Analysis
- max time kernel
97s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2024, 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
- Target 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe
- Size 96KB
- Sample241107-dkk2bavblp
- SHA256 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243
- MD5 61182b496753e4f342c7ee3bc7117e60
- SHA1 1e401e713132ec4e69e6c5a4d63d20a3940d2806
- SHA512 7f3b0b32082ca31ef66e904cd2c596ba9b191436d82ec3a8569ecd58ca166c8f2c409bd567a155334f7d7550168ea631460d3c232bdae685c53d4ef39c1a8446
- SSDEEP 1536:FZ4iimZ67BzXUkq5Y9LTFyXdvRLR90p2LLaIZTJ+7LhkiB0MPiKeEAgH:EA6azG/kRLR9xLaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://crutop.nu/index.php
-
http://crutop.ru/index.php
-
http://mazafaka.ru/index.php
-
http://color-bank.ru/index.php
-
http://asechka.ru/index.php
-
http://trojan.ru/index.php
-
http://fuck.ru/index.php
-
http://goldensand.ru/index.php
-
http://filesearch.ru/index.php
-
http://devx.nm.ru/index.php
-
http://ros-neftbank.ru/index.php
-
http://lovingod.host.sk/index.php
-
http://www.redline.ru/index.php
-
http://cvv.ru/index.php
-
http://hackers.lv/index.php
-
http://fethard.biz/index.php
-
http://ldark.nm.ru/index.htm
-
http://gaz-prom.ru/index.htm
-
http://promo.ru/index.htm
-
http://potleaf.chat.ru/index.htm
-
http://kadet.ru/index.htm
-
http://cvv.ru/index.htm
-
http://crutop.nu/index.htm
-
http://crutop.ru/index.htm
-
http://mazafaka.ru/index.htm
-
http://xware.cjb.net/index.htm
-
http://konfiskat.org/index.htm
-
http://parex-bank.ru/index.htm
-
http://kidos-bank.ru/index.htm
-
http://kavkaz.ru/index.htm
-
http://fethard.biz/index.htm
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cffdpghg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cffdpghg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhhnpjmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djgjlelk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmefhako.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddonekbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmqmma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dfpgffpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdhhdlid.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Danecp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Danecp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddonekbl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dkifae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmgbnq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deokon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Deokon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Daekdooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddjejl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djdmffnn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djgjlelk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdhhdlid.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddjejl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmgbnq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djdmffnn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmqmma32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfpgffpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dgbdlf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhhnpjmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dmefhako.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dkifae32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daekdooc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgbdlf32.exe - Berbew family
- Executes dropped EXE 18 IoCs
pid Process 1028 Cdhhdlid.exe 1884 Cffdpghg.exe 3504 Cmqmma32.exe 216 Ddjejl32.exe 2692 Djdmffnn.exe 2400 Danecp32.exe 3008 Dhhnpjmh.exe 4828 Djgjlelk.exe 2120 Dmefhako.exe 4880 Ddonekbl.exe 4064 Dkifae32.exe 3120 Dmgbnq32.exe 3948 Deokon32.exe 4456 Dfpgffpm.exe 2924 Dogogcpo.exe 4820 Daekdooc.exe 3660 Dgbdlf32.exe 316 Dmllipeg.exe - Drops file in System32 directory 54 IoCs
description ioc Process File created C:\Windows\SysWOW64\Ddjejl32.exe Cmqmma32.exe File opened for modification C:\Windows\SysWOW64\Dhhnpjmh.exe Danecp32.exe File created C:\Windows\SysWOW64\Mjelcfha.dll Dmefhako.exe File opened for modification C:\Windows\SysWOW64\Dkifae32.exe Ddonekbl.exe File opened for modification C:\Windows\SysWOW64\Dmgbnq32.exe Dkifae32.exe File opened for modification C:\Windows\SysWOW64\Daekdooc.exe Dogogcpo.exe File created C:\Windows\SysWOW64\Ohmoom32.dll Dogogcpo.exe File created C:\Windows\SysWOW64\Dmgbnq32.exe Dkifae32.exe File created C:\Windows\SysWOW64\Gfghpl32.dll Daekdooc.exe File created C:\Windows\SysWOW64\Lbabpnmn.dll Dfpgffpm.exe File opened for modification C:\Windows\SysWOW64\Cdhhdlid.exe 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe File opened for modification C:\Windows\SysWOW64\Cffdpghg.exe Cdhhdlid.exe File created C:\Windows\SysWOW64\Dchfiejc.dll Cdhhdlid.exe File opened for modification C:\Windows\SysWOW64\Cmqmma32.exe Cffdpghg.exe File opened for modification C:\Windows\SysWOW64\Djdmffnn.exe Ddjejl32.exe File created C:\Windows\SysWOW64\Dhhnpjmh.exe Danecp32.exe File created C:\Windows\SysWOW64\Nbgngp32.dll Danecp32.exe File opened for modification C:\Windows\SysWOW64\Dmefhako.exe Djgjlelk.exe File created C:\Windows\SysWOW64\Pdheac32.dll Ddonekbl.exe File created C:\Windows\SysWOW64\Cffdpghg.exe Cdhhdlid.exe File created C:\Windows\SysWOW64\Cmqmma32.exe Cffdpghg.exe File opened for modification C:\Windows\SysWOW64\Ddjejl32.exe Cmqmma32.exe File opened for modification C:\Windows\SysWOW64\Ddonekbl.exe Dmefhako.exe File created C:\Windows\SysWOW64\Dgbdlf32.exe Daekdooc.exe File created C:\Windows\SysWOW64\Ihidnp32.dll Dkifae32.exe File opened for modification C:\Windows\SysWOW64\Deokon32.exe Dmgbnq32.exe File created C:\Windows\SysWOW64\Dmefhako.exe Djgjlelk.exe File created C:\Windows\SysWOW64\Dmllipeg.exe Dgbdlf32.exe File opened for modification C:\Windows\SysWOW64\Djgjlelk.exe Dhhnpjmh.exe File created C:\Windows\SysWOW64\Beeppfin.dll Dhhnpjmh.exe File created C:\Windows\SysWOW64\Deokon32.exe Dmgbnq32.exe File opened for modification C:\Windows\SysWOW64\Dfpgffpm.exe Deokon32.exe File opened for modification C:\Windows\SysWOW64\Dgbdlf32.exe Daekdooc.exe File created C:\Windows\SysWOW64\Agjbpg32.dll Djdmffnn.exe File created C:\Windows\SysWOW64\Djgjlelk.exe Dhhnpjmh.exe File created C:\Windows\SysWOW64\Gidbim32.dll Djgjlelk.exe File created C:\Windows\SysWOW64\Hfanhp32.dll Cmqmma32.exe File created C:\Windows\SysWOW64\Dogogcpo.exe Dfpgffpm.exe File opened for modification C:\Windows\SysWOW64\Danecp32.exe Djdmffnn.exe File opened for modification C:\Windows\SysWOW64\Dmllipeg.exe Dgbdlf32.exe File created C:\Windows\SysWOW64\Lpggmhkg.dll 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe File created C:\Windows\SysWOW64\Kmdjdl32.dll Deokon32.exe File opened for modification C:\Windows\SysWOW64\Dogogcpo.exe Dfpgffpm.exe File created C:\Windows\SysWOW64\Daekdooc.exe Dogogcpo.exe File created C:\Windows\SysWOW64\Kngpec32.dll Dgbdlf32.exe File created C:\Windows\SysWOW64\Amfoeb32.dll Dmgbnq32.exe File created C:\Windows\SysWOW64\Cdhhdlid.exe 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe File created C:\Windows\SysWOW64\Okgoadbf.dll Cffdpghg.exe File created C:\Windows\SysWOW64\Hdhpgj32.dll Ddjejl32.exe File created C:\Windows\SysWOW64\Djdmffnn.exe Ddjejl32.exe File created C:\Windows\SysWOW64\Danecp32.exe Djdmffnn.exe File created C:\Windows\SysWOW64\Ddonekbl.exe Dmefhako.exe File created C:\Windows\SysWOW64\Dkifae32.exe Ddonekbl.exe File created C:\Windows\SysWOW64\Dfpgffpm.exe Deokon32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3944 316 WerFault.exe 103 - System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cffdpghg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Danecp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhhnpjmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmefhako.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deokon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfpgffpm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daekdooc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdhhdlid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djdmffnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddonekbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dogogcpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddjejl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djgjlelk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmqmma32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkifae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmgbnq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgbdlf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmllipeg.exe - Modifies registry class 57 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmgbnq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdhhdlid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddonekbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpggmhkg.dll" 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhhnpjmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll" Dmefhako.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfoeb32.dll" Dmgbnq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cffdpghg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddjejl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Deokon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll" Cmqmma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll" Dhhnpjmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dkifae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll" Dfpgffpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll" Dgbdlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll" Cdhhdlid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddjejl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Daekdooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Daekdooc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dkifae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll" Daekdooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll" Deokon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Deokon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdhhdlid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll" Cffdpghg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll" Ddonekbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmqmma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll" Djdmffnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Djgjlelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmgbnq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Djdmffnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dhhnpjmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll" Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dfpgffpm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dgbdlf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmefhako.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll" Dkifae32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dfpgffpm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Danecp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djgjlelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddonekbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cffdpghg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll" Ddjejl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll" Danecp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dmefhako.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll" Dogogcpo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmqmma32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Djdmffnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Danecp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dgbdlf32.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1564 wrote to memory of 1028 1564 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe 83 PID 1564 wrote to memory of 1028 1564 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe 83 PID 1564 wrote to memory of 1028 1564 57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe 83 PID 1028 wrote to memory of 1884 1028 Cdhhdlid.exe 84 PID 1028 wrote to memory of 1884 1028 Cdhhdlid.exe 84 PID 1028 wrote to memory of 1884 1028 Cdhhdlid.exe 84 PID 1884 wrote to memory of 3504 1884 Cffdpghg.exe 85 PID 1884 wrote to memory of 3504 1884 Cffdpghg.exe 85 PID 1884 wrote to memory of 3504 1884 Cffdpghg.exe 85 PID 3504 wrote to memory of 216 3504 Cmqmma32.exe 87 PID 3504 wrote to memory of 216 3504 Cmqmma32.exe 87 PID 3504 wrote to memory of 216 3504 Cmqmma32.exe 87 PID 216 wrote to memory of 2692 216 Ddjejl32.exe 88 PID 216 wrote to memory of 2692 216 Ddjejl32.exe 88 PID 216 wrote to memory of 2692 216 Ddjejl32.exe 88 PID 2692 wrote to memory of 2400 2692 Djdmffnn.exe 89 PID 2692 wrote to memory of 2400 2692 Djdmffnn.exe 89 PID 2692 wrote to memory of 2400 2692 Djdmffnn.exe 89 PID 2400 wrote to memory of 3008 2400 Danecp32.exe 91 PID 2400 wrote to memory of 3008 2400 Danecp32.exe 91 PID 2400 wrote to memory of 3008 2400 Danecp32.exe 91 PID 3008 wrote to memory of 4828 3008 Dhhnpjmh.exe 92 PID 3008 wrote to memory of 4828 3008 Dhhnpjmh.exe 92 PID 3008 wrote to memory of 4828 3008 Dhhnpjmh.exe 92 PID 4828 wrote to memory of 2120 4828 Djgjlelk.exe 93 PID 4828 wrote to memory of 2120 4828 Djgjlelk.exe 93 PID 4828 wrote to memory of 2120 4828 Djgjlelk.exe 93 PID 2120 wrote to memory of 4880 2120 Dmefhako.exe 94 PID 2120 wrote to memory of 4880 2120 Dmefhako.exe 94 PID 2120 wrote to memory of 4880 2120 Dmefhako.exe 94 PID 4880 wrote to memory of 4064 4880 Ddonekbl.exe 95 PID 4880 wrote to memory of 4064 4880 Ddonekbl.exe 95 PID 4880 wrote to memory of 4064 4880 Ddonekbl.exe 95 PID 4064 wrote to memory of 3120 4064 Dkifae32.exe 96 PID 4064 wrote to memory of 3120 4064 Dkifae32.exe 96 PID 4064 wrote to memory of 3120 4064 Dkifae32.exe 96 PID 3120 wrote to memory of 3948 3120 Dmgbnq32.exe 98 PID 3120 wrote to memory of 3948 3120 Dmgbnq32.exe 98 PID 3120 wrote to memory of 3948 3120 Dmgbnq32.exe 98 PID 3948 wrote to memory of 4456 3948 Deokon32.exe 99 PID 3948 wrote to memory of 4456 3948 Deokon32.exe 99 PID 3948 wrote to memory of 4456 3948 Deokon32.exe 99 PID 4456 wrote to memory of 2924 4456 Dfpgffpm.exe 100 PID 4456 wrote to memory of 2924 4456 Dfpgffpm.exe 100 PID 4456 wrote to memory of 2924 4456 Dfpgffpm.exe 100 PID 2924 wrote to memory of 4820 2924 Dogogcpo.exe 101 PID 2924 wrote to memory of 4820 2924 Dogogcpo.exe 101 PID 2924 wrote to memory of 4820 2924 Dogogcpo.exe 101 PID 4820 wrote to memory of 3660 4820 Daekdooc.exe 102 PID 4820 wrote to memory of 3660 4820 Daekdooc.exe 102 PID 4820 wrote to memory of 3660 4820 Daekdooc.exe 102 PID 3660 wrote to memory of 316 3660 Dgbdlf32.exe 103 PID 3660 wrote to memory of 316 3660 Dgbdlf32.exe 103 PID 3660 wrote to memory of 316 3660 Dgbdlf32.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe"C:\Users\Admin\AppData\Local\Temp\57892bd1cf681d3ff2db33d68f40433e61c7b78b1f816e227bfffe3aae0f5243N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\Cdhhdlid.exeC:\Windows\system32\Cdhhdlid.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\Cffdpghg.exeC:\Windows\system32\Cffdpghg.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\Cmqmma32.exeC:\Windows\system32\Cmqmma32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\Ddjejl32.exeC:\Windows\system32\Ddjejl32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\Djdmffnn.exeC:\Windows\system32\Djdmffnn.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\Danecp32.exeC:\Windows\system32\Danecp32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\Dhhnpjmh.exeC:\Windows\system32\Dhhnpjmh.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\Djgjlelk.exeC:\Windows\system32\Djgjlelk.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\Dmefhako.exeC:\Windows\system32\Dmefhako.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\Ddonekbl.exeC:\Windows\system32\Ddonekbl.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\Dkifae32.exeC:\Windows\system32\Dkifae32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\Dmgbnq32.exeC:\Windows\system32\Dmgbnq32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\Deokon32.exeC:\Windows\system32\Deokon32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\Dfpgffpm.exeC:\Windows\system32\Dfpgffpm.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\Dogogcpo.exeC:\Windows\system32\Dogogcpo.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\Daekdooc.exeC:\Windows\system32\Daekdooc.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\Dgbdlf32.exeC:\Windows\system32\Dgbdlf32.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\Dmllipeg.exeC:\Windows\system32\Dmllipeg.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 39620⤵
- Program crash
PID:3944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 316 -ip 3161⤵PID:4104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Cdhhdlid.exe
- Size 96KB
- SHA256 23448ef63182c6184cd8c8f19d4d5c54d460c4830cd8cc928acda0b8cccf2fc2
- MD5 1fea207ea5c35acf2605086d923117f2
- SHA1 bde5f27fbd7e7a357888b1eca4202bdf454f4b6c
- SHA512 54404ec6e0c6165669d276290955fefd14836b4866f6f7eed9943bf0042851af81efcdd4259f244d8df8a2881d2b782bcd0a6ac0a231a5fa00e8765c62d69146
- SSDEEP 1536:9qrZuKvoMckfi/PuFangzekqQVqVN1hHNFJ2LHaIZTJ+7LhkiB0MPiKeEAgH:Itbgvui/GEg1qQsVN1hrCHaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Cffdpghg.exe
- Size 96KB
- SHA256 b00f4de9d6848960e1df92d7bab6898c6d4366f741e9fa21b50289e7ce686586
- MD5 b089575f9579941ad01e9248946c0b3a
- SHA1 d1593dfa127f260e7a1b96ab58396327ceb2d20e
- SHA512 f2caa93af1b85fa4e836ebe4219178fd0a8998909f9380b29b80c16f2b48735477ae269ab49127717ef10fb402c36cc418d70331a0427da33aa646d23ed7880d
- SSDEEP 1536:HdYRTgiOGMBa61MGP2LIaIZTJ+7LhkiB0MPiKeEAgH:HdYxHi31MvIaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Cmqmma32.exe
- Size 96KB
- SHA256 805f41ec59128fc3effff10871df805f9e25e78ce1ddfbb4092058b70e9eb7f7
- MD5 9cafdca74c6007570ec27a5eea32025b
- SHA1 7f083eab87c035b5ea3eace8a729ad633fc3d7be
- SHA512 4f41d7035d03ef0bcfbba558a8ba4fa5a46d2e3909927be0ef346a8e44fe8a0010876d8ab46162f11da3257d28a7c189c95ef70cb604ca887188a43e0a8f7e58
- SSDEEP 1536:VZQAg8HZnVSnAqgTXcLoIsKm2L1aIZTJ+7LhkiB0MPiKeEAgH:HQAg8V4AqgTsL9L1aMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Daekdooc.exe
- Size 96KB
- SHA256 ba3939b794fd3d8500d9dbb5e4b799ced0fdbf8e10def09782e6bb6e96fc1c5b
- MD5 96643737324cffad8c01a0fd09e3690b
- SHA1 a49df6578687241044a198ef19866bebff2c707b
- SHA512 b01a68977ce25594464ad43e98b7a3c6f73cbef45d90869d15ec47cb10ddcb420b93957dc1515af3cd99b2ea58660ec468a48032c794134125266ee802125e2d
- SSDEEP 1536:vHnFT29rVTkzC60gPbTzbuMoDAoAooasW2L8iaIZTJ+7LhkiB0MPiKeEAgH:vHnIINDbksNas7taMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Danecp32.exe
- Size 96KB
- SHA256 96f7c25918de263e02413c0a2ba3eaa36ca2b36d44c27882ba4b8e2ce44150c6
- MD5 6b67532574eacb690b98b9f1027609ae
- SHA1 df22c8e6fc82f3afc42c384a09fae4e94cf1158d
- SHA512 ac78c5ddbe9102506af14b25c5e5f0f6abb29d13690efcdbbca98bc3084833e74d9c0613f15c700b16f9ba075069c264e6716853e13c2e33bf2d8f99e7745ea7
- SSDEEP 1536:/O9tMbS9zHzD2wwsfl1zthadc2LRaIZTJ+7LhkiB0MPiKeEAgH:KMW9zHn2wwsfl1ztha7RaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Ddjejl32.exe
- Size 96KB
- SHA256 b6f0fecc3f0ebb8b8e4e04d7db05deda2795681026039a1f0d8a5046177ab947
- MD5 f0dfeaa1579f2c6abd1f662dcdd1d658
- SHA1 126957275fc6b89c0e95420c71ac61dc3ab63ef1
- SHA512 48b19b066dfb8e9cac6162348a978d1b9cc7f424d8433f283017c0e1a9688f8248557085af52ea304984591b7fd9773016c2bd038df8e1e66bdce4a4a646a628
- SSDEEP 1536:GmlRo1u4Tyo2dJ1c4FvNM3EGgG2LcLaIZTJ+7LhkiB0MPiKeEAgH:VRo15TyoUhFvKLkAaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Ddonekbl.exe
- Size 96KB
- SHA256 dc59223e0eb9e191d1d3686812419419540fb70a1454a26f087aa9d68b222b79
- MD5 ea5b1e977291f2aeb351b4ccd1170366
- SHA1 47c44fa179b1ad64bd44f724af1dfb4485f25e02
- SHA512 423d49873beb2ac7eed491b50adf675f9509180e3f21f0b440605b85c30927d16924d516888c44143ab6687bfb05d367bf21467d8738b61fc5fac2d3ba07de7e
- SSDEEP 1536:ESu5plVd1aq6ZqbHkjPjlO7QGf2LBbaIZTJ+7LhkiB0MPiKeEAgH:bcpDdANZqbij474RaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Deokon32.exe
- Size 96KB
- SHA256 1790f0e6fd8ae0bd8baa5b633ab51d56f6683b219d0ec4db9dea69a1e434d4b2
- MD5 5181fb3645e4991b80db81d30ab8afd5
- SHA1 005ba519918dee8065be192be46aa4abcc13295c
- SHA512 bc9dc0331aa030ba8764f89283ba5fda92eaeb2e14ca290722709476b89510772a08c681673cf43a911f84dc22f5e734599fa76fed30805164a493c6e095a483
- SSDEEP 1536:3Sv9y4tXktXMFsnnSf5CBx7f2L9aIZTJ+7LhkiB0MPiKeEAgH:CvgIXk9MFTf5j9aMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dfpgffpm.exe
- Size 96KB
- SHA256 3c6d768c61a699aaca821bf3a6a8f823b56894cda47c6343e9347ea64dd047d3
- MD5 167806231554eadb062494459c50ad7f
- SHA1 c4ae12b234dfac89c4808a3aaf36509c9d741154
- SHA512 60c40872d1e8382c97ca6ee2a476da798d14ef405892e2561cd486dbd4a080901f093ac9ea6ad0315b803c746b403a18286b756e66e322271b52067ea64e7ac8
- SSDEEP 1536:zB3lTKyt9LrdZ1/PZCi1lR82LlaIZTJ+7LhkiB0MPiKeEAgH:Foyt9lZ1XZCi1VlaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dgbdlf32.exe
- Size 96KB
- SHA256 f2ae4ff503fab038e487911f7885e245135a8042851bfa4c5eca039ebddde9c1
- MD5 6b46b0c1bd7c0f820e9cce6ade0616d3
- SHA1 07b14bb8c046a33cd50d139c76ca5eefb3396763
- SHA512 ef904ba410254e9ac2e8c95adc35496dc92cd03d07fdc6a48426eca61600b28d5f20beb15a84797671ad3659640afad5a1bbad6a8b4b8b69b9ea72180b9045b6
- SSDEEP 1536:cHsAKwMaH83AXOT7KNzjYYeGeo2LZaIZTJ+7LhkiB0MPiKeEAgH:cHXBqAXvVjwZaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dhhnpjmh.exe
- Size 96KB
- SHA256 afd3041667e273862dd6f99a3637f05014ae0dbefef9f78754f2e28838e9646a
- MD5 fe0ac5477cd4c64c36df1b55e8176d46
- SHA1 50b0aa260dc0172263b65115ae21cf50a82da8ef
- SHA512 630c01d24004abc9bd5f9d35221c393850586cef0a2ac590c2b4fc499e6ad6765f9fefc176b61358c2ebf673de63ac08080faa14d840b0e8e1736ea4fd0b1077
- SSDEEP 1536:GSml9u+j06sz2M30jn2cZoIbZEmkpt2LfaIZTJ+7LhkiB0MPiKeEAgH:GSSI6szOjn2ooIbZEmkp+faMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Djdmffnn.exe
- Size 96KB
- SHA256 2067cca47dc07e7f70bc7896b0b7017ebbdf7f9ff65979780c620336a60ba842
- MD5 cf8ff0dbd6536879b4d79859774a8e1d
- SHA1 e8d0b5a9085819cffcc9ac486c53860c0cdb896c
- SHA512 bd736fb5c94fd4f4c339f3f23983b2084b98185b1b717cde68039b720f4ec74ef84fb6c2cb139885c5a3101f1336013eb3fbfb9491b820cafbef0f5061f85e5b
- SSDEEP 1536:XbXramcK3/RZoWMeEPWTRitKCe02L9aIZTJ+7LhkiB0MPiKeEAgH:XbXramvPieEPWditKV9aMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Djgjlelk.exe
- Size 96KB
- SHA256 4272ec1484d6da6f34a0a67ad5e2e24c475f1da9efa70b5a3fa5ff904a42da2d
- MD5 8f17201946b01a2fcbacefe9fbfc81d5
- SHA1 975a7543cd1422463e43175b2b9af46461cb256e
- SHA512 9e41f5c0ba758ea2bfe77f276d820cdc1709c94ab7b950e0244bf81887c7d012e51836cfa65955b02a339bed7c67c0f4fd6fe78c0c50db2dcf651f0507cde790
- SSDEEP 1536:dkTrg8sP/UdTo60+cpTAMQQQLY2W6b742L+aIZTJ+7LhkiB0MPiKeEAgH:2TUh/UdTo60rpTAMQQQ0sb7J+aMU7ui1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dkifae32.exe
- Size 96KB
- SHA256 94fe5a4f856587d5c71455db08b5d6b8a9830f2d0dbf03e6de1bd26a84b1a55a
- MD5 cb3ac17a91668e2ed192e93d15828d08
- SHA1 2ee28912612ae2bf007adf122ec21774612ecfc2
- SHA512 1bc806f34043c7fdb0c8fca6029d5d9f9fa223fcbcc548c3fd504d1447bb1f6db22576d7016cfc1cf2390bda007ab765f0f4d84e6fabbbb8312ff86f2d33c9b7
- SSDEEP 1536:uEfE6G2dmQ04zO+5K2LnaIZTJ+7LhkiB0MPiKeEAgH:uEc6DwL43XnaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dmefhako.exe
- Size 96KB
- SHA256 36e50da0278702fd792232df5686c248c42a9b93945f132693ea0a4e0c5aa4e6
- MD5 d7fae3093bfff6ad213aa4d7fe00ab7c
- SHA1 edc578496c688395723b305673bfd1e33262da4b
- SHA512 43a5c9f212dbd68d9e71673a02dcf9fab28cd93d8ff28cd4caa60dc947a54419053cb0bb6c3f3d5a86467b4cb7ec702988366ed42c86236304cf8a5448c2c00f
- SSDEEP 1536:Z+k3WKnF5cgisCt1s4Ye2M8m2LMaIZTJ+7LhkiB0MPiKeEAgH:wkGKHcxsTSSMaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dmgbnq32.exe
- Size 96KB
- SHA256 13db2c88d7d0f66364484850b4fa93c84edf63391cf4863d6ce7dbe2d5534a44
- MD5 c6efaa23d768b940d3a4a8f869066f81
- SHA1 f0a4b0ce9503aa16d82d807d0792991a8b914ccd
- SHA512 f956e1eba12ab8ad4877d5a5e4906cd61a0ea298888ee8d9accb34fdd5e1858551271d5d0f21e31ed095e3ea8311cefa5c101241c315714489d0bac3645a79c7
- SSDEEP 1536:7dlMFFJFIEZ+QZVfpXgggMl5TAheoDa2a2LQaIZTJ+7LhkiB0MPiKeEAgH:rMFFnNZ+Q7pXgggMl5TAhemQaMU7uihv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dmllipeg.exe
- Size 96KB
- SHA256 5e5ca4c898942907436d78591c3198e85f69432a203f007bd7d4f8e3ae9bc3cf
- MD5 37b60ded7d37cda04460aacfb151df82
- SHA1 a93f36f57e51a766643ffafa3329f9f31a6766eb
- SHA512 86577554bdfc415cbcfa4aa18ef46a7cc87d931b099028e8070b1886101e3f5cdc0362e49a5bfbd4e2a680abada2a23e061d467a2e1fb503e8cceb1330bb2930
- SSDEEP 1536:EET+DQZOb9Mxdff5zbfF9VI2LYaIZTJ+7LhkiB0MPiKeEAgH:EE2QZMMxZBbN9DYaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dogogcpo.exe
- Size 96KB
- SHA256 ec010b21c7c88e1e903854168269a5eca212ecb543434f95b17e7460d97ed432
- MD5 5e5c8b32a4c393c080fe3b14762fa0fe
- SHA1 d0a5d8feea4677f8eb757d34010ec07a38268a0c
- SHA512 405859b6d759058dece36ff8ff176b2d2b536b14236d7d0bfaabd39f3abbcabac83e8d59a89684cd27bccef4df670362fbf9fbe9d33aac0db097d30da4863e8b
- SSDEEP 1536:4jL+HIXJag26Rzc3ZmtQRqqqabLR2LhaIZTJ+7LhkiB0MPiKeEAgH:4n++Ja16RzAZmGVLqhaMU7uihJ5
- MD5 SHA1 SHA512 SSDEEP