcolha.exe
      C:\Windows\system32\Jbjcolha.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4312

C:\Windows\SysWOW64\Jmpgldhg.exe
C:\Windows\system32\Jmpgldhg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\Lpebpm32.exe
  C:\Windows\system32\Lpebpm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\Lingibiq.exe
    C:\Windows\system32\Lingibiq.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\SysWOW64\Mmlpoqpg.exe
      C:\Windows\system32\Mmlpoqpg.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3416
    - - C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3268

C:\Windows\SysWOW64\Mlampmdo.exe
C:\Windows\system32\Mlampmdo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\Miemjaci.exe
  C:\Windows\system32\Miemjaci.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\Mdmnlj32.exe
    C:\Windows\system32\Mdmnlj32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\SysWOW64\Miifeq32.exe
      C:\Windows\system32\Miifeq32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3724
    - - C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4660
      - C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4932
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1124
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1104
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3492
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:220
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4052
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        16⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3052

C:\Windows\SysWOW64\Pjeoglgc.exe
C:\Windows\system32\Pjeoglgc.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4332
- C:\Windows\SysWOW64\Pqpgdfnp.exe
  C:\Windows\system32\Pqpgdfnp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  PID:1248
- - C:\Windows\SysWOW64\Pcncpbmd.exe
    C:\Windows\system32\Pcncpbmd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    PID:3620
  - - C:\Windows\SysWOW64\Pdmpje32.exe
      C:\Windows\system32\Pdmpje32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      PID:3840
    - - C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4124
      - C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1356
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2996
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1628
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3288
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1432
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4992
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:212
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        16⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1180
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1240
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2072
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3660
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4036
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2144
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4788
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3504
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3616
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4620
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1152
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        40⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        44⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        45⤵
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        47⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        48⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 396
        49⤵
        Program crash
        
        PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5696 -ip 5696
1⤵
PID:5728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
432KB

MD5
aa923cc299de3ea21752d6db496d617e

SHA1
04cdf219f867dad251629b5b74052c81c363b5a4

SHA256
f67e4684b86e87219f659514d75ba073ba587be0df78d8f543aa9bce36e79e6d

SHA512
7a4824e056a31598bce393279406673a0e67db543afb0e3b84fea2d5ef6acb00aa7e91ab3cc194552dfac9a20061bfe30253b80d7d703eb7ecdbb7bfe6601ba8

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
432KB

MD5
7fc23c3ea276a92a06d4ec57b4b8e8ae

SHA1
cf6686125fb8367678c336a258d033cc02f99094

SHA256
327d1c2618d84d51c93e8d5f8823a6977073043210bbaebcbe976b02f2e20605

SHA512
5e1c00143ad4b08c4a33aa2c8e913ee1e94b0e9edc58c278fb0dd50fa6e5e56a165a36a6be037978492a89997b8180a2d19090540802f78dc924e9019bc33915

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
432KB

MD5
21fe49b82039d751b73fb4b0ad40d78b

SHA1
99e242bfe4d78a31a715a6b838b8b873afb1ffc6

SHA256
65d03cb25342ffebf98106c521e8a467f58fe3f520a2cb4b90225228354d7f1e

SHA512
57f59411503eb9cfef72610113063935cb4058abe0e016449213b4fc8bcf33cbe7943fbc5528917f361cf1433648cd1b5915b0de94bf7099a27ea02d73e0e462

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
432KB

MD5
0e35b31b0b0ee6113c7c98c18766a8b8

SHA1
2522d146c616a03f3e18ad072eb2356bf7b43620

SHA256
a2adb907bd01d469dc0f987f8ce226f5700c821750cbf88063cf94239e697eb7

SHA512
aedabbafd0e9658e205a93d2321ea457d9dbdf07901aa377e289a1ac68a14aa4998c3e4b4c437057a519442e549af8b632c601f819350c4212e9473eb6434a84

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
432KB

MD5
70591178e36776b0e59fea2f5d12b8af

SHA1
e970f21205582ed4fbe6a60f65b6ab18501f00cc

SHA256
385d599ebb74f9fa003e660557526634506239c7a4be09c9e70e9b4cd77623f7

SHA512
1d88dfe4b20e0986dac91b1b960ae677ef0b800169c541b68daefc700e9566860194a899a3d7bb62b8ac730dd6ad191362a17930adad1a650e00f2cfc8f63473

Download Submit
C:\Windows\SysWOW64\Ibqpimpl.exe

Filesize
432KB

MD5
4387cbcec8f679ec1f232225a0cdf39e

SHA1
2786e8e004dd33b18335daf2a575a9bc568df564

SHA256
282bc372df68d7517d941a9d627eb736a1c12520a218494a7c24495ee1b6b39a

SHA512
274549e4dd902fe278a087ffcaa9f296bc32b50aec9a78eacd08a78ee668c2cc6529171780a35605dbccaec14fa34738bd4b9869baf7223f4e815c42ee7bc70a

Download Submit
C:\Windows\SysWOW64\Ibqpimpl.exe

Filesize
432KB

MD5
4387cbcec8f679ec1f232225a0cdf39e

SHA1
2786e8e004dd33b18335daf2a575a9bc568df564

SHA256
282bc372df68d7517d941a9d627eb736a1c12520a218494a7c24495ee1b6b39a

SHA512
274549e4dd902fe278a087ffcaa9f296bc32b50aec9a78eacd08a78ee668c2cc6529171780a35605dbccaec14fa34738bd4b9869baf7223f4e815c42ee7bc70a

Download Submit
C:\Windows\SysWOW64\Ilidbbgl.exe

Filesize
432KB

MD5
925892c454a50d4b0422c6097020d0bb

SHA1
40b1646ab65e4d460835341acf6f8a7c9b8dcf1d

SHA256
b28423dc29f51796ef029d303fac3cf826bd54e2fe0768a343642630ad1627b9

SHA512
3cfbcdc240a26dbf49eb4c5fc4600061e6be6fa7275d5977d32a71a537bf32c969e9122386ff32be128e687f9f40c29f3b73cd4935acdab178a754f7bb7e4e1d

Download Submit
C:\Windows\SysWOW64\Ilidbbgl.exe

Filesize
432KB

MD5
925892c454a50d4b0422c6097020d0bb

SHA1
40b1646ab65e4d460835341acf6f8a7c9b8dcf1d

SHA256
b28423dc29f51796ef029d303fac3cf826bd54e2fe0768a343642630ad1627b9

SHA512
3cfbcdc240a26dbf49eb4c5fc4600061e6be6fa7275d5977d32a71a537bf32c969e9122386ff32be128e687f9f40c29f3b73cd4935acdab178a754f7bb7e4e1d

Download Submit
C:\Windows\SysWOW64\Imdgqfbd.exe

Filesize
432KB

MD5
27b24b7c9b78f09731742a3405522829

SHA1
f5f6032e7c2aca2b19530fca87307aa5444c727f

SHA256
717183a148a13f008a59fb33c0475ea7cd5c24e86711cd51af0ffa79472bfb5b

SHA512
30674892d074736015dc672d7bea3f4f11c57b4f358827b95dbfd4df6a836802720c0e0ab630e81306fd713ce4ef5361b41138159b816f4543d550205f109c8f

Download Submit
C:\Windows\SysWOW64\Imdgqfbd.exe

Filesize
432KB

MD5
27b24b7c9b78f09731742a3405522829

SHA1
f5f6032e7c2aca2b19530fca87307aa5444c727f

SHA256
717183a148a13f008a59fb33c0475ea7cd5c24e86711cd51af0ffa79472bfb5b

SHA512
30674892d074736015dc672d7bea3f4f11c57b4f358827b95dbfd4df6a836802720c0e0ab630e81306fd713ce4ef5361b41138159b816f4543d550205f109c8f

Download Submit
C:\Windows\SysWOW64\Jbhfjljd.exe

Filesize
432KB

MD5
79be76a824aa3b23fe5f78786b1a0f0c

SHA1
503b37047cace0eaf039fac8c9c00bd14930dcd1

SHA256
de042986f728397c7f478e9161fb7cb2bd79706d4b0e3c664960146ccb7ed352

SHA512
0f3d7b078506b48a71962b359d280701cb717ae542659fad6bec6aa64a333f82fcaee6d9afb5fe0859c9edf6145cd36ca18c47bcbff57957928f33f9bbcf6560

Download Submit
C:\Windows\SysWOW64\Jbhfjljd.exe

Filesize
432KB

MD5
79be76a824aa3b23fe5f78786b1a0f0c

SHA1
503b37047cace0eaf039fac8c9c00bd14930dcd1

SHA256
de042986f728397c7f478e9161fb7cb2bd79706d4b0e3c664960146ccb7ed352

SHA512
0f3d7b078506b48a71962b359d280701cb717ae542659fad6bec6aa64a333f82fcaee6d9afb5fe0859c9edf6145cd36ca18c47bcbff57957928f33f9bbcf6560

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
432KB

MD5
5d2f28a1236b0eff457e6cf899ab2cbc

SHA1
5d9abf9fd3e8b576b24ac1861c77e3af27502f6c

SHA256
8d2ceb59b8172573a2ab54db50553c261e6b5223cffa387d6e7741ab7f50be65

SHA512
226498c71e7c696a8140fdc1b580c41c29c5467c60e94b264b68fcc69b3c07d6fa91469d07d600da6aca6812ee515af4ee71da3f2315ea6c5c0fdb0520b5a2ff

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
432KB

MD5
5d2f28a1236b0eff457e6cf899ab2cbc

SHA1
5d9abf9fd3e8b576b24ac1861c77e3af27502f6c

SHA256
8d2ceb59b8172573a2ab54db50553c261e6b5223cffa387d6e7741ab7f50be65

SHA512
226498c71e7c696a8140fdc1b580c41c29c5467c60e94b264b68fcc69b3c07d6fa91469d07d600da6aca6812ee515af4ee71da3f2315ea6c5c0fdb0520b5a2ff

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
432KB

MD5
43f75ff587fc644b494b14ead3655635

SHA1
74a42c750389f8145130b103df11090dda4ba143

SHA256
07847264d97a32b99ae73c4db77739e639c06620aa9697262b6aff27e5dc94d7

SHA512
b38472a91e7a23a39875db5ff37651dee63700acabee095a132cccac2c10c6392b6d7ac21d6eb977e0f5c5fc94b17b31120a12d2e265b11545e2d1639afcf190

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
432KB

MD5
43f75ff587fc644b494b14ead3655635

SHA1
74a42c750389f8145130b103df11090dda4ba143

SHA256
07847264d97a32b99ae73c4db77739e639c06620aa9697262b6aff27e5dc94d7

SHA512
b38472a91e7a23a39875db5ff37651dee63700acabee095a132cccac2c10c6392b6d7ac21d6eb977e0f5c5fc94b17b31120a12d2e265b11545e2d1639afcf190

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
432KB

MD5
9761dd6bb38f09718e31582fd2377500

SHA1
d2624a5f2aa33ed87a37d84f08d646c454105578

SHA256
aeb5f559fd268b1d53dc7bdc020fbda29a45d7a3e2dd4c165915360ba01d3c10

SHA512
866653a201c7e69aa5f9e3bae386c7be26f7877c6e20936dfaabe67035353879f0a6d49fe059052aed3aaa57fd86d7e178dce9037d7edd3a7324052f052a3219

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
432KB

MD5
9761dd6bb38f09718e31582fd2377500

SHA1
d2624a5f2aa33ed87a37d84f08d646c454105578

SHA256
aeb5f559fd268b1d53dc7bdc020fbda29a45d7a3e2dd4c165915360ba01d3c10

SHA512
866653a201c7e69aa5f9e3bae386c7be26f7877c6e20936dfaabe67035353879f0a6d49fe059052aed3aaa57fd86d7e178dce9037d7edd3a7324052f052a3219

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
432KB

MD5
d7379bdaa01f626c79459932f64b2e3a

SHA1
fd9f77e3b50257a4003c3f074eb1d535604c1e02

SHA256
c2636008c8fff667657f38817074ada063863ea4eb106cb33b93e3f44a12b126

SHA512
ad0f2963d144d88f74516b81a3b7af6f358e9dc579606bd08cd5aec56e3e2263b4f2eb9b43981baebe9a34181aec36572b05419eed49e2217673c8dfc1c712f0

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
432KB

MD5
d7379bdaa01f626c79459932f64b2e3a

SHA1
fd9f77e3b50257a4003c3f074eb1d535604c1e02

SHA256
c2636008c8fff667657f38817074ada063863ea4eb106cb33b93e3f44a12b126

SHA512
ad0f2963d144d88f74516b81a3b7af6f358e9dc579606bd08cd5aec56e3e2263b4f2eb9b43981baebe9a34181aec36572b05419eed49e2217673c8dfc1c712f0

Download Submit
C:\Windows\SysWOW64\Jmhale32.exe

Filesize
432KB

MD5
7499149e0951713bcd0944df836e6e5d

SHA1
5d92cc675fd1e7de6e93223c681a59ac868a1997

SHA256
565f08dd609a335735786da68c1f41427dc4bdbe56aff82a5fec1736834c3082

SHA512
79965a1d5ba1d4c89e5221f21f8b1e0144c2b2c87fe41470f7cff23429f316c14631b78292527aaeb13b405ac51bccc6b413136f7a9c136088d30042ffd1daa0

Download Submit
C:\Windows\SysWOW64\Jmhale32.exe

Filesize
432KB

MD5
7499149e0951713bcd0944df836e6e5d

SHA1
5d92cc675fd1e7de6e93223c681a59ac868a1997

SHA256
565f08dd609a335735786da68c1f41427dc4bdbe56aff82a5fec1736834c3082

SHA512
79965a1d5ba1d4c89e5221f21f8b1e0144c2b2c87fe41470f7cff23429f316c14631b78292527aaeb13b405ac51bccc6b413136f7a9c136088d30042ffd1daa0

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
432KB

MD5
b1693f86b9350deb723786427374dcd3

SHA1
b8f0a5ce122735d7b85b44d96a25ee8b21057960

SHA256
572d6d15bfb07c29d5221f0c4dae38006cdbe69104113e7c915266218cf0d6d9

SHA512
40fc5e3c72230f147dab83fc0eb50dda6f20786454cf108bdaefc0332bf5bc71502f520a9bca3b0e38a8b87d13ae87a5cfba706cf3c8feb7bf41e6a06c2d40aa

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
432KB

MD5
b1693f86b9350deb723786427374dcd3

SHA1
b8f0a5ce122735d7b85b44d96a25ee8b21057960

SHA256
572d6d15bfb07c29d5221f0c4dae38006cdbe69104113e7c915266218cf0d6d9

SHA512
40fc5e3c72230f147dab83fc0eb50dda6f20786454cf108bdaefc0332bf5bc71502f520a9bca3b0e38a8b87d13ae87a5cfba706cf3c8feb7bf41e6a06c2d40aa

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
432KB

MD5
fd80c054b143891a44b6276619b55686

SHA1
06337ce85068ac618b594d6e7810af892952ff61

SHA256
84d8c26353828052f6fb4460fe6454ad8b7e520390236233a2938a875819c141

SHA512
659aa7a8e808e6e4970f882e689b19c5bd055ea9e0c821774b551365b2296e667862daa965d66eddb3f1dc2d56929092a8bde9ef9939af8e228d7e16991de03b

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
432KB

MD5
fd80c054b143891a44b6276619b55686

SHA1
06337ce85068ac618b594d6e7810af892952ff61

SHA256
84d8c26353828052f6fb4460fe6454ad8b7e520390236233a2938a875819c141

SHA512
659aa7a8e808e6e4970f882e689b19c5bd055ea9e0c821774b551365b2296e667862daa965d66eddb3f1dc2d56929092a8bde9ef9939af8e228d7e16991de03b

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
432KB

MD5
f84a077be94da12bb4d4c5a3d6599592

SHA1
98fe3555645690e2290fe8a51bb1dc64baec5966

SHA256
73ad043af1e21e9a3749b84c4f7c15c328cb43d02bd12428202353b6cc8284ef

SHA512
bec3f8ab73aaa6131d87112dc4315a019ebbef8afcc8949ce064793bbbace53968f97191abe9c533aa42d7891d115700241fa7bd12dd6c128ff855ac7ddb15aa

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
432KB

MD5
f84a077be94da12bb4d4c5a3d6599592

SHA1
98fe3555645690e2290fe8a51bb1dc64baec5966

SHA256
73ad043af1e21e9a3749b84c4f7c15c328cb43d02bd12428202353b6cc8284ef

SHA512
bec3f8ab73aaa6131d87112dc4315a019ebbef8afcc8949ce064793bbbace53968f97191abe9c533aa42d7891d115700241fa7bd12dd6c128ff855ac7ddb15aa

Download Submit
C:\Windows\SysWOW64\Mdehlk32.exe

Filesize
432KB

MD5
aa94227207dd0a7a045e6cb45d194954

SHA1
91b01be2d314f9587c9b831d342c582d1202cf77

SHA256
4e6c2d98d1cfc0b5204e89464782daeec6440e0beafb0d449f048fc46abd5381

SHA512
ec4b941205f728c441b279ce6e2f5ec46f85bcde21e174c7725fde9107d0b6cc0f66828d43d58f69f8b9d87ccfeae85367d3eca7e9c65b1488fbae68ee746e37

Download Submit
C:\Windows\SysWOW64\Mdehlk32.exe

Filesize
432KB

MD5
aa94227207dd0a7a045e6cb45d194954

SHA1
91b01be2d314f9587c9b831d342c582d1202cf77

SHA256
4e6c2d98d1cfc0b5204e89464782daeec6440e0beafb0d449f048fc46abd5381

SHA512
ec4b941205f728c441b279ce6e2f5ec46f85bcde21e174c7725fde9107d0b6cc0f66828d43d58f69f8b9d87ccfeae85367d3eca7e9c65b1488fbae68ee746e37

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
432KB

MD5
991622adb625bd6839430d8e07361e30

SHA1
89b595560a1144e22b8efaf71f3c30edefed363a

SHA256
5caa062bdefdc3286d9e5515df49d450a6c90841b6080cce7fdb47aab879e148

SHA512
dae9f72d312427ce4feb5b6532a4bf5fe835dfa0d969d27f086f7c205d887cfe38af5a3f61584e956b5a056ec5c1c0d8961d21e97bec7dc2a4f64a7f0719904d

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
432KB

MD5
991622adb625bd6839430d8e07361e30

SHA1
89b595560a1144e22b8efaf71f3c30edefed363a

SHA256
5caa062bdefdc3286d9e5515df49d450a6c90841b6080cce7fdb47aab879e148

SHA512
dae9f72d312427ce4feb5b6532a4bf5fe835dfa0d969d27f086f7c205d887cfe38af5a3f61584e956b5a056ec5c1c0d8961d21e97bec7dc2a4f64a7f0719904d

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
432KB

MD5
d3d18369f35d4ef0ea1434b81ac55a36

SHA1
5bd67028156ac43e04ac0598bfb64d18bf1e5373

SHA256
eec125d94f7aca465780cdcd2eb8af0a8116d72760109818843dc361af6394c8

SHA512
40cfb4af2791df0150143bf94422ee415b0b43a7e52b0356873ec089b029e710e18e208deaddb3a743c42ae7184b24e7820fbb331f40129b91832f5e55f5bd7f

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
432KB

MD5
d3d18369f35d4ef0ea1434b81ac55a36

SHA1
5bd67028156ac43e04ac0598bfb64d18bf1e5373

SHA256
eec125d94f7aca465780cdcd2eb8af0a8116d72760109818843dc361af6394c8

SHA512
40cfb4af2791df0150143bf94422ee415b0b43a7e52b0356873ec089b029e710e18e208deaddb3a743c42ae7184b24e7820fbb331f40129b91832f5e55f5bd7f

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
432KB

MD5
2271c4ed7ae2bd02ee8fe529b6568f8c

SHA1
84510ef8705c34d39023a702b0b51203b74ca2f1

SHA256
69f912c03ce977bff57c425f71f4c107ef6855bf540b59541fdcb653dc1f76a5

SHA512
58b9357ff086bb9abae6f47e6a8f6b2b3bc28d9d51c8c0f329c2573aff998db63844e2ea2af554b80c7f52bc834183007d46da0e695ff5a6a13c46c79216ce1f

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
432KB

MD5
2271c4ed7ae2bd02ee8fe529b6568f8c

SHA1
84510ef8705c34d39023a702b0b51203b74ca2f1

SHA256
69f912c03ce977bff57c425f71f4c107ef6855bf540b59541fdcb653dc1f76a5

SHA512
58b9357ff086bb9abae6f47e6a8f6b2b3bc28d9d51c8c0f329c2573aff998db63844e2ea2af554b80c7f52bc834183007d46da0e695ff5a6a13c46c79216ce1f

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
432KB

MD5
7ed7ff6c8c559e55cfb1239269c8adf6

SHA1
f91439345bd7d63cad86d230e8b58037071b9e4a

SHA256
deac985562c2586286976272c8fa19a32599a9a7c7f85e4ca97ae6a6fadc3d14

SHA512
ec11f730b28a54802312e16f2cd127e94f8456b5dbeb3b518af05ef1cdf2eb019042c5ad77a490b6885a033ca59b4ad7757d580d962eade2c143d843571c51e1

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
432KB

MD5
7ed7ff6c8c559e55cfb1239269c8adf6

SHA1
f91439345bd7d63cad86d230e8b58037071b9e4a

SHA256
deac985562c2586286976272c8fa19a32599a9a7c7f85e4ca97ae6a6fadc3d14

SHA512
ec11f730b28a54802312e16f2cd127e94f8456b5dbeb3b518af05ef1cdf2eb019042c5ad77a490b6885a033ca59b4ad7757d580d962eade2c143d843571c51e1

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
432KB

MD5
68aa58da75da5592398b2c08b6c9f7cc

SHA1
5b6bfe9086222f01d9e3b4564e42413aad8ede44

SHA256
4c70de87eb0c183b6d6f30684d8dde9bf594be5e24736f382f283d3738978bcd

SHA512
dc8ec6ad7247694cb45a0bd940b4fa4baa8803d0dc6c3a8dc13d16b509b07dc9a08502fa58a9852ced7e4d52413a4518621298c7723ec8eecaffe5f50dbb82f8

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
432KB

MD5
68aa58da75da5592398b2c08b6c9f7cc

SHA1
5b6bfe9086222f01d9e3b4564e42413aad8ede44

SHA256
4c70de87eb0c183b6d6f30684d8dde9bf594be5e24736f382f283d3738978bcd

SHA512
dc8ec6ad7247694cb45a0bd940b4fa4baa8803d0dc6c3a8dc13d16b509b07dc9a08502fa58a9852ced7e4d52413a4518621298c7723ec8eecaffe5f50dbb82f8

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
432KB

MD5
09948ba0d8914fc58d6d2de7a770986c

SHA1
5b7afcb0bd7edcab0ee6f9753da8cdb5fe9100a1

SHA256
77c3b03ffc3cc28bb4a07ae1584eda9f1f4b6f3ad4ae22b6b4a2674ddef7a8c7

SHA512
9ec4c55e8f68180c0ea0204f7262be1be47a419ba2f7d9d490b5ad40737a330b793cb196a66faaf1c590b5b4df189c0b44d6c3d9cfd14e96bfc6a3d77625d863

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
432KB

MD5
09948ba0d8914fc58d6d2de7a770986c

SHA1
5b7afcb0bd7edcab0ee6f9753da8cdb5fe9100a1

SHA256
77c3b03ffc3cc28bb4a07ae1584eda9f1f4b6f3ad4ae22b6b4a2674ddef7a8c7

SHA512
9ec4c55e8f68180c0ea0204f7262be1be47a419ba2f7d9d490b5ad40737a330b793cb196a66faaf1c590b5b4df189c0b44d6c3d9cfd14e96bfc6a3d77625d863

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
432KB

MD5
5c85dc876a71ba180822a8d89a6f979b

SHA1
76d80df49f7b6f7caa1ed9db793a1062ab3d888c

SHA256
76751c3b90f88b23e677d4d940f2a1dbc26dcec4f75eb8ff44af57ffa848a7e7

SHA512
e895e2c8cce637e0efaa8e08ef5007d120b7b1109dd929e339b42cbe7d63362f412d4838d089e21001ed2c31d2a34a651d57f86e2e116d0c6775f7a4a16fb546

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
432KB

MD5
5c85dc876a71ba180822a8d89a6f979b

SHA1
76d80df49f7b6f7caa1ed9db793a1062ab3d888c

SHA256
76751c3b90f88b23e677d4d940f2a1dbc26dcec4f75eb8ff44af57ffa848a7e7

SHA512
e895e2c8cce637e0efaa8e08ef5007d120b7b1109dd929e339b42cbe7d63362f412d4838d089e21001ed2c31d2a34a651d57f86e2e116d0c6775f7a4a16fb546

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
432KB

MD5
e6e0a000a11d7a11ce6829eaaa1d2e6e

SHA1
a159c0cd45ad8b5fe8975acc8f88256e665a9e16

SHA256
549d1efa5587729ebed32ee4781883e863850302c3f448797f37cc82fcea01fd

SHA512
f343dec55ba693eb70caad87daf44c6a72f3bba9a615de408d8b4bad76e2d0c77ce167e5f194844c090393d386f169359c196de4793eb648f389fb3ca07453f3

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
432KB

MD5
e6e0a000a11d7a11ce6829eaaa1d2e6e

SHA1
a159c0cd45ad8b5fe8975acc8f88256e665a9e16

SHA256
549d1efa5587729ebed32ee4781883e863850302c3f448797f37cc82fcea01fd

SHA512
f343dec55ba693eb70caad87daf44c6a72f3bba9a615de408d8b4bad76e2d0c77ce167e5f194844c090393d386f169359c196de4793eb648f389fb3ca07453f3

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
432KB

MD5
92464473c9b4b454792be0c333310e4b

SHA1
4620368d2f645928ebd048728158e57ff4ae86f3

SHA256
213dfc796c41d838f37f101d8f581bca97fd6d9a7a24ea490a5ee3e818d88933

SHA512
710a03ec25cce59fdc9c1ac3fcbe24587d83a636850d991fbb451dbfffb055ed3bc63bdc0f01712d71cf09234e305d4d76ff7edb0b72ce22493567a53f731a33

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
432KB

MD5
92464473c9b4b454792be0c333310e4b

SHA1
4620368d2f645928ebd048728158e57ff4ae86f3

SHA256
213dfc796c41d838f37f101d8f581bca97fd6d9a7a24ea490a5ee3e818d88933

SHA512
710a03ec25cce59fdc9c1ac3fcbe24587d83a636850d991fbb451dbfffb055ed3bc63bdc0f01712d71cf09234e305d4d76ff7edb0b72ce22493567a53f731a33

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
432KB

MD5
d00ac3956ff07fd037f60abbd4f1bdcf

SHA1
6b0dcd2247a86abbf079f369b1479337130e107b

SHA256
0f19bb508790cd6559d89aa8cb8271c6d7d0c6bd3ba026cffea14db840dc49ee

SHA512
6d0fde75d66cd6c3cf088ea590a5422928a50f533421c4056284bc2c3fe85578ad8703979039caebdcdd2d27e57dbc7cf2d1e03a6706c75c64bfa893afaac4b3

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
432KB

MD5
d00ac3956ff07fd037f60abbd4f1bdcf

SHA1
6b0dcd2247a86abbf079f369b1479337130e107b

SHA256
0f19bb508790cd6559d89aa8cb8271c6d7d0c6bd3ba026cffea14db840dc49ee

SHA512
6d0fde75d66cd6c3cf088ea590a5422928a50f533421c4056284bc2c3fe85578ad8703979039caebdcdd2d27e57dbc7cf2d1e03a6706c75c64bfa893afaac4b3

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
432KB

MD5
59fe8cb8000e9fb2527a1f25f36895d9

SHA1
b5e417833334fb664057d2e6c8a63b7e31abad44

SHA256
839aaecaf61620f34f25b38887af44bb6fa8c62b5ac52602b0529759c13681cb

SHA512
736afcdd17b879f5e1d4e2e0aecda71670e2393522880d8b15238e3a1d88272b8a6f5cbf79519f2b7ed47bf09a5b6b5e9ae8d48472fd9ed674ea10417c87736f

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
432KB

MD5
59fe8cb8000e9fb2527a1f25f36895d9

SHA1
b5e417833334fb664057d2e6c8a63b7e31abad44

SHA256
839aaecaf61620f34f25b38887af44bb6fa8c62b5ac52602b0529759c13681cb

SHA512
736afcdd17b879f5e1d4e2e0aecda71670e2393522880d8b15238e3a1d88272b8a6f5cbf79519f2b7ed47bf09a5b6b5e9ae8d48472fd9ed674ea10417c87736f

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
432KB

MD5
27107a739d88c51551029f223207dc7f

SHA1
fec89a81278f833346be0068028ef07fad66ad27

SHA256
ae0157656ee24358601b2bffc606ad1cf633c2c454988457b4a0a37a61b0e122

SHA512
acb6f47fa63579eab7f1851e853a18c9aa645aa51f09f9cd00b2c67fc190d8820e0ce2c829a494ba160cc2fa97d757fd9da6ae83a20c797a5466d96493debe8e

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
432KB

MD5
27107a739d88c51551029f223207dc7f

SHA1
fec89a81278f833346be0068028ef07fad66ad27

SHA256
ae0157656ee24358601b2bffc606ad1cf633c2c454988457b4a0a37a61b0e122

SHA512
acb6f47fa63579eab7f1851e853a18c9aa645aa51f09f9cd00b2c67fc190d8820e0ce2c829a494ba160cc2fa97d757fd9da6ae83a20c797a5466d96493debe8e

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
432KB

MD5
f00d3690f0c782fc62e6d11c4e7be206

SHA1
ffebe2bc64d97cc8a1b30fae9456944f377e8620

SHA256
a75640c9902cfc7470b20005f2fddc1c050725326c5896b480b60b523d6cbb65

SHA512
d952fd71f8a0a7e652d021466315db731eb6613a3bede3b8fdfa266bfc329f0febafe3fc296ecafc6f8215bba41b1d3b99a86f8760c758c1ab58b71c1d45e592

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
432KB

MD5
f00d3690f0c782fc62e6d11c4e7be206

SHA1
ffebe2bc64d97cc8a1b30fae9456944f377e8620

SHA256
a75640c9902cfc7470b20005f2fddc1c050725326c5896b480b60b523d6cbb65

SHA512
d952fd71f8a0a7e652d021466315db731eb6613a3bede3b8fdfa266bfc329f0febafe3fc296ecafc6f8215bba41b1d3b99a86f8760c758c1ab58b71c1d45e592

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
432KB

MD5
66f0ca86e127245908e03f64e2b716df

SHA1
817a453902b1afb609917ae70b4f1a297f47e335

SHA256
27864955fe2add0f915fcb2992c4e491ebdaa2e00bdbb6ce45dcb305ccf8f024

SHA512
81e4417b62cd03418a469c10c8028755aa9b3f36ffa80141ae64fe2cde5570f408b42eaf6275ec84c00fc27b4ffd2967ae8f8ce0aabc1f643b3244ee4250ca68

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
432KB

MD5
66f0ca86e127245908e03f64e2b716df

SHA1
817a453902b1afb609917ae70b4f1a297f47e335

SHA256
27864955fe2add0f915fcb2992c4e491ebdaa2e00bdbb6ce45dcb305ccf8f024

SHA512
81e4417b62cd03418a469c10c8028755aa9b3f36ffa80141ae64fe2cde5570f408b42eaf6275ec84c00fc27b4ffd2967ae8f8ce0aabc1f643b3244ee4250ca68

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
432KB

MD5
ebbaebacaeec3c69eb98c45a36510813

SHA1
a2e4175e74878d13ddaf19a73ea3649b7bd718d1

SHA256
1bb1b945c09ae1dcb476ea369284d583700051857ca50f8153fe198add6284bf

SHA512
ee2d2ff8b08659c88a28abfa10eadceaa36f936c951944ab0876a4e1754c17d04294abc66b5c75585a9accab6b4f6f824921192d9cc6128e4e96d8623a6eadcf

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
432KB

MD5
ebbaebacaeec3c69eb98c45a36510813

SHA1
a2e4175e74878d13ddaf19a73ea3649b7bd718d1

SHA256
1bb1b945c09ae1dcb476ea369284d583700051857ca50f8153fe198add6284bf

SHA512
ee2d2ff8b08659c88a28abfa10eadceaa36f936c951944ab0876a4e1754c17d04294abc66b5c75585a9accab6b4f6f824921192d9cc6128e4e96d8623a6eadcf

Download Submit
C:\Windows\SysWOW64\Opakbi32.exe

Filesize
432KB

MD5
2b8567df8a7a51879ec4f755028d3d26

SHA1
8d17d29d71f8c556bcf027fd9e7e70b4a2dc6a2c

SHA256
8dcc54b1181facc87f7afc2c858501202ddfc8aefc1637014ac72335c31946e7

SHA512
b099554d73fba5c06786de1e6995ad4b8050f2ed20b1574ec311b255e5d973bbe150f960ab3469a23786a468ff38f4f9f780e3fe10f002f8f8cd626019f1eeb8

Download Submit
C:\Windows\SysWOW64\Opakbi32.exe

Filesize
432KB

MD5
2b8567df8a7a51879ec4f755028d3d26

SHA1
8d17d29d71f8c556bcf027fd9e7e70b4a2dc6a2c

SHA256
8dcc54b1181facc87f7afc2c858501202ddfc8aefc1637014ac72335c31946e7

SHA512
b099554d73fba5c06786de1e6995ad4b8050f2ed20b1574ec311b255e5d973bbe150f960ab3469a23786a468ff38f4f9f780e3fe10f002f8f8cd626019f1eeb8

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
432KB

MD5
3748e01e39ededf2cd5650d3331c85c7

SHA1
4c4afdfac390cb1c9fe567bac9c4363400c30657

SHA256
4a4dc89c0d00c10600902dfd153adf2ee131957753481b5b802f174ee605cdd3

SHA512
5c785cb8d76320e840df2bb3dfb5ae2edb93651df0e36cbe2dfc828e82dcca8cc5266318a5fad3e079493aab75abd7c028f2e1eb7ec4efdf0d670857d03a4bda

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
432KB

MD5
3748e01e39ededf2cd5650d3331c85c7

SHA1
4c4afdfac390cb1c9fe567bac9c4363400c30657

SHA256
4a4dc89c0d00c10600902dfd153adf2ee131957753481b5b802f174ee605cdd3

SHA512
5c785cb8d76320e840df2bb3dfb5ae2edb93651df0e36cbe2dfc828e82dcca8cc5266318a5fad3e079493aab75abd7c028f2e1eb7ec4efdf0d670857d03a4bda

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
432KB

MD5
f29b36c56e49254c204fec1396b89ffb

SHA1
0e44c6fdac549179dbe43e17975834cff10109d6

SHA256
fd554b0b6d27b4a14d72a8ca71ef2dab18dbe2da700253a3749b65749ffdd61a

SHA512
2e0edb9210907a46180d5edb363dbceff7a40fd08e9016559e91568ce5f4269fdf5f0f9ae31cc4464effcf743cc47b209533f145f0382c57ce57aebee9d65944

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
432KB

MD5
f29b36c56e49254c204fec1396b89ffb

SHA1
0e44c6fdac549179dbe43e17975834cff10109d6

SHA256
fd554b0b6d27b4a14d72a8ca71ef2dab18dbe2da700253a3749b65749ffdd61a

SHA512
2e0edb9210907a46180d5edb363dbceff7a40fd08e9016559e91568ce5f4269fdf5f0f9ae31cc4464effcf743cc47b209533f145f0382c57ce57aebee9d65944

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
432KB

MD5
265478694d59f8405a79aad1f81ac0ae

SHA1
0fe29ee6f117a31b9db4bdffb39b6b422058ba1a

SHA256
b48125066e4483b927d782cb3ead0317741557bd8042349c3c5fecdef9975503

SHA512
e3ab458d0fa2992fd50087fee9b56901d24ce7e2c6a263644c02b875b83bbc3d982b949e78cebcb612da7057db3a843e60b0f375c341f4dca8683e46c69cbb8f

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
432KB

MD5
265478694d59f8405a79aad1f81ac0ae

SHA1
0fe29ee6f117a31b9db4bdffb39b6b422058ba1a

SHA256
b48125066e4483b927d782cb3ead0317741557bd8042349c3c5fecdef9975503

SHA512
e3ab458d0fa2992fd50087fee9b56901d24ce7e2c6a263644c02b875b83bbc3d982b949e78cebcb612da7057db3a843e60b0f375c341f4dca8683e46c69cbb8f

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
432KB

MD5
e033a13c2b21b21479a62cf72c255cba

SHA1
26e9e43d7a578d1e5058abe2e971de67dc4121b4

SHA256
27f57d87aacf47b8458d409a8dccaf26e6f4a2a329d0645f2db98469987487d8

SHA512
17cbbee97f47aee3e3ff90fd85caa285ddef0aef36db84a3755cfd65a17d075a73f0c79343aef688487129aabe2a9172e48bd68bdf62634af6c9e205e64250ab

Download Submit
memory/212-334-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/220-231-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/396-34-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/428-382-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/624-216-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/940-352-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1000-340-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1104-207-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1124-200-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1180-358-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1240-364-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1248-278-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1304-80-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1352-394-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1356-292-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1420-112-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1432-322-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1452-412-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1628-310-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1680-306-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2004-424-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2016-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2072-376-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2144-436-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2548-248-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2592-180-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2676-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2824-140-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2996-298-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3052-255-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3268-123-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3288-316-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3368-406-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3416-104-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3492-223-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3620-273-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3660-422-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3724-151-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3840-280-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4036-430-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4052-244-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4124-286-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4168-346-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4204-370-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4276-173-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4312-78-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4316-79-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4332-267-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4336-388-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4440-24-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4468-95-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4548-192-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4596-128-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4660-160-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4676-148-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4752-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4788-442-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4808-48-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4880-88-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4920-56-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4932-184-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4944-39-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4992-328-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5084-400-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads