Analysis
- max time kernel
94s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 22:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe
Resource
win7-20241023-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe
- Size 768KB
- Sample241109-2l36aatfml
- SHA256 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02
- MD5 c64180754e35fa13486b2af5556baaa8
- SHA1 d93a37db0526fa6b049a02473d983a679064f8db
- SHA512 3e31bc5d075efb4b36a217c48c5aa1754a9d3c412de9fff7b95edf2c24ee1214077fbbf594cce423f1a8cf9027c6808794f5526a368fc236a853c0384ebe01a0
- SSDEEP 12288:FSRvO7MbJ/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcolH:i8MbJm0BmmvFimm0Xcr6VDsEqacjgqAz
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
berbew
C2
-
http://f/wcmd.htm
-
http://f/ppslog.php
-
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 34 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djdmffnn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dodbbdbb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfpgffpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cajlhqjp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Delnin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Deokon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dknpmdfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cnffqf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhocqigp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dknpmdfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Chokikeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djdmffnn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfpnph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cfpnph32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnffqf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deagdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Deagdn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cajlhqjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djgjlelk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmjocp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dmjocp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dodbbdbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dhmgki32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhmgki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dfpgffpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dhocqigp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chokikeb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chcddk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Chcddk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Delnin32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Deokon32.exe - Berbew family
- Executes dropped EXE 17 IoCs
pid Process 4904 Cfpnph32.exe 3476 Cnffqf32.exe 2736 Chokikeb.exe 2160 Cajlhqjp.exe 468 Chcddk32.exe 2536 Djdmffnn.exe 1676 Djgjlelk.exe 3116 Delnin32.exe 4564 Dodbbdbb.exe 3388 Deokon32.exe 1852 Dhmgki32.exe 224 Dfpgffpm.exe 3424 Dmjocp32.exe 2232 Deagdn32.exe 1976 Dhocqigp.exe 868 Dknpmdfc.exe 3544 Dmllipeg.exe - Drops file in System32 directory 51 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Cnffqf32.exe Cfpnph32.exe File created C:\Windows\SysWOW64\Chcddk32.exe Cajlhqjp.exe File created C:\Windows\SysWOW64\Hdhpgj32.dll Chcddk32.exe File opened for modification C:\Windows\SysWOW64\Deokon32.exe Dodbbdbb.exe File opened for modification C:\Windows\SysWOW64\Dknpmdfc.exe Dhocqigp.exe File created C:\Windows\SysWOW64\Cnffqf32.exe Cfpnph32.exe File created C:\Windows\SysWOW64\Bilonkon.dll Cajlhqjp.exe File created C:\Windows\SysWOW64\Djgjlelk.exe Djdmffnn.exe File created C:\Windows\SysWOW64\Dodbbdbb.exe Delnin32.exe File opened for modification C:\Windows\SysWOW64\Dmllipeg.exe Dknpmdfc.exe File opened for modification C:\Windows\SysWOW64\Cfpnph32.exe 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe File created C:\Windows\SysWOW64\Lfjhbihm.dll Cfpnph32.exe File created C:\Windows\SysWOW64\Delnin32.exe Djgjlelk.exe File created C:\Windows\SysWOW64\Dfpgffpm.exe Dhmgki32.exe File created C:\Windows\SysWOW64\Deokon32.exe Dodbbdbb.exe File created C:\Windows\SysWOW64\Dhmgki32.exe Deokon32.exe File opened for modification C:\Windows\SysWOW64\Dhmgki32.exe Deokon32.exe File created C:\Windows\SysWOW64\Chokikeb.exe Cnffqf32.exe File opened for modification C:\Windows\SysWOW64\Cajlhqjp.exe Chokikeb.exe File created C:\Windows\SysWOW64\Clghpklj.dll Chokikeb.exe File opened for modification C:\Windows\SysWOW64\Chcddk32.exe Cajlhqjp.exe File created C:\Windows\SysWOW64\Gmcfdb32.dll Djgjlelk.exe File opened for modification C:\Windows\SysWOW64\Dfpgffpm.exe Dhmgki32.exe File opened for modification C:\Windows\SysWOW64\Dmjocp32.exe Dfpgffpm.exe File created C:\Windows\SysWOW64\Nokpao32.dll Dhocqigp.exe File created C:\Windows\SysWOW64\Kngpec32.dll Dknpmdfc.exe File opened for modification C:\Windows\SysWOW64\Deagdn32.exe Dmjocp32.exe File created C:\Windows\SysWOW64\Cfpnph32.exe 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe File created C:\Windows\SysWOW64\Flgehc32.dll 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe File created C:\Windows\SysWOW64\Cajlhqjp.exe Chokikeb.exe File opened for modification C:\Windows\SysWOW64\Dodbbdbb.exe Delnin32.exe File created C:\Windows\SysWOW64\Kmdjdl32.dll Dhmgki32.exe File created C:\Windows\SysWOW64\Beeppfin.dll Djdmffnn.exe File created C:\Windows\SysWOW64\Dmjocp32.exe Dfpgffpm.exe File created C:\Windows\SysWOW64\Dhocqigp.exe Deagdn32.exe File opened for modification C:\Windows\SysWOW64\Dhocqigp.exe Deagdn32.exe File created C:\Windows\SysWOW64\Bobiobnp.dll Dfpgffpm.exe File created C:\Windows\SysWOW64\Elkadb32.dll Deagdn32.exe File created C:\Windows\SysWOW64\Dknpmdfc.exe Dhocqigp.exe File created C:\Windows\SysWOW64\Dnieoofh.dll Cnffqf32.exe File created C:\Windows\SysWOW64\Djdmffnn.exe Chcddk32.exe File opened for modification C:\Windows\SysWOW64\Djdmffnn.exe Chcddk32.exe File opened for modification C:\Windows\SysWOW64\Djgjlelk.exe Djdmffnn.exe File created C:\Windows\SysWOW64\Amfoeb32.dll Dodbbdbb.exe File created C:\Windows\SysWOW64\Kahdohfm.dll Dmjocp32.exe File created C:\Windows\SysWOW64\Dmllipeg.exe Dknpmdfc.exe File opened for modification C:\Windows\SysWOW64\Chokikeb.exe Cnffqf32.exe File opened for modification C:\Windows\SysWOW64\Delnin32.exe Djgjlelk.exe File created C:\Windows\SysWOW64\Fnmnbf32.dll Delnin32.exe File created C:\Windows\SysWOW64\Fpdaoioe.dll Deokon32.exe File created C:\Windows\SysWOW64\Deagdn32.exe Dmjocp32.exe - Program crash 1 IoCs
pid pid_target Process 2176 3544 WerFault.exe - System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmjocp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dknpmdfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmllipeg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfpnph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djgjlelk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dodbbdbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhmgki32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djdmffnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Delnin32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deokon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deagdn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhocqigp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cnffqf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chokikeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cajlhqjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chcddk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfpgffpm.exe - Modifies registry class 54 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll" Cfpnph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll" Chcddk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll" Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Delnin32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Chcddk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll" Cnffqf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dhmgki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cfpnph32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Deokon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Djdmffnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dhocqigp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dodbbdbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Deagdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll" Dhmgki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cnffqf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cnffqf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dmjocp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Deagdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll" Chokikeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll" Dfpgffpm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dmjocp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll" Dmjocp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dknpmdfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Djgjlelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Deokon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Chokikeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll" Cajlhqjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Djdmffnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll" Dhocqigp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dknpmdfc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll" 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dodbbdbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dfpgffpm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll" Deagdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll" Dknpmdfc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cfpnph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll" Delnin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Chcddk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cajlhqjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cajlhqjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll" Djdmffnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfoeb32.dll" Dodbbdbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll" Deokon32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dhmgki32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dfpgffpm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dhocqigp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Chokikeb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Delnin32.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4904 4980 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe 83 PID 4980 wrote to memory of 4904 4980 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe 83 PID 4980 wrote to memory of 4904 4980 5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe 83 PID 4904 wrote to memory of 3476 4904 Cfpnph32.exe 84 PID 4904 wrote to memory of 3476 4904 Cfpnph32.exe 84 PID 4904 wrote to memory of 3476 4904 Cfpnph32.exe 84 PID 3476 wrote to memory of 2736 3476 Cnffqf32.exe 85 PID 3476 wrote to memory of 2736 3476 Cnffqf32.exe 85 PID 3476 wrote to memory of 2736 3476 Cnffqf32.exe 85 PID 2736 wrote to memory of 2160 2736 Chokikeb.exe 87 PID 2736 wrote to memory of 2160 2736 Chokikeb.exe 87 PID 2736 wrote to memory of 2160 2736 Chokikeb.exe 87 PID 2160 wrote to memory of 468 2160 Cajlhqjp.exe 89 PID 2160 wrote to memory of 468 2160 Cajlhqjp.exe 89 PID 2160 wrote to memory of 468 2160 Cajlhqjp.exe 89 PID 468 wrote to memory of 2536 468 Chcddk32.exe 90 PID 468 wrote to memory of 2536 468 Chcddk32.exe 90 PID 468 wrote to memory of 2536 468 Chcddk32.exe 90 PID 2536 wrote to memory of 1676 2536 Djdmffnn.exe 91 PID 2536 wrote to memory of 1676 2536 Djdmffnn.exe 91 PID 2536 wrote to memory of 1676 2536 Djdmffnn.exe 91 PID 1676 wrote to memory of 3116 1676 Djgjlelk.exe 93 PID 1676 wrote to memory of 3116 1676 Djgjlelk.exe 93 PID 1676 wrote to memory of 3116 1676 Djgjlelk.exe 93 PID 3116 wrote to memory of 4564 3116 Delnin32.exe 94 PID 3116 wrote to memory of 4564 3116 Delnin32.exe 94 PID 3116 wrote to memory of 4564 3116 Delnin32.exe 94 PID 4564 wrote to memory of 3388 4564 Dodbbdbb.exe 95 PID 4564 wrote to memory of 3388 4564 Dodbbdbb.exe 95 PID 4564 wrote to memory of 3388 4564 Dodbbdbb.exe 95 PID 3388 wrote to memory of 1852 3388 Deokon32.exe 96 PID 3388 wrote to memory of 1852 3388 Deokon32.exe 96 PID 3388 wrote to memory of 1852 3388 Deokon32.exe 96 PID 1852 wrote to memory of 224 1852 Dhmgki32.exe 97 PID 1852 wrote to memory of 224 1852 Dhmgki32.exe 97 PID 1852 wrote to memory of 224 1852 Dhmgki32.exe 97 PID 224 wrote to memory of 3424 224 Dfpgffpm.exe 98 PID 224 wrote to memory of 3424 224 Dfpgffpm.exe 98 PID 224 wrote to memory of 3424 224 Dfpgffpm.exe 98 PID 3424 wrote to memory of 2232 3424 Dmjocp32.exe 99 PID 3424 wrote to memory of 2232 3424 Dmjocp32.exe 99 PID 3424 wrote to memory of 2232 3424 Dmjocp32.exe 99 PID 2232 wrote to memory of 1976 2232 Deagdn32.exe 100 PID 2232 wrote to memory of 1976 2232 Deagdn32.exe 100 PID 2232 wrote to memory of 1976 2232 Deagdn32.exe 100 PID 1976 wrote to memory of 868 1976 Dhocqigp.exe 101 PID 1976 wrote to memory of 868 1976 Dhocqigp.exe 101 PID 1976 wrote to memory of 868 1976 Dhocqigp.exe 101 PID 868 wrote to memory of 3544 868 Dknpmdfc.exe 102 PID 868 wrote to memory of 3544 868 Dknpmdfc.exe 102 PID 868 wrote to memory of 3544 868 Dknpmdfc.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe"C:\Users\Admin\AppData\Local\Temp\5c922582de0f559206d26ed25864e9a099e95b9b059ef2e42eb1dfb1dd145d02.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\Cfpnph32.exeC:\Windows\system32\Cfpnph32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\Cnffqf32.exeC:\Windows\system32\Cnffqf32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\Chokikeb.exeC:\Windows\system32\Chokikeb.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\Cajlhqjp.exeC:\Windows\system32\Cajlhqjp.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\Chcddk32.exeC:\Windows\system32\Chcddk32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\Djdmffnn.exeC:\Windows\system32\Djdmffnn.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\Djgjlelk.exeC:\Windows\system32\Djgjlelk.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\Delnin32.exeC:\Windows\system32\Delnin32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\Dodbbdbb.exeC:\Windows\system32\Dodbbdbb.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\Deokon32.exeC:\Windows\system32\Deokon32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\Dhmgki32.exeC:\Windows\system32\Dhmgki32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\Dfpgffpm.exeC:\Windows\system32\Dfpgffpm.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\Dmjocp32.exeC:\Windows\system32\Dmjocp32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\Deagdn32.exeC:\Windows\system32\Deagdn32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\Dhocqigp.exeC:\Windows\system32\Dhocqigp.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\Dknpmdfc.exeC:\Windows\system32\Dknpmdfc.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\Dmllipeg.exeC:\Windows\system32\Dmllipeg.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 40819⤵
- Program crash
PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3544 -ip 35441⤵PID:2196
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Bilonkon.dll
- Size 7KB
- SHA256 c69eb14e267e5dc92eb34634c83666689a2d380ff0c65d009295394c6f8aa754
- MD5 b9b54f2565daf7e6dcb9bb8ca01c0161
- SHA1 d26d2b60d49e5149f317b8cb8a6aeb950365f1be
- SHA512 d21898bc55f4c24e01dbea03a112bb325bcdeae20b8d9c63e536432c49fa1c5f9830890e1fc0c677b136aba78f821b406601ff7b3e619e1185302523052f83e1
- SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWIbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPaq3qX5S2hV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Cajlhqjp.exe
- Size 768KB
- SHA256 9b18e47b91d498dc98a4123872ec879a89b52b73fcde77259385c19410adc92e
- MD5 449819348cc74275575922edbf69b679
- SHA1 993fd1a21f80b22fe9bea43d8f0191ba038d4b5e
- SHA512 37aea0aa08555a0d85488bef333a545cdd98aedb75ef2d8c41c1ca2ee38d612bc4f72adb70d00b8dc46d69d292f37679bd3904cadec6209961fdb53553a81fbc
- SSDEEP 12288:y2C4uxq/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27U:M4uEm0BmmvFimm0Xcr6VDsEqacjgqAN1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Cfpnph32.exe
- Size 768KB
- SHA256 09b6a9d569f87688e886d7bdca2a01bac8cf8c35a69991b6a9b1187b85fc2f44
- MD5 4d4c828fdc2a08ebfbe31608549b3e1c
- SHA1 4571532ed659bf754c4c354c69088f2cf4e3357e
- SHA512 60ac12904915ba9940bc46f328e0ae3a6cfe77829a5753bb829710995e1bb1ce57a24cfe89e6fc9da8af5b99db71fafaa65787dd63a21f334a90ff1930a151e7
- SSDEEP 12288:rl5Yd/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27Z5Y:rLem0BmmvFimm0Xcr6VDsEqacjgqANXF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Chcddk32.exe
- Size 768KB
- SHA256 4c706f925c732142f2cc72bdbd8adca76050bfcb92c62eab813d38a4994e6469
- MD5 a0e3a69543ae33ed36f960d582e9a7a5
- SHA1 6f10ce28e01b63df06e3c07585d4010f029ced99
- SHA512 79b649ce387f0ee01d8a6307a2ea812d8e9c9c4efad28c6b91f62f551b42a9af94ff2ed5082db67022be1e29bb1586b6d02787d1c48670a11ef75f534fdbf763
- SSDEEP 12288:HGoBv/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27Z5Y:HGoFm0BmmvFimm0Xcr6VDsEqacjgqAN1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Chokikeb.exe
- Size 768KB
- SHA256 5767bafbad2f05ab6657c73665cbbb302b59668b70a8125285137fbe92ffbf93
- MD5 09aaae400ec22a23596c78690dd72edf
- SHA1 b6fcbc7b4481f3b3d7afa5c8ade0d2b0f9122be0
- SHA512 a4ca71709c7860a3f7d64ebbcc4752e572bb1d5f22468c18cda0d3a6cedda1aec3883b9fdaf7a35fff3b55c52607e58807e8bfbcf731f5559af8f6fd27feb796
- SSDEEP 12288:REeinLu/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27U:jNm0BmmvFimm0Xcr6VDsEqacjgqANXcw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Cnffqf32.exe
- Size 768KB
- SHA256 ccf43d3f7eaa2a2e183f8a77385709b3704b9bd3c7bb7b94ad79bb502bb5ffbe
- MD5 81953eba4912c9007dde9b15b0cb2530
- SHA1 6684e4d6bbd4a389ace1b58216f8c2e7f70ba92c
- SHA512 42ca652f8e600057feeabde9d9209d810a6782c21f9d38cb27b4c93d90f73581ab4c922194f6ab08a7e613ad6f4e589f8b6655b74ed096c22df60928eedf75db
- SSDEEP 12288:xbByQTS5/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol2Q:tS5m0BmmvFimm0Xcr6VDsEqacjgqANXF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Deagdn32.exe
- Size 768KB
- SHA256 911a7b0cf65436ae993c0172d64f5ded1d758fdedecb4b354d6f6b7be55257df
- MD5 5dda7e9f983236f61f34c8edb0ae3c74
- SHA1 8f4206a3fd492a54b256290b1a8a6f1d09a8ae24
- SHA512 1de92aa42052292b99bc3739bc8613013a404b520c6e4c0c63cc0bec16723e6321860f43f1b802b44764e9e69c6b8b20d4127d591984cf3819d54dfbbf159bd4
- SSDEEP 12288:wcISswp/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27U:WUm0BmmvFimm0Xcr6VDsEqacjgqANXcw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Delnin32.exe
- Size 768KB
- SHA256 4001f6017b0fde8b6fd806b90a3365e0bf3296c8f70faf11cd62db8d5d8c80eb
- MD5 24f6e574022394b40d70b1fc87974f39
- SHA1 ca9b6dceb8da5a11c2873d44857549bb7c33e0fd
- SHA512 ceb9938af09910c2054b5ca0fbebfb0332c999e90d5514cc453b4aeb5eb8141f6ce8e2215c3ad7a87f921fde90307607bf8513e268be0068079f14fa0ec5595b
- SSDEEP 12288:4BXZ/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27Z5nY:4BJm0BmmvFimm0Xcr6VDsEqacjgqANXF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Deokon32.exe
- Size 768KB
- SHA256 b52525393b426455832bdec9fcc1f8c5bfef70340c56ba121062207a43aa32a4
- MD5 e75f27686dcac62614431d16c9dcc73c
- SHA1 998079805956cbc3e3d5067c52a0b8b5f77c3322
- SHA512 bf9429ad36c6151a3cc6064be918bc57e15d69dcc81e0a0f84da1923ef69aee485ea29775a355f1f7cc68f5f2d0f1636c01a27a7f034b6ba4044f16f85328496
- SSDEEP 12288:Che3s/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27Z5Y:2m0BmmvFimm0Xcr6VDsEqacjgqANXcoN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dfpgffpm.exe
- Size 768KB
- SHA256 be9aefd921eebd5c63049a9200489490c3271ab63bab99c7ac2961df7be10a31
- MD5 8e0dbfd46e3cf4f1305d791f5c23a69b
- SHA1 a8639ef858fd9176a8b7ea5bafd276174d934ff3
- SHA512 8a96a54ccf36e9329f1cdcf9b870eafa22ef7165a60a165de6811c74935c5e8bcb227067e05b437a8cfba57c7b68fc2870633db8f34c2ceab87ed2244a79aa71
- SSDEEP 12288:GWEW+dYF/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol2Q:KCFm0BmmvFimm0Xcr6VDsEqacjgqANXF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dhmgki32.exe
- Size 768KB
- SHA256 79edf9912c6b87d0003d041ed08488e5905dae0449e7384b86e93ce7f3fc5df2
- MD5 4256ee7aeb990e6d5dccdd3bb3f57673
- SHA1 56818f6ce2b08cb162904eaf4aeea03b96f55ae7
- SHA512 41ac0fc622182f481349d9737ad0c3f2b7d0a50cfb42dc36bd7cc07d6a0325012e7ed48dcd317afb1d6d2877607e7c32cc0e93746802dd01e40a36f84a0e3bd4
- SSDEEP 12288:UhAl0aFlCjAXgIvyzsfy4c+rh4sBfPaCWekY/Qke/+zrWAI5KFum/+zrWAIAqWi0:UhAl0aFlCjAXgIvyzsfy4c+rh4sBfPab
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dhocqigp.exe
- Size 768KB
- SHA256 53cf2e49bd710990195bb3a439afb570bb33d54715b98c9d91b7a7fe0f8fa12b
- MD5 190933f556903511c5d84dbff548eb31
- SHA1 d954da9d7cbda3e2d26ce279d819f42d847b215d
- SHA512 b8bcba531b2690fad1710e0a2585550f5fe50eae4631ab49e27627798281f54f980847ea78aa0f7ce3e2b350f72bf5bfa9c1c2e0f915246e9e82c005131d468d
- SSDEEP 12288:m6iR/N/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27ZO:mfR/Nm0BmmvFimm0Xcr6VDsEqacjgqAz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Djdmffnn.exe
- Size 768KB
- SHA256 5e7390c142c1250ca2efab1e5cd0664b71f0ef978d35437da3879b1681c26b30
- MD5 5d8d48ba06e049beca94f4ff2771e575
- SHA1 93e2a33bdf7970f3432db3df8aa6d909028c13ca
- SHA512 d3e3e53801fbcc85f85769cd858c2fa1cc9eaf58cd671fad55666291d4732b03a72146f762a32e5b8e88d094c8c459d4c04e8c2e9d57a920137747c9c9defd46
- SSDEEP 12288:HGoBX/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27Z5Y:HGo1m0BmmvFimm0Xcr6VDsEqacjgqAN1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Djdmffnn.exe
- Size 768KB
- SHA256 f9b08a655cf9fd8c81d4ec891067f94d59aa529dfc51db4d4ec76d6ade69a9b1
- MD5 cdd0308005ca7513691caeb230753050
- SHA1 6a6fe1ddec3d99ce8af4236979116acc6b8faf80
- SHA512 31b5406385a2d34f690830e2fd5043c044dcdcd31de373cf482d7ccf814c278224fdb86946c5ebf5919d83153e9b53d5fb030301858b3dc019a2c80144df0e51
- SSDEEP 12288:vhvWf1QYrKb/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcw:ZvWGdm0BmmvFimm0Xcr6VDsEqacjgqAz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Djgjlelk.exe
- Size 768KB
- SHA256 859a0fab6af4693c11fbab1cfff89ad3866c8a648a57414eac34bb36ed27cdd1
- MD5 754ef447c5af63cfe103002590722482
- SHA1 0b3f69bdcb16c49246996a7d1f9f45399509041f
- SHA512 b6eaae91ef46fa6efd67a69b689b44535aa6a19bafb259f1b095e28838e4d8ab00375338fe4e099fa065f2452b73039fed3e1f36e18453c1b74794d8da39eb1b
- SSDEEP 12288:IgXyV/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27Z5Y:yVm0BmmvFimm0Xcr6VDsEqacjgqANXcw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dknpmdfc.exe
- Size 768KB
- SHA256 1b3da8152df594a079b522333f3b03eac4c20ccdf8b23db0751807f3cf088777
- MD5 98431e9d3ac6f11a7e8045e70765dc79
- SHA1 c6c5b4898e0bd3ecba168f01fc349cd740195525
- SHA512 b1db950a71079797a8bbf34df968cf42892e392e4393136f9f84abae0205fee30ca0f204484c8e667c8f6f84158c5d795bc2b5e70a1a99cd76a50ecafaa855bf
- SSDEEP 12288:QN132K/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27ZO:QNZzm0BmmvFimm0Xcr6VDsEqacjgqAN1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dmjocp32.exe
- Size 768KB
- SHA256 3500043e9fbc55c2bf93f7498851f924c0aa85d03ca11aed63e4e98e1f96f9cc
- MD5 17e888c68304ef0ec9452657d993bb9a
- SHA1 85b780f09a7254229fdaf569b1bf55e9c2450da3
- SHA512 53d4821dc03032db2dfc62719569bab78e9f4cdcdaae282171c09e1b76c47a1abe09cd665f6873151d20d7262eac8c756ee5fe98583fb1f9b863f718c01a0afb
- SSDEEP 12288:aOM8Vt9/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27U:Q8Vt9m0BmmvFimm0Xcr6VDsEqacjgqAz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dmllipeg.exe
- Size 768KB
- SHA256 bdd87fd4237fdc2892bbf9f555110568d85eeeb1d51637e959db70887bf26ed7
- MD5 e1793ed8e99f8d1c76700073b04b90ac
- SHA1 6b0bd47fbdadff6ba9a5ef4270eb0c7e126e02f8
- SHA512 6db88eef1b752832b98277077529f1c16ea44cf60bc3f2cfbefcf38687f60930e66dab562491b41653c6702499dca1af651b2a42e62544b148375ec4dd50fe8f
- SSDEEP 12288:iBzp/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27Z5nY:iBzpm0BmmvFimm0Xcr6VDsEqacjgqAN1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dodbbdbb.exe
- Size 768KB
- SHA256 549feb895d8aa13b71cd29c5c4a0730066eafbfae111f0d7f4c052c73a29784b
- MD5 d9986cf8219bf9d8bce0a743baae3b4a
- SHA1 830098080d1fa9d10fbba9a71cffe4a687ae49c4
- SHA512 baf3f52a93eeed8d3b27e01963d945e3c5abfc4e51d5d99c4c34ddf5cf6623dccf6c06b1f2eacad803616c695d6609a754758675791a3b0557351001de197692
- SSDEEP 12288:B8z/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KF4cr6VDsEqacjgqANXcol27Z5nNm:B8zm0BmmvFimm0Xcr6VDsEqacjgqANXF
- MD5 SHA1 SHA512 SSDEEP