berbew | 198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad.exe
Size 71KB
Sample260910-jqaenagb35
SHA256 198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad
MD5 7433e4dd4d17a90fc70a80634aaf1739
SHA1 b34d06b39b75c50e35826d60e31346388b9d6ada
SHA512 bf6d28d87dec95565564c68e5942434d88b112508f0ce956b1e2bb70862e50bca82594c2f8a286b30a7e40fa13081ef8e5d04f02649d2dc8ea4cb0ce4cad824f
SSDEEP 1536:u4JW+g7he2XsNdCi50HkCZPcfjR0VNs6aJi4uRQiDbEyRCRRRoR4RkG:uZ+g7hgnyPkqVNs6hXecEy032yaG
TLSH
T1DE639DA316EBDE3BFC4B59B7B207C869916DD8B007FEE9464053E14C343BA1E946B142
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew padodor persistence trojan

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Family: Padodor
Padodor is a Windows trojan/backdoor written in C.
trojan backdoor padodor

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfhbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aajhndkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcbpjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmmqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnmmboed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljceqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgeakekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nmipdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdnbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnhdgpii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oghghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lfeljd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljeafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljeafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lqojclne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgibpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnegbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnmmboed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nfcabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lmdnbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npiiffqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjbcplpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnplfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chfegk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmmqhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncqlkemc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppgegd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpdgqmnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfqlfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nggnadib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ogekbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhpimhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjkmomfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdimqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfqlfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjmjdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njfkmphe.exe

Detects Padodor trojan 64 IoCs

resource	yara_rule
behavioral1/memory/4552-0-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/4716-7-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x000600000001e6b8-6.dat	family_padodor
behavioral1/files/0x0007000000024571-14.dat	family_padodor
behavioral1/memory/556-16-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024574-22.dat	family_padodor
behavioral1/memory/5100-24-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/2972-36-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/4488-39-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024578-38.dat	family_padodor
behavioral1/files/0x0007000000024576-31.dat	family_padodor
behavioral1/files/0x000700000002457a-46.dat	family_padodor
behavioral1/memory/4748-52-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x000700000002457c-54.dat	family_padodor
behavioral1/memory/2668-60-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x000700000002457e-62.dat	family_padodor
behavioral1/files/0x0007000000024580-70.dat	family_padodor
behavioral1/memory/5072-72-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/1080-69-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024582-78.dat	family_padodor
behavioral1/memory/2424-79-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024584-86.dat	family_padodor
behavioral1/memory/3812-87-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/1532-100-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024586-95.dat	family_padodor
behavioral1/memory/3472-103-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024588-104.dat	family_padodor
behavioral1/files/0x000700000002458a-111.dat	family_padodor
behavioral1/memory/4332-112-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x000700000002458c-118.dat	family_padodor
behavioral1/memory/4180-128-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/2232-127-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x000700000002458e-126.dat	family_padodor
behavioral1/files/0x0007000000024590-134.dat	family_padodor
behavioral1/files/0x0007000000024592-142.dat	family_padodor
behavioral1/memory/4016-144-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/5052-141-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/4300-157-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024594-151.dat	family_padodor
behavioral1/files/0x000300000001e6a3-159.dat	family_padodor
behavioral1/memory/516-164-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x000300000001e6e7-167.dat	family_padodor
behavioral1/memory/1128-168-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x000300000001e6e9-175.dat	family_padodor
behavioral1/memory/1552-180-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x000800000002456e-183.dat	family_padodor
behavioral1/memory/4588-187-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x0007000000024597-190.dat	family_padodor
behavioral1/files/0x0007000000024599-197.dat	family_padodor
behavioral1/files/0x000700000002459b-207.dat	family_padodor
behavioral1/memory/4120-212-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/2708-204-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/1592-199-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/2440-216-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x000700000002459d-215.dat	family_padodor
behavioral1/files/0x000700000002459f-222.dat	family_padodor
behavioral1/memory/4256-223-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x00070000000245a2-230.dat	family_padodor
behavioral1/memory/4592-232-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/memory/4720-239-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor
behavioral1/files/0x00070000000245a4-238.dat	family_padodor
behavioral1/files/0x00070000000245a6-246.dat	family_padodor
behavioral1/files/0x00070000000245a8-254.dat	family_padodor
behavioral1/memory/2340-260-0x0000000000400000-0x0000000000439000-memory.dmp	family_padodor

Executes dropped EXE 64 IoCs

pid	Process
4716	Lfeljd32.exe
556	Lomqcjie.exe
5100	Lcimdh32.exe
2972	Ljceqb32.exe
4488	Lnoaaaad.exe
4748	Ljeafb32.exe
2668	Lmdnbn32.exe
1080	Lqojclne.exe
5072	Lgibpf32.exe
2424	Modgdicm.exe
3812	Mnegbp32.exe
1532	Mcbpjg32.exe
3472	Mfqlfb32.exe
4332	Mnhdgpii.exe
2232	Mfchlbfd.exe
4180	Mjodla32.exe
5052	Mmmqhl32.exe
4016	Mfeeabda.exe
4300	Mnmmboed.exe
516	Mgeakekd.exe
1128	Mfhbga32.exe
1552	Nggnadib.exe
4588	Njfkmphe.exe
1592	Nnafno32.exe
2708	Nqpcjj32.exe
4120	Ncnofeof.exe
2440	Nflkbanj.exe
4256	Ncqlkemc.exe
4592	Nmipdk32.exe
4720	Ncchae32.exe
2812	Nnhmnn32.exe
2340	Npiiffqe.exe
4328	Nfcabp32.exe
456	Onkidm32.exe
4740	Omnjojpo.exe
2332	Onmfimga.exe
1300	Ogekbb32.exe
4012	Oghghb32.exe
2556	Onapdl32.exe
4800	Ocohmc32.exe
3000	Ojhpimhp.exe
3980	Opeiadfg.exe
2760	Pjkmomfn.exe
2780	Ppgegd32.exe
2076	Pjmjdm32.exe
2204	Pagbaglh.exe
4772	Phajna32.exe
3820	Pnkbkk32.exe
3776	Pdhkcb32.exe
2600	Pjbcplpe.exe
4676	Ppolhcnm.exe
2496	Phfcipoo.exe
3364	Pnplfj32.exe
4164	Ppahmb32.exe
4160	Qjfmkk32.exe
4808	Qhjmdp32.exe
4324	Qodeajbg.exe
4176	Afpjel32.exe
4124	Aphnnafb.exe
5092	Ahofoogd.exe
3740	Afbgkl32.exe
1836	Aoioli32.exe
4584	Apjkcadp.exe
2392	Agdcpkll.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bnlhncgi.exe	Bgbpaipl.exe
File created	C:\Windows\SysWOW64\Ehojko32.dll	Bgbpaipl.exe
File created	C:\Windows\SysWOW64\Pghien32.dll	Chfegk32.exe
File created	C:\Windows\SysWOW64\Bgnffj32.exe	Bmeandma.exe
File created	C:\Windows\SysWOW64\Jbofpe32.dll	Npiiffqe.exe
File created	C:\Windows\SysWOW64\Lfeljd32.exe	198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad.exe
File opened for modification	C:\Windows\SysWOW64\Modgdicm.exe	Lgibpf32.exe
File opened for modification	C:\Windows\SysWOW64\Mnegbp32.exe	Modgdicm.exe
File opened for modification	C:\Windows\SysWOW64\Bnlhncgi.exe	Bgbpaipl.exe
File created	C:\Windows\SysWOW64\Dpkmal32.exe	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Mfeeabda.exe	Mmmqhl32.exe
File created	C:\Windows\SysWOW64\Fcokoohi.dll	Ncnofeof.exe
File created	C:\Windows\SysWOW64\Pagbaglh.exe	Pjmjdm32.exe
File opened for modification	C:\Windows\SysWOW64\Pnkbkk32.exe	Phajna32.exe
File created	C:\Windows\SysWOW64\Akdilipp.exe	Adkqoohc.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Mjodla32.exe	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Ojenek32.dll	Ogekbb32.exe
File created	C:\Windows\SysWOW64\Dbdjofbi.dll	Pagbaglh.exe
File created	C:\Windows\SysWOW64\Qjfmkk32.exe	Ppahmb32.exe
File opened for modification	C:\Windows\SysWOW64\Mgeakekd.exe	Mnmmboed.exe
File opened for modification	C:\Windows\SysWOW64\Aajhndkb.exe	Amnlme32.exe
File created	C:\Windows\SysWOW64\Bgbpaipl.exe	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Nggnadib.exe	Mfhbga32.exe
File created	C:\Windows\SysWOW64\Kmkdjo32.dll	Njfkmphe.exe
File created	C:\Windows\SysWOW64\Kibohd32.dll	Oghghb32.exe
File opened for modification	C:\Windows\SysWOW64\Lcimdh32.exe	Lomqcjie.exe
File created	C:\Windows\SysWOW64\Mmmqhl32.exe	Mjodla32.exe
File opened for modification	C:\Windows\SysWOW64\Nnhmnn32.exe	Ncchae32.exe
File opened for modification	C:\Windows\SysWOW64\Afpjel32.exe	Qodeajbg.exe
File created	C:\Windows\SysWOW64\Ogjembbd.dll	Lomqcjie.exe
File created	C:\Windows\SysWOW64\Ncnofeof.exe	Nqpcjj32.exe
File opened for modification	C:\Windows\SysWOW64\Mfqlfb32.exe	Mcbpjg32.exe
File opened for modification	C:\Windows\SysWOW64\Ncnofeof.exe	Nqpcjj32.exe
File created	C:\Windows\SysWOW64\Occmjg32.dll	Pjbcplpe.exe
File opened for modification	C:\Windows\SysWOW64\Bhhiemoj.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Qodeajbg.exe	Qhjmdp32.exe
File created	C:\Windows\SysWOW64\Nflkbanj.exe	Ncnofeof.exe
File opened for modification	C:\Windows\SysWOW64\Aphnnafb.exe	Afpjel32.exe
File opened for modification	C:\Windows\SysWOW64\Conanfli.exe	Cdimqm32.exe
File created	C:\Windows\SysWOW64\Glfdiedd.dll	Dpkmal32.exe
File created	C:\Windows\SysWOW64\Lomqcjie.exe	Lfeljd32.exe
File opened for modification	C:\Windows\SysWOW64\Ppolhcnm.exe	Pjbcplpe.exe
File created	C:\Windows\SysWOW64\Pjbcplpe.exe	Pdhkcb32.exe
File created	C:\Windows\SysWOW64\Mioaanec.dll	Bhhiemoj.exe
File opened for modification	C:\Windows\SysWOW64\Dahmfpap.exe	Cnjdpaki.exe
File opened for modification	C:\Windows\SysWOW64\Onmfimga.exe	Omnjojpo.exe
File created	C:\Windows\SysWOW64\Opeiadfg.exe	Ojhpimhp.exe
File created	C:\Windows\SysWOW64\Eignjamf.dll	Ahofoogd.exe
File opened for modification	C:\Windows\SysWOW64\Bmeandma.exe	Bgkiaj32.exe
File created	C:\Windows\SysWOW64\Cpfoag32.dll	Cocjiehd.exe
File opened for modification	C:\Windows\SysWOW64\Dkqaoe32.exe	Dpkmal32.exe
File opened for modification	C:\Windows\SysWOW64\Ljeafb32.exe	Lnoaaaad.exe
File created	C:\Windows\SysWOW64\Mfqlfb32.exe	Mcbpjg32.exe
File opened for modification	C:\Windows\SysWOW64\Mnmmboed.exe	Mfeeabda.exe
File opened for modification	C:\Windows\SysWOW64\Njfkmphe.exe	Nggnadib.exe
File created	C:\Windows\SysWOW64\Afbgkl32.exe	Ahofoogd.exe
File opened for modification	C:\Windows\SysWOW64\Ocohmc32.exe	Onapdl32.exe
File created	C:\Windows\SysWOW64\Cpkgohbq.dll	Aphnnafb.exe
File created	C:\Windows\SysWOW64\Cocjiehd.exe	Chfegk32.exe
File created	C:\Windows\SysWOW64\Ljceqb32.exe	Lcimdh32.exe
File created	C:\Windows\SysWOW64\Ngidlo32.dll	Lnoaaaad.exe
File created	C:\Windows\SysWOW64\Mfjnfknb.dll	Mfqlfb32.exe
File created	C:\Windows\SysWOW64\Qgnnai32.dll	Mfchlbfd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3416	2324	WerFault.exe	177

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljeafb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqpcjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpkmal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjfmkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggnadib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnafno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmjdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phajna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppahmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnlme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmdnbn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onapdl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdhkcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgkiaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bogkmgba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfeljd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcimdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgibpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omnjojpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjbcplpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcbpjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgeakekd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfhbga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njfkmphe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocohmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agdcpkll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahmfpap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmipdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahofoogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnhdgpii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfchlbfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncqlkemc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncchae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfcabp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onmfimga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogekbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opeiadfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhpimhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhiemoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgbpaipl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phfcipoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnlgjlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lomqcjie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modgdicm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfqlfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjodla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnmmboed.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndnljbeg.dll"	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ogekbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Adkqoohc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpfoag32.dll"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nmipdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmbgla32.dll"	Afpjel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Afbgkl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgqin32.dll"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcgmgn32.dll"	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeeape32.dll"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhgbbckh.dll"	Ncchae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occmjg32.dll"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lfeljd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojhpimhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hikemehi.dll"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnifpf32.dll"	Mnhdgpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lomqcjie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mfhbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnafno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ppgegd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qjfmkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdebopdl.dll"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogjembbd.dll"	Lomqcjie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnbdlf32.dll"	Ljceqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojnkocdc.dll"	Mcbpjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibohd32.dll"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mioaanec.dll"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ljeafb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncqlkemc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncchae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pnkbkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Akdilipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnhmnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qjfmkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlfpph32.dll"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mfhbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchdqkfl.dll"	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Npiiffqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmocfo32.dll"	Ppahmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bacjdbch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4716	4552	198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad.exe	86
PID 4716 wrote to memory of 556	4716	Lfeljd32.exe	87
PID 556 wrote to memory of 5100	556	Lomqcjie.exe	88
PID 5100 wrote to memory of 2972	5100	Lcimdh32.exe	89
PID 2972 wrote to memory of 4488	2972	Ljceqb32.exe	90
PID 4488 wrote to memory of 4748	4488	Lnoaaaad.exe	91
PID 4748 wrote to memory of 2668	4748	Ljeafb32.exe	92
PID 2668 wrote to memory of 1080	2668	Lmdnbn32.exe	93
PID 1080 wrote to memory of 5072	1080	Lqojclne.exe	94
PID 5072 wrote to memory of 2424	5072	Lgibpf32.exe	95
PID 2424 wrote to memory of 3812	2424	Modgdicm.exe	96
PID 3812 wrote to memory of 1532	3812	Mnegbp32.exe	97
PID 1532 wrote to memory of 3472	1532	Mcbpjg32.exe	98
PID 3472 wrote to memory of 4332	3472	Mfqlfb32.exe	99
PID 4332 wrote to memory of 2232	4332	Mnhdgpii.exe	100
PID 2232 wrote to memory of 4180	2232	Mfchlbfd.exe	101
PID 4180 wrote to memory of 5052	4180	Mjodla32.exe	102
PID 5052 wrote to memory of 4016	5052	Mmmqhl32.exe	103
PID 4016 wrote to memory of 4300	4016	Mfeeabda.exe	104
PID 4300 wrote to memory of 516	4300	Mnmmboed.exe	105
PID 516 wrote to memory of 1128	516	Mgeakekd.exe	106
PID 1128 wrote to memory of 1552	1128	Mfhbga32.exe	107
PID 1552 wrote to memory of 4588	1552	Nggnadib.exe	108
PID 4588 wrote to memory of 1592	4588	Njfkmphe.exe	109
PID 1592 wrote to memory of 2708	1592	Nnafno32.exe	110
PID 2708 wrote to memory of 4120	2708	Nqpcjj32.exe	111
PID 4120 wrote to memory of 2440	4120	Ncnofeof.exe	112
PID 2440 wrote to memory of 4256	2440	Nflkbanj.exe	113
PID 4256 wrote to memory of 4592	4256	Ncqlkemc.exe	114
PID 4592 wrote to memory of 4720	4592	Nmipdk32.exe	115
PID 4720 wrote to memory of 2812	4720	Ncchae32.exe	116
PID 2812 wrote to memory of 2340	2812	Nnhmnn32.exe	117
PID 2340 wrote to memory of 4328	2340	Npiiffqe.exe	118
PID 4328 wrote to memory of 456	4328	Nfcabp32.exe	119
PID 456 wrote to memory of 4740	456	Onkidm32.exe	120
PID 4740 wrote to memory of 2332	4740	Omnjojpo.exe	121
PID 2332 wrote to memory of 1300	2332	Onmfimga.exe	122
PID 1300 wrote to memory of 4012	1300	Ogekbb32.exe	123
PID 4012 wrote to memory of 2556	4012	Oghghb32.exe	124
PID 2556 wrote to memory of 4800	2556	Onapdl32.exe	125
PID 4800 wrote to memory of 3000	4800	Ocohmc32.exe	126
PID 3000 wrote to memory of 3980	3000	Ojhpimhp.exe	127
PID 3980 wrote to memory of 2760	3980	Opeiadfg.exe	128
PID 2760 wrote to memory of 2780	2760	Pjkmomfn.exe	129
PID 2780 wrote to memory of 2076	2780	Ppgegd32.exe	130
PID 2076 wrote to memory of 2204	2076	Pjmjdm32.exe	131
PID 2204 wrote to memory of 4772	2204	Pagbaglh.exe	132
PID 4772 wrote to memory of 3820	4772	Phajna32.exe	133
PID 3820 wrote to memory of 3776	3820	Pnkbkk32.exe	134
PID 3776 wrote to memory of 2600	3776	Pdhkcb32.exe	135
PID 2600 wrote to memory of 4676	2600	Pjbcplpe.exe	136
PID 4676 wrote to memory of 2496	4676	Ppolhcnm.exe	137
PID 2496 wrote to memory of 3364	2496	Phfcipoo.exe	138
PID 3364 wrote to memory of 4164	3364	Pnplfj32.exe	139
PID 4164 wrote to memory of 4160	4164	Ppahmb32.exe	140
PID 4160 wrote to memory of 4808	4160	Qjfmkk32.exe	141
PID 4808 wrote to memory of 4324	4808	Qhjmdp32.exe	142
PID 4324 wrote to memory of 4176	4324	Qodeajbg.exe	143
PID 4176 wrote to memory of 4124	4176	Afpjel32.exe	144
PID 4124 wrote to memory of 5092	4124	Aphnnafb.exe	145
PID 5092 wrote to memory of 3740	5092	Ahofoogd.exe	146
PID 3740 wrote to memory of 1836	3740	Afbgkl32.exe	147
PID 1836 wrote to memory of 4584	1836	Aoioli32.exe	148
PID 4584 wrote to memory of 2392	4584	Apjkcadp.exe	149

C:\Users\Admin\AppData\Local\Temp\198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad.exe
"C:\Users\Admin\AppData\Local\Temp\198a71026cef33f78d2449ee6b5db23d0eb71ebc849ed348491ed969792af1ad.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\Lfeljd32.exe
  C:\Windows\system32\Lfeljd32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\Lomqcjie.exe
    C:\Windows\system32\Lomqcjie.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\SysWOW64\Lcimdh32.exe
      C:\Windows\system32\Lcimdh32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2744
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5088
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4264
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4196
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3552
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2404
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        76⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4624
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        77⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5016
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2304
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1220
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        82⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4212
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2072
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4548
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:1228
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        89⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        90⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1884
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3712
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        93⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 412
        94⤵
        Program crash
        
        PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2324 -ip 2324
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Adkqoohc.exe

Path C:\Windows\SysWOW64\Adkqoohc.exe
Size 71KB
SHA256 4ebc8bc7e1bb90ed5603e3174580fc8a76ad42bd88ab35b145db3fd25ef89814
MD5 268238e5e803aaca4d9489d46d2bdb39
SHA1 4fdc2e227087931574f48b08c014f27a5a1fbd04
SHA512 0a772434b70d582ef73f4df7bcf408066874076a89409948cf5b9a25255a77bd5545c4f72ff1670f509cf39d0f4f3b9c3b4ce3eea1000112e383c46955442c7a
SSDEEP 1536:rvGxPxP5QkDuQc7sJothV50cR3E+ruJtMWsRQ5DbEyRCRRRoR4RkG:7GDhLqdsA/0O3HuJtbselEy032yaG
TLSH
T1F2638C77DEE0BC03D4481AB80AB258B87F34F7F7A950887D8593D349656A2AD1C1F236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Afpjel32.exe

Path C:\Windows\SysWOW64\Afpjel32.exe
Size 71KB
SHA256 9bebca2d412487064fcf4f06dc99b9b2be7f77857d9e6d3a24bde868c78f444f
MD5 1b7eb11622de129503dedafcd2681f07
SHA1 e8d53f755f1f61ba5c80288b611bc7b0ba8e6da5
SHA512 cfd979c3d14a0457d489b3f6da978d605fd1b4f59d7910c093a9786c1aeb102b7b73a0e8a206b208c5a1f09fc6e72180ac6fde23de5f703ace0620cf6ba88a55
SSDEEP 1536:d7c/JcdKJwXDIxd2l2Diuj49ADW2d2p+0tzrrcRQ1DbEyRCRRRoR4RkG:BmJcWIasltuju2d6+cz3cepEy032yaG
TLSH
T1CA637DA639D13F87D5CF50F0191AC3A514745EBF02D6AACE58E39F18FABE69412D0183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agdcpkll.exe

Path C:\Windows\SysWOW64\Agdcpkll.exe
Size 71KB
SHA256 a3d41520b5eef714e0babb907df6946265cc2e42137c50fb03860e2bac5b1d4f
MD5 091525f60b33b37f0a4fdf212eec513c
SHA1 1f21e46278f1aed2236790a9bab21ce81a11377a
SHA512 6f11bda7c60f0d735940d9ffc4d09cb1d5cde51d61e61a57b8f8b98b11e54dc55738811a14a0275aa1d487ff7f733eb4f2ce06b5ab340caba97351efce49643f
SSDEEP 1536:SAntS/WRDmXIWCCyT0LlUWDrZ6YeLasRQoDbEyRCRRRoR4RkG:xoWRDYIFiXee+Ey032yaG
TLSH
T1AA635ADD103DBDFCDEF982F0097B99B9D77D8B53038969F97520A6C8168A43188AE4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bgnffj32.exe

Path C:\Windows\SysWOW64\Bgnffj32.exe
Size 71KB
SHA256 fa1c159cc5d59c0b5ba3cdb935547cd80bfd72945f90a296245d4a7902c92c01
MD5 e5a65e31ad1adbfd4a944082eda5ef66
SHA1 c7671db73818063f69a0aee077a8625414485035
SHA512 8387f2f6349208b75de0fb26dda652535937e3d5eb7eccf1bd3bd6c299e3de3a08d6f0e661dfd30f73923ea5113af5f5bd466e56b6f0cd82324335f3a2a0701d
SSDEEP 1536:dVIlLv9JwAnWgbt9hsqAYH4+K47uwAZRQuDbEyRCRRRoR4RkG:IlhxnxhBAYY+K47TAZeAEy032yaG
TLSH
T1F2637C671448DEA3FDC604B7410B49FA7AE8E8B01165A763748DC22A897B3FC4B0D7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bnlhncgi.exe

Path C:\Windows\SysWOW64\Bnlhncgi.exe
Size 71KB
SHA256 921cd3acc82672b740a3abc681b005a0a5c2112813df1035a0f2eaa08d1ae4a5
MD5 a09b12de42f31af33b3b6184111752b0
SHA1 919d812c9f8135bde5a46b8dd25df0f91fded287
SHA512 a8deb0a512fb2a0462470b7b9e316fa299a7c810f3e3b491655b1df04c791b73d3673e215c9b767fb324c419e4bff7e35b1c3c58618908ab85220af5245f1db9
SSDEEP 1536:xSknO4h1H2xO6o9MLIZIy1VVKS6CRQvDbEyRCRRRoR4RkG:I4h1WxO6jLZYjT6CeHEy032yaG
TLSH
T1F6635BA5BB7A0D83C9871EFA3C5E40E0EBF442A4AE5D31D75CC8F20A46FAC551558E83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cocjiehd.exe

Path C:\Windows\SysWOW64\Cocjiehd.exe
Size 71KB
SHA256 02181452aa95966f58a1a47536cd1e392f6e73fa71032e51d9364c0881259058
MD5 b4627152e4f01bd788ce02b6a8ddc3da
SHA1 1761dec7054ffbd36121c2b7a2ce994a205f82d0
SHA512 9aa6dfc5a06dee4bca106b59f200b27ac893507ff5ae032f56305e5fb0900915d0c0b3383cf42c9f22e3746eb2fb6248636f0fb40d31242bd64e997e768e5025
SSDEEP 1536:2/S0Sz1j+lCv3hVQMBWScTpBEyNwx7ru97xHiXRQYEDbEyRCRRRoR4RkG:o4jvv3wMBKTpBZc69VmeTEy032yaG
TLSH
T1BC636BF0E03D7FA5DC1D46F7044A2C2AB984B5A718069C451812B7A19F3F29BD4BB7CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dnbdlf32.dll

Path C:\Windows\SysWOW64\Dnbdlf32.dll
Size 7KB
SHA256 95c52dcf42d08c1f012eb852e9d01eebf8e2fc3ab6bc40d8d5336ea42218cf0f
MD5 e505f5f91707202d1600943723c9650e
SHA1 040dececd5ef5dfe2f0ae138a5e6a4222dc897e0
SHA512 0974b5afd42481b0dca307f039e8adb9b826810235ac37a21b2c84051b93fc02daf54541d5c588aa630d95eddf5f9d1c0fb19d51d02eb7c75cbcd393d2fe5874
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPFd3cX5aXW:wUaJf/aFbP0OS2JaX
TLSH
T18CE15493FD8041FBC08D0A7951FF26229B6E69342AD890056B8899351C9CFDFFF78546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lcimdh32.exe

Path C:\Windows\SysWOW64\Lcimdh32.exe
Size 71KB
SHA256 5def1704420c971b14cd424ff96e77f075353310f93a0b5ffbc407e5bd4aa050
MD5 971fc222dc91a7dc88b6c04044e7490c
SHA1 0d359142aadea8a4db4d0a0e5e5842361bed4249
SHA512 ab7bbda9c44411f9e8b6d484ea840bcaa911536f36dec5761b8db04333277e6df5406f2e6b69740c5570a74095cfcd374c9dc8f7fa0decce0de6e0226a211e41
SSDEEP 1536:23Po1Czv7kk1TSXwt17Oh5J5jaiCuvLbHJzWBRQnDbEyRCRRRoR4RkG:nQzvJub5dvLbJWBe/Ey032yaG
TLSH
T155638D47DAA5AE94C0FE90F4A8BF98346FE9E0AFCF25F5829D14D87BB44FE401498501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lfeljd32.exe

Path C:\Windows\SysWOW64\Lfeljd32.exe
Size 71KB
SHA256 f65d99196e752c35287c17af37b2873b2a4d22e30767bb05b56be7df55e93086
MD5 cb18d9df8bd29a5aef5140ac13e1f9bf
SHA1 f1aa7658bd9bf4ea0e838cdc115509aabf9667cd
SHA512 4cb96fec336824a8810bd9884ca1b47657b56412600e4101bf94c943c67ed5dd3cde1dd10a85aaffeee68df1e320ca29848ad399d284365801efbfc94f92c691
SSDEEP 1536:TxOUTb8Ey3kKm4VmomPcWaeWns1NsveaEdIRQkDbEyRCRRRoR4RkG:tLbbyU7QmfcJnHvB+IeiEy032yaG
TLSH
T169636CA5A828DDA1D14830B1731E41EFAD5DE57D4E6F8423B56CCE06B08783FC879AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lgibpf32.exe

Path C:\Windows\SysWOW64\Lgibpf32.exe
Size 71KB
SHA256 4b8e2c9ef7df3a93952460e46d12110e88ea01106347c81f742f0ed155212073
MD5 ae24d536fab36bde91dae28e454ba219
SHA1 a4017e3d83abbd781d302dcafaaa5da50410c3c1
SHA512 6266692b920f9e9fc528c02ab66df532f75a1efaac6402267930a566ce9dabacf1aadb9aff7226e5990e5836bf60e16b23415c8edffe5df233c1247b88b7bca1
SSDEEP 1536:GvxJ5yTde8HTumnHL/2Mbx6UafI3t5/Cr4OEDRQWDbEyRCRRRoR4RkG:ix/yTdYmnr+Mbxtx9lOEDeoEy032yaG
TLSH
T148637C8FE6EA6CF9F4905DB78681C7D1A26CD42E0C88C05E246CAE0576CF44BDE6C48D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljceqb32.exe

Path C:\Windows\SysWOW64\Ljceqb32.exe
Size 71KB
SHA256 1d2d083c1e90b9243c33106e0dee024b2371fc51b3744f45eeba1ed1aeca14d3
MD5 902e302e8b1d9b8901524b2a79cf368d
SHA1 450255e4e5e55210eb8864771680f2366968d952
SHA512 d6b50bd812eaba23d9abcc933be958a0c2414ac7e54817d9102b780bc5983c452b3b7bb4d94d397cdf0c1ac909d07f3ee0163a2421d1e7efa7d26506e5d4d33d
SSDEEP 1536:tfS8Hwv8PvCuZ1IUSu0UIsTQcEnnLGYRjFitnRQ+DbEyRCRRRoR4RkG:t2GvD7ZXIs8vnnLGejEneQEy032yaG
TLSH
T126639DC8FB7C2E16FC6925FC414DEC349CE7A5160EE689CC82B6D91C0D6F28452B99C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ljeafb32.exe

Path C:\Windows\SysWOW64\Ljeafb32.exe
Size 71KB
SHA256 ea09a7f26acea55bd2974a28b0d14c31952e17dde5eb3e00e8961817587b1583
MD5 6c53d8b7f795304f230d96ed11c4a7d4
SHA1 58286629c553481c392e89420191e6bea4474c5f
SHA512 e70ed05872b085bd379a8d906e74d30d2919dc54338fe077a071b188efd7827ac2821c7b5a5ebdc084c188dea8a2d1568203ebd88cfbda87192ded16da1e4dfe
SSDEEP 1536:PQCcp84zS4LnruTVTBzj0oioqYPLLQFrhsHGynApkRQm1DbEyRCRRRoR4RkG:PXcrvoBzooRjTUrhsHGUPeKEy032yaG
TLSH
T1D3636BEA1629CC9FFE2D04F5A0031363D4446A60073A8383F972F777658B4A9A35F95E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lmdnbn32.exe

Path C:\Windows\SysWOW64\Lmdnbn32.exe
Size 71KB
SHA256 019a7a7cdcfc750baf970640e23868c6d93ecc515bb792556b0f93c8ce241baa
MD5 17f3b6935650a3c759ce89308c44997e
SHA1 08f2799b5d8dd0987c59150eb993a82e6ddfd42e
SHA512 56956f22b7111fb194f4aa7cdb44081cff8e0d2c5fb7d7c0e0373df5a4724796ab55f18eb8445b8bb005c17b174272df81223ec5758d86f9671d4639da286276
SSDEEP 1536:vKCCBYbQ8V6LHqz8XiHPUtJFlfwmtJcAs3wA5fDdt55RQYqDbEyRCRRRoR4RkG:v8ehCFXiHP2JPRHZ4Ddt55ehEy032yaG
TLSH
T149638BCF01324F39E69AB4F052DAFE202251F162196E8CD657CA873A57DECDC8531C6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lnoaaaad.exe

Path C:\Windows\SysWOW64\Lnoaaaad.exe
Size 71KB
SHA256 de7b2413ce798f37efe66796957947fc79831fe10d9a6f22019d88302e8573b7
MD5 efa9e8c9ed7d66ada7bb39947e5b8d5c
SHA1 ffcdad4635afd8dc40fa4368862c566717aba330
SHA512 516640ff03ea2a596caa2b83a87c33869417613b75ece765ac28ee8b10df2bb8d3f206daa43172cc92c73a61445bf8f23085e54285dd2876ae35706f1d00fd2b
SSDEEP 1536:KiGyk2h9aE8xB/rSRSHfpvGsV+rfdS/+QA90tMxRQ7DbEyRCRRRoR4RkG:ySPa9T/pvGscrfdwtWerEy032yaG
TLSH
T1BC637C8955E6FC6FE78FA2B4F101C1AD882CD7F427CC999D180EC94C44FF48D662961A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lomqcjie.exe

Path C:\Windows\SysWOW64\Lomqcjie.exe
Size 71KB
SHA256 c30faff75dd8145fcb2e2b35030783445f684629656d268b64ac6c6380cd52ed
MD5 8b8916dcc0a3bd32440637046db422e8
SHA1 482246dde5c7780eaea20416e425eaaac7934178
SHA512 ecce49333eb8527e40a29efba0ff7a4bd7ff7b343a8576befd6a9d05f98f88e7614bd6742c2c88bb37d1b0cacb483aa887713b97da58396b3b9c138492da66d4
SSDEEP 1536:Dl/UhR9vjRWM3QFSTOx3G0uFFkTSqxm3CCrH01lbRQ5DbEyRCRRRoR4RkG:Dl/WR9dcFvW7kTNGMlelEy032yaG
TLSH
T157636ACE795C4EEAEB9230B9C01B497B36508366E7B7D6765A0E43F4D9C7F421A0A900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lqojclne.exe

Path C:\Windows\SysWOW64\Lqojclne.exe
Size 71KB
SHA256 0f5b7e270dc4ac0cf936cb290fa1c8f98d98ef36e157f7743fb6b91899fdc2e3
MD5 172326e498fbb21eb499545821f15552
SHA1 6591278c03343703fb99b97c7798ed1b8ccf6af4
SHA512 0e90dc11d94caedf5e2754c8c9568f5e5cf4ba9a022af445b71e8e2daaa11150fe40e494f3c7c734f82b764e8e52b6542f0403c9d4051a59f451772ab0d71f19
SSDEEP 1536:GzVPi8nuhduT7Vw8qy1P/tVRrdfWbqwzP1WWRQdDbEyRCRRRoR4RkG:AP8/Mdt/tVzaqM17exEy032yaG
TLSH
T15F636B4B22AD5D96D72C12B48C0F81ECB6C1D16CD9474F8705ADC0B93D0A27EE7BA9B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcbpjg32.exe

Path C:\Windows\SysWOW64\Mcbpjg32.exe
Size 71KB
SHA256 f2bbec7c2b3aa0cb6d424045f23f86355517d8a26b20b068320bec7c2e6097fb
MD5 ddaf6d1adb469ad721e80d0f8dba3084
SHA1 38c89af3eb44c788889e45e2adf77c483fa1514b
SHA512 cec4580cf9cc46382c7e98f232323e204e67bbc3b996a627df79a7c49779403ebf99bb31a3e5fb6f48774bc5f5d914d8a3e442c681b608ee70a3a7761641ed23
SSDEEP 1536:35dU//Y9GbbKBi1En3iKtYtMWnf0HRQNDbEyRCRRRoR4RkG:JdU/Q9GIiWn3s5fEehEy032yaG
TLSH
T169638C7926345D67ED97AEB48A5E01343B85E8238FEC97C5CF79CE8474368327E29081
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfchlbfd.exe

Path C:\Windows\SysWOW64\Mfchlbfd.exe
Size 71KB
SHA256 86a8a91e69ef73259e5cd0c041a7c00e3b2991a6121b4a81bb084623094d71d6
MD5 f4d85439cdc0a8033e28ee3bec9709e2
SHA1 af07baadaeaecf95d3db2707fb7238f9de3c356a
SHA512 9e7119cb55c7a622177bc1a47555087670b380d99f89e01e221a409ddf4ed6e048a92e45eacb27638a72572b58cc1048ed2aa292f7fe0810fb396afec9531285
SSDEEP 1536:ESBJ8OhgKA7BgfMpmlsGvEBdAaufYCMMRQCDbEyRCRRRoR4RkG:EsJnyWPMdAa5CMMe8Ey032yaG
TLSH
T1AA636A85ECBCFD95C8D20EF0A17BA175B278A4364C79F653CD04858953BAA25BE1C30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfeeabda.exe

Path C:\Windows\SysWOW64\Mfeeabda.exe
Size 71KB
SHA256 d4e257496e2d618a2074d4014f48fa3c8da86e6d86b98074c8711070d93b4a32
MD5 92a08ecb6805fa3fd8535b6ce90cfe14
SHA1 c368dbe293d049966ab2499d646e763c5177e3fb
SHA512 aab3779cae4cdc68a6af93fe35511d9988a9c66dc278c0ff1482e72ea0353ebca7ad8b74b76ef01b0dc70cd11be6a5b5367068c867b50f14c52c442cfb24e967
SSDEEP 1536:J/cFKYCevPamJF7eWGL44tEH1SQcxqep/GNrH9rC0HZqRQkDbEyRCRRRoR4RkG:tc7YmJETL4d1SQcI7H9rC0HZqeiEy03x
TLSH
T1D5635B7624324E0FE8A8AFF0501F92EED144C9980F01DBBD964782ADEA5F31D159F6E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfhbga32.exe

Path C:\Windows\SysWOW64\Mfhbga32.exe
Size 71KB
SHA256 9a298f01a51d33141b70ca7986dcf4ecb11d823f8115f21e650e1c52c27da1fe
MD5 fa4a5d229ff70c02c811864a057a207b
SHA1 6472122095ac1af005b98541aa7cdf4dbec6d615
SHA512 b55482c13d4613e9b1d0beb9f803c7bc86f51ab0f744bfc92a33fb7852abdba8bf9497d3dd0b9f18e35b02c7da42604ba895059d570e877fdad434dd96eaa130
SSDEEP 1536:dNsLnZL8QrQTPXA5CKwMu8KxTpfxJINvbBwUIr1RQhDbEyRCRRRoR4RkG:vszZYQrIquPxTpfxJINvbBwUA1eNEy0B
TLSH
T1E4638D86E8AB5EAFC09703B8463016F051E15DE065CAB4E3CB7BCED8692FCF0155618D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfqlfb32.exe

Path C:\Windows\SysWOW64\Mfqlfb32.exe
Size 71KB
SHA256 e4bc0c1c99d17fbf5b280f289f1a820942fdfe78663174181cd454cddd74ddcc
MD5 932138e1911716013d3a520f554dd2b6
SHA1 f493c28d0962a94472b39fbf113a79c6fd291317
SHA512 f78665c12bb3d35080de29e99cabec78e5886579b53c3624a79565f50ec07e1cba9b2c79f77d74965ffc70a9fd4df92c8d38d0172fab68ec3ae0ca00d5e687c0
SSDEEP 1536:wAEpgI08qFOs1YNT3ggIfgQM/N3oDtidRQJDbEyRCRRRoR4RkG:w3pmFf1QLgzgQMJoDt0e1Ey032yaG
TLSH
T17C637DD6B1B40DA2EC47BAB244164E781FE5B410BDD498A38CD06B7951FA3333DAE5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mgeakekd.exe

Path C:\Windows\SysWOW64\Mgeakekd.exe
Size 71KB
SHA256 b5e5a410141265becc12d431674c4acfa35b9b0c0d9e96205465ebb0c3e1d764
MD5 9cc3dbff87fdaea99e112fadf4a3f13d
SHA1 189f031e07435213d98e873cfbf91ecd7490a208
SHA512 e2751dde62fbb445041308403141de545f3a76b824be3d60b3b58f356169fa12a990a164c3f8994197d0ddb203cfd3f1cc1ef706d3f113582b7fd1979f3cf00c
SSDEEP 1536:rMM1CE+kCN6tJLfiMwkwvl6eUZaEW92iCCCCCCCCrwRQQDbEyRCRRRoR4RkG:r/1CE+ky6tJLfupEXmweGEy032yaG
TLSH
T1BB638D6964F4CD13C84975B0DC4F2D5D3AE87FD9C3486EC66BB4891CFA8A3AC4069362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mjodla32.exe

Path C:\Windows\SysWOW64\Mjodla32.exe
Size 71KB
SHA256 1867f860ed24c30a5ecb78f8484f5a4cbcac2680e98b0bd3c25e6e4f14bac3d0
MD5 817eace1d864c854e0e2293dbbb9e8c8
SHA1 39aa0bd08196d72dadf8d906df26cf96697144ca
SHA512 e9fdfa70053a61002c56016dffeb7edd773ea658ea21ed3a38709e95088c1da60051ec7be2a65726fb63fca6291c194de2e193cd68319b74eabc13a234c01d13
SSDEEP 1536:aVaI2No/vjz66SPDRATWqDPm59wRqUAHAwQyjOuRQ8DbEyRCRRRoR4RkG:AaIT6Vri8NiueaEy032yaG
TLSH
T13E635B8F3B785EA9FED42377B34960F550AAF87C8ADF46A154BC6704122B7913C482B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mmmqhl32.exe

Path C:\Windows\SysWOW64\Mmmqhl32.exe
Size 71KB
SHA256 55b5939ae99946b840d877bd765fa4d9168bf87c56868784073f0dc80e682b7a
MD5 2e5958742892c978bb22b9452045ba2a
SHA1 715460786a5d27614f279b8045e4abf508a031da
SHA512 cf1754c470b703a653d7b64a0b0d90686ecdc539d4f91ec88f42272c941c01de1e13e0ea11cfc6ab157fccabb550aea62fde8e52e755d38644fe09efb8f7981f
SSDEEP 1536:iFY/aLZEem996TrRqCWoR2GP8ce1+p4SMHK3SgbUHFGzw5IRQyDbEyRCRRRoR4RD:iF+8lm996TVqCW22GPjcIMHK3SgbUWwh
TLSH
T1CC636ABA43FC5D9DED154C7814230C5977ADA2FC60E4CAB2C984DA081BEB72481AF779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mnegbp32.exe

Path C:\Windows\SysWOW64\Mnegbp32.exe
Size 71KB
SHA256 f7d91fcd0ff154c953c34fb1e0d0e91c6c65972e39920327849c51dda5271583
MD5 d50eac37cd8001186dc1496bd5ae53bf
SHA1 db6d419bf8157d7b70d7f495f7a05ed1040aaaa4
SHA512 3fcbc8f9939d21bf90a91cf9d5f47d64f1c6832f55fc62f2330c2256782a3ac24b8c3269942ed3b241c9780b698d5f6a65525d3b0467aa530552615ef656070e
SSDEEP 1536:UlXziUZ6bXvQDv5SUR/Hlf1ffxxxaq7KRQqDbEyRCRRRoR4RkG:uc/gUUiGKeEEy032yaG
TLSH
T139635C8328B56CF2D5D64EF4D23BC73E51E49570CDEF8AD7988C71090A8B4C347689AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mnhdgpii.exe

Path C:\Windows\SysWOW64\Mnhdgpii.exe
Size 71KB
SHA256 65b602c964694e66af21f87150a3ebf89c91b9579c7090a7149fdf7ef3460bcf
MD5 80fd26015dc3bc6d3804bdd8c1c44d26
SHA1 adf4cd0644003ec68b21a608c2c0d1d62eef9e32
SHA512 9c99e903d674364eb50a728ff7c0b7cb0b2bc6d18b5fea21a469be933d827bda2c39c6044e14a0c9b52bc02530f2d2f546c692ce8190303ca7cfce1be333dedc
SSDEEP 1536:OXuwSOuvsot1G338jw3UiHlWdMUMUblkO6EB6fsRQ6DbEyRCRRRoR4RkG:DwSOuvRtevxHcFvhkOt7eUEy032yaG
TLSH
T1E9636CD71952AF48D8D643BCFDD3602960ABA3798F96ACF201DCC1273D6B209D4365B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mnmmboed.exe

Path C:\Windows\SysWOW64\Mnmmboed.exe
Size 71KB
SHA256 10578af095612e49b9a012bc2cc83b9e734364459c173404612fe61b18e06edb
MD5 a309aba44a1c05b0bfcb8299d4419e68
SHA1 3a903b7a1f43d7aeebcb1e9ac03b6ec74c379dd8
SHA512 c1bd28649d5004fa40a1bb569b3fb6570306e8b0bbd0bdea023ff4009f399503d6fe9201dcb2a2b65c70e7096bc1e47d892ffd2f304e1a93aff26bb1423dc67c
SSDEEP 1536:0w3iQDFRCyx5SUc51DB87TiwNS63HBi81ClM6CRQ8aDbEyRCRRRoR4RkG:0w3iMFRCyxkbaiwke31Cl0eZEy032yaG
TLSH
T103638DDB26E98FC6FB9920BC0A4B007930D4D13F7F97716B492644EE59BB068F43A412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Modgdicm.exe

Path C:\Windows\SysWOW64\Modgdicm.exe
Size 71KB
SHA256 5b0e4eabe558000dd4264a3dc48d2b7abab9fb3f8ab8e7ab6cc51c9ccea5c323
MD5 d99f024422798d078fda46b4dc515430
SHA1 32bfcec17b543ac66dde0fde7b5ac93ef22836f6
SHA512 cce82f24c6122a3ff18fcba8197a666bfb9813fd086a602a3f9512456e7058cd2811ca0e7ba4932b29de4052ecd888849b703d9ec1d7295af782984595e37dee
SSDEEP 1536:FXyjmL+CvcHCWJ5ifFMBNOjW6t0fo28X7LDYMRQnJDbEyRCRRRoR4RkG:FXrdUHL7NIW6tsote1Ey032yaG
TLSH
T1F6636BA8EB6C4DB6FDF6C730914590246E29D2941B1DDBAB38C3707D02766C28DBBB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncchae32.exe

Path C:\Windows\SysWOW64\Ncchae32.exe
Size 71KB
SHA256 817415680f8e969dfd82799d106e0af4075ca528688cf3d9aadb523e2ed274b2
MD5 ec26ca0c623963845b2d8413b93dcc02
SHA1 9bfec060aa9ddc2a41d2bb66a5c4326463ce97b4
SHA512 2f753c31f5a705a8045a85de4f8c9766bbec3d7b76835e93de2e98d8a16b547e082798f4441624bd8acd320f6400d8d972393fdd77b87f83b6309adab2dbaf5c
SSDEEP 1536:Whz6mjvfmCQBKRpze2YA1goPhk0mxP5RQsDbEyRCRRRoR4RkG:a5vsBE1tvmzeKEy032yaG
TLSH
T1BD636C6591721CB6C7AE20B4D232C7BCB6486A2833DE93634ECE873BDB17104659971F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncnofeof.exe

Path C:\Windows\SysWOW64\Ncnofeof.exe
Size 71KB
SHA256 54774e86fcae88aabad3750e379a567d49aa4b7a4983d04b544ad56f43a672aa
MD5 4cb5fe6415a85ef5e2d19bdc56f4dc3e
SHA1 9fa5d5d4588f65f32addd3bc3d57f72869ab26e7
SHA512 d7274fd0cffd4ec92dcd174851aebae8a76d9c19d36cb22db17abe72f3d8116160d55c04be01e3fb3e20a69ffcc311811cd06e760ea435847e76087b64717d2e
SSDEEP 1536:ib7w3tBM9YPZAUATq/YL7yxn94gRQG+DbEyRCRRRoR4RkG:iwdBXdRageGQEy032yaG
TLSH
T11A635B5229FD0E2AE85F40B2C13CC2F632BAD1F486F56856504EFA3AF47BF276512215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncqlkemc.exe

Path C:\Windows\SysWOW64\Ncqlkemc.exe
Size 71KB
SHA256 f94791ec5ff55e9d4bbd8de3a20669a06450b01ebf1f8d19a2ce459d32a4b096
MD5 8270c7ef114ee5c57afb3de21e069627
SHA1 51119f8872dc663654763e9d7c6d772b4b538d86
SHA512 3b6a7e560571f48d09054f023833165e36ff1a79002ae05da559082d54ccce2c291706c9719e3169b1beab663d987f1ee5d9acc44821b0a7dd583fb51d2b673d
SSDEEP 1536:4j8nUzoeV9i8w/P/VHM5mtb48jSEDJXfwRQgDbEyRCRRRoR4RkG:PfeVsJ3VHMoUtE5fweWEy032yaG
TLSH
T1EA638C9DB3257E28FCC025F4D1171DD2B71696D57398AF3A0424F28358CAB0EA9285BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nflkbanj.exe

Path C:\Windows\SysWOW64\Nflkbanj.exe
Size 71KB
SHA256 e949628d567dcf75bb60290a6ab2eff05592788119f266b906584bdfe46ef2da
MD5 e4ae473c4cd0a55cc024d885fb09a34e
SHA1 ca48d0904700ad9882d5f38500d85a0ac93a5735
SHA512 14fe12cf8a4de0cddb00499dac55b8f8332720abf1361366b23ebd367bb3353713a6a91f14cb15237162139ecb2b38be0888dbffc792aa48549170dcca1f3de2
SSDEEP 1536:n7FiUkb2nVva6U6ZaQvS8Z3BsSKFYC80huRtWRQyDbEyRCRRRoR4RkG:7F4b2nMN6ZaQvS8BBsLFYC80hIIesEya
TLSH
T1C8636AC63BB8BE85D43550B9601E4CB11BE5CC221165E3BE410C4D2F6DDBEA9B27E278
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nggnadib.exe

Path C:\Windows\SysWOW64\Nggnadib.exe
Size 71KB
SHA256 89796f2f0649cc6612881cc95b7e229907da407964ad9bcfaa69a9efa1a01bdc
MD5 bef7110a6e1354234e9736ba7462b625
SHA1 d52c5ababf803c5fd310d3c72f86d914b7eef45f
SHA512 922bdd2f69d52bc24c8f57cf2e92bbd43eb5cd292eab1c092e0b4d4f30dd7f1cddde3cee7ad669eedb670efceaf961bea46b9148858e7b345ebbf62119027309
SSDEEP 1536:6RCsn5eOMGNJ73FxvEx8wtF0Dx7Bsj1jToGuTRQJDbEyRCRRRoR4RkG:6cXOMGNhvEGw4ZBsj1jTQTe1Ey032yaG
TLSH
T1BF638CE4CFBC2E90C988247069E962E0365493E24738AC771873EEDFE34B65C84E5576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njfkmphe.exe

Path C:\Windows\SysWOW64\Njfkmphe.exe
Size 71KB
SHA256 dd248ebe357bb302c5fb5329c7e4f09bd41130ec08145b3681ce9e76e92d7223
MD5 67d5dab81bf1599e84883c185ad0aef4
SHA1 d3f7874e5ea63f8ac5ae556d9af3c266868dd323
SHA512 d4e24b1bf4a821bd43ca58f80d6ab2c395a947b3c611f3fd00a468f772030ed4d696419b1da54c6dfced6e3e7127cd594337c9001e176289454952d449ba2922
SSDEEP 1536:7N/UsxPTKZb91yVG/NgY5XJDSK3Di/Z5pA2sJA14tF9kGkQOPoRQRDbEyRCRRRoc:76sW1yVgZWKzie2sq1YHyQOge9Ey032c
TLSH
T150637BA1F0B13DBCD548B9F000E953751471AFAD8B68C4A1C849C119E6AFD86EFAEC5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nmipdk32.exe

Path C:\Windows\SysWOW64\Nmipdk32.exe
Size 71KB
SHA256 316b8e55644c544f9384a0a3989aa359b5e0e09bd7109b44999b80e772763658
MD5 f249b843ed9d81d354431db65a03413f
SHA1 3ac78b2646f2a36bd173ed602a6c95dd917a7b8e
SHA512 cf88d0fd83462db66c6f300833ea3918557007a06fb811e3347836f0be0e8a916060143c4cd3ff54ff14dfa83e8f1b7e7a96fc8977244bd2a4928c7b1a45ef36
SSDEEP 1536:Oe6tiJcs9zSdwfYyJcB9pLrWHYPr92EQtYuiyrdljpHlBO5voPnXjlv4aRQ6DbEf:Oe6iJUOyB9VoEyYLvoPXjlwaeUEy032c
TLSH
T140639ED35FE11CB5D96FADB39277088537F883B0809966C52AD678391ACA57E8D2CC03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nnafno32.exe

Path C:\Windows\SysWOW64\Nnafno32.exe
Size 71KB
SHA256 d21cad1df033ea6b30d44263e3ab8ade093a02504fc920d34429c53933c914c5
MD5 3001a7b840c6bc97df93bdbaafbd3537
SHA1 02c3328aff962c15f2490fdbe47bac6f310eb12c
SHA512 6f35bb01d7f7c99ec381b1b168ce0106fb3ee8f04adefdb2137d81d6770337ef1b6cd77aa7583e00d105224655c16b18d2a17ab4e9957044785c23a82e6776f7
SSDEEP 1536:PlwePP5Q37afdl6SMN+rCb+6bmTBimdNR48+FuRQLDbEyRCRRRoR4RkG:Nw25Q+d7tmbBbYl4Ae7Ey032yaG
TLSH
T1D1637D6F8C127C97CC6802BA41534DF01153AA3D08C1F1EDD8C8AEE4ABD654A7ADD39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nnhmnn32.exe

Path C:\Windows\SysWOW64\Nnhmnn32.exe
Size 71KB
SHA256 e49a9ef0fa242037e2e71788ee3acf5e20e19db04009465cdb371ea25adac1d1
MD5 884e2c8889a559b6161b288ab1d81028
SHA1 8a11f53ba1b58a1a932c44414af7140376355fe3
SHA512 ba3011120316d13ff71162a400476368f384584081e1e83617cdcc48592fd7ac83302ff60207b10bbb785b18f11c8a3bbb207c5957b0f708e2c8ddc049a97a46
SSDEEP 1536:dqaNQuMljzh7ms1cLgu/mP7Wpf7dEAz+QRQTDbEyRCRRRoR4RkG:d6hmseLgu/maNL+QeDEy032yaG
TLSH
T1C5638E57D0A8BFB9CEF533F0A219786C65F09921C70BC5C35980862464EB6BDDC217AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Npiiffqe.exe

Path C:\Windows\SysWOW64\Npiiffqe.exe
Size 71KB
SHA256 e7a71651f444e295b83389a183aa8cc0f3f66f5cedd62bde0f9dc487371697ea
MD5 f4b6b665583594b75587ba843d7765ea
SHA1 bab2ae796b2534571e740761e39d6c40f93f3655
SHA512 44f9d9e3265d4b52a55877e0515d3af5f9d3ccf62e8a256002128a902d071c64280b7b79f424ddaecda5254fc9bb3dbb405b79c5a00420b1fc070964a9229ade
SSDEEP 1536:0oyS1rJ5k7S1nIUKm6zddl6lgbE9or+AXnSD6AyRQZHDbEyRCRRRoR4RkG:IorICNKrdJE9ord3SDfyeNEy032yaG
TLSH
T1D7638DEE13A91EE6C5800BF09E2F85FEFDD5B8ECE929DE5E090E81686D53816530DD40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nqpcjj32.exe

Path C:\Windows\SysWOW64\Nqpcjj32.exe
Size 71KB
SHA256 654977bebc475990e74b49d88792c8d58ed1cf81b94f5c99115d575d687c361c
MD5 634a9e85f8ca6973e33ac388404ac713
SHA1 8f0cdfcfe69737418d399e2be39584a011ae0c95
SHA512 0024ad5531db863297c5f8b3a6395d5bcd83d27129ddd77e6aa31ec8d03fbd5e769db926d94072b27dc9d44a79da7bf6c3188c0032a03d7f2ad3b8f3f9411bab
SSDEEP 1536:S51CUo+Ejj0wBGz2e9EfQGUxq++5s1hva+OqP1Et45eMRQaDbEyRCRRRoR4RkG:S51CX+UTBGxQRUxkGhiaaMeMe0Ey032c
TLSH
T181635CE60522CFDBE94833BCC236336D72FEA7EBC2C5CA105047D44669C6DE26097A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ocohmc32.exe

Path C:\Windows\SysWOW64\Ocohmc32.exe
Size 71KB
SHA256 0abd05269c5af83f5e82bba9328c0122a8e3e24c8acc0a7f7ba93483851f3959
MD5 98ae9dd454a0da7ab816be972e8ade43
SHA1 a612f869c5ee5c6439a4ff44a5360d65c90012cc
SHA512 abb007c38a51ba8428061eb660eeb900996c242c8dae450221ef695fccd5d782ba18ee7f5bbd585a8c72875c7cbd2574b2e8a80ac6301128a0927a2af79d4844
SSDEEP 1536:niuqKk6jiSkA6GkEBwamxsySz1FHo4eMLAvTXoRQgJDbEyRCRRRoR4RkG:nikk6Xk8krSz1FIAcTYeIEy032yaG
TLSH
T13F637C3DC6E5FFCAF2FE24BD84885329108BC2A62904D8C149A0FD5761DA2DE57DE583
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oghghb32.exe

Path C:\Windows\SysWOW64\Oghghb32.exe
Size 71KB
SHA256 05afae33d9fbf1dcd54835ebc1e7faa4769b24835f5b45d0d17662cadc5c12b9
MD5 22eca9d90ae00621eb3c6a0801fc1e76
SHA1 2c7cd5104e5390d24674b7679604428cb9b3ee12
SHA512 62f7956d3a96db7a9da1a78de339c0b6422c71ffd53453fea831d34fac97c42d34169b5eecca558ee9b3efe7731ed626c843b79e0fe3be49f6a904f101d6cece
SSDEEP 1536:wWruOvzPU95lQap63MtqW7Ox2UKHOcjbALRQ7DbEyRCRRRoR4RkG:ThIjlXpNUubyerEy032yaG
TLSH
T163637C63B7907C6BCE93163651D9C8613250CDACC77BDEC66640CD68AC872E0ABF2572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opeiadfg.exe

Path C:\Windows\SysWOW64\Opeiadfg.exe
Size 71KB
SHA256 41c49c1363088578612d4ef2142d97292d21d11b4bc789364bb653d578475577
MD5 6696a69849e9927821a5f5d066c47a0b
SHA1 10c1a838fef0d721481ebf30bb66e0304c16e3fb
SHA512 e54d1856910f15b1cecc0c453ba39f801a47f4abc048e10e02d58a8b0018b29e0782fb095d3a251734e712ee35efa5050b1ae488c8a900bbea7c1d341b58dded
SSDEEP 1536:A3aQK39DjxGseWX46LCCQd4ROdj8rSjGSD2RQ5DbEyRCRRRoR4RkG:A3aQUJtx3XvCCMdj8riD2elEy032yaG
TLSH
T166638CDB41338D57EACAB6BBB2288DE1A6B7A211C5FCCC304DE6E11E493E4717411E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjbcplpe.exe

Path C:\Windows\SysWOW64\Pjbcplpe.exe
Size 71KB
SHA256 21b8b3197c582ba6b154b668f96daab5f6b709fa4a30d5d53c240948c6443389
MD5 7220674cc157759d8adce6f5ffdf450a
SHA1 be7d1799075f3031f466f3987494a37062171b1c
SHA512 15a139ec1b350955efc7bffcf6d987ae69e45d1ca16cda6ca04e8583663773c8a34f048b24a5f23f4165daf3319f17a3b3da4eb817a6eb1082d978215b47be86
SSDEEP 1536:q86nmyp2mTVIWJnC9W2K56bXxQog5JxRQHDbEyRCRRRoR4RkG:qZTE9py6lVghefEy032yaG
TLSH
T134638DAF9267AE4BC60C16F7100B47BFC92DE31DC99D4FA381DBC25C211AB1D19962B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pnkbkk32.exe

Path C:\Windows\SysWOW64\Pnkbkk32.exe
Size 71KB
SHA256 261b201612e1c5c5335c23636daacdd22cc904d19753fe2392404e1670c07b59
MD5 40c9be980ea1e17d0164bffc2891e0be
SHA1 e72e49a1e44eb7f38011c06c549e733b12daf672
SHA512 c768871ea2879486c1d8122fa4132ff5a6ae9f3f1979da6dd68d94087b083fa151c6a31f5f1bdfe6a7eb55623f7673610e8f25dae6932939d3dafbafe3308469
SSDEEP 1536:quqHMu/PsyNarSNHBBJNH8PJWxIbyYqCs3KiV/glWRQ08DbEyRCRRRoR4RkG:qpLcysCHBHJiWydo35V/gseNEy032yaG
TLSH
T1DA638D7D597D3F81FED822B421D6EDA661619376BB13C4E343CCA4952BAFC358823208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppahmb32.exe

Path C:\Windows\SysWOW64\Ppahmb32.exe
Size 71KB
SHA256 a7293e04d7800c0784a969812fabf296d2c06d841b951ee8233445fbdffa9cfe
MD5 b5547b73b95a529bcff25d523bfd0869
SHA1 2189769faa012e29f9e2e83c2d549ce3811e9800
SHA512 91f64599dcc0a725b91190aeb8a4cdd7f57d2c9ad8b963029b84ab36d6b92ce7a79714b73080c5c7f7a7dddb37bf41abcb8b5d9a7f7effdcaed0711398f2a409
SSDEEP 1536:VV4gVx4l6JnQvoxWsx6bpj31QuF+6/uCrQ2mRQdDbEyRCRRRoR4RkG:ggVx4l6mvoYsx6bpj31QuFECrQPexEya
TLSH
T1AE639DA1E2675DD5FB0819F0746BCEFC6FBCE125338484C216DE5A9F2CAF285609C912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppgegd32.exe

Path C:\Windows\SysWOW64\Ppgegd32.exe
Size 71KB
SHA256 6626ef468bb32203f08ba230d9d42cbd87ef796bb3fbfd8d2790b2b7f8ff4bd0
MD5 02fa5f89cba303695eb7886042d137ba
SHA1 70cf73ae7b22ff3d6e6779b2eed9ce8030b1b827
SHA512 074c85c7a952b4ea765fa3ffeabf4ba0cf7e58d0983c2495ac224f15c3ad4f2e739d2dc50940e9b26dcf75155d6411998800d414488cf8b275c55f7e448fde0b
SSDEEP 1536:bSnpAwI7YsdNCi0VcePqYiy5bbrJ/obg9MRQUDbEyRCRRRoR4RkG:bSnpm7YsdOVLV3Vo8MeSEy032yaG
TLSH
T140637D7997E00E67CEFCB0F125FA04759232E6B1873CBE864F759C29064E8D96416DC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-508-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/456-273-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/516-164-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/556-16-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/556-558-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/736-478-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1080-69-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1128-168-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1220-538-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1228-591-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1300-286-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1532-100-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1552-180-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1592-199-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1632-597-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1836-436-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2072-572-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2076-334-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2204-340-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2232-127-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2304-532-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2332-280-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2340-260-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2392-448-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2404-502-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2424-79-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2440-216-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2496-376-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2556-298-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2600-364-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2668-60-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2708-204-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2744-460-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2760-322-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2780-328-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2812-253-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/2972-36-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3000-310-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3364-382-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3468-604-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3472-103-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3552-496-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3676-458-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3740-435-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3776-358-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3812-87-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3820-352-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3980-316-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4012-292-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4016-144-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4056-585-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4060-495-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4120-212-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4124-418-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4160-394-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4164-388-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4176-412-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4180-128-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4196-484-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4212-566-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4256-223-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4264-472-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4300-157-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4324-406-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4328-262-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4332-112-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4352-526-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4476-559-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4488-39-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4488-578-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4548-581-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4552-0-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4552-544-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4584-442-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4588-187-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4592-232-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4624-514-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4676-370-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4716-7-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4716-551-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4720-239-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4740-274-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4748-52-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4772-346-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4800-304-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4808-400-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4816-545-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5016-520-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5052-141-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5072-603-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5072-72-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5076-552-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5088-471-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5092-424-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5100-565-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5100-24-0x0000000000400000-0x0000000000439000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads