berbew | 547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0.exe
Size 384KB
Sample241109-191jmatdph
SHA256 547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0
MD5 d8aff774b52f3d839e4aaea3defe6a0b
SHA1 f394fe5134d4717dff8b82ec8f6bad094c712143
SHA512 7a165dac89a0f353c9fe140060e62ae25f6823b66b36fde9bde1a1ea0e0dd36747faab81d18636c5c2296d0645d50725013f0edb62e668f33b4c0821bf737561
SSDEEP 6144:D4/WAr5408SeNpgdyuH1lZfRo0V8JcgE+ezpg12:cNrj87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lbdolh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdehlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmidog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nepgjaeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ogkcpbam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncbknfed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llgjjnlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnneknob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnmcjg32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3648	Ldleel32.exe
4860	Lmdina32.exe
4948	Llgjjnlj.exe
2748	Likjcbkc.exe
2112	Lpebpm32.exe
5044	Lbdolh32.exe
3220	Lebkhc32.exe
544	Lllcen32.exe
556	Mdckfk32.exe
400	Mgagbf32.exe
5024	Mmlpoqpg.exe
1568	Mdehlk32.exe
2124	Mmnldp32.exe
2276	Mgfqmfde.exe
744	Mlcifmbl.exe
2512	Mcmabg32.exe
3536	Mpablkhc.exe
4504	Menjdbgj.exe
1524	Miifeq32.exe
4548	Ncbknfed.exe
4932	Nepgjaeg.exe
1156	Ndaggimg.exe
1520	Nnjlpo32.exe
2900	Ncfdie32.exe
1168	Nnlhfn32.exe
3008	Npjebj32.exe
2144	Nnneknob.exe
3480	Npmagine.exe
4392	Nckndeni.exe
3904	Njefqo32.exe
956	Ocnjidkf.exe
3588	Oflgep32.exe
4780	Opakbi32.exe
4056	Ogkcpbam.exe
1496	Ofnckp32.exe
3988	Olhlhjpd.exe
1708	Odocigqg.exe
3124	Ocbddc32.exe
1136	Ofqpqo32.exe
4516	Ojllan32.exe
5036	Olkhmi32.exe
3432	Odapnf32.exe
2576	Ogpmjb32.exe
4552	Ojoign32.exe
4212	Olmeci32.exe
3560	Oddmdf32.exe
2572	Ocgmpccl.exe
4228	Ofeilobp.exe
1652	Pnlaml32.exe
4980	Pqknig32.exe
528	Pdfjifjo.exe
4760	Pgefeajb.exe
4540	Pjcbbmif.exe
4276	Pmannhhj.exe
4832	Pdifoehl.exe
3260	Pggbkagp.exe
2416	Pfjcgn32.exe
4776	Pnakhkol.exe
464	Pdkcde32.exe
3640	Pgioqq32.exe
2208	Pmfhig32.exe
5052	Pdmpje32.exe
4820	Pfolbmje.exe
2340	Pmidog32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Odocigqg.exe	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Qnjnnj32.exe	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Acjclpcf.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Idnljnaa.dll	Andqdh32.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Mcmabg32.exe	Mlcifmbl.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Ocbddc32.exe	Odocigqg.exe
File opened for modification	C:\Windows\SysWOW64\Afhohlbj.exe	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Cabfga32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Lebkhc32.exe	Lbdolh32.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Ocgmpccl.exe	Oddmdf32.exe
File created	C:\Windows\SysWOW64\Pmannhhj.exe	Pjcbbmif.exe
File opened for modification	C:\Windows\SysWOW64\Pmannhhj.exe	Pjcbbmif.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Afhohlbj.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Lmdina32.exe	Ldleel32.exe
File created	C:\Windows\SysWOW64\Mbpfgbfp.dll	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Ajanck32.exe	Qcgffqei.exe
File opened for modification	C:\Windows\SysWOW64\Ojoign32.exe	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Aomaga32.dll	Likjcbkc.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Amddjegd.exe	Afjlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Nnjlpo32.exe	Ndaggimg.exe
File created	C:\Windows\SysWOW64\Gmdkpdef.dll	Olmeci32.exe
File created	C:\Windows\SysWOW64\Pgnilpah.exe	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Aqkgpedc.exe
File opened for modification	C:\Windows\SysWOW64\Afjlnk32.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Amddjegd.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Olcjhi32.dll	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Caebma32.exe
File created	C:\Windows\SysWOW64\Mpablkhc.exe	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Donfhp32.dll	Ocbddc32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Llgjjnlj.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Panfqmhb.dll	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Pfolbmje.exe	Pdmpje32.exe
File created	C:\Windows\SysWOW64\Anmjcieo.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cabfga32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Blleba32.dll	Mmlpoqpg.exe
File opened for modification	C:\Windows\SysWOW64\Ncfdie32.exe	Nnjlpo32.exe
File opened for modification	C:\Windows\SysWOW64\Nnlhfn32.exe	Ncfdie32.exe
File opened for modification	C:\Windows\SysWOW64\Olkhmi32.exe	Ojllan32.exe
File created	C:\Windows\SysWOW64\Aeiofcji.exe	Ambgef32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Mpablkhc.exe	Mcmabg32.exe
File opened for modification	C:\Windows\SysWOW64\Miifeq32.exe	Menjdbgj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6072	5652	WerFault.exe	221

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmdina32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjjnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdckfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menjdbgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbdolh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmnldp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odocigqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnjidkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofqpqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojllan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olkhmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmlpoqpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oddmdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miifeq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lllcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdehlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogpmjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdifoehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnakhkol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnjlpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogkcpbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfjcgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepgjaeg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcmfk32.dll"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcnha32.dll"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmphmhjc.dll"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnljnaa.dll"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndkqipob.dll"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najmlf32.dll"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilkmnni.dll"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lmdina32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfdjmlhn.dll"	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Olkhmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpbkoql.dll"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Empblm32.dll"	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clncadfb.dll"	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfenk32.dll"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjeieojj.dll"	Lbdolh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdkpdef.dll"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deimfpda.dll"	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfbgbeai.dll"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Olkhmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3648	4976	547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0.exe	83
PID 4976 wrote to memory of 3648	4976	547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0.exe	83
PID 4976 wrote to memory of 3648	4976	547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0.exe	83
PID 3648 wrote to memory of 4860	3648	Ldleel32.exe	84
PID 3648 wrote to memory of 4860	3648	Ldleel32.exe	84
PID 3648 wrote to memory of 4860	3648	Ldleel32.exe	84
PID 4860 wrote to memory of 4948	4860	Lmdina32.exe	85
PID 4860 wrote to memory of 4948	4860	Lmdina32.exe	85
PID 4860 wrote to memory of 4948	4860	Lmdina32.exe	85
PID 4948 wrote to memory of 2748	4948	Llgjjnlj.exe	86
PID 4948 wrote to memory of 2748	4948	Llgjjnlj.exe	86
PID 4948 wrote to memory of 2748	4948	Llgjjnlj.exe	86
PID 2748 wrote to memory of 2112	2748	Likjcbkc.exe	87
PID 2748 wrote to memory of 2112	2748	Likjcbkc.exe	87
PID 2748 wrote to memory of 2112	2748	Likjcbkc.exe	87
PID 2112 wrote to memory of 5044	2112	Lpebpm32.exe	88
PID 2112 wrote to memory of 5044	2112	Lpebpm32.exe	88
PID 2112 wrote to memory of 5044	2112	Lpebpm32.exe	88
PID 5044 wrote to memory of 3220	5044	Lbdolh32.exe	90
PID 5044 wrote to memory of 3220	5044	Lbdolh32.exe	90
PID 5044 wrote to memory of 3220	5044	Lbdolh32.exe	90
PID 3220 wrote to memory of 544	3220	Lebkhc32.exe	91
PID 3220 wrote to memory of 544	3220	Lebkhc32.exe	91
PID 3220 wrote to memory of 544	3220	Lebkhc32.exe	91
PID 544 wrote to memory of 556	544	Lllcen32.exe	92
PID 544 wrote to memory of 556	544	Lllcen32.exe	92
PID 544 wrote to memory of 556	544	Lllcen32.exe	92
PID 556 wrote to memory of 400	556	Mdckfk32.exe	93
PID 556 wrote to memory of 400	556	Mdckfk32.exe	93
PID 556 wrote to memory of 400	556	Mdckfk32.exe	93
PID 400 wrote to memory of 5024	400	Mgagbf32.exe	94
PID 400 wrote to memory of 5024	400	Mgagbf32.exe	94
PID 400 wrote to memory of 5024	400	Mgagbf32.exe	94
PID 5024 wrote to memory of 1568	5024	Mmlpoqpg.exe	95
PID 5024 wrote to memory of 1568	5024	Mmlpoqpg.exe	95
PID 5024 wrote to memory of 1568	5024	Mmlpoqpg.exe	95
PID 1568 wrote to memory of 2124	1568	Mdehlk32.exe	97
PID 1568 wrote to memory of 2124	1568	Mdehlk32.exe	97
PID 1568 wrote to memory of 2124	1568	Mdehlk32.exe	97
PID 2124 wrote to memory of 2276	2124	Mmnldp32.exe	98
PID 2124 wrote to memory of 2276	2124	Mmnldp32.exe	98
PID 2124 wrote to memory of 2276	2124	Mmnldp32.exe	98
PID 2276 wrote to memory of 744	2276	Mgfqmfde.exe	99
PID 2276 wrote to memory of 744	2276	Mgfqmfde.exe	99
PID 2276 wrote to memory of 744	2276	Mgfqmfde.exe	99
PID 744 wrote to memory of 2512	744	Mlcifmbl.exe	101
PID 744 wrote to memory of 2512	744	Mlcifmbl.exe	101
PID 744 wrote to memory of 2512	744	Mlcifmbl.exe	101
PID 2512 wrote to memory of 3536	2512	Mcmabg32.exe	102
PID 2512 wrote to memory of 3536	2512	Mcmabg32.exe	102
PID 2512 wrote to memory of 3536	2512	Mcmabg32.exe	102
PID 3536 wrote to memory of 4504	3536	Mpablkhc.exe	103
PID 3536 wrote to memory of 4504	3536	Mpablkhc.exe	103
PID 3536 wrote to memory of 4504	3536	Mpablkhc.exe	103
PID 4504 wrote to memory of 1524	4504	Menjdbgj.exe	104
PID 4504 wrote to memory of 1524	4504	Menjdbgj.exe	104
PID 4504 wrote to memory of 1524	4504	Menjdbgj.exe	104
PID 1524 wrote to memory of 4548	1524	Miifeq32.exe	105
PID 1524 wrote to memory of 4548	1524	Miifeq32.exe	105
PID 1524 wrote to memory of 4548	1524	Miifeq32.exe	105
PID 4548 wrote to memory of 4932	4548	Ncbknfed.exe	106
PID 4548 wrote to memory of 4932	4548	Ncbknfed.exe	106
PID 4548 wrote to memory of 4932	4548	Ncbknfed.exe	106
PID 4932 wrote to memory of 1156	4932	Nepgjaeg.exe	107

C:\Users\Admin\AppData\Local\Temp\547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0.exe
"C:\Users\Admin\AppData\Local\Temp\547a55882df236ae00799fa47dd7343a62396ac968eaf221d83f8ec33efb2ef0.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\Ldleel32.exe
  C:\Windows\system32\Ldleel32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\Lmdina32.exe
    C:\Windows\system32\Lmdina32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\Llgjjnlj.exe
      C:\Windows\system32\Llgjjnlj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:744
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1156
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2900
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        26⤵
        Executes dropped EXE
        
        PID:1168
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3008
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        30⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3904
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:956
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        33⤵
        Executes dropped EXE
        
        PID:3588
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        36⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3988
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3432
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2576
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4212
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3560
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2572
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4228
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:528
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4760
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4540
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4276
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        57⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        60⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        67⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3404
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2884
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        70⤵
        Drops file in System32 directory
        
        PID:1016
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        71⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        73⤵
        Drops file in System32 directory
        
        PID:4092
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4544
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2368
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        76⤵
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4140
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4168
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1656
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4244
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2176
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        85⤵
        Modifies registry class
        
        PID:4528
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        86⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        87⤵
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        88⤵
        Modifies registry class
        
        PID:628
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:656
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        90⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        91⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        92⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5308
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        96⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        98⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        99⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        101⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        102⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        104⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        105⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        106⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        109⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        112⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        114⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        115⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        116⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5940
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        121⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        122⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        123⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        125⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        128⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        129⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        130⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        133⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 408
        134⤵
        Program crash
        
        PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5652 -ip 5652
1⤵
PID:6000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aabmqd32.exe

Path C:\Windows\SysWOW64\Aabmqd32.exe
Size 384KB
SHA256 b120ef19adbfc29c7e5a3a0e21109e7a3debf94d9ec7dc85ad3d140c88f493f6
MD5 cf516b35450a1a69ff0493a08d9a7675
SHA1 f399e6afb00cc90ca81ac72366d451482bcf3087
SHA512 ce27ef05c7f564fd0c66fcf7d0f92a057c9a04c22e1c65e1aa1d0bc8c3f17ee18bf728cb5a4cd48894ef4c01fe106130f0e56975c466b1d9b92da4d3c221f760
SSDEEP 6144:AeYLUIqmqhp4QCu58SeNpgdyuH1lZfRo0V8JcgE+ezpg12:A7LBqmqhp4s87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aadifclh.exe

Path C:\Windows\SysWOW64\Aadifclh.exe
Size 384KB
SHA256 0af6993b0f36c8096adbd5a5e3cee76f5e001f146048dd36a65362d5a54a3445
MD5 60816feadee90c0eeefd5c20d7df3639
SHA1 3400b7d4dd613c01079c46a73333aa06ad197bba
SHA512 9900889e386f93e4f2f60b3efdda0a30d03baed3d41806cfbbafb63424a7f8230e10515bbe34f39d9ca4d1c2b5a4a276bf514678fe0e94e56cd7872d0edb3ad0
SSDEEP 6144:D6kphU7EI8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:D6kpC87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeklkchg.exe

Path C:\Windows\SysWOW64\Aeklkchg.exe
Size 384KB
SHA256 90cf752e9cec89e5f085ae1af296b6b0aecd4c7e6e72a2cb1968bba12b83ae5f
MD5 4f0bd46d56e5c6c42322566207fd0818
SHA1 92fdd0413ab0053a9baf80264133f3f021893594
SHA512 679a9b76fa1e59803d810e9cea59f279e706af3eeea594cc6e4b6e3e978e286cf662e419f4b44d9927f0f9ead9495100b7af8d96b85cadd4e7d6441a47aa4bd4
SSDEEP 6144:TgoUW8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:Tn87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aomaga32.dll

Path C:\Windows\SysWOW64\Aomaga32.dll
Size 7KB
SHA256 14fc200506e2995bc796f78430c64ad7d29561bb24ccc406e5bdc549b682abe0
MD5 8d23a262c4a65a43242e705d4d783870
SHA1 7efd9023c0c0f2271148657c3dd34a0ba13aae74
SHA512 c56be529ab0c219c9aa5d04eecb67944ca658278534c99f58b783bb181e7075f71b6e12a7e072300c8590267a71a975ccd32941c72a07540ecb6d46457b64f47
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPFd3cX5aXW:wUaJf/aFbP0Oe2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfdodjhm.exe

Path C:\Windows\SysWOW64\Bfdodjhm.exe
Size 384KB
SHA256 945c34cf635befa439f3f0bff3e3b8d054bf3562ae64cb49289efc1fe1eefe61
MD5 432449b36b3431fe1dfc0297806cc803
SHA1 bf0b64422b40d3cfde1e6376ad759fffb12e8400
SHA512 29771da3ec1020315ffbc57183308d97bb05ad075a762702e3dde84b614157de1328ddfa0d7c295614d393e4206116aff553ef0a2f1b1ae20274273036bab7e8
SSDEEP 6144:jSq3N3gQgAlNP8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:jSgLgAld87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnmcjg32.exe

Path C:\Windows\SysWOW64\Bnmcjg32.exe
Size 384KB
SHA256 a678cf9017a6453a28c6d37ad88e5a5d612fef8013594e642748a04cec7975fc
MD5 0e1a99a43480b3e3d49c8515a125060f
SHA1 b6b823021f4224cc17da674b2e959aab6a116538
SHA512 88d3aebba2a0d1cd5c1c32dd90a326f028ccbb0cdde75ae7368e8a7365c876e2b031265c3fe6cb33c49a8bb7645cee06a69a3dbeb4b98b2d43dffebbec3001b0
SSDEEP 6144:MvirPjz8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:Mv8PX87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdfkolkf.exe

Path C:\Windows\SysWOW64\Cdfkolkf.exe
Size 384KB
SHA256 05c26d07868b75d3568d72fe13baa440ce67a93963923e4dd96c4dd40f976c39
MD5 6ed936461464fd88a069613fa2c2769a
SHA1 56b68abe30b4b3fe7bae4c88f076208db6f929a3
SHA512 325a63eb15a28b88392b448c2bc7798cd71b4e778738060d149a89a7c738ff06c5fa64072bbe06251d6dfd227efb636a1767abde4f0889cd34009d87d935213a
SSDEEP 6144:hfEaO8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:1Eh87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ceqnmpfo.exe

Path C:\Windows\SysWOW64\Ceqnmpfo.exe
Size 384KB
SHA256 fea04c1a66a9cb4725c62bfbe750afefad04b4b838fb25b18b74936d7392025c
MD5 c00708096bff0d26bd7c0a549fc067b3
SHA1 b422c77e66620a81776756f30ea9a597d9330415
SHA512 67a899c06bb296e7c1ac7f031a974b254fa8e76047a8050c9e7e583907c20599c3bf81e217cde18e453ddee53b83d14de3a3f09595d64641b3be083f2ef6809c
SSDEEP 6144:tH0DVUkf8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:tHJa87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chmndlge.exe

Path C:\Windows\SysWOW64\Chmndlge.exe
Size 384KB
SHA256 c4ed63b3768f9de2d96db854c221894f07aebce6bc2fa70af12a03ef4566cf7f
MD5 1a220cee20e986bd7a67b447bf4bb30c
SHA1 bc0d2486223d85e1d3e0fb48249605ff7da9d685
SHA512 ed5fb90e069f72c5e8ae8fbd4849de986131502b13304376c03e804ab3a34ebd349528ed8d7109e8d60f38da50643aba51159411a0b8d0ccc41c8fc990b2211e
SSDEEP 6144:QUTx1LsA0bq+jE8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:QsDd0u387g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmnpgb32.exe

Path C:\Windows\SysWOW64\Cmnpgb32.exe
Size 384KB
SHA256 a33b2f1e3389bc3715f21cf0c8263d2ecbc296221afc1094a30e0613561ef87b
MD5 2c7347385586146bf666d3f1ab136bee
SHA1 87f5222d9a2d40b6b192e5d50ffdd21c6cb95241
SHA512 b4e9b2e0bd460ed736e59be3d1f5549a7aaf7b3460f746c7ec1f71b4fa550b3dca15fc061a4280b3294381f69fc2ff954b5ef0d99af72d1509d21f6ebb537171
SSDEEP 6144:YTmfNyxr5SKP1W8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:tALPQ87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmqmma32.exe

Path C:\Windows\SysWOW64\Cmqmma32.exe
Size 384KB
SHA256 3a96c0173d99512496b1c5d252fd489cbb35b8ec6c9e68d5e0f950c44f4d2592
MD5 3d09d38e81f809ec59d2900e01bda662
SHA1 8357051ce3ac7258852e6eb83f572dec056f365b
SHA512 61b399aaea659d5639637393671111ca50e551a4e2cfa6d2f773c87a06bbfbf2f002ca28f5790bddc020bf205c820d175d92e91d7776c69dd8b1076df6b8c35b
SSDEEP 6144:2Z/d3ICo8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:2ZVc87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddakjkqi.exe

Path C:\Windows\SysWOW64\Ddakjkqi.exe
Size 384KB
SHA256 e3d55022fbab4c03640ef7da18a2cfa023a8af11bb3b24d307ecab3c2b1f13b1
MD5 b18bd0ef5de86b561d84a4ca32759ad5
SHA1 610a037a544bacf2bbe436ad1bcdfbf6021fdcc1
SHA512 cc28d432881d9cbe43bda75414fa75b922880c4ee48e2a05138fd58631072b41ecbf4ccea5813cd216e5b99ae40f4eb6548c36b56fb7dae26b7a27d032cadb21
SSDEEP 6144:I4waag90Trp8k8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:/waa3TrpV87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Djgjlelk.exe

Path C:\Windows\SysWOW64\Djgjlelk.exe
Size 384KB
SHA256 6a9a91ed6912ce98831b5935a48bba865e8f5cdfd90b4f6745d03490da64cf4d
MD5 5cd75692a5bfda61cbd2bb486601c438
SHA1 a14277ddacb5cce468bc7a54357447e85fd2fe2d
SHA512 ac4c9c8d599f9bee24104d1e4f4fd2539548e33da271388244b6ca8d93e61a15b3e0587cc69afb0b6dbff0929929e60bfbe4fe2f4c435fa2aa264d643b1150b5
SSDEEP 6144:vTF27eHVYeHyfRwkuz0k8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:E7e1YeHmwkM87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lbdolh32.exe

Path C:\Windows\SysWOW64\Lbdolh32.exe
Size 384KB
SHA256 8267b9efda1559178ba93ba3854eb4b450b562eef1f50074ded37eb5aeaaef13
MD5 0b8be1933110d05ab1ca34877dcdcf83
SHA1 4d9baf237dbdfd99570047709e5621dd7552d975
SHA512 b37b08835e3bec9762e490e02c22e0bef10cf29669cafcc0a99bce2fc384da16d6789b1e7fac3e152aa4f7f7778c95c6bfe627e7635a7e69a77f7f404eaed42c
SSDEEP 6144:Z3abLSM8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:Zw87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ldleel32.exe

Path C:\Windows\SysWOW64\Ldleel32.exe
Size 384KB
SHA256 beb202c6f6098f29611bb30f5a504b1815242e8cae48b1ff4e61b529a9b64f07
MD5 8225fdaffb7c818e148e90513aa865bf
SHA1 f3248ec9d467687eabba46428bb0ca5a50380d51
SHA512 1cef5845a98b9c1f7c8edd8c355294fb4e64634ec7dbde4297af7e4e32d476544efc8e444e8f821d998b9fbc97d9da70b26b985cba4be82571b123645cad90e7
SSDEEP 6144:BVqGM4bdrMBxjy8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:BVqOKxe87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lebkhc32.exe

Path C:\Windows\SysWOW64\Lebkhc32.exe
Size 384KB
SHA256 802af8d9f7705bb22235a544817ccb67eaa65f33140d0af2d0506284f5a8c2cf
MD5 1b0e4d52d0489c6a11babc2b743a4941
SHA1 228455de74c5994ea1c1726e43638533c3653404
SHA512 2678e4307e7ebf8f682673d05243f019454b46ef9bbe0b8e4b96f5f7729924d039f8c844abd23eb04e618b41e9d423ecf85dda9d4bd4afc6a4c28eb9fb618d01
SSDEEP 6144:ikCH0bXLy8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:cH/87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Likjcbkc.exe

Path C:\Windows\SysWOW64\Likjcbkc.exe
Size 384KB
SHA256 c3c178855b4183fbce3f2f1b8a142eca4cca45ddc8eabd06fd5f785a7c9b5d36
MD5 045e0d5ed2c102bc3ac21fb5ac530f64
SHA1 060216d7071e207066e6a93d7d0e68d8f240f3b5
SHA512 b39632754ba384210de51525e2465532f3eeea8b12cfa575741a58cf3e4a17682be58050b7cdc2e4e52a2a62d59195f01ca0221b525e0c953a67c6710b1ca369
SSDEEP 6144:dCUsN5b8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:hyB87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Llgjjnlj.exe

Path C:\Windows\SysWOW64\Llgjjnlj.exe
Size 384KB
SHA256 1b4f75b1c6b7acd69f034d97f853e0ae4354962490a15051b3d78f1af567edf4
MD5 58f2bcf6fcfea6e79b4536f488783f11
SHA1 3a2ed55ec3404b94bb6f4eebf83120c4aeb69eb2
SHA512 0ae8cb842de32854cedcacea31befd1a489a3d25d25e5e772a94970b7242e28962afa6d02b9fd412384d1d6cf99c655dce90c1313f3c9da3875a0d8e9c990682
SSDEEP 6144:UyCueIKHVU48SeNpgdyuH1lZfRo0V8JcgE+ezpg12:zep87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lllcen32.exe

Path C:\Windows\SysWOW64\Lllcen32.exe
Size 384KB
SHA256 cece47c8ef35e91af06a503bdd042025bf376e53825a5dd01d5ba7f4c6b82574
MD5 4e21267a483f8d94fc285fb7c54ab770
SHA1 b79aa4086a7feff01d4204e6f05e9b3ecbd2b3e7
SHA512 04a2ec9095d1972aa1663245c1c1b1134614f55f4e44bfa846bce51ce293273dea55de8f083ac18a00609d1f14a0839626433cef771d0b58865fdcf7e211e05a
SSDEEP 6144:OLzFBCMbjuDN8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:OLzaMbY87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmdina32.exe

Path C:\Windows\SysWOW64\Lmdina32.exe
Size 384KB
SHA256 c8d7b510c0e3488724fc22c50075abd9af8f560f850fa1fb0c7f94c75586556c
MD5 5f307cb13c9dd8df2a49fa518ebfb582
SHA1 9372ee1e32455157772815aa3365843c0620988e
SHA512 ce6eef9d9efec9bc655ea4e8d034bdd4f2dff0fb825dc64c8e8b5e03e05fbf79c40993829ed05922a115f10109425cc9766cdaea9925d01ce06e0342cb490047
SSDEEP 6144:M6etGUnaAkjr58SeNpgdyuH1lZfRo0V8JcgE+ezpg12:M6gLnc87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpebpm32.exe

Path C:\Windows\SysWOW64\Lpebpm32.exe
Size 384KB
SHA256 5bdae02d218258d25380edfcec1119ba5c42712da831a35b37a8310cfd4bd581
MD5 687decd8b167a652da007837a648e624
SHA1 0836d25fdac63672af2aecedef311cd1d1f43873
SHA512 5fefd8cc3b261c0408b804b9ef57e8be7a3144670f9d97fbe19a4f8cb56c25ff6e88d3fbaf8db24d665010807710464bb09cc40354246036ea9b6cc8eff9530e
SSDEEP 6144:9NIIlTr8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:987g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcmabg32.exe

Path C:\Windows\SysWOW64\Mcmabg32.exe
Size 384KB
SHA256 940a609f156413f42fe2d2db880c786e2b28b50383949370f1a2d58afd53c564
MD5 b087bbc9d5ef16e987589051720379ed
SHA1 5f159300c3b7bb6f2cd793581c980ba89b286780
SHA512 0467ed062c598a5a5442f04c740f4b859a23661ed22750da944a8bc4320d597f14ee003f35649c90ba63ba0e4213678a16571664ab4c19e8c55c9965efd57357
SSDEEP 6144:jseAxL+63DVv5A8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:LAxLrJW87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdckfk32.exe

Path C:\Windows\SysWOW64\Mdckfk32.exe
Size 384KB
SHA256 e90bd21b8c4fce6e860bb643ce79a1dc24429893de7c23561720d2730d15464d
MD5 1e98ffdb5d0a08d7b280dbde95f34f07
SHA1 197f27e3762cb418fb1d725a8a700bead144eb08
SHA512 d6daa331033ebe0db4d9cb8581034ea4d19f401764f56c4e49cac6fcca2aadce27f4f9c20b98b8953e7de6cd6ab95babcdfb8e51f24862a74e2c79f7a76a1bac
SSDEEP 6144:Br49tYoo7fynSto8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:BsglfISK87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mdehlk32.exe

Path C:\Windows\SysWOW64\Mdehlk32.exe
Size 384KB
SHA256 af1ca52542ecd74df17af6236cb4e88fb6fac4379c4a2027cfab20b047c820f1
MD5 a81e96e8bae3acfeea9ebad4a01ee252
SHA1 060d50ca76a1a9a7e101fda4aa18fe9453e7ef5e
SHA512 08a7e73b904d1316a6df72fcc72a27ad0298cc66efaf5b4bcaa6a19378caf0d2b782881f8620f23972843f96a7ac4164803a3cd64c4e5b8212956160283f2f55
SSDEEP 6144:dkYLbHTDE8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:Z7TI87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Menjdbgj.exe

Path C:\Windows\SysWOW64\Menjdbgj.exe
Size 384KB
SHA256 d81b10fc8a39da97843979a52e03a6decfcc980aedc28b4d3185e96e82c2ee6d
MD5 0af5f600592959acabd44394e403d999
SHA1 26532f8cc45ebc89571bbc57dd752a39ab5f31a1
SHA512 e9177e16215922648cf43f9bdea143c8cb2dab6c823e68e3b40a12a9607d87e9c552a6e0eb223bf2823de7eb45bd1d67f4f4c45e9382f4cb279a3d0e82547ca4
SSDEEP 6144:aZAQ6IXuK8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:amQvx87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgagbf32.exe

Path C:\Windows\SysWOW64\Mgagbf32.exe
Size 384KB
SHA256 848adbcce1c2e67b4c966e2f09d03a6baa9ef9105240eb16679e210d43f42f37
MD5 7b441605ded5b50afb59d123bf665f00
SHA1 ca26de0ee7d0e06de18a5f95859b8ff44ddffa49
SHA512 6b8249f4d5f7cf344417f71c75000f443e2334c9530b053c7b3ab48c9bab8ef4145c56ee7259a210afb30b24071675ae8e120317ec6dad1627510f7600e351a7
SSDEEP 6144:3Clmpihton8Zc8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:3pihw87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgfqmfde.exe

Path C:\Windows\SysWOW64\Mgfqmfde.exe
Size 384KB
SHA256 9dcca8b1b5e851d0744693fa96983ca9f135ad50ba6f30f63cf8b0dc1d992851
MD5 3ac43d04b84958c4f7019726c157aeed
SHA1 3c87003fb989bd3f8a037aadf55681794591a257
SHA512 2de95b7db696645d80f4b90ba860c90c9f76877ab1544880ff03197efd60772ecbe4b09cbb2f1c395d96d0da8c86f97ddddd18d898240c710a56b6da77b57e3f
SSDEEP 6144:p0QrQNsLhb/D8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:INC787g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Miifeq32.exe

Path C:\Windows\SysWOW64\Miifeq32.exe
Size 384KB
SHA256 1ed4c24c64d62e086b173f8d2b88c9ed5350b7c6a857e6589e3fb47fe8734e7c
MD5 aaf897e1817dcf901d9675c57f32189d
SHA1 2e8df9e520b3cc2550308c0dbdb9f20083c3a27d
SHA512 0dc4f11eeb088f280c438adb61110f1ccab83a46c1aaeca97f6e7f542e5166da0ca70535d11714acb1d04e28ec4d0fdc68d3083fbeaf6da68cebd3e63af90055
SSDEEP 6144:BCptC7aukgf68SeNpgdyuH1lZfRo0V8JcgE+ezpg12:B0gC87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlcifmbl.exe

Path C:\Windows\SysWOW64\Mlcifmbl.exe
Size 384KB
SHA256 8b4ae06a2143898d81f13be80e38934bce8b735d539c381750b069a9ce97654d
MD5 7f63cbdb6ad7fd7945b94d6cf830bf72
SHA1 6bee6b2788dae626e1171ec91e3ec4a1c2f58f45
SHA512 2d2ed3845a9ea3efb869a09afbd957dbed9f3a1300af0af06f95e30eafc9b794eac738ec86385343f0105477cb9b6147322ef29ea92f23953a1779cf5f56b3f0
SSDEEP 6144:vaykw2ApaUbs8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:vaQpaF87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mmlpoqpg.exe

Path C:\Windows\SysWOW64\Mmlpoqpg.exe
Size 384KB
SHA256 c5aa9c085698f1155b6548909b6a5fe435138b2e9726919a10f4a959df2c1416
MD5 04e3d7b370d9013c4e2332d98d75f82f
SHA1 54714ebd833878c1c98a842bc52f6bff9ef21efb
SHA512 f61edc6825ed7458db5e31e6cfd16e9633374b02888ecd46b8d5f37c9ed96411e948e7dee8258c2f689f7fd5851caee6981416cae5b8d00d445432420834cf50
SSDEEP 6144:2QjDO+y0dU8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:tfby0687g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mmnldp32.exe

Path C:\Windows\SysWOW64\Mmnldp32.exe
Size 384KB
SHA256 a45f797fdcd3dc07e54ed2eedfe4e73a661000307c19c3200c22658d2b612196
MD5 ab67a567ce274cb0d1945f9ec2d92b50
SHA1 caf88bf25d351e141a9db5288706c27a56face53
SHA512 38c5b8be5596b496d6a9b1c9aa06afb203382123a3e15e7540b6653d495b1ab0231209aeb613024e2487f21094c12a32e2ee81d50ea2c570cda0212d687d501d
SSDEEP 6144:C7Y+Ox6IDwZG8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:1+Oxnl87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpablkhc.exe

Path C:\Windows\SysWOW64\Mpablkhc.exe
Size 320KB
SHA256 7428cdc8786a7d56b0169a185210d50be95127ee96a9fe2946f8229778d44c96
MD5 1d6515196825aa2ee2b998cca69d7d8e
SHA1 fc650c699c2142ac9b5d0cc2be71c227e0c9958d
SHA512 1f310298264362ff8e5308ef63d58d06ef90f257bf78b246961684fa81898e82e37b5d37368c5bcdd1fae2751e578995cb02f2b8ec7d4447e58f84ce76edae96
SSDEEP 6144:jseAxL+63DVv5A8SeNpgdyuH1lZfRo0V8JcgE:LAxLrJW87g7/VycgE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpablkhc.exe

Path C:\Windows\SysWOW64\Mpablkhc.exe
Size 384KB
SHA256 4b417d9637baa779f638c5c3e9bd9a0b20181c68c67eb9401a74492f1e2daadc
MD5 a0255c29f93c9b84f2fc50051ff18556
SHA1 c00f952e51e8ce8445622bed3624b3317c4271eb
SHA512 145239b9b171926c62bb0c6ed9cecc1315e0ae9dbb80761cd5bced6734336007f0a542b9a0eb1fb1e805ddd83f9144c32eadcd7d0ead917ed86844db0843cece
SSDEEP 6144:NMyiCz48SeNpgdyuH1lZfRo0V8JcgE+ezpg12:NMyiCc87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncbknfed.exe

Path C:\Windows\SysWOW64\Ncbknfed.exe
Size 384KB
SHA256 de3ee5bdc9ef67d3fd159de532d6075b811b91563a4dacafc2c457aad0c71812
MD5 a0eeaddb5dfb55a771c39aff28d29e40
SHA1 296afa95e69250d7f8d904d483a15e3512ce5a01
SHA512 345ce2b80c27deabb3123f7bf867e9e9d8393e78eb7eefa85b5c0839940760dbf3decb6177071b5ab1012bee674e417960ac87bac29e509e76bc2b7c59f36240
SSDEEP 6144:8M1OZjtgsriCtN58SeNpgdyuH1lZfRo0V8JcgE+ezpg12:r1OZSCtb87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncfdie32.exe

Path C:\Windows\SysWOW64\Ncfdie32.exe
Size 384KB
SHA256 61aa7b59108cc4f0431ca97ffc59ac864cd58b954e0e89dc4c9f2da05548dbd1
MD5 ebdf33f9181ce75a2098ae2c723fd74e
SHA1 f5cd3030fdc7e2b99af57f58afe475ad9ef51a28
SHA512 31c5afabda04fbada568b2eb89845d7a30ba0aa5934188938719a1e1437e6966c02e73da14714ccfe6cf06dfa51d3050d4fab261460cb6482502fa9cde3e5207
SSDEEP 6144:OxVKSkzet8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:Or87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nckndeni.exe

Path C:\Windows\SysWOW64\Nckndeni.exe
Size 384KB
SHA256 9f0c5db829b0a2abde3e7b6284142cca32ad68d54531ca8ceeb136e641eb4930
MD5 2ec306bbd17b85c1939ae443e0e3cfe5
SHA1 78b676f17f8f92395d8fc93b9c5a150d6deb2a01
SHA512 9845d8882b248ad70e7ec26fb8c37171d4253a97a790d504dd4996cacc746d8f2462d5142f2e362b01b0eda3e45666998465e6160d362c0e076cd1c37ffc9dd7
SSDEEP 6144:15Taidjj5rhMCR8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:3aiF87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndaggimg.exe

Path C:\Windows\SysWOW64\Ndaggimg.exe
Size 384KB
SHA256 1981eef5d40f58576419f951040c5bbee225d0bf20948a72df4817768ebf80c0
MD5 f07dc323a05f75f65c8e6008efabfab4
SHA1 afee3d3b3f63906160f96e8f4490fd1faac9fed6
SHA512 e1f4fb3586d30d07ebb4ec043239fb9f187990137af90f744724fc08cdc29275bebd90726e6e5e3f1e00e4a574bce114d1362bcb3ac643e92f885ae3c9ba0ad3
SSDEEP 6144:EYYpQ3pfZ8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:EFQ3r87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nepgjaeg.exe

Path C:\Windows\SysWOW64\Nepgjaeg.exe
Size 384KB
SHA256 d9dedb683ba57d74c9aa8743a6457f26ca7977334496bd20edd1b25eac0d00a8
MD5 edfd80bfbfccf9e7bf18fb8413daaf09
SHA1 edcd4b83f0f2b0d243f8429c61fa667586f3926b
SHA512 6160c85e76630e1de65cce72a979e6feb8835e55ceb47869293af3f2ef0161c91c6d474dcc5f1e04777ee1f0f006df7d4f9f29daa3ad5392b4eae1e9054a1563
SSDEEP 6144:wuAKt0sS8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:vAD87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njefqo32.exe

Path C:\Windows\SysWOW64\Njefqo32.exe
Size 384KB
SHA256 6c70a2d8b5e3cc4d97891908e7aceeae345e6282442b3f0cc8335581a64a78d7
MD5 b0e0572d9baa19bc460b6db879b3f0ba
SHA1 66c52825398be915c4c58a9f2b73dbc249635b6f
SHA512 c1677c526e989164f6f4d95d9b5be9d9ef298664b557394346ec434b1c21de70a9ad96461b9f7481bd557492a49884f63241b6b5b7cff9d25a05d3a28f433d74
SSDEEP 6144:DbT8QZ1at/8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:Dfjkd87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnjlpo32.exe

Path C:\Windows\SysWOW64\Nnjlpo32.exe
Size 384KB
SHA256 8b9bc0a46780d62b00c215b1f693ddb3f94def01e890e2ae2f0d75b5a2fa199f
MD5 505ac7ecee16af41b474e453a7f16866
SHA1 6d6b5d5d3a6aff5ad955555f19c1cfc5cdb43bb3
SHA512 c534f4f41699d7ecca00fbb6d0408516e3ef16752e27d894158e78fd68af99d31ac612c6cfdad4df3862dcedf72a1ddff3473f4941592d7ab222536187f4e87d
SSDEEP 6144:HQZbNXYLod8Ib8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:wF+Pm87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnlhfn32.exe

Path C:\Windows\SysWOW64\Nnlhfn32.exe
Size 384KB
SHA256 9881e8c606a159cd86f6d8b3ffb537dea91d3cab3921a8aeecff22ada3bba73b
MD5 cc56714c92d02bd85a6a4778dbc7f25c
SHA1 0592f8694e78c5da4135e9c52171220b8a294ca8
SHA512 c971948e22ba38673857d301def42e5d77fad7bee019b2cbe9fa8f0514e4f0c0551bb519395283ec41ce7cf473c1d0eb7861b147fd8a1464eda790cd8ce2dfaa
SSDEEP 6144:XRbWyCMpcqHNe8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:XRPd7U87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnneknob.exe

Path C:\Windows\SysWOW64\Nnneknob.exe
Size 384KB
SHA256 8568ad153fa624af64ecc7b6f0b809730dedf5b97ba5ce4e573d50c9327bf032
MD5 ed9e707f30bfeb20d33c03a261eacba0
SHA1 0784e9d9e8d3c3b2ffee5c7f9bf57d2915e8343f
SHA512 f4e5ef44ea78cb620eb2e37c4407ba437b71f3e66d21ec77d6e18de58df2b4ed3d72cfdeb3f386e0e2c434ef50eed4b47d3d1e8a6c7dae237baa491a9d7da163
SSDEEP 6144:GwUgffh458SeNpgdyuH1lZfRo0V8JcgE+ezpg12:GxgRY87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npjebj32.exe

Path C:\Windows\SysWOW64\Npjebj32.exe
Size 384KB
SHA256 f404ddb1825d8d577e52d0048b4f1b217db7ce7ca00a09f6dfd39b1e97dd7af5
MD5 4acbacf8779e60005902522614ec5576
SHA1 72604dde6f5d59414d88811b896700d8f1415af3
SHA512 de572a1ad9eb32f6bda94a0ba923b69002b1e73eedc8465b2526b413eeaec8bea532326a24b35053c80ee0d03636df31674551546b86e942b286cbfddc30d469
SSDEEP 6144:/ycrN0mqVklJm2F8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:jrNOkl8u87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npmagine.exe

Path C:\Windows\SysWOW64\Npmagine.exe
Size 384KB
SHA256 5fbdf224c579aef920620f75cb7820e5b4e19ae9d3a80aa95a9fc2b00f338a8c
MD5 0b1eb1a520ee4f927de5e34dc4a283e7
SHA1 d4c23b1f888d30ebc891ecea999f1d6af06136d2
SHA512 e8b18676ae975ffcde27211eb2118ee48b40566b96ce441673b2a0369a1f985b96f14c9b134649d2a61d2eb271c01a83c7900ee192d21489d980887ce55494de
SSDEEP 6144:/RM6piNH89D88SeNpgdyuH1lZfRo0V8JcgE+ezpg12:/RMhNH8m87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocnjidkf.exe

Path C:\Windows\SysWOW64\Ocnjidkf.exe
Size 384KB
SHA256 87c9703f792cc19b9d17ad27eebd045aa7e02c7ba1357e7f684e55a27b4690a3
MD5 6f9916552ea4ea1365ba6609317dd7be
SHA1 383299f543fb9704a2c73820f5834cd443a79392
SHA512 ad0f539163e13756c4362e164a32c875ea7773063ec4dafeb3b1e0981cbc1a6deb5aa18447b2709cdbbf2e2b72a0f6b3fc2ce3167affb399e5fbf7ebbc49b652
SSDEEP 6144:vwTEnvvKKOD8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:vZHy87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Odapnf32.exe

Path C:\Windows\SysWOW64\Odapnf32.exe
Size 384KB
SHA256 6236e05df4e5d8cd4f6843a7092d6533b9bb05859f94cd0ec55f9eba0cb7e705
MD5 15181c5b90cc63204d65c4e4789ac0ee
SHA1 243dc899eb657726de447c0eeb0068fd07c3a843
SHA512 a612166938cbf86fe2ed68072d68fc0ee87dcee07925f866f502b8b278a4691f99e045b45be592869f712855c7b1deb09315deefdf5781fc63409ba8be934e7c
SSDEEP 6144:ze7sgwVtzdit+8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:wQV2Q87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oflgep32.exe

Path C:\Windows\SysWOW64\Oflgep32.exe
Size 384KB
SHA256 58a33af5f37beba5286ff083112b17e04e915adf4e35fd4a55d9eae00b1e48d0
MD5 8f0f8f3779d5d96bd725584a33b0189e
SHA1 ac3496fe31bacd10e0c804208b2bd74aa94fd272
SHA512 42dfac61b654c3b9f45b0ffbc4f33757c2818e75a6a29fa5a1ffc56c56b1e9bfd26fb40aa81aac5a3a22fffb97f0f0b3f8c0a23d00e50f34711b6628160731e1
SSDEEP 6144:A+WXo6X394cZ9n8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:ZWYq7Zl87g7/VycgE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-79-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/404-520-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/464-418-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/528-374-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/544-64-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/544-599-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/556-72-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/628-593-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/640-484-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/744-120-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/956-247-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1016-478-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1136-298-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1156-175-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1168-199-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1496-274-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1520-185-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1524-152-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1568-95-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1652-358-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1656-552-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1708-286-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2112-578-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2112-40-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2124-103-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2144-216-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2176-565-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2208-430-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2276-111-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2308-454-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2340-453-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2368-508-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2416-406-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2512-128-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2572-346-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2576-322-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2600-545-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2748-571-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2748-31-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2884-472-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2900-191-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3008-208-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3124-292-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3172-579-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3220-592-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3220-56-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3260-400-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3404-460-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3432-316-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3480-224-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3536-135-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3560-340-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3588-255-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3640-424-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3648-551-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3648-7-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3676-1024-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3676-490-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3736-586-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3904-239-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3988-280-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4056-268-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4092-496-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4092-1023-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4140-526-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4168-532-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4212-334-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4228-352-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4244-558-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4276-388-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4392-232-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4496-514-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4504-144-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4516-304-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4528-572-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4540-382-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4544-507-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4548-160-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4552-328-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4760-376-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4776-412-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4780-262-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4820-446-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4832-394-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4860-20-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4932-168-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4940-466-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4944-538-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4948-23-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4948-564-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4976-544-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4976-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4980-367-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5024-88-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5036-310-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5044-48-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5044-585-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5052-436-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5400-945-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5732-965-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6092-930-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6112-915-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads