berbew | 715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f

Analysis

max time kernel
148s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe
Size 163KB
Sample260908-mf7tysxtc1
SHA256 715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f
MD5 d7052461c1fbc83a8b36bcac115c31d6
SHA1 d4a7f6a807ab585bdb65b683834a18bcea9d1d62
SHA512 00237daa1a8c1c254a376ece6c783db3b1705d4974dd85f54538f7a6606e847756600a03e8f1712c3a747e393b696887f9bda9ec708425add8993c8318ef86d3
SSDEEP 3072:zUvCpazbhRD2Y7N5g7woHKxoDltOrWKDBr+yJb:zUvCyRD2YLSd8oDLOf
TLSH
T1AAF33DEA73294FE8CA5CD7B484E38B61D4AEF1B81EE1A63D5DDDDEB400085981C46F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkbgjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkcpql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbfkceca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqikob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmhhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egkddo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqkhda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkalbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gclafmej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enhifi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekljpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egegjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekimjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnhbmgmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgqgfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnljkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcjdam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnljkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dncpkjoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecdbop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enlcahgh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnalmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnohnffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqnejaff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dckoia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eahobg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkcpql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgiaemic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgnjqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejojljqa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eafbmgad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqphic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdkdibjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdkdibjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkgillpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgnjqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eaaiahei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnaecedp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egkddo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejjaqk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnhbmgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epdime32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enhifi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edfknb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjhmbihg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbdnne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnmlhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqkhda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkalbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekljpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eahobg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbaahf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkcigjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkedonpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enemaimp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecdbop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecgodpgb.exe

Executes dropped EXE 64 IoCs

pid	Process
3436	Daeifj32.exe
3940	Dnljkk32.exe
3772	Dahfkimd.exe
4548	Dckoia32.exe
4796	Dkbgjo32.exe
1624	Dpopbepi.exe
1632	Dkedonpo.exe
3180	Djgdkk32.exe
4540	Dncpkjoc.exe
3208	Dpalgenf.exe
3536	Ddmhhd32.exe
2292	Dcphdqmj.exe
2660	Egkddo32.exe
2204	Ejjaqk32.exe
4912	Enemaimp.exe
4304	Eaaiahei.exe
2740	Epdime32.exe
1392	Ecbeip32.exe
4068	Egnajocq.exe
656	Ekimjn32.exe
1388	Ejlnfjbd.exe
1120	Enhifi32.exe
4056	Epffbd32.exe
584	Ecdbop32.exe
1496	Ekljpm32.exe
732	Ejojljqa.exe
388	Eafbmgad.exe
1940	Ephbhd32.exe
3788	Ecgodpgb.exe
4488	Ekngemhd.exe
4240	Enlcahgh.exe
2840	Eahobg32.exe
720	Edfknb32.exe
3988	Egegjn32.exe
2456	Ekqckmfb.exe
3000	Enopghee.exe
756	Eajlhg32.exe
2928	Edihdb32.exe
2620	Fggdpnkf.exe
3484	Fkcpql32.exe
2724	Fnalmh32.exe
3452	Fqphic32.exe
4612	Fdkdibjp.exe
1076	Fgiaemic.exe
1248	Fjhmbihg.exe
924	Fncibg32.exe
4432	Fqbeoc32.exe
1856	Fcpakn32.exe
4196	Fkgillpj.exe
4044	Fnffhgon.exe
2816	Fbaahf32.exe
4252	Fdpnda32.exe
2128	Fgnjqm32.exe
3316	Fnhbmgmk.exe
2836	Fbdnne32.exe
1872	Fdbkja32.exe
988	Fgqgfl32.exe
4524	Fjocbhbo.exe
4160	Fbfkceca.exe
956	Fqikob32.exe
3948	Gcghkm32.exe
3972	Gkoplk32.exe
404	Gnmlhf32.exe
3420	Gqkhda32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fnalmh32.exe	Fkcpql32.exe
File created	C:\Windows\SysWOW64\Fqphic32.exe	Fnalmh32.exe
File opened for modification	C:\Windows\SysWOW64\Fgiaemic.exe	Fdkdibjp.exe
File opened for modification	C:\Windows\SysWOW64\Fgnjqm32.exe	Fdpnda32.exe
File created	C:\Windows\SysWOW64\Gcjdam32.exe	Gqkhda32.exe
File opened for modification	C:\Windows\SysWOW64\Dckoia32.exe	Dahfkimd.exe
File created	C:\Windows\SysWOW64\Camgolnm.dll	Epdime32.exe
File created	C:\Windows\SysWOW64\Ljkgblln.dll	Ekimjn32.exe
File created	C:\Windows\SysWOW64\Ekljpm32.exe	Ecdbop32.exe
File created	C:\Windows\SysWOW64\Fnffhgon.exe	Fkgillpj.exe
File created	C:\Windows\SysWOW64\Fgqgfl32.exe	Fdbkja32.exe
File created	C:\Windows\SysWOW64\Kminigbj.dll	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Gnmlhf32.exe	Gkoplk32.exe
File created	C:\Windows\SysWOW64\Dkbgjo32.exe	Dckoia32.exe
File created	C:\Windows\SysWOW64\Ohjckodg.dll	Dckoia32.exe
File created	C:\Windows\SysWOW64\Dnhpfk32.dll	Dpalgenf.exe
File opened for modification	C:\Windows\SysWOW64\Epdime32.exe	Eaaiahei.exe
File created	C:\Windows\SysWOW64\Jhhnfh32.dll	Edfknb32.exe
File created	C:\Windows\SysWOW64\Fncibg32.exe	Fjhmbihg.exe
File created	C:\Windows\SysWOW64\Fcpakn32.exe	Fqbeoc32.exe
File opened for modification	C:\Windows\SysWOW64\Fbaahf32.exe	Fnffhgon.exe
File opened for modification	C:\Windows\SysWOW64\Dahfkimd.exe	Dnljkk32.exe
File created	C:\Windows\SysWOW64\Dikifc32.dll	Enemaimp.exe
File opened for modification	C:\Windows\SysWOW64\Edfknb32.exe	Eahobg32.exe
File opened for modification	C:\Windows\SysWOW64\Fnhbmgmk.exe	Fgnjqm32.exe
File created	C:\Windows\SysWOW64\Iolgql32.dll	Fgnjqm32.exe
File created	C:\Windows\SysWOW64\Mkhpmopi.dll	Fdbkja32.exe
File created	C:\Windows\SysWOW64\Pqgpcnpb.dll	Fqikob32.exe
File created	C:\Windows\SysWOW64\Gnaecedp.exe	Gkcigjel.exe
File opened for modification	C:\Windows\SysWOW64\Eaaiahei.exe	Enemaimp.exe
File opened for modification	C:\Windows\SysWOW64\Ejjaqk32.exe	Egkddo32.exe
File created	C:\Windows\SysWOW64\Eaaiahei.exe	Enemaimp.exe
File created	C:\Windows\SysWOW64\Ejlnfjbd.exe	Ekimjn32.exe
File opened for modification	C:\Windows\SysWOW64\Fdkdibjp.exe	Fqphic32.exe
File opened for modification	C:\Windows\SysWOW64\Fbdnne32.exe	Fnhbmgmk.exe
File opened for modification	C:\Windows\SysWOW64\Fdbkja32.exe	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Mcqelbcc.dll	Gkoplk32.exe
File created	C:\Windows\SysWOW64\Ncbigo32.dll	Dcphdqmj.exe
File opened for modification	C:\Windows\SysWOW64\Daeifj32.exe	715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe
File created	C:\Windows\SysWOW64\Hhdebqbi.dll	Dkbgjo32.exe
File opened for modification	C:\Windows\SysWOW64\Dpalgenf.exe	Dncpkjoc.exe
File created	C:\Windows\SysWOW64\Gdmkfp32.dll	Dncpkjoc.exe
File created	C:\Windows\SysWOW64\Gadeee32.dll	Fncibg32.exe
File opened for modification	C:\Windows\SysWOW64\Gcghkm32.exe	Fqikob32.exe
File opened for modification	C:\Windows\SysWOW64\Gqkhda32.exe	Gnmlhf32.exe
File opened for modification	C:\Windows\SysWOW64\Ekimjn32.exe	Egnajocq.exe
File created	C:\Windows\SysWOW64\Cgilho32.dll	Ecdbop32.exe
File created	C:\Windows\SysWOW64\Ekngemhd.exe	Ecgodpgb.exe
File created	C:\Windows\SysWOW64\Fqikob32.exe	Fbfkceca.exe
File created	C:\Windows\SysWOW64\Lifcnk32.dll	Gnmlhf32.exe
File created	C:\Windows\SysWOW64\Gnohnffc.exe	Gkalbj32.exe
File created	C:\Windows\SysWOW64\Ohgohiia.dll	Gkalbj32.exe
File opened for modification	C:\Windows\SysWOW64\Gclafmej.exe	Gqnejaff.exe
File opened for modification	C:\Windows\SysWOW64\Ejlnfjbd.exe	Ekimjn32.exe
File created	C:\Windows\SysWOW64\Edfknb32.exe	Eahobg32.exe
File created	C:\Windows\SysWOW64\Fkgillpj.exe	Fcpakn32.exe
File created	C:\Windows\SysWOW64\Fohoiloe.dll	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Ckfaapfi.dll	Gnohnffc.exe
File created	C:\Windows\SysWOW64\Gkcigjel.exe	Gclafmej.exe
File created	C:\Windows\SysWOW64\Hdedgjno.dll	Dnljkk32.exe
File created	C:\Windows\SysWOW64\Dpopbepi.exe	Dkbgjo32.exe
File created	C:\Windows\SysWOW64\Ncjiib32.dll	Djgdkk32.exe
File created	C:\Windows\SysWOW64\Anijgd32.dll	Egnajocq.exe
File created	C:\Windows\SysWOW64\Enhifi32.exe	Ejlnfjbd.exe

Program crash 1 IoCs

pid	pid_target	Process
4884	4928	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dckoia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkbgjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enlcahgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eajlhg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fggdpnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnmlhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnljkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkcpql32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnalmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnffhgon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnaecedp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejlnfjbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epffbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fncibg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egnajocq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahfkimd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dncpkjoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enopghee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkcigjel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcpakn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdpnda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcghkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgiaemic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnohnffc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbmadd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eafbmgad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epdime32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecbeip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekngemhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gclafmej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egkddo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkedonpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpalgenf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ephbhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekqckmfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdkdibjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbfkceca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eahobg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqkhda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkalbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqnejaff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekljpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejojljqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqphic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqbeoc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbaahf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgnjqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnhbmgmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enemaimp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekimjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjhmbihg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkgillpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgqgfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdnne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eaaiahei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcphdqmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecgodpgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edfknb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcjdam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpopbepi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egegjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkoplk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmhhd32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eajlhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfqqddpi.dll"	Fqbeoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqbeoc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcpakn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efehkimj.dll"	Dahfkimd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjocbhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcqelbcc.dll"	Gkoplk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahhgi32.dll"	Gclafmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokmd32.dll"	715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjbaohka.dll"	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnljkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekngemhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcipf32.dll"	Fbdnne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdbkja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apocmn32.dll"	Gcjdam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edihdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnimkcjf.dll"	Fkgillpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpopbepi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npgqep32.dll"	Ejjaqk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofjljj32.dll"	Eajlhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkcpql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdpnda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgnjqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iolgql32.dll"	Fgnjqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edfknb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnoefe32.dll"	Eaaiahei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enhifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fncibg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbdnne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbfkceca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcghkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnljkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncjiib32.dll"	Djgdkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgilho32.dll"	Ecdbop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpiedd32.dll"	Fjocbhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gqkhda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dncpkjoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Epffbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enlcahgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imhcpepk.dll"	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbfbkfaa.dll"	Fkcpql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgiaemic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkoplk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anijgd32.dll"	Egnajocq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aehojk32.dll"	Eahobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcpakn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqikob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqkhda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnaecedp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejlnfjbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Epffbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aolphl32.dll"	Ejojljqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eahobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhhnfh32.dll"	Edfknb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqphic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgiaemic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gadeee32.dll"	Fncibg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3436	2120	715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe	84
PID 3436 wrote to memory of 3940	3436	Daeifj32.exe	85
PID 3940 wrote to memory of 3772	3940	Dnljkk32.exe	86
PID 3772 wrote to memory of 4548	3772	Dahfkimd.exe	87
PID 4548 wrote to memory of 4796	4548	Dckoia32.exe	88
PID 4796 wrote to memory of 1624	4796	Dkbgjo32.exe	89
PID 1624 wrote to memory of 1632	1624	Dpopbepi.exe	90
PID 1632 wrote to memory of 3180	1632	Dkedonpo.exe	91
PID 3180 wrote to memory of 4540	3180	Djgdkk32.exe	92
PID 4540 wrote to memory of 3208	4540	Dncpkjoc.exe	93
PID 3208 wrote to memory of 3536	3208	Dpalgenf.exe	94
PID 3536 wrote to memory of 2292	3536	Ddmhhd32.exe	95
PID 2292 wrote to memory of 2660	2292	Dcphdqmj.exe	96
PID 2660 wrote to memory of 2204	2660	Egkddo32.exe	97
PID 2204 wrote to memory of 4912	2204	Ejjaqk32.exe	98
PID 4912 wrote to memory of 4304	4912	Enemaimp.exe	99
PID 4304 wrote to memory of 2740	4304	Eaaiahei.exe	100
PID 2740 wrote to memory of 1392	2740	Epdime32.exe	101
PID 1392 wrote to memory of 4068	1392	Ecbeip32.exe	102
PID 4068 wrote to memory of 656	4068	Egnajocq.exe	103
PID 656 wrote to memory of 1388	656	Ekimjn32.exe	104
PID 1388 wrote to memory of 1120	1388	Ejlnfjbd.exe	105
PID 1120 wrote to memory of 4056	1120	Enhifi32.exe	106
PID 4056 wrote to memory of 584	4056	Epffbd32.exe	107
PID 584 wrote to memory of 1496	584	Ecdbop32.exe	108
PID 1496 wrote to memory of 732	1496	Ekljpm32.exe	109
PID 732 wrote to memory of 388	732	Ejojljqa.exe	110
PID 388 wrote to memory of 1940	388	Eafbmgad.exe	111
PID 1940 wrote to memory of 3788	1940	Ephbhd32.exe	112
PID 3788 wrote to memory of 4488	3788	Ecgodpgb.exe	113
PID 4488 wrote to memory of 4240	4488	Ekngemhd.exe	114
PID 4240 wrote to memory of 2840	4240	Enlcahgh.exe	115
PID 2840 wrote to memory of 720	2840	Eahobg32.exe	116
PID 720 wrote to memory of 3988	720	Edfknb32.exe	117
PID 3988 wrote to memory of 2456	3988	Egegjn32.exe	118
PID 2456 wrote to memory of 3000	2456	Ekqckmfb.exe	119
PID 3000 wrote to memory of 756	3000	Enopghee.exe	120
PID 756 wrote to memory of 2928	756	Eajlhg32.exe	121
PID 2928 wrote to memory of 2620	2928	Edihdb32.exe	122
PID 2620 wrote to memory of 3484	2620	Fggdpnkf.exe	123
PID 3484 wrote to memory of 2724	3484	Fkcpql32.exe	124
PID 2724 wrote to memory of 3452	2724	Fnalmh32.exe	125
PID 3452 wrote to memory of 4612	3452	Fqphic32.exe	126
PID 4612 wrote to memory of 1076	4612	Fdkdibjp.exe	127
PID 1076 wrote to memory of 1248	1076	Fgiaemic.exe	128
PID 1248 wrote to memory of 924	1248	Fjhmbihg.exe	129
PID 924 wrote to memory of 4432	924	Fncibg32.exe	130
PID 4432 wrote to memory of 1856	4432	Fqbeoc32.exe	131
PID 1856 wrote to memory of 4196	1856	Fcpakn32.exe	132
PID 4196 wrote to memory of 4044	4196	Fkgillpj.exe	133
PID 4044 wrote to memory of 2816	4044	Fnffhgon.exe	134
PID 2816 wrote to memory of 4252	2816	Fbaahf32.exe	135
PID 4252 wrote to memory of 2128	4252	Fdpnda32.exe	136
PID 2128 wrote to memory of 3316	2128	Fgnjqm32.exe	137
PID 3316 wrote to memory of 2836	3316	Fnhbmgmk.exe	138
PID 2836 wrote to memory of 1872	2836	Fbdnne32.exe	139
PID 1872 wrote to memory of 988	1872	Fdbkja32.exe	140
PID 988 wrote to memory of 4524	988	Fgqgfl32.exe	141
PID 4524 wrote to memory of 4160	4524	Fjocbhbo.exe	142
PID 4160 wrote to memory of 956	4160	Fbfkceca.exe	143
PID 956 wrote to memory of 3948	956	Fqikob32.exe	144
PID 3948 wrote to memory of 3972	3948	Gcghkm32.exe	145
PID 3972 wrote to memory of 404	3972	Gkoplk32.exe	146
PID 404 wrote to memory of 3420	404	Gnmlhf32.exe	147

C:\Users\Admin\AppData\Local\Temp\715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe
"C:\Users\Admin\AppData\Local\Temp\715a115d26fdec13382c265aac203362d8e0ecb755c671eccdbaba7225cf228f.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\Daeifj32.exe
  C:\Windows\system32\Daeifj32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\Dnljkk32.exe
    C:\Windows\system32\Dnljkk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\SysWOW64\Dahfkimd.exe
      C:\Windows\system32\Dahfkimd.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SysWOW64\Egkddo32.exe
        
        C:\Windows\system32\Egkddo32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Eaaiahei.exe
        
        C:\Windows\system32\Eaaiahei.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Ekimjn32.exe
        
        C:\Windows\system32\Ekimjn32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:656
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:584
        
        C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Edfknb32.exe
        
        C:\Windows\system32\Edfknb32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:720
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Eajlhg32.exe
        
        C:\Windows\system32\Eajlhg32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\Fnalmh32.exe
        
        C:\Windows\system32\Fnalmh32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\Fdkdibjp.exe
        
        C:\Windows\system32\Fdkdibjp.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Gkoplk32.exe
        
        C:\Windows\system32\Gkoplk32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Windows\SysWOW64\Gnohnffc.exe
        
        C:\Windows\system32\Gnohnffc.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4536
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:872
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3340
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 400
        74⤵
        Program crash
        
        PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4928 -ip 4928
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daeifj32.exe

Path C:\Windows\SysWOW64\Daeifj32.exe
Size 163KB
SHA256 f5a62215e6ac20c8ff620f651fa6ccea443c2c3c3647eba4a80f5bca3c62dc32
MD5 bee8b192b07957d21c74303d1eacc81a
SHA1 3f352322a687e881337502779cf3280165770126
SHA512 b29cddb169d5861a811684bff4254824e10f74921e57a6bf473cb7a20c8588eba9ede15f428af3dfdc60b11a773f84dc02bf01d9341ae808729325a09950bd34
SSDEEP 1536:PIrxwED/hOF7md57ScwurcE1rZFKehlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:4xwKZORmd5+t7E1rdhltOrWKDBr+yJb
TLSH
T1BCF33EEA73294FD8C6ACC7B48CE78B69E49DF0701CE1945D4D5DEEB409A85B81C02FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dahfkimd.exe

Path C:\Windows\SysWOW64\Dahfkimd.exe
Size 163KB
SHA256 0ac1b94868f52a53a3c3b1fe4befb993db31a445b54192e2c28a3a4a34be65d5
MD5 2d5a5051972016352fedea41833d9842
SHA1 4025b127bf776360df12f143e0e342432356b387
SHA512 e3d4f44143de3f1d348c02ecd6bf01cfc01e78fbcefc464c7b9ae618be9e25210dc4b4c79fe9b803bee4dafeea771aac1c00bbf8522cb5ef9764a9baa7a028e1
SSDEEP 1536:Pw/KNwZs0nUJg2vD4X+Lu10RjaRX6MFexKXlProNVU4qNVUrk/9QbfBr+7GwKrPb:C20z2vw+KTFIKXltOrWKDBr+yJb
TLSH
T135F3D7EA73294FE8C57CC7B484E38B6AE4AEF5741CF1A429ED5ECEB500085981D16F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dckoia32.exe

Path C:\Windows\SysWOW64\Dckoia32.exe
Size 163KB
SHA256 7de7cf8f7a8cc403db0b7cd60a6605c2ea349b260075ac268653ff5ed9e5ccd9
MD5 d441aec6fffa155e2798d0074d0b8af4
SHA1 4beb271523037a44d3c4687bf154590e1f8bc6d9
SHA512 1b777675a7cf1887e26540352f33eead12a4f54c6206a72b30c3e396b07c4eb39c6d6480f647c7e7370c1f0e5f2549ed7b9f6984d0514b89bd3455f4981d2f99
SSDEEP 1536:Pzl7EQB5Ge6thKF9jaigUlUnT2Nn8lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:REQB5Ge6tA9+fnTm8ltOrWKDBr+yJb
TLSH
T1BEF31BEA73664FE8C458CFB484E38BA9D4EEF8741CE5941E6E5EDEB400085B85C16F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dcphdqmj.exe

Path C:\Windows\SysWOW64\Dcphdqmj.exe
Size 163KB
SHA256 f0701305bbf44e4ab338c0399134fe2b68f6db04c8bd1e473d23bae5b0402ec2
MD5 17d75161269d0b2060b3a90fa17d0de4
SHA1 eeea120ec6da4bf19d59f097b78fa5e2f84fa369
SHA512 2532ed041cb8fadd0d64b452be323583516f0606e3a52a24e45cfac25bdd367969c4f2978e9b06c9c1af0b7b61ade8e7be0e2343056c8ad3a4fcb1b5d6339bfa
SSDEEP 3072:dAl7W2olZnXdTJBo4QaqpLzHHzdltOrWKDBr+yJb:dAli2olZq7dLOf
TLSH
T176F34CFAB3645FDAC5A8C7B488EB8B60D4AEF4741CE1949D4D5DCFB183285A81C06F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddmhhd32.exe

Path C:\Windows\SysWOW64\Ddmhhd32.exe
Size 163KB
SHA256 97212f6bd7cc1a573e0a3961895da2b9216d4a8dce9f6c53cf8c6a5b8a68d90a
MD5 47b8b7c92e469e3a9e5b9281498e1e56
SHA1 d9651554456c07ef57d720df87735d7956b1be9e
SHA512 4f4b03d027700e966d0d89e0090f16fbcdf7ffc8a9ed6e4aad30c56325d057a0028bdb3faa121c2acd802e8c8efec9fa8dc314c0eed7cb06bc2c80804f43b39e
SSDEEP 3072:eQeT/HQpP/jnzquxGMJK8H/ltOrWKDBr+yJb:eQ3P/jzq18H/LOf
TLSH
T11AF3E7FA73640BD8F6A8C7B484D38B79D4AEF0B41DE6942D8D5ECEB5010C5AA5C06F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Djgdkk32.exe

Path C:\Windows\SysWOW64\Djgdkk32.exe
Size 163KB
SHA256 72f7b41fb41425f688286c367472528c3cc019250e362c30eaeb5237d60e7fea
MD5 f93253a06e7dbd3bd56752815a3ff5b5
SHA1 64fc739fa128bc1c0323dfe0474ba151ceb0cda8
SHA512 18c8b94990f05c098467871bb3ae6e26b265df8e06abb4f0e77b15249b7d1361fe719ea97e7661f44ac09e43ce0955069e5c955c38b7703c61891900590b896a
SSDEEP 1536:P+/u7f2Zw0P5iUdjM00MUWcwSlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:mQfyRiUdjMVMURwSltOrWKDBr+yJb
TLSH
T1FCF3F9EA7769CFE8C46CE7B486E38B5198BEF0F42CE194398E5DCEB445085981C46F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dkbgjo32.exe

Path C:\Windows\SysWOW64\Dkbgjo32.exe
Size 163KB
SHA256 09c629216b72e51a8b6bcec508155c01f9dd2289bda8c877d14a9624a5e09f95
MD5 30a3b655e13c121be8c66cad57d18fbb
SHA1 62a00d996670e8846e3827c3cf202008ff1f06d9
SHA512 deb924c4de5361bbe8068e69d42787a305fc25b3848e7a426e6c67ab6d34a0821b8a3ad7af4f1f389083baee88129017dd465b014ac5b363bb6c52af57a8571f
SSDEEP 1536:POzfhOAid3yLncT+cBw5AhJMKGhqmRflProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:wf4+vzJRfltOrWKDBr+yJb
TLSH
T12BF31CDA73295FE8E5ACC7B484EB8B51DAAEF0B41DE1942D8D5FDEB880085591C02F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dkedonpo.exe

Path C:\Windows\SysWOW64\Dkedonpo.exe
Size 163KB
SHA256 d4b5a6084305d2eef55283bfb1e1898fc8c73deeaf6e3dd5377d93558794405e
MD5 38a21927ca76637137f996ea1d0a962f
SHA1 75e221d151c3a08218ef78693c7bdc3116372073
SHA512 c9041c7cdf410292916282b6182faeed7cee3cecf678038eaaf69d1f8dd2fdaa6300acad63128c30788f56980d02276329aaab828ffd16e7c6189849aaf9a37c
SSDEEP 1536:PPvUBcD1tz4yd5j9AQL2MbSblProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:nzdj9HobltOrWKDBr+yJb
TLSH
T14BF3D7EA73254BD8C4A8C7B4C8F38B75E4AEF0B41DF194298D6ECEB5401969D4C46F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dncpkjoc.exe

Path C:\Windows\SysWOW64\Dncpkjoc.exe
Size 163KB
SHA256 4ca1b1c086f9657e997d15dbaee585970d6a86e42baa4ab7fc0190059e38c9e6
MD5 2f306b8c82b1b0dc75955bf70bf5d2b1
SHA1 6ff8ff3b0e6cfe048be61c2cce6733004f4d3426
SHA512 a7602600f7feece068874a5a8d5a5c3efc703dbf26605a323eff24b1fdabeca691cc1bbe1e4eb3ceccb8075f02ed52cafdef8dbe4586166602013748b9242096
SSDEEP 1536:PZkYfgxaAt4K7onGxi0v6YflProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:+w7A2VnGxi0hfltOrWKDBr+yJb
TLSH
T1C9F34EEA73754FE8C46DC7B486E38BA1D6BEF0B41CE1942D6D5DCEB1090869A0C46F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dnljkk32.exe

Path C:\Windows\SysWOW64\Dnljkk32.exe
Size 163KB
SHA256 5fa4ebb700164bf90111f4b65a20232d386eb0ca5527898a88990ec03aba4b43
MD5 aa7f3e7bb874c3630d4177fed8b8de70
SHA1 06aa39bffc85421b74627c023f2d5d446bba47b5
SHA512 ff7b5ed5d96c2331910983f95601ee965a490cfaef5ed5fe2668e37607011b8b433f948b6165e83ed08e68cd7bcb1f8c88b8673f45742a7091c758be42741135
SSDEEP 1536:PdxxDDI8xFG45BarSmwhVvZi9gSblProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:l/DxFG450SRhZkgqltOrWKDBr+yJb
TLSH
T142F32BEBB3645FE8C5AAC7B884F3CB59D5AEF0B01CE5985D4D6DCEB4020856A1C06F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpalgenf.exe

Path C:\Windows\SysWOW64\Dpalgenf.exe
Size 163KB
SHA256 c906bff68d149a742255ecfa560682ff0d297726f7c0ae5fe54937afd8e269c9
MD5 3ee982692f670a2b8fecb7f713e839ed
SHA1 eb7b072a9b3b58822312d0a780552ace4f5f41aa
SHA512 4b7f787021878b550f9dd761a460642bff5e1ceda011775adb8363c0be4ea37724e5e34e62379bec8870143f96236d8c1369596ebdc6c12ad222ca420743f9f0
SSDEEP 1536:PgjWwD/Pmo19x3V4t4QhVTby9g0lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:mtD2W7WRVK60ltOrWKDBr+yJb
TLSH
T151F3DBEA73256BD9C468C7F4A4E38B51D8BBF0741DE1A42D6E6DCEB131085B85E02F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpopbepi.exe

Path C:\Windows\SysWOW64\Dpopbepi.exe
Size 163KB
SHA256 e561b7531c1f4f202d885f3bb973e5be8415b90873a936cb60bc7c18e736209c
MD5 647f4dcb474cba2281d1fd8b93900efc
SHA1 864a3985d39e29a609a155b19954a4497b1285cd
SHA512 b44720398b306f29fb0ad67dc8da3f0ff401b2523b806f58300fd96a5fc8d1520b7916801754f9b79f2eeb14b130eeb5c76f7686330473a30035d82f5d199e6a
SSDEEP 3072:c+VSpvpP5ebpm2658HCltOrWKDBr+yJb:c2wv34KMCLOf
TLSH
T109F36EEA73294FD8C5ACC7BC88E38B69D4AEF1749CE1942D4E5ECEF500085992C56F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eaaiahei.exe

Path C:\Windows\SysWOW64\Eaaiahei.exe
Size 163KB
SHA256 96c3103498797b309f6454e4a45840458c6e8e91f46d81b056010e5498df2412
MD5 09bf18d9e44075094e83d47b913da515
SHA1 fb98ceafadd80c5fa8f4cb21457db829670915fb
SHA512 dbb01d1f0bccc87e0cb50ba97b0120366fdee94729207d221c7cc3ad8c5fe187cbe8b8da51e8bf61cdfc1c04b6b8f080d76879274830aa0bf0bbcabb3b22c6c7
SSDEEP 1536:PPvi7qyJy93rCJ+HZQyZ2iXYDvOblProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:fSqykIKZIwYObltOrWKDBr+yJb
TLSH
T140F33EEAB3A44FD8C45CE7B6A4D38B61D4AEF1742EE5A41E4D5DCEB021187990C06F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eafbmgad.exe

Path C:\Windows\SysWOW64\Eafbmgad.exe
Size 163KB
SHA256 f3c605ad9034154553d7044167cd5d3e86a12d9138a85590f65fb7351df1b277
MD5 f2ef0b839280866c658ff6cdce87257e
SHA1 06ba7ad583b61583cd9fa79828c63b61bf9b66e9
SHA512 578bd729248bfda76e624b8f2c7e5b85e6139a9e3f9c7e24b6231a7109e8f0b7d51551f131ba1af253ea74b966e245baf61c998c1510f92661b14b7416c22e13
SSDEEP 3072:DLE8EYcdqnG32UY0kCWhPYd57I4Vq+BQVltOrWKDBr+yJb:DQ8PwqG3o0TWhPYd57I4q8QVLOf
TLSH
T113F32FEA73691FD8C5ACC7BC84FB8BA1D49EF4789CE0942E4E5DDEB100089595E06F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eahobg32.exe

Path C:\Windows\SysWOW64\Eahobg32.exe
Size 163KB
SHA256 5a042c78fb121ec3012d29170200fb5518d22e1586a763f9ad5c590ac1f5004c
MD5 ba3696e429838937d0968b41fedf7a8a
SHA1 0c8a968b697efd151cb5fb54c7ea990209412b84
SHA512 069a0fd1cde2484f97d4edab20c9f0c9bb95fbd7b798f059e1e0ae266bf4ddb78d4c659c8a61d78af1e8a7e9b3b29c25b75539cb1f527fa806a962a0b18420d2
SSDEEP 1536:PqS8szuIMLdV7lXj3VemlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:iS8zIsHljVNltOrWKDBr+yJb
TLSH
T1C6F33BEE73694FD8C5A8C7B486E3CB61D4AEF4742CE6942D4D6DDFB508489A81C06F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ecbeip32.exe

Path C:\Windows\SysWOW64\Ecbeip32.exe
Size 163KB
SHA256 329df5318bc6c999e571e98290b996f63c9b4b1bd64734d27cbd57e011411482
MD5 7866fb06d7e9157f87e39c132e591e89
SHA1 f27e63887f01b7c79abb6523c3f9509ff4c30a82
SHA512 46aeb1eccfaa0d72996fca4dbf90e9be47260d886e3ee4a3d514c116631033ac73f76899142e77a11d622552a3f9e17a5adc58d45bbfdef4d41f5f8c48e64f1b
SSDEEP 1536:POOO+6l62fnE2R0pdZfzddlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:WNNSdZBdltOrWKDBr+yJb
TLSH
T10DF30AEA73681FE8C468CBB4C4E38B61D4ADF4B41CF194696E9DDEF4810C6985C86F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ecdbop32.exe

Path C:\Windows\SysWOW64\Ecdbop32.exe
Size 163KB
SHA256 2514e7ebb2755c0f898a1601760d0290092d0c69e77ef830940284e5d59ce350
MD5 90ce1cd266b0701363f321412e8a424a
SHA1 8c10028483b87ddd03bfc6a2b58c113522ab1c68
SHA512 c53976d185fcc3f36e152406949d675c3034ca8badcd5a948e454ace978be875429a9a28bfbddce8371400079bc80e397580fbd70d76e561a9d6ee4a898369fe
SSDEEP 1536:P7+kn23CmGEZnHe/3QJFH9BJ/9n6DT3STdlProNVU4qNVUrk/9QbfBr+7GwKrPAS:sCmGE83Qr+T3STdltOrWKDBr+yJb
TLSH
T13FF31BEA73280FE8E578C7B488D38B65D4AEF5B69CE5A42D4D5ECEF000085995C06F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ecgodpgb.exe

Path C:\Windows\SysWOW64\Ecgodpgb.exe
Size 163KB
SHA256 4084745b1cc38bf0eeed2b86ab4539ebdda219c679c0e2af771f756617665c3e
MD5 a778abb4615bb0d5ab6b61d294fc6055
SHA1 deb35e0aa811a9884470385566f21165f567a35d
SHA512 94d0f5bfde398f27a8c35544ed1344cf0a530bd5d06a305e358d201062d1ca42ad2b334decb7e616fee1574cf40a3f499039aecdb03c634e8c7da237399b8c96
SSDEEP 3072:Dh/tJLZ7kcmgs3CabRbC0LtltOrWKDBr+yJb:Dh39gZgv0LtLOf
TLSH
T105F3D7EB73694FE9C5A8C7B688F38B6594BEF4F41DE294198D5ECEB900089581C07F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egkddo32.exe

Path C:\Windows\SysWOW64\Egkddo32.exe
Size 163KB
SHA256 042efcfbfdca292d36e074c8a8e99318c1f11a11c9bd230634efdaff8160aca0
MD5 21b66b1c7a8ea3d9439850bb38763e10
SHA1 0016fee129595ef882989e27bf6e85451119c13b
SHA512 6402f6b2c05f98748f90b971762330946050f7726b82085fcaf467c20da86c2d9d7f45a7fd64264a9f599b89a70e026c7ec5a06c629fd8edb81b8360d5cc56cd
SSDEEP 1536:PEQ/CKQI9+BtMD7+L/bra1VEa2dOSlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:9bUBJ2jEaKOSltOrWKDBr+yJb
TLSH
T1CEF30CEA77659FD8C5A8CBB888E3AB60D49EF0B41CF1B43D4D6DEEB500085981C56F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Egnajocq.exe

Path C:\Windows\SysWOW64\Egnajocq.exe
Size 163KB
SHA256 0e6ff03f2b155db92c0498a05f42ad793bd31f36b18adea1e04ad9dbe5e28a1a
MD5 87128ef9746243b67b99961c7f430930
SHA1 0e43984637655de681a527d21d0ebc07686efe4e
SHA512 a7244c9aa2430d62f2f41e5ba180f65e46f652df1211ce13838c9de4c58a80bfce01a937bfe89239bf801c5adf9df90bbcf5a13265b42b9d92ad646c1fa8a50a
SSDEEP 1536:P8CbSWh9eWtuUhJeR9Vacj2SR9XHEGfxO4xlProNVU4qNVUrk/9QbfBr+7GwKrPb:yFmuUhMeW/9XkaxpxltOrWKDBr+yJb
TLSH
T16FF30BEAFB686FD8E478E7B484E39B61E4AEF0741DE1A42D4D5FCEB401085681C46F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ejjaqk32.exe

Path C:\Windows\SysWOW64\Ejjaqk32.exe
Size 163KB
SHA256 5ccf555966e8c789542390801c123b1e41e7670348c853f3502b7199270fc507
MD5 4dc8d22f8df73f569b3b5d1ba272f4a8
SHA1 953e389fb21017347186c607fbe898999689169e
SHA512 7cfab413288ce7fbd28077122186897fc14ec34fb39fce0bdac7c92e018dd26ad31d3fc7838edf855eec70518f90bb3c4a4e3aaa9500ad49f6357481437d1e1d
SSDEEP 3072:1FZbXKrw2LxFvR3VZh8H2BltOrWKDBr+yJb:bZbgwOxFvR3VZyWBLOf
TLSH
T128F3F9EA73254BE8E47CE7B885E38B2194EEF0B8ACE1941A4D5DDFF402085995C45F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ejlnfjbd.exe

Path C:\Windows\SysWOW64\Ejlnfjbd.exe
Size 163KB
SHA256 dc3d758d2e10d3068aeb03917449dd3470dfecd700974daafaf3d25345b309fb
MD5 cc4bcb9aa971c917441bdbc3e21929d6
SHA1 87c353b43aed35ceca26944af455df23a172141d
SHA512 b387fd364e377d5006ed62f32776257b0c07263c1bbbeeb9385c35a98e4780d09bce0d9d9270edddd7a897cadae9e4e302e64f382eb2942956b30175acbfc59c
SSDEEP 1536:P1w6dbifgVdXIdXmKfAOtDLKBBhGiTI+yPlProNVU4qNVUrk/9QbfBr+7GwKrPAS:tNJifkidXmKjPMBpyPltOrWKDBr+yJb
TLSH
T1FDF33EEA73694FE8C45CE7B4A6EB8B31D89EF2761CE0941D4D5EEEB400085985C42FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ejojljqa.exe

Path C:\Windows\SysWOW64\Ejojljqa.exe
Size 163KB
SHA256 ff870eb438d6a1d15a1f7a37937d11d2cb98d38eb158910341fc749a4440fe11
MD5 f4da1f05b75f11baebae08615211766d
SHA1 90913a60dcb91962d8717e15f9c3da1ed1ededf1
SHA512 d13048375b96fd021d7589851000f90a257c3961bbdf5d50ad497a90bdcad092760a0fc18542079208633383c993a1b4a0893d6ca33dad89bcdc22c399ad338d
SSDEEP 1536:PUEZG32rw9ol5VQVGg6ZqWYqDizONXJV9B6lProNVU4qNVUrk/9QbfBr+7GwKrPb:DwOQV0ZZDxlJV9B6ltOrWKDBr+yJb
TLSH
T1A7F3FCEA73284FE8C55CC7B4A8D3CB62D4AEF8741CE194AE4D5DDEB521089786C81F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ekimjn32.exe

Path C:\Windows\SysWOW64\Ekimjn32.exe
Size 163KB
SHA256 f9a3cc11741125d1648a760506a86b9a29ac91c56a791ad23219bd07843394c3
MD5 de3df78ae6bc6d85806104f3c9b62ce2
SHA1 bc9ed28bdda3da704293d6777b7696ef1a299e10
SHA512 3b9ad0b0847e0e235e1e6f9f5d370bd10f4adbe130a792471184b7eeda6a99c01352a38f8ab6c8805108b03e994965b22c5d6c45a691df28b96affe87b68db78
SSDEEP 1536:PzLaJNnBSY6wZOAkJXgj6pUirZZZZZZZ01lProNVU4qNVUrk/9QbfBr+7GwKrPAS:bL8NnzNgJXgj6pQ1ltOrWKDBr+yJb
TLSH
T1A8F3F9EAB3284FDAC1A8C7BC88E78B65D4ADF8B41DE1F42D4D5DDEB1000A5685C06F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ekljpm32.exe

Path C:\Windows\SysWOW64\Ekljpm32.exe
Size 163KB
SHA256 aaf1940c0e9329db1f2e7a09b03b6a40f5022f69d88ef78254a2970536b9eded
MD5 6d736afbc4b8e8488af64a185639d7e7
SHA1 6544913b2e5d904fb260409d1f212986b8bae372
SHA512 ea5cf8f7f468455fe5b9d2acfe9e74f79fb87f77b3e1dd8fab277085c63987a42f03bbfdba7aee63dcfbcd35e20e4db7150de617a89f9927315b9bb62850f298
SSDEEP 3072:nE49xiwHjgm58mpN1L3A+v2ltOrWKDBr+yJb:N9x+q8mpXL3r2LOf
TLSH
T1E5F32CEA73645FE8C5ACC7B484E38B5AD4AEF0B41CE5942D8D5DCEF128085E98C46F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ekngemhd.exe

Path C:\Windows\SysWOW64\Ekngemhd.exe
Size 163KB
SHA256 46db764939b2becf96655b88fcf665bc9175d3e40bc564c3276e398fe5d3e6e5
MD5 1a362861249d2cac8c73edc233d58346
SHA1 c05cc0f43f29ef0a38d4e6019a15f04a01eb283a
SHA512 8598f05a493d8700d43be3a5d699689bc7613bd1f5bb8c0d6abcbba8a7c0eaff6674357cc599f31e8e216f5b33e5bd88e794e4d1f2404607a89097042040861f
SSDEEP 1536:PTlFJyZVNzIEFdMB2BjGWEvRJ/lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:rYVhIi6BlJ/ltOrWKDBr+yJb
TLSH
T1EEF30CEA77254FE9C5B8CBB484E38B69D4AEF4F41CE0941D4D9DCEB601285BA1C06F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enemaimp.exe

Path C:\Windows\SysWOW64\Enemaimp.exe
Size 163KB
SHA256 96a084c2409a891da8f4431bcf6deb9a96ff8f2aa6f46dca09bc2c95aa193ed3
MD5 4343f59ffc73651bf0987203a92daf6b
SHA1 1090fa06d0b70c539d3fd025916140c50b56382f
SHA512 4bc1ca26df143f84efcf98bff1ecb74505855a2ebd71575463668b22f8da55c8c3deb3bbbe18a0cac036216a561d1cd45e578a3a8507d9fe5c92fec9fbeb76b7
SSDEEP 3072:K1RGxOAIq5t7Frkx7o0YLltOrWKDBr+yJb:uRkOANHLLOf
TLSH
T118F3FAEAB3254BFAC468C7B488E38B61D4AEF0B41DE594194D6EEEB4010C9BD5C46F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enhifi32.exe

Path C:\Windows\SysWOW64\Enhifi32.exe
Size 163KB
SHA256 0575509105fc2778572ef646535acc31589c466711d666b320d52c2b5b16bf9f
MD5 9bee41a16462f30febf303d3ec3946e6
SHA1 dba266a0893606d93887733e4b43009f20241e21
SHA512 a2a8a808ea12093830dbe6ef2656a1e038842416702e9de8a023402873de69dbfc2149af14c00f3c328ea3e52a8090f41fdcc8501f276d65a0760b8f1c984c66
SSDEEP 1536:P20N/mvrPOuwiFHpe+3EgSxlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:+02rDNpKjxltOrWKDBr+yJb
TLSH
T163F32CEEB3295FE8C4A8D7B484E39B61D5AEF4741CE1E42D4E6DCEB540085992C0AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Enlcahgh.exe

Path C:\Windows\SysWOW64\Enlcahgh.exe
Size 163KB
SHA256 795fcb3149283206acfb87d6f3fd975794c5bf9778d2c7db55c370b4d13b05da
MD5 7f4f6e55a2336a66c004d93c03ba7a8f
SHA1 58c700eb62d1a2f3f8b67d7d18c029a85a4dbf3c
SHA512 89bdb6c98ab8ac4c9fe4d2c0e51fe5df9cceaee037640b0d5935dac7d1b9b8c04256dd42e43f1d494e2b2ee9787fa757f895795bc74e755abbc5537067a74702
SSDEEP 1536:P0pYJsiDZZdETR+K1Y6lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:OlRx1nltOrWKDBr+yJb
TLSH
T164F32BFA73244FECE468C7B484E38B71E4AEF4B49DE9946D4D9DCEB021085984C46FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Epdime32.exe

Path C:\Windows\SysWOW64\Epdime32.exe
Size 163KB
SHA256 a400e7e46a4cd735e3de552df572849639c7701ddfe056dce8d1e3dd4bf07aac
MD5 c969cf03dcdb93f180113bfd5a994e03
SHA1 ec36a05799495c47a1bce33fde675474b0a77024
SHA512 2886e35d0b4dff5909d10c5621778b6038966bcfd6458d0876b43542c76bccbdf83b3cb78f4753276c67c986674727b342d1f2c99480b379c58131444b598e92
SSDEEP 1536:PZ5whIE/lIAyQcwKM0tISBkklProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:ZE/WAyQd0p2kltOrWKDBr+yJb
TLSH
T181F30AEA73A59FE8C468C7B484E38B52D4EEF57A1EE1B85D4D5ECEB400189981C43F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Epffbd32.exe

Path C:\Windows\SysWOW64\Epffbd32.exe
Size 163KB
SHA256 44987f8ff65877f116b2e362594c3a6beafaf330e2c3a33984a5d691ba74719b
MD5 0a39c3da0633d5e5670308172abc5c9d
SHA1 e75c166b49bdb0a7248cfcb3d8723c990264ccce
SHA512 952913d4a0748c4feda2159227d2c55fdc2a7a7111e595e82afb23c8766ad20cd0d0bfeac237f0b203d79fff4390a443eab4dcbe58e3e69b5484235f7deef8a7
SSDEEP 1536:Pfg4h3G6oNai7kPbXvBLEB3CgJ644ahYlProNVU4qNVUrk/9QbfBr+7GwKrPAsqE:Xg4UVjGvgU4pultOrWKDBr+yJb
TLSH
T155F32FEA736D6FD8C45CDBB084E38BA1F49EF1B41EE0945D4E5DCEB420A85582C06FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ephbhd32.exe

Path C:\Windows\SysWOW64\Ephbhd32.exe
Size 163KB
SHA256 91aac5320bddecb6eed820b5e7afd9dd60f52bf0c3d67ce6af1f51831e74ff27
MD5 a8c0d9fd0eb5ec49357ad233b4a338da
SHA1 9d94cd3dde32a4dedcef03a9571963b192b29088
SHA512 b8bd9caa074687076284e547843575dc24df15515adf4346af4af6096b0e4475a8f4366bd81fb567b40ca554752f3eba554dc2ad00edc16b6e2a38affae46a1b
SSDEEP 3072:BcUfmQDqiWlkbJag/5K7DltOrWKDBr+yJb:BcUJqJ+aWK7DLOf
TLSH
T11FF30BEA73356FE8C4ACC7B488E38BA5E4AEF5B41CE5941D4D5FCEB0020A5996C05F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-222-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/404-446-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/404-514-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/584-198-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/656-166-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/720-268-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/732-214-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/872-500-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/872-487-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/924-345-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/956-429-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/956-520-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/988-526-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/988-411-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1076-337-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1120-181-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1152-506-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1248-339-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1388-174-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1392-150-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1496-206-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1584-464-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1584-508-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1624-48-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1632-62-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1780-458-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1780-510-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1856-544-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1856-357-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1872-405-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1872-528-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1940-230-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2120-0-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2120-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/2128-387-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2128-534-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2204-118-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2292-102-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2456-280-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2620-303-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2660-110-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2724-315-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2740-142-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2816-375-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2816-538-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2836-399-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2836-530-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2840-262-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2928-297-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3000-286-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3180-70-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3208-86-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3316-393-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3316-532-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3340-498-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3340-493-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3420-452-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3420-512-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3436-9-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3452-321-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3484-309-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3536-94-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3772-25-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3788-238-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3940-16-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3948-518-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3972-516-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3972-440-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3988-274-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4044-369-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4044-540-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4056-190-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4068-158-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4160-522-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4160-423-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4196-542-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4196-363-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4240-254-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4252-381-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4252-536-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4304-134-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4432-351-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4488-246-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4524-524-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4524-417-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4536-502-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4536-481-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4540-78-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4548-37-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4612-327-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4796-45-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4872-475-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4872-504-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4912-125-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4928-494-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4928-496-0x0000000000400000-0x0000000000453000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads