berbew | 2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe
Size 377KB
Sample260828-mffepswvex
SHA256 2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25
MD5 f3f8c577cd64dea5d4b5bea004ca6970
SHA1 7b565d885ef5dbce97f9f95d4d2d2d0efbc83b43
SHA512 d3d706333f8fc8a719dc89b16a0dd176d0847e3e8d7e9ba3c2f6aa678de1c63ea5616a25df40906dda6f2822f03d73f3744a1260a3d9a30b02d2703245c76a07
SSDEEP 3072:8CNLeasDa9hsKRNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:8CNSasD2pRNl5fKx/SgnohignC5V
TLSH
T1CA84E03F58343E1AD6414AFD89F01571C89A9255416FCA023B58E32EE6EE3193FD8B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpfjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boldhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnlecmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnldla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oplfkeob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofhknodl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahfmpnql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnldla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbpjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbpjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npbceggm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oghghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phcgcqab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baannc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baegibae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckgohf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chkobkod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnjqmpgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmhocd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knnhjcog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcpjnjii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfchlbfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcpjnjii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmmqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chkobkod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljnlecmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njhgbp32.exe

Executes dropped EXE 51 IoCs

pid	Process
4220	Knnhjcog.exe
3404	Kpmdfonj.exe
5016	Kcpjnjii.exe
4732	Kjjbjd32.exe
4084	Lljklo32.exe
1792	Ljnlecmp.exe
2024	Lnldla32.exe
644	Ljeafb32.exe
888	Mcbpjg32.exe
4308	Mfchlbfd.exe
1304	Mnjqmpgg.exe
1672	Mmmqhl32.exe
4112	Npbceggm.exe
4468	Ngjkfd32.exe
3752	Njhgbp32.exe
4588	Nceefd32.exe
4148	Oplfkeob.exe
640	Ofhknodl.exe
452	Oghghb32.exe
1372	Ondljl32.exe
4808	Ohlqcagj.exe
2556	Pfandnla.exe
3792	Pjpfjl32.exe
2132	Phcgcqab.exe
4356	Phfcipoo.exe
388	Pdmdnadc.exe
4832	Qpcecb32.exe
5000	Qodeajbg.exe
2596	Akkffkhk.exe
2832	Amlogfel.exe
4480	Aggpfkjj.exe
3908	Ahfmpnql.exe
1540	Bhhiemoj.exe
3500	Baannc32.exe
4476	Bhkfkmmg.exe
5052	Bmhocd32.exe
1888	Bhmbqm32.exe
2056	Baegibae.exe
612	Bgbpaipl.exe
4420	Boihcf32.exe
4552	Boldhf32.exe
4780	Cnaaib32.exe
4876	Cgifbhid.exe
2128	Caojpaij.exe
2960	Ckgohf32.exe
4548	Chkobkod.exe
4132	Cpfcfmlp.exe
1744	Cgqlcg32.exe
1900	Dpiplm32.exe
2136	Dahmfpap.exe
1160	Dkqaoe32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lnldla32.exe	Ljnlecmp.exe
File created	C:\Windows\SysWOW64\Jcleff32.dll	Ngjkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Oplfkeob.exe	Nceefd32.exe
File opened for modification	C:\Windows\SysWOW64\Ckgohf32.exe	Caojpaij.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Lljklo32.exe	Kjjbjd32.exe
File opened for modification	C:\Windows\SysWOW64\Pfandnla.exe	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Kmephjke.dll	Pjpfjl32.exe
File created	C:\Windows\SysWOW64\Pkoaeldi.dll	Bgbpaipl.exe
File created	C:\Windows\SysWOW64\Ljeafb32.exe	Lnldla32.exe
File opened for modification	C:\Windows\SysWOW64\Nceefd32.exe	Njhgbp32.exe
File created	C:\Windows\SysWOW64\Amlogfel.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Ckgohf32.exe	Caojpaij.exe
File opened for modification	C:\Windows\SysWOW64\Ljnlecmp.exe	Lljklo32.exe
File opened for modification	C:\Windows\SysWOW64\Ondljl32.exe	Oghghb32.exe
File opened for modification	C:\Windows\SysWOW64\Ahfmpnql.exe	Aggpfkjj.exe
File created	C:\Windows\SysWOW64\Fbjieo32.dll	Baannc32.exe
File created	C:\Windows\SysWOW64\Dahmfpap.exe	Dpiplm32.exe
File opened for modification	C:\Windows\SysWOW64\Dahmfpap.exe	Dpiplm32.exe
File created	C:\Windows\SysWOW64\Mmmqhl32.exe	Mnjqmpgg.exe
File created	C:\Windows\SysWOW64\Gmbjqfjb.dll	Njhgbp32.exe
File created	C:\Windows\SysWOW64\Ifomef32.dll	Oplfkeob.exe
File created	C:\Windows\SysWOW64\Ondljl32.exe	Oghghb32.exe
File created	C:\Windows\SysWOW64\Bhhiemoj.exe	Ahfmpnql.exe
File created	C:\Windows\SysWOW64\Kpmdfonj.exe	Knnhjcog.exe
File created	C:\Windows\SysWOW64\Ljnlecmp.exe	Lljklo32.exe
File created	C:\Windows\SysWOW64\Ciipkkdj.dll	Boihcf32.exe
File created	C:\Windows\SysWOW64\Aqjpajgi.dll	Caojpaij.exe
File created	C:\Windows\SysWOW64\Cpfcfmlp.exe	Chkobkod.exe
File created	C:\Windows\SysWOW64\Bppgif32.dll	Kpmdfonj.exe
File opened for modification	C:\Windows\SysWOW64\Kjjbjd32.exe	Kcpjnjii.exe
File created	C:\Windows\SysWOW64\Ngidlo32.dll	Lnldla32.exe
File created	C:\Windows\SysWOW64\Qfoaecol.dll	Cgifbhid.exe
File opened for modification	C:\Windows\SysWOW64\Cpfcfmlp.exe	Chkobkod.exe
File created	C:\Windows\SysWOW64\Hicakqhn.dll	2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe
File created	C:\Windows\SysWOW64\Fmplqd32.dll	Ljnlecmp.exe
File opened for modification	C:\Windows\SysWOW64\Ljeafb32.exe	Lnldla32.exe
File created	C:\Windows\SysWOW64\Hlhefcoo.dll	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Qgaeof32.dll	Akkffkhk.exe
File opened for modification	C:\Windows\SysWOW64\Bgbpaipl.exe	Baegibae.exe
File opened for modification	C:\Windows\SysWOW64\Cgqlcg32.exe	Cpfcfmlp.exe
File created	C:\Windows\SysWOW64\Knnhjcog.exe	2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe
File opened for modification	C:\Windows\SysWOW64\Kcpjnjii.exe	Kpmdfonj.exe
File created	C:\Windows\SysWOW64\Npbceggm.exe	Mmmqhl32.exe
File created	C:\Windows\SysWOW64\Dicdcemd.dll	Npbceggm.exe
File created	C:\Windows\SysWOW64\Blqhpg32.dll	Nceefd32.exe
File created	C:\Windows\SysWOW64\Pnpkdp32.dll	Ondljl32.exe
File opened for modification	C:\Windows\SysWOW64\Pjpfjl32.exe	Pfandnla.exe
File opened for modification	C:\Windows\SysWOW64\Akkffkhk.exe	Qodeajbg.exe
File opened for modification	C:\Windows\SysWOW64\Kpmdfonj.exe	Knnhjcog.exe
File created	C:\Windows\SysWOW64\Hlohlk32.dll	Ahfmpnql.exe
File created	C:\Windows\SysWOW64\Nflnbh32.dll	Boldhf32.exe
File created	C:\Windows\SysWOW64\Okhbek32.dll	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Ngjkfd32.exe	Npbceggm.exe
File opened for modification	C:\Windows\SysWOW64\Ofhknodl.exe	Oplfkeob.exe
File created	C:\Windows\SysWOW64\Ojenek32.dll	Ofhknodl.exe
File created	C:\Windows\SysWOW64\Bpcaaeme.dll	Qodeajbg.exe
File created	C:\Windows\SysWOW64\Fgijpe32.dll	Baegibae.exe
File created	C:\Windows\SysWOW64\Mbkkam32.dll	Ckgohf32.exe
File opened for modification	C:\Windows\SysWOW64\Lljklo32.exe	Kjjbjd32.exe
File opened for modification	C:\Windows\SysWOW64\Ohlqcagj.exe	Ondljl32.exe
File created	C:\Windows\SysWOW64\Chkobkod.exe	Ckgohf32.exe
File opened for modification	C:\Windows\SysWOW64\Bmhocd32.exe	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Pjllddpj.dll	Bmhocd32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4608	1160	WerFault.exe	135

System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oplfkeob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjpfjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhiemoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmhocd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpmdfonj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcpjnjii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjjbjd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfchlbfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofhknodl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohlqcagj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phcgcqab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lljklo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhmbqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boldhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caojpaij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcbpjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpcecb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nceefd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oghghb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfandnla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amlogfel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgbpaipl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boihcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpiplm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahmfpap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnldla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmdnadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckgohf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljeafb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnjqmpgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npbceggm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phfcipoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baannc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baegibae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmmqhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njhgbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ondljl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahfmpnql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgifbhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chkobkod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knnhjcog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljnlecmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngjkfd32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgaeof32.dll"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baegibae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmbjqfjb.dll"	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nflnbh32.dll"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcleff32.dll"	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobhb32.dll"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahfmpnql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkoaeldi.dll"	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkamodje.dll"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmacdg32.dll"	Knnhjcog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phfcipoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npbceggm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baegibae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gemdebha.dll"	Kjjbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngidlo32.dll"	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmpjlk32.dll"	Ljeafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgijpe32.dll"	Baegibae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lljklo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmdml32.dll"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnpkdp32.dll"	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqjpajgi.dll"	Caojpaij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmplqd32.dll"	Ljnlecmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmmqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljnlecmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcbpjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gabfbmnl.dll"	Mfchlbfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojenek32.dll"	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmephjke.dll"	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bohgljdl.dll"	Kcpjnjii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpenegb.dll"	Pfandnla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cggkemhh.dll"	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmodn32.dll"	Bhhiemoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlohlk32.dll"	Ahfmpnql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qodeajbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dicdcemd.dll"	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngjkfd32.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 4220	872	2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe	85
PID 4220 wrote to memory of 3404	4220	Knnhjcog.exe	86
PID 3404 wrote to memory of 5016	3404	Kpmdfonj.exe	87
PID 5016 wrote to memory of 4732	5016	Kcpjnjii.exe	88
PID 4732 wrote to memory of 4084	4732	Kjjbjd32.exe	89
PID 4084 wrote to memory of 1792	4084	Lljklo32.exe	90
PID 1792 wrote to memory of 2024	1792	Ljnlecmp.exe	91
PID 2024 wrote to memory of 644	2024	Lnldla32.exe	92
PID 644 wrote to memory of 888	644	Ljeafb32.exe	93
PID 888 wrote to memory of 4308	888	Mcbpjg32.exe	94
PID 4308 wrote to memory of 1304	4308	Mfchlbfd.exe	95
PID 1304 wrote to memory of 1672	1304	Mnjqmpgg.exe	96
PID 1672 wrote to memory of 4112	1672	Mmmqhl32.exe	97
PID 4112 wrote to memory of 4468	4112	Npbceggm.exe	98
PID 4468 wrote to memory of 3752	4468	Ngjkfd32.exe	99
PID 3752 wrote to memory of 4588	3752	Njhgbp32.exe	100
PID 4588 wrote to memory of 4148	4588	Nceefd32.exe	101
PID 4148 wrote to memory of 640	4148	Oplfkeob.exe	102
PID 640 wrote to memory of 452	640	Ofhknodl.exe	103
PID 452 wrote to memory of 1372	452	Oghghb32.exe	104
PID 1372 wrote to memory of 4808	1372	Ondljl32.exe	105
PID 4808 wrote to memory of 2556	4808	Ohlqcagj.exe	106
PID 2556 wrote to memory of 3792	2556	Pfandnla.exe	107
PID 3792 wrote to memory of 2132	3792	Pjpfjl32.exe	108
PID 2132 wrote to memory of 4356	2132	Phcgcqab.exe	109
PID 4356 wrote to memory of 388	4356	Phfcipoo.exe	110
PID 388 wrote to memory of 4832	388	Pdmdnadc.exe	111
PID 4832 wrote to memory of 5000	4832	Qpcecb32.exe	112
PID 5000 wrote to memory of 2596	5000	Qodeajbg.exe	113
PID 2596 wrote to memory of 2832	2596	Akkffkhk.exe	114
PID 2832 wrote to memory of 4480	2832	Amlogfel.exe	115
PID 4480 wrote to memory of 3908	4480	Aggpfkjj.exe	116
PID 3908 wrote to memory of 1540	3908	Ahfmpnql.exe	117
PID 1540 wrote to memory of 3500	1540	Bhhiemoj.exe	118
PID 3500 wrote to memory of 4476	3500	Baannc32.exe	119
PID 4476 wrote to memory of 5052	4476	Bhkfkmmg.exe	120
PID 5052 wrote to memory of 1888	5052	Bmhocd32.exe	121
PID 1888 wrote to memory of 2056	1888	Bhmbqm32.exe	122
PID 2056 wrote to memory of 612	2056	Baegibae.exe	123
PID 612 wrote to memory of 4420	612	Bgbpaipl.exe	124
PID 4420 wrote to memory of 4552	4420	Boihcf32.exe	125
PID 4552 wrote to memory of 4780	4552	Boldhf32.exe	126
PID 4780 wrote to memory of 4876	4780	Cnaaib32.exe	127
PID 4876 wrote to memory of 2128	4876	Cgifbhid.exe	128
PID 2128 wrote to memory of 2960	2128	Caojpaij.exe	129
PID 2960 wrote to memory of 4548	2960	Ckgohf32.exe	130
PID 4548 wrote to memory of 4132	4548	Chkobkod.exe	131
PID 4132 wrote to memory of 1744	4132	Cpfcfmlp.exe	132
PID 1744 wrote to memory of 1900	1744	Cgqlcg32.exe	133
PID 1900 wrote to memory of 2136	1900	Dpiplm32.exe	134
PID 2136 wrote to memory of 1160	2136	Dahmfpap.exe	135

C:\Users\Admin\AppData\Local\Temp\2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe
"C:\Users\Admin\AppData\Local\Temp\2d8964c5c32ac230b69c992b1f8ac0a027af2cd7bccf5fb745568ddf674f5c25.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\Knnhjcog.exe
  C:\Windows\system32\Knnhjcog.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\Kpmdfonj.exe
    C:\Windows\system32\Kpmdfonj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\SysWOW64\Kcpjnjii.exe
      C:\Windows\system32\Kcpjnjii.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4732
      - C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:612
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 400
        53⤵
        Program crash
        
        PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1160 -ip 1160
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aggpfkjj.exe

Path C:\Windows\SysWOW64\Aggpfkjj.exe
Size 377KB
SHA256 fc5e25d89eb4ae1e495e7f9a12458ce768d9df36c71e2b9f784a3e7b845f4466
MD5 52c93578212083ad97b39a8bc4e6f7f8
SHA1 85128946f98e116bf160d7aa40bfea7e8b45f595
SHA512 f8a9d68f1cb37ff09d9a0b8b2f841aa480f0ded62156a6e85b5bd420b6b6b9f54110f057331adaea01be597f2899a3fe5be4dc436a6b447eb120b3c0f18d7248
SSDEEP 3072:0LZAahmKmSvkntEdjXfvKNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:0ltmZtEdTKNl5fKx/SgnohignC5V
TLSH
T1E484D02EA8F3FE07F214C5F405F72364888FA9FB722181153A85525D95BE746BF88E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahfmpnql.exe

Path C:\Windows\SysWOW64\Ahfmpnql.exe
Size 377KB
SHA256 54bb2a71907e1d367682bad2267821e3e43da6357f3048beec4bcf9f51687c89
MD5 e3f8ec33844c87f0cec53c9077216fd5
SHA1 2c10d386f0c9a1f17f57b33f702ae42718c63f2d
SHA512 ca9bb6c18121676dbe59e913ef54d9d4bde9db6aa557d343aa1383e39bcf5c56b2bcb8f62821e7aa3bf18382fa3fed850dbce209a00551c2664e5c6f0a47eca7
SSDEEP 3072:2UqKGPd3fyIkkNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:2UqKGPSkNl5fKx/SgnohignC5V
TLSH
T1B984D07E47BC3E4EC2205AB505F1C3E4549FA5EA021248067ABA735E56FE3FF6184B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Akkffkhk.exe

Path C:\Windows\SysWOW64\Akkffkhk.exe
Size 377KB
SHA256 cf80d13503635f2961f85e35fe36f65c3658630aed0da5df3b4b9af63f038eee
MD5 9280100d537e45fed7aa4044200a7bd8
SHA1 b9b406586bb432a1def9ac3fd2e1b82789a942d6
SHA512 1ad8c8dab6f2bef08d3491a7d586b0dd153719c98d145b70b414de4de0d59f70d42582ddd2db27ee278a4e2a3ca10d527c708400fa468f37590bd30ab755c87c
SSDEEP 3072:/8ZnAYl67VNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:UdrqVNl5fKx/SgnohignC5V
TLSH
T10384D0EE303C2D4FF6258AF8F4FA3AE4F04AA5650310450AEAE9615F92BE3156174FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Amlogfel.exe

Path C:\Windows\SysWOW64\Amlogfel.exe
Size 377KB
SHA256 d06f4b8fda1120fcc3f862472c31e264f24b60b05d6f2a17d377a07f81dc6432
MD5 3860c222be30bbf584412ef5fb210276
SHA1 ba924e2d454947c6206c81066c66f7b349065fd2
SHA512 65036c85507485be9a3116330a72d0d28a12249c5f949c8e3242e6cdea938f576880701dc570a92ef23233a65b96bfbd78232f786c93ec28bbf01a5a6dae2756
SSDEEP 3072:6D2+q4qTDkoAxyNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:66+vqT/AxyNl5fKx/SgnohignC5V
TLSH
T1BD84D0EF883C2D0BF6144AB81BF465E9925DC8EB010A4B0A3A97536F46ED70EB1D5F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Boldhf32.exe

Path C:\Windows\SysWOW64\Boldhf32.exe
Size 377KB
SHA256 cfd79d12a2d44b1bf19040582dac0a2019178ea957500147e8954d57ca24481e
MD5 a47decdf5326ba57dc616f95aefe1756
SHA1 ae6ed9aca04fda702ee6e376925491d32485a1f1
SHA512 1ce8133b2c317ca3d1e547c99a69abd8e846736ce548ed788217585fbee0c76a496fef4e38707185a622739b668baf16c488ba63b3e589d39aa4af826dbe4908
SSDEEP 3072:WtotKn+U9TrdMNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:WGg+U9pMNl5fKx/SgnohignC5V
TLSH
T12984D02E61303E4ECA6485F808F7076090C9E5AB01854D057BA7953D8AAD77F6EF7F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ckgohf32.exe

Path C:\Windows\SysWOW64\Ckgohf32.exe
Size 377KB
SHA256 0d55b175e7f70855acf658f7d68b63399e9fce4c413e1fc01c3ba1845c60d0ab
MD5 b77bdf32ddd2253376dfb8a40653fac1
SHA1 57eb4ce34a1d02a92d27ef5c4c60b5ae5c3a0ab2
SHA512 c30d7c2f24f326a90bf3fb42a5c247c51bc64de7465434023dc828cf2cd6fe72f0b4af9226ef644f5584c140663caa459eddf7121cff596868edad143d31f52e
SSDEEP 3072:x1LfpX7iFnMOoTMVYNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:x1YFnNoTMqNl5fKx/SgnohignC5V
TLSH
T1D484D0FF70B02D06E657C0FE08F601B5908EE59B731342067EEAA77A96BDF096094E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpiplm32.exe

Path C:\Windows\SysWOW64\Dpiplm32.exe
Size 377KB
SHA256 d847e412ebb29f0d0c88a70affbaf960cb1bcbc0e731ece6e439f5dd2b38d4e8
MD5 b003a4859da9806f6145737cf59ca5af
SHA1 16bc7bc4e1401a6a92ea10f4b0760b9af93fae5c
SHA512 efacd0cf7a60540a43a8619adab071fb8e7ed58b6b87e6a1de7155b70fe319ce8d45ccc1a78f4f3dee2d66980c84f8c8626abb7e1bf9cfc457355805e3762303
SSDEEP 3072:0j9Tw5YCGFhxkNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:0jYYCKxkNl5fKx/SgnohignC5V
TLSH
T15084D03F8C312F0FC85188F828FD12B58D9ED9A901119B153E9967DE76AE30971D7E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kcpjnjii.exe

Path C:\Windows\SysWOW64\Kcpjnjii.exe
Size 377KB
SHA256 21ef2cd0e6e0914f976c4fc7c9b36f86e12d9dd271786ce6c9cb563d0d5bb767
MD5 797491e20917b68169d88699c4904a8b
SHA1 7fd521270b4b87f2fa5eb70c32c79fc9372d4b63
SHA512 62a9d9eaff57738c047cd303f7d6f494574088797a6e3e2874eb205a395f2da043c52455cebf300a94590a0fb3a878b7f94133a631a4ffe3b49a26d8556ae4fb
SSDEEP 3072:YriET+n59Nl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:YrNW59Nl5fKx/SgnohignC5V
TLSH
T14284CF7E1434FFCBD351CEF844F10AA0619AA47EE1018B057AD6DD289AAD34BB1D5F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kjjbjd32.exe

Path C:\Windows\SysWOW64\Kjjbjd32.exe
Size 377KB
SHA256 e13b46e49b0ea2787d51e4fc9c651c875b1c2a282f07b84c4c292ca4ee531daa
MD5 b96848fee07a3478be81ab6e81d1a202
SHA1 f3ad1733a6f1a29ee527d1b25f1e2337c9c1662b
SHA512 263bdefe83ea4811b589eba84f4b4f31c8f03d11fd0c726bf7a40bf666f45058399352844062c019b74fec993cb9d036be6554f009cd784502f254802f2875a0
SSDEEP 3072:QaW8SU8CHfkDNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:u86CHfkDNl5fKx/SgnohignC5V
TLSH
T1FF84DF7F7B3D6EC6E6619CB408F9DAE4A14AAC7E0E01CE453958432866AF30E50C8DC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Knnhjcog.exe

Path C:\Windows\SysWOW64\Knnhjcog.exe
Size 377KB
SHA256 fdf0d52b5edad11d298ce3446e1b582a35847dca90b0369caa0613f6e103581c
MD5 6ba9d6fef1be9f7b82a654485771391c
SHA1 35a3f7140745251c6e10ae8e852fa4408833c744
SHA512 11c9e5d2d20a4238d66c89c6d25ea2748d18fe83af38fb04810e984fd48a4a827b2f7b3a7eb7be6d2b2aa42620fa159805055d0a95f4cc984d585eb54a902e9f
SSDEEP 3072:cHBkIkFDC5MwYzlNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:chu9CRYzlNl5fKx/SgnohignC5V
TLSH
T12084E03E66343D07CA36CBB603F442A550DA986B41830D06F559D3F89EFE34A61EFA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kpmdfonj.exe

Path C:\Windows\SysWOW64\Kpmdfonj.exe
Size 377KB
SHA256 681d8a2ff5d399fce8a9a0c0317cdfa127c9493435ec2c8b0b6a4cf04564ad64
MD5 3b2569727a697ea98db1d5567c2b3de9
SHA1 2241dbbc6b95ee5e18a0809f191107df35cee7e0
SHA512 0092b18cf689559edb98b7e518a60404bc091e5e0f4daf2e347d88f96587cca043d40e08c7a8c810c18bafabc9d4591c325fb6803686bd1b2f478a4e74d0a6d2
SSDEEP 3072:qdTuVlRwONNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:qIVlRwONNl5fKx/SgnohignC5V
TLSH
T1E984D07F54733C4ADE34CABC13F615E49099E56A0142CD423A9CA21DBEEDF4A61E8F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljeafb32.exe

Path C:\Windows\SysWOW64\Ljeafb32.exe
Size 377KB
SHA256 2f5c65c2360e90bfdfdf68c4de81d57620b34c00e0a086efaa6f1e3f3c903a35
MD5 5c4e45009916a3d727b9d9515538ffb9
SHA1 dcd1b00aef78978b8e93f10858f58f9b00b93e30
SHA512 58bad5789a56a3c166e0489362ca6bf207eab7268acfd03b7aca82c66aefcc7b0bb41243ab75e310c726b435659c195b8e4e49a697fdf6e81a1e119fec158c1d
SSDEEP 3072:UUMskaJjuybuNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:URs5juIuNl5fKx/SgnohignC5V
TLSH
T18784CF2F68316E4FEE1945F804F72361C0D9A85A53214207FA75B32F56ED35BA387B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljnlecmp.exe

Path C:\Windows\SysWOW64\Ljnlecmp.exe
Size 377KB
SHA256 fe518db5c55ced0699401cfc3277fa7f951af8bd3fde221b02ca5af324b9f2c2
MD5 b47c82628ea0f91254a1e7553fba3b88
SHA1 97f3a1adaff2e015430a5109d66f5314165c87dd
SHA512 75a8d642d3fd3ae2fdc5dfcde8b7fdf9b65d45db801bc117bd2352979552b6ba06740a9758e9e0151033e23fe0fbf3216af2132ca82170f04e499f29b0789d5b
SSDEEP 3072:KJ7B8Afjzh7LS5wlXKNNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:G7da5MKNNl5fKx/SgnohignC5V
TLSH
T19184D07E94F02E0BD2A249B575F412A79089B5BF00D6C2013B8976594ABD30A52DFFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lljklo32.exe

Path C:\Windows\SysWOW64\Lljklo32.exe
Size 377KB
SHA256 be17e7bd10a3a6a1279ace796adab338883a3f973745a631da6413152f47d8d3
MD5 ddf35618305770da516f2fe8497633de
SHA1 84676aaaf18b7e3fbf691babf0ae114a15f21722
SHA512 e283c9a0c11ca613d7610b7ec21e2c3b6bdb4ecccf95fcb0c7e46523f80a3f74edf4bedc70c1a434c2e2153284199d796430b38074b3ca89128b760788ba2890
SSDEEP 3072:FALHjUXOJlb3sklpQB9iNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:MHjyOJMziNl5fKx/SgnohignC5V
TLSH
T11884D02F14322D06F978CAF414FC0EB594CFE4ADC112430D295D56D89AEFF69A1E9A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lnldla32.exe

Path C:\Windows\SysWOW64\Lnldla32.exe
Size 377KB
SHA256 8dd5fe298a33780ecb5e77eeb0ecfce9a2d38cda97d874531b86119925e1651c
MD5 fb6ec2ad6b48a83766b5f4c210c14c50
SHA1 06ea62729d43176acfd1c688b261b5b7e7fb4084
SHA512 2101ddd4bced1afe2a3c3c4557f897cd1b43c03b02511715fd927d9343621bc1e409765b21b294cd703bf1c1e08e7569f3dd1fda1c7e65310015acb882413fef
SSDEEP 3072:6Y3DjGcg/8yEFs6mX4I4Gxc4Nl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:H3DjGjfo4Nl5fKx/SgnohignC5V
TLSH
T11B84DF3E55353D06D20089FA05F917A7808AEA6FC03547393B85BF1C57AE7C99EA8E0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcbpjg32.exe

Path C:\Windows\SysWOW64\Mcbpjg32.exe
Size 377KB
SHA256 95f5ceb1fac39bc1d531cb1f4cffd966d9e84da3ecbf3a514a1adba012b42105
MD5 4c664aea0dcf9c0e4efb7b4bf366929c
SHA1 7256d547c21d969ab643f78f34df79da1f5da37e
SHA512 5155d9c716fb65e18dda1518f9124ba05aff718be9e54fcb16b0c268b133951c62f8de1814399b099c3758274ff8be4ae53a619d59dffec3ea1794f31acad4b7
SSDEEP 3072:gM8JmfJoOaUvr0Je/zwB4Nl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:Ii5gE/44Nl5fKx/SgnohignC5V
TLSH
T19584D07E58743847D66489B600F802B063DA98A6CFCC47C9FF79DE18957933A7E94E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfchlbfd.exe

Path C:\Windows\SysWOW64\Mfchlbfd.exe
Size 377KB
SHA256 68468536774e70f101e9a47560bdddb3185c6c5f5ac6f98fb84d6df41e79c2a6
MD5 9aa2995f1727f08c3bcdf8ae5a6443c7
SHA1 01d664a666f897792c35d53cc4a38ba486fb8477
SHA512 fb2b05e1bfd1ff2967821cd69f860093529b7554f317f5e3be5edffab9d628c7494e600f9268779d09fdf99b5e4f6be47059ae40b0ada3aec2681b5894d17100
SSDEEP 3072:eic/gYtglcwJelNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:fc/geglcwslNl5fKx/SgnohignC5V
TLSH
T19C84E02EEC7CFD06D1908AB844F555B0F1BEE826455272067E68431C87FE74A7E98B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mmmqhl32.exe

Path C:\Windows\SysWOW64\Mmmqhl32.exe
Size 377KB
SHA256 b4016e000ed11c6e012efe7f9537de75154370c478f6454b852287d8b6930923
MD5 48c2aa0d1112eda9fc942761ff34ca2b
SHA1 61dfc3ab32200d6ab1b0aac00a3b16c339b054d7
SHA512 d4d7dbb3521f1a279f42e77361a6c5957b856be2581cee8d627b0b5ec5ed0568f08ac2b95691df847c91baca60324b0dae9dfa895352286ab7ff4d037616c799
SSDEEP 3072:WJSAr4hCiOx1fCAQAi5Nl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:OchCi4KAQAi5Nl5fKx/SgnohignC5V
TLSH
T15284D03ED77D784BF61488BC04F10DA9B08D94EA40D1C206EE95A62C57EF35AA29DF0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mnjqmpgg.exe

Path C:\Windows\SysWOW64\Mnjqmpgg.exe
Size 377KB
SHA256 da78a6d556c09baffb56ef556e5f979bfa013669cc9fc481b292795c54a6681b
MD5 fb2a9fe54f5441f75bb9b922c59e12e9
SHA1 5335396c34a893839303a2a1653913e8367b4c87
SHA512 6f7cf3deee82e273a5687a31d110f3ca43d7a152d39d758f82427d97495979455a5cc8b309cb003748f92d0d344ddb03f73cf9def656c202058b349d4799f6dd
SSDEEP 3072:3itlSQhOcX48n8kzjSTpNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:SZzOTpNl5fKx/SgnohignC5V
TLSH
T1D084CF2F70313E76FAE484B9C9F507A4A18CD876061066053F79926F66BE70FA0B9F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nceefd32.exe

Path C:\Windows\SysWOW64\Nceefd32.exe
Size 377KB
SHA256 995d3213073f206b0f80589acc2a83095a7115b26792b74b78ff38fcd54c6d3b
MD5 1ab5349321f6ea62455ef96d27829c51
SHA1 47583973ed28538021df9831451cec060ecde1f5
SHA512 91dd815ae92ccd53d6f4e2e8480b40aa1a8dc0dba967604079f226c3bf096ccab39a2732a63eea66ba5503d9754ff9c12533c19f2e99931dcfe5bb3fa5014cb7
SSDEEP 3072:pkzaqI0sBhCmMVHUiwNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:wGMRUiwNl5fKx/SgnohignC5V
TLSH
T13884CF2F94F17B0DDD2447F508F116B3838A915A4DCA41DD2E5912DC9BEE3CA6298F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ngjkfd32.exe

Path C:\Windows\SysWOW64\Ngjkfd32.exe
Size 377KB
SHA256 e92dc2ead98cc5a2878a403d5eadc930dd5905b309b12826cbfa6d067a3eeaba
MD5 03c33d6b5a0049aba2fd63d2942fe12a
SHA1 5c67a6413058ea9b162ae710709bb891d653f90a
SHA512 30a0e55d440315d3ff0f60cc884da55598374a62f495704300bc871f26ee81adee047249f8f094d45d423a7a5a7d4829720f0f3a8dfbbecacb7f8fb179c3ffd6
SSDEEP 3072:aLBowUJuLFSTrecANl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:aawaLTrTANl5fKx/SgnohignC5V
TLSH
T12984E13EA4333D4EED6489BD4AFD86F0804BC56F521186053AD9D22CD6ED36DE29CE09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njhgbp32.exe

Path C:\Windows\SysWOW64\Njhgbp32.exe
Size 377KB
SHA256 e18373cb4442f0f2b7163c23297b948b4bcff59c62a36565b390c311364cb5a2
MD5 240994d442e5fe061a871abf8d8f9426
SHA1 1ad50a21f0ae4560ee282b5b18f143d77a4db3da
SHA512 99a7625142bd5abaabf9962ef8c8b944f5eebf8d48b7a56fa7f4f1e0804590adf0a27de2147734567d195dddaafab329c83209bf1170b2d7adf6e3cd5bda3e1c
SSDEEP 3072:65FOkxbPEpeCHO+Nl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:xe8peCu+Nl5fKx/SgnohignC5V
TLSH
T1FE84D06E2DB73D1AE86846BC04F4C7B0A19ED9EA4102F50D395E626C51FE348F29CB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Npbceggm.exe

Path C:\Windows\SysWOW64\Npbceggm.exe
Size 377KB
SHA256 8adb004aada417b428739191b178382e139b8dfd5839b40fb1276e93ce7e41fb
MD5 6a8d7731ceb35c9905aaa30abcc16d1f
SHA1 848994b1e4cd74836aed126d24ebb4d605511eed
SHA512 c51898a5d6e7cf5b46683863d1ec03b3d1fa72e3657089c21cef130d973e34f2b693d9f7af9fd0cb378fbed1bb412f4636b97909ecc64598395bea71884e7d6e
SSDEEP 3072:+NiFIyv3ViOPAlBRS7Nl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:+NiZv3eRS7Nl5fKx/SgnohignC5V
TLSH
T19A84D02E5833F90FE3544475C7FD35A0909DEC691102851EEA98924E8AFE34BF2D9DCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ofhknodl.exe

Path C:\Windows\SysWOW64\Ofhknodl.exe
Size 377KB
SHA256 a08587aecfe48cbe3b46db574d7c0da90d4fb5cac3bdd75733da58aa5227e23f
MD5 484f1ee3a472a55fc5299325707272c2
SHA1 0076cd5020fc7d99a2a838654456d13fb3818ab0
SHA512 69e32ce6919063350b88d7359f6b71bdce8b2992be86fc52f11f4c5b1441e0cd7a11c82886483a81725f579095d91159ed33f69974594ff3b35ecadb65d53e81
SSDEEP 3072:6+NFszatV3a5lXg6U+SNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:tb7tR+SNl5fKx/SgnohignC5V
TLSH
T1BA84DF3E6534EE4BDA11D5B948FCC6B280FAD93E441249053B58E61DBDBE30952F8E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oghghb32.exe

Path C:\Windows\SysWOW64\Oghghb32.exe
Size 377KB
SHA256 fe76898f5e75f605c114ee7b322eedeb17b8f28a438bdc3007efc84886837599
MD5 d2a9b86a11a0409661fb19eb50d96fcb
SHA1 206ec60840a013cefd1c82acc2e48263b3ddf617
SHA512 5db100ca2a3a19d565c32f41418c5a54db9121ef069558f9f47c5d209470338375684c61cb93cca2329377e28ede526320f61541c70203a92d5d335c9066a0c2
SSDEEP 3072:FqIDqohsV1ccubc/I/yEtPNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:8IOoiV1CeEtPNl5fKx/SgnohignC5V
TLSH
T1F084CFEDDD3B3D26D32085F704F306B4529AB9664D11CB053A9953ECDABD30E629CA0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ohlqcagj.exe

Path C:\Windows\SysWOW64\Ohlqcagj.exe
Size 377KB
SHA256 3563d062fed492509b8933b00bbedbfb64e7f94b1dbde40ae43faccb1013f7a8
MD5 0f934ce6e0d725b6abb24a6d874cace4
SHA1 a5b19f9e745bfd91d947b9bbabd8d8f249d2d69b
SHA512 c50ff96533dff524337f460a1f6f08535f85f3a27cfa91702be583451c859dc0a16d69d8e4991bd30331d3f832e93f86a89e03d1a16040a69eecc1a22a35e204
SSDEEP 3072:Naem28V3xHGpNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:NXT8V3pGpNl5fKx/SgnohignC5V
TLSH
T15884D02E67713FCFE23685F904F336B0B1AAD963015147046F6993ACA2BD37A2594F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ondljl32.exe

Path C:\Windows\SysWOW64\Ondljl32.exe
Size 377KB
SHA256 cf00ba832c6c64606f0b97524849ff98608e1ca9ed988b44510bf9157dcf5dce
MD5 2eaa14fdd513694da78cbd31cebf6236
SHA1 528897da3154d7865aa6f4a6dcd87936e4666407
SHA512 ba86b64e794971abca9fc80d7c23420d6bd6190a3ef126b48e76bd1c960247112226425965cca4058cc31a210a554ea85293997e1bae8e5d1bb67508cebe48da
SSDEEP 3072:acn2D0L8Lnm1SdDeDxez/O9MNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:J6MDxez/8MNl5fKx/SgnohignC5V
TLSH
T1E784D03F957029C6D3184AFBC1F896F5948E9576407283083E949A3F5DBE344B2A8F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oplfkeob.exe

Path C:\Windows\SysWOW64\Oplfkeob.exe
Size 377KB
SHA256 2ee598c1b4e9808945f85b8fe6945d53135484ec004baf9b7f08733e2413b844
MD5 7dfa453841e041ec0d971b4ce0e19435
SHA1 e3cb1babca58f4a35219713653a0b0c8412e8339
SHA512 e8515165182b1c4542914b5b5ad4d70bb3c41e48c34cd01e12b8fe08ead2ae39d5cbe6fde94a67738a88edd09973728001d3c3ca58fdf2a8a35a452f61fdfb15
SSDEEP 3072:qYxuzOuAh4SjONl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:It8jONl5fKx/SgnohignC5V
TLSH
T14A84D02FDB31AE0BDE7DCEBA34F409A487AEDCA71101490A39FD762846AD30D71B5905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pdmdnadc.exe

Path C:\Windows\SysWOW64\Pdmdnadc.exe
Size 377KB
SHA256 f411e033c6f4a2fb09e605b8466b53b5e209f2ff4b4ae60876187789377f3ba5
MD5 a95a036431edc248d186238296e7b6c3
SHA1 86a6f2015e690e72e2c2b420aad810a26ba0a93e
SHA512 349e3734f08f1a229017eab7e4b548d8893f7a6603bbbf4c93c09e5eb86882a6b220253c130f1b35d967414d97e6e4eab68d50bc0f28388d3a0a7568989bb150
SSDEEP 3072:vh1032hYS1lxt4qmiBNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:p10GiAtPmiBNl5fKx/SgnohignC5V
TLSH
T1DB84CFAEDF347A1AC55F8EF804F126EDD08EB5234DE7441C2949726EC6AF30A60D4E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfandnla.exe

Path C:\Windows\SysWOW64\Pfandnla.exe
Size 377KB
SHA256 a58d9e6fb898344f94ad6e3ace8ae338872f8b112eb19afef5345f701c7e5403
MD5 db66f43c05080016c4ac523522d9b6b2
SHA1 4bb3188553403c4b376ebdfd77cf63b986087a93
SHA512 f6d7886c5fdd071a6df4a29461407fb8e137484a48f051bef42e47eee931156eb2cc917799978a8dba6632103f2c1d4341236403b37f93b7f37278b323a648e9
SSDEEP 3072:sjKzF/SoMPvsk2Nl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:s2x/SxPz2Nl5fKx/SgnohignC5V
TLSH
T17D84DF6E54713D2EF7254DF984F033B0F16AE7FA410189053B597328E5BE32AA198BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Phcgcqab.exe

Path C:\Windows\SysWOW64\Phcgcqab.exe
Size 377KB
SHA256 9b506cf9801e4b642f4a80adff0f7434d7f680a8faf0e77de398c5a28043a954
MD5 b629af82fe4e4c724ef7cb180ea74f4d
SHA1 4cddffd6120499b5b027a88f07576f2816c64d9c
SHA512 dead4628032f28f628029d5ad7396aad42b876f1caed3bc5cc82934beefdb1aa3fb388c42d37649c8178a3e4eefb55c0cbba3fa802978524d1746929a79abb42
SSDEEP 3072:VlxOlSe1R96LawmNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:pOoA6mwmNl5fKx/SgnohignC5V
TLSH
T17084CF7E1831298AD27176FCC4F041F0C0AFFA5641468A5E395BB65C67EE38CB284F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Phfcipoo.exe

Path C:\Windows\SysWOW64\Phfcipoo.exe
Size 377KB
SHA256 0f7d6e3a6c28dc1b8d3ca7dca5f1a580217426d6005b84bc45e58da75b0bb9a7
MD5 c7c69e862ee8592bf8b4824f4baa4787
SHA1 9fb4cee3de7dfc08c3ea6a889df7930809a3cdc4
SHA512 58bbe3ac5e99d80ded1a6376307f5cde42f29e0ccde9e8410559071bcca76607e7c4293213e271338530038cfb7e96ab713dee37fc5799b5c2ef3ce2f8445098
SSDEEP 3072:ViJV1VYNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:ViJV1VYNl5fKx/SgnohignC5V
TLSH
T16684CF7E18363D0BF150CFF800F127E081DEA5F6492152CA7A6D661C46BE71BEDA9A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjpfjl32.exe

Path C:\Windows\SysWOW64\Pjpfjl32.exe
Size 377KB
SHA256 1a25301398eec91a1fd04b96bdc6330d9fa84ab361939ad873c786ff2e3b840f
MD5 c8c06963b0ab1431b7ee01165db664ff
SHA1 c2d9af69a43f623eff79a45fdfc4c36163fac21f
SHA512 35e3c6b1e055cf29fc5e09ca86b7ca51f2e8f1697102a3b18a90b5450656be0e413a6664eccde9b1ea0e139dee03ba8377fa86d6ae77603a9c2d1cec2bf7c2b5
SSDEEP 3072:HvwN52w0q73zHxrZusHdNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:g0qfHx1dNl5fKx/SgnohignC5V
TLSH
T13884D03E64746B8FE2749CF81CF857A0D2CFB5F640E2C5056EE687196AFD34A1284E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qodeajbg.exe

Path C:\Windows\SysWOW64\Qodeajbg.exe
Size 377KB
SHA256 ab9a92e073c43af541a0d2fc776a18271215631b085c6a951b95691ee699d053
MD5 9e63c86440f7f56d7e03df6598392acb
SHA1 1fb3791c7722f180e9c813dd9b750090ea4f8d75
SHA512 3b57f394d998a1c29996ce502a4de3956943580bcd495bd3f131d59b2502b2cee4482dd12ba1b3166622c383218dd7e0c2a723182039a015b829ff72752ce93d
SSDEEP 3072:/pqwoW64LJbyNl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:xHjFbyNl5fKx/SgnohignC5V
TLSH
T15784CF6E1CB13D0BD6DB85F408F543A090B95DAF91E2804D35E36F28F6BD39962D8B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qpcecb32.exe

Path C:\Windows\SysWOW64\Qpcecb32.exe
Size 377KB
SHA256 32576dd488aaa479627b775b214382869fad29f62696dd07cba617dc76c94652
MD5 a2c29f29356d7805dc60dc8d9ce830e9
SHA1 d58cdcc33935023dbd986042ffed56786f18ca65
SHA512 8d65e84c6ee596269f39938fe63c119f5c3e821eb3d941384c9721119951c7a609f22723d254d9eb3848a6c294f0a87e761a53f0930202275b17c562198c7a0a
SSDEEP 3072:SGUgqsmtx2JjG63Nl5ecz7RAxFKUXCt8/zAIo92VGiK/zAIC588:SG0smajG63Nl5fKx/SgnohignC5V
TLSH
T13284D0AF5CF06E06C55CC4BA45F445A090FE94BA82224106394AD72BB3FDB7D61B6E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-423-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/388-209-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/452-437-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/452-153-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/612-299-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/612-397-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/640-144-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/640-439-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/644-65-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/872-0-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/872-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/888-457-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/888-73-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1160-374-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1160-371-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1304-93-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1304-453-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1372-435-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1372-160-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1540-263-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1540-409-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1672-451-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1672-97-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1744-379-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1744-353-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1792-48-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1888-401-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1888-287-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1900-377-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1900-359-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2024-57-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2056-399-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2056-293-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2128-329-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2128-387-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2132-193-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2132-427-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2136-375-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2136-365-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2556-177-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2556-431-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2596-233-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2596-417-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2832-240-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2832-415-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2960-385-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/2960-335-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3404-17-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3500-269-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3500-407-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3752-445-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3752-121-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3792-429-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3792-185-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3908-257-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/3908-411-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4084-45-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4112-449-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4112-109-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4132-381-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4132-347-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4148-441-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4148-137-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4220-13-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4308-86-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4308-455-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4356-201-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4356-425-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4420-395-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4420-305-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4468-116-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4468-447-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4476-275-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4476-405-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4480-413-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4480-249-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4548-383-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4548-341-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4552-311-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4552-393-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4588-443-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4588-129-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4732-32-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4780-391-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4780-317-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4808-433-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4808-168-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4832-216-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4832-421-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4876-323-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4876-389-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5000-225-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5000-419-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5016-26-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5052-281-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5052-403-0x0000000000400000-0x000000000048A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads