berbew | 9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963N.exe
Size 128KB
Sample241006-npc7da1gpr
SHA256 9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963
MD5 55d405f39d0bfc68e4a34ac367437a20
SHA1 3525d0cfdc850a3119dcda901bf9b790c96eb720
SHA512 8c4a0c4e41018b06c8aed9ccfac7d029dcc1e0bf350c4e315a8511b957750badbff25a369d32baaf3476b552eb604122feaa8f25cd13422830305584c3ddf6a7
SSDEEP 3072:t6HgjiIoFBrt9FFDJ7nAaXQmW2wS7IrHrYj:txjTc9DFFlrjgmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojoign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pclgkb32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 63 IoCs

pid	Process
4956	Ojoign32.exe
2412	Oddmdf32.exe
2664	Ojaelm32.exe
3292	Pdfjifjo.exe
1664	Pfhfan32.exe
3484	Pqmjog32.exe
3692	Pclgkb32.exe
4756	Pjeoglgc.exe
2744	Pqpgdfnp.exe
4060	Pgioqq32.exe
684	Pncgmkmj.exe
5080	Pdmpje32.exe
3500	Pfolbmje.exe
2828	Pqdqof32.exe
1116	Pgnilpah.exe
2924	Qmkadgpo.exe
4780	Qgqeappe.exe
428	Qnjnnj32.exe
4772	Qddfkd32.exe
3220	Qgcbgo32.exe
4568	Anmjcieo.exe
848	Aqkgpedc.exe
3432	Acjclpcf.exe
3108	Anogiicl.exe
4656	Aqncedbp.exe
808	Agglboim.exe
4164	Aeklkchg.exe
1940	Agjhgngj.exe
1136	Andqdh32.exe
1952	Afoeiklb.exe
1780	Accfbokl.exe
2840	Bmkjkd32.exe
4792	Bnkgeg32.exe
4448	Beeoaapl.exe
2860	Bmpcfdmg.exe
3596	Bnpppgdj.exe
3544	Bnbmefbg.exe
1532	Cfmajipb.exe
3100	Cdabcm32.exe
2852	Cfpnph32.exe
4948	Cnffqf32.exe
1580	Chokikeb.exe
3844	Cnicfe32.exe
2336	Cdfkolkf.exe
4132	Cfdhkhjj.exe
2140	Cmnpgb32.exe
2072	Chcddk32.exe
716	Cnnlaehj.exe
1328	Cmqmma32.exe
1224	Dfiafg32.exe
2064	Djdmffnn.exe
880	Dejacond.exe
4576	Ddmaok32.exe
760	Dobfld32.exe
2260	Delnin32.exe
812	Dhkjej32.exe
3192	Dkifae32.exe
912	Daconoae.exe
5028	Ddakjkqi.exe
4528	Dkkcge32.exe
5104	Daekdooc.exe
4208	Dhocqigp.exe
2252	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pncgmkmj.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Qciaajej.dll	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Hmcjlfqa.dll	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Aqncedbp.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Accfbokl.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Bhicommo.dll	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Qddfkd32.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Bnkgeg32.exe	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Beeoaapl.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Ojaelm32.exe	Oddmdf32.exe
File created	C:\Windows\SysWOW64\Pqdqof32.exe	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Pdmpje32.exe	Pncgmkmj.exe
File opened for modification	C:\Windows\SysWOW64\Aqncedbp.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Agglboim.exe	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Qnjnnj32.exe	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Mjpabk32.dll	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Aqkgpedc.exe	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Qhbepcmd.dll	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Beeoaapl.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cnnlaehj.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pqdqof32.exe
File opened for modification	C:\Windows\SysWOW64\Qgqeappe.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Andqdh32.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Ddmaok32.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Pgioqq32.exe	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Papbpdoi.dll	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Andqdh32.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qddfkd32.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Jocbigff.dll	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Qmkadgpo.exe	Pgnilpah.exe
File opened for modification	C:\Windows\SysWOW64\Anmjcieo.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Pkmlea32.dll	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Aeklkchg.exe	Agglboim.exe
File created	C:\Windows\SysWOW64\Bmkjkd32.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4048	2252	WerFault.exe	145

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdfjifjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oddmdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmkadgpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pncgmkmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqdqof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojaelm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnamnpl.dll"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingfla32.dll"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qciaajej.dll"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdjinlko.dll"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekgcil.dll"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igjnojdk.dll"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffggf32.dll"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfiafg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4956	4676	9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963N.exe	82
PID 4676 wrote to memory of 4956	4676	9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963N.exe	82
PID 4676 wrote to memory of 4956	4676	9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963N.exe	82
PID 4956 wrote to memory of 2412	4956	Ojoign32.exe	83
PID 4956 wrote to memory of 2412	4956	Ojoign32.exe	83
PID 4956 wrote to memory of 2412	4956	Ojoign32.exe	83
PID 2412 wrote to memory of 2664	2412	Oddmdf32.exe	84
PID 2412 wrote to memory of 2664	2412	Oddmdf32.exe	84
PID 2412 wrote to memory of 2664	2412	Oddmdf32.exe	84
PID 2664 wrote to memory of 3292	2664	Ojaelm32.exe	85
PID 2664 wrote to memory of 3292	2664	Ojaelm32.exe	85
PID 2664 wrote to memory of 3292	2664	Ojaelm32.exe	85
PID 3292 wrote to memory of 1664	3292	Pdfjifjo.exe	86
PID 3292 wrote to memory of 1664	3292	Pdfjifjo.exe	86
PID 3292 wrote to memory of 1664	3292	Pdfjifjo.exe	86
PID 1664 wrote to memory of 3484	1664	Pfhfan32.exe	87
PID 1664 wrote to memory of 3484	1664	Pfhfan32.exe	87
PID 1664 wrote to memory of 3484	1664	Pfhfan32.exe	87
PID 3484 wrote to memory of 3692	3484	Pqmjog32.exe	88
PID 3484 wrote to memory of 3692	3484	Pqmjog32.exe	88
PID 3484 wrote to memory of 3692	3484	Pqmjog32.exe	88
PID 3692 wrote to memory of 4756	3692	Pclgkb32.exe	89
PID 3692 wrote to memory of 4756	3692	Pclgkb32.exe	89
PID 3692 wrote to memory of 4756	3692	Pclgkb32.exe	89
PID 4756 wrote to memory of 2744	4756	Pjeoglgc.exe	90
PID 4756 wrote to memory of 2744	4756	Pjeoglgc.exe	90
PID 4756 wrote to memory of 2744	4756	Pjeoglgc.exe	90
PID 2744 wrote to memory of 4060	2744	Pqpgdfnp.exe	91
PID 2744 wrote to memory of 4060	2744	Pqpgdfnp.exe	91
PID 2744 wrote to memory of 4060	2744	Pqpgdfnp.exe	91
PID 4060 wrote to memory of 684	4060	Pgioqq32.exe	92
PID 4060 wrote to memory of 684	4060	Pgioqq32.exe	92
PID 4060 wrote to memory of 684	4060	Pgioqq32.exe	92
PID 684 wrote to memory of 5080	684	Pncgmkmj.exe	93
PID 684 wrote to memory of 5080	684	Pncgmkmj.exe	93
PID 684 wrote to memory of 5080	684	Pncgmkmj.exe	93
PID 5080 wrote to memory of 3500	5080	Pdmpje32.exe	94
PID 5080 wrote to memory of 3500	5080	Pdmpje32.exe	94
PID 5080 wrote to memory of 3500	5080	Pdmpje32.exe	94
PID 3500 wrote to memory of 2828	3500	Pfolbmje.exe	95
PID 3500 wrote to memory of 2828	3500	Pfolbmje.exe	95
PID 3500 wrote to memory of 2828	3500	Pfolbmje.exe	95
PID 2828 wrote to memory of 1116	2828	Pqdqof32.exe	96
PID 2828 wrote to memory of 1116	2828	Pqdqof32.exe	96
PID 2828 wrote to memory of 1116	2828	Pqdqof32.exe	96
PID 1116 wrote to memory of 2924	1116	Pgnilpah.exe	97
PID 1116 wrote to memory of 2924	1116	Pgnilpah.exe	97
PID 1116 wrote to memory of 2924	1116	Pgnilpah.exe	97
PID 2924 wrote to memory of 4780	2924	Qmkadgpo.exe	98
PID 2924 wrote to memory of 4780	2924	Qmkadgpo.exe	98
PID 2924 wrote to memory of 4780	2924	Qmkadgpo.exe	98
PID 4780 wrote to memory of 428	4780	Qgqeappe.exe	99
PID 4780 wrote to memory of 428	4780	Qgqeappe.exe	99
PID 4780 wrote to memory of 428	4780	Qgqeappe.exe	99
PID 428 wrote to memory of 4772	428	Qnjnnj32.exe	100
PID 428 wrote to memory of 4772	428	Qnjnnj32.exe	100
PID 428 wrote to memory of 4772	428	Qnjnnj32.exe	100
PID 4772 wrote to memory of 3220	4772	Qddfkd32.exe	101
PID 4772 wrote to memory of 3220	4772	Qddfkd32.exe	101
PID 4772 wrote to memory of 3220	4772	Qddfkd32.exe	101
PID 3220 wrote to memory of 4568	3220	Qgcbgo32.exe	102
PID 3220 wrote to memory of 4568	3220	Qgcbgo32.exe	102
PID 3220 wrote to memory of 4568	3220	Qgcbgo32.exe	102
PID 4568 wrote to memory of 848	4568	Anmjcieo.exe	103

C:\Users\Admin\AppData\Local\Temp\9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963N.exe
"C:\Users\Admin\AppData\Local\Temp\9cc458ccd296dacb2e7e0dcf2f26014d2bfc7532aac46894bfa0aca36eae4963N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\Ojoign32.exe
  C:\Windows\system32\Ojoign32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\Oddmdf32.exe
    C:\Windows\system32\Oddmdf32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\SysWOW64\Ojaelm32.exe
      C:\Windows\system32\Ojaelm32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2664
    - - C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3292
      - C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:848
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3432
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4656
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:808
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2840
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1532
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3844
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2336
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4132
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2072
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:716
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2064
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:880
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:912
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4528
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4208
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 220
        66⤵
        Program crash
        
        PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2252 -ip 2252
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Accfbokl.exe

Path C:\Windows\SysWOW64\Accfbokl.exe
Size 128KB
SHA256 2723651150079ebb6c9ea157031faaca866e71319f294549d33a84c10b0018d8
MD5 dc807c1c710e8503130207fba6329618
SHA1 5fbe327c944db3fc8c694c4eab2baf5f86f80bf8
SHA512 ee18036fe740015cebf7473c8e60bdc3cbc08d717a499c109522a9e1239267adfb6a6743a870c94173282d880c8f3184fea7bb2ee845dce39e3ab46ca8606132
SSDEEP 1536:0RKhFk1uj4CbrVlPrfNYs54ZFYzIhXGJZcWiqgF72S7f/QuMXi1oHk3CYyq:rha17C3VJX4ZFYz6XEmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acjclpcf.exe

Path C:\Windows\SysWOW64\Acjclpcf.exe
Size 128KB
SHA256 f1b65539b708a020abee66271d0aee29a8e50494d2cfb07e67814e37759ed3a9
MD5 38c3f001329cb6a8c515350c4ddab74c
SHA1 aab25ba0ec341828a34a7d31554aa2267782f38c
SHA512 c5b8b3af282cf76ebb3e20efc922595aa73f200e09928f9fe3099a4a1daba06696ffbd70fdacc2e4368e1ded33f16ac2a938b0431ae1c559106091d394467cea
SSDEEP 1536:KJxZ/2wO7N28IZ1uzDb0sbYfPlukMKtE/X6MyAhXDZcWiqgF72S7f/QuMXi1oHkb:enewSImDD4u0WBXDmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeklkchg.exe

Path C:\Windows\SysWOW64\Aeklkchg.exe
Size 128KB
SHA256 6ff7ecdc249fa8a6af4aa8fd8d438059dab474e79306dc8b51c11e79201d89b8
MD5 286717f5708faa38ea50208ac7103c64
SHA1 6ac44f9dc774ab7bb440cf7df8df5a5947e63c1d
SHA512 5fe1124c9b6361e60fda2d312c93ae03d452406ce3da6ac73be56641c604ca9dc1c761b41a9e54f5209d3ea0e1d2da376d93f032fb379da4ceb0b56f73b24eb8
SSDEEP 3072:g7bxbPTgUvUNZuCUxtTNXRvXHQaXpmW2wS7IrHrYj:g7bxLENZRUxtTNXRvX7ZmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeklkchg.exe

Path C:\Windows\SysWOW64\Aeklkchg.exe
Size 128KB
SHA256 fb8bb88765616d7a2c7734353fb4db55260997bd42bd531e3c70f4089f1e061b
MD5 0774fa2a6f2b9f631efc685cb9f2ba5b
SHA1 32490e51df5c57bb579ba8dcecdaf64e0638d769
SHA512 150bb2fc04cf3c05bc3c19af76b4945421b5ccd3df9e799ad67a32348a37d7f2581e1b60087d467df8e6284bb80169c3e41337a73645e95bd72e0f1423bb8b50
SSDEEP 1536:EgdKNiQkGoOeKamAl3dtw1/S0OFI5j4neaJeXhXpZcWiqgF72S7f/QuMXi1oHk3L:p2zkTWm3dt70O8aIXpmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afoeiklb.exe

Path C:\Windows\SysWOW64\Afoeiklb.exe
Size 128KB
SHA256 c2e771b40da2116656faba50094fadedb0da94e25acec5f63c9fc457f1390cb7
MD5 9475fcb796ef8913ddba582b7d22c016
SHA1 5abd83357a750209580fe48c8c6081b289bba343
SHA512 7046e2ec80707a046d84975d92b6c3c22056d716ac8fad172d0b27550acd45bcde72b5a938b558f2229fc187d4b7da63bf6ed79b967e49f1e0b3b471b13f0cd3
SSDEEP 3072:7/oX+TIHyyRgU6G+NsTYV28XNmW2wS7IrHrYj:u+TuyyRG9NbVfdmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agglboim.exe

Path C:\Windows\SysWOW64\Agglboim.exe
Size 128KB
SHA256 710244cdb34da4ef311748993fd497cc522a601b7aac25558030cf7cefd58feb
MD5 54ec77bac14aca05892cdac504f939c3
SHA1 0b27215d67dd6f2593046a4b8f1345512f93ac69
SHA512 8f1f6a804aed719ee0469f4f3f6b69454384293bcdea3559fa5443ea257f07bb12442d76de9e9e74c33dfe9c863e0b93b138bef921d18a888c7abbbe997e397c
SSDEEP 3072:g7bxbPTgUvUNZuCUxtTNXRvXHQRsXimW2wS7IrHrYj:g7bxLENZRUxtTNXRvXHSmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agjhgngj.exe

Path C:\Windows\SysWOW64\Agjhgngj.exe
Size 128KB
SHA256 d5bf29586fa441b22d22d348c9258db3a219ec92f4322d09bca98faa0d1a7428
MD5 3fed0e7c4480c23a0812e005bbb0f3cb
SHA1 696f562ce5ec278d711329783b440514be171358
SHA512 36a5d90578f3074e97578a5ed9bd51180d5a18964514d4a618f8a1df715cc8cbef8f8c0688ed464622bd9a82a12ce595ffae8a3fbf44feb78a1d3986c02b8971
SSDEEP 3072:9XJhNGOAjM3z36JbJYmX3mW2wS7IrHrYj:9XJhcOKM3D6vbnmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Andqdh32.exe

Path C:\Windows\SysWOW64\Andqdh32.exe
Size 128KB
SHA256 510aea7912ae4f4ab686704fd2de8b5d6a1a6a2332a58259234c9dd2cb45e163
MD5 9187c9703beb6b6f1c73e12a7f8c3e94
SHA1 9cd1290a884579e6b55b579721cf5259bf958275
SHA512 a8f4cb99955fe8cbc33e0c1b3bcefa18adbf0ee2b7a50ecc8ee5e82466c05748e14e712152f38d8a2a87399c15a6765d67c7bb71522a21b0d4f82deb8d71c31a
SSDEEP 3072:urv9wZLfU+f9uB5K7fqRvA5J4XDXmW2wS7IrHrYj:gOZY+fcB5K7yRo52DmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anmjcieo.exe

Path C:\Windows\SysWOW64\Anmjcieo.exe
Size 128KB
SHA256 6110a046d5b9864d6427eb5df8a2ea299f6e1c46ac5a9932ab0b4cf280674ab7
MD5 91fdd053f5627d79ba7458372c91ec3f
SHA1 40e2ef72909385bbac9219796b4468342e3619b5
SHA512 977332a37a42bb8ee16efe38553abb76b9140d159a4dd1d2374e9f3ccf0ba25605d1ba221e63a8839b4b81a9e2081dcf5b01c25dd7ab9332e97c2eb19cd6e23e
SSDEEP 1536:Q7fdoCMJ1jh3kfvcfgFH+h0OVsohXdZcWiqgF72S7f/QuMXi1oHk3CYyq:Q7fijbgFH+1LXdmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anogiicl.exe

Path C:\Windows\SysWOW64\Anogiicl.exe
Size 128KB
SHA256 9cf3e62bcaf8c650c6bae9f8b19939b3a0a92d5b772d694503a93488ebe9f06b
MD5 c244504b875881ea85231919e701a13d
SHA1 8b5df6d527888883c687659512f553721b44fd17
SHA512 c99374ae5e68294484d0d3bdffbe8506c99baff0ae3717394f4cfba1d02f1a36116943f040dc9874730df23b1d6fbb6fdce075b7de30fcae84a6422e95daeaa1
SSDEEP 3072:X7TwbPPlj0kAXHFRyB/ny4nlQy+XkmW2wS7IrHrYj:LTMj1AXPyYEliUmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aqkgpedc.exe

Path C:\Windows\SysWOW64\Aqkgpedc.exe
Size 128KB
SHA256 25a5d049ef70e61b55781cca416fc4c0c5db6dd9a49d35b915a308debe445c09
MD5 447c324466ce75f18d13fdfef074a334
SHA1 85a4ef49cb5f06af28e639befbf4c71c3ef80f24
SHA512 c8f0ab82d8ba00bda7dce89db8c6e94ad4f40fc1cad647a5359b3ab67073cc88d3c08aa4059121251806cc9db6b74abd3f1956fea95fdd2108be5b426d6ab980
SSDEEP 1536:uQUTGbnF1qHbwn9C128fmKFJKKykpdODsPnnlahXGnkZcWiqgF72S7f/QuMXi1oG:yGyHbwnQ1lfmqJRnlAXBmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aqncedbp.exe

Path C:\Windows\SysWOW64\Aqncedbp.exe
Size 128KB
SHA256 9567f69393442dcf1092a729a118548e6e07a52689741d08387dd677bc7c4833
MD5 3d27b06d90df0191fb58ffeece779105
SHA1 7da0197be38bd02f4420df11bfb2a273229a445f
SHA512 876b916b5ea4b63cf7b72e35f2d4656d888ff2fb14f373f22fa2fbc53f7399db8eac5725774c1daef732321b40f61fde3a62411cdf90ef7bea8406e302d4725b
SSDEEP 3072:5fuY35dcAfuV2xCW09aWOo8LHXvmW2wS7IrHrYj:5HfuyrhfmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmkjkd32.exe

Path C:\Windows\SysWOW64\Bmkjkd32.exe
Size 128KB
SHA256 3a5c3ca1762ee049077862fd3f2f4ccadacb4d881fd49cb0ac16992dedbc1e5a
MD5 aaf94490f5055f024be2007855e8c27a
SHA1 e34bdafb87a981141d0cda384fd44b28e10e1cd3
SHA512 5ca2eb3363b9af48214ef2aa2da6aaecb5c64354814bd16c67c1098b17fa0d382994d08cca2db0bc64b8880f5f5dfdd653bc89f8bddc6c0af1131f55b015f59d
SSDEEP 3072:/C3eePSM49sxcSsirrEFqEtKXDmW2wS7IrHrYj:/C3DSz9sS6zmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmpcfdmg.exe

Path C:\Windows\SysWOW64\Bmpcfdmg.exe
Size 128KB
SHA256 3df3653f40b757158da56c74bbabaac35e55f5105b1322d35ad313b21c0bf728
MD5 d764338cb75f19b029c1b3480f12fb65
SHA1 1d3d0be857584134a27ccdf1f301bbf02f2cc39e
SHA512 419d9d09b8a15c7b458cfd48327cb557cb60869749ea77f5d2fa01b44ab0d0e16b46c343eb1f844581955373e207dcb64ba23ee741206a3fe129fa8d587773a7
SSDEEP 3072:1YWuAjocMInj5828EmCrWgXbmW2wS7IrHrYj:1YWuAjMIMpkWgrmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdfkolkf.exe

Path C:\Windows\SysWOW64\Cdfkolkf.exe
Size 128KB
SHA256 3f4128ffae51ebd4396808b07b5b9cfe54784fb81b856a6f8a5efd1b78c16fa4
MD5 512852ed6f52e190c9c8d4c54a67b5e1
SHA1 c28784b1926fe843f4b554b1616d3d20d18b4557
SHA512 ef84656076f8c85e8c036d818e3150ce77b09fc0ec60ace92427d26d0c44fd727be5ea158e5266a7c526b345b23aee226cdcb83407ac188f1d16c1e65b409d21
SSDEEP 3072:zIGcWKG+AlOYFSJLYFOTwM4xPCQSXAXumW2wS7IrHrYj:5Z6AgJLxv47p+mHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cfmajipb.exe

Path C:\Windows\SysWOW64\Cfmajipb.exe
Size 128KB
SHA256 922061f2a5fc714537e70e90be7a8d8cdb2a2a9a2e00d966fd2ca95e7abdd6c8
MD5 be24c95e119741abc4ca8180d414aea6
SHA1 0a655a5c0eeabb3f3db2716ece9fdc34101c6e69
SHA512 96e3e33110b512e5d3a4a39ab098327231e3da36675a29b03337204d21b2210c4098e2327d71f1bd3991e68b99a42e55b5d60fb8a6b0dc1a0c679c96f1f40dd7
SSDEEP 3072:OxB3GWAG+n6n/Gy2Iabc2XEmW2wS7IrHrYj:OHx0iuIm0mHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chcddk32.exe

Path C:\Windows\SysWOW64\Chcddk32.exe
Size 128KB
SHA256 ac1083ca19a959f7525b6c2582782b2261145c7d65b886e03054cff58fedd767
MD5 4776ebb56867d376ebb3907f81bf8fae
SHA1 bb2b1b3faa8d7a63f6301b4ba84c4ed759c10e18
SHA512 e163e109c1b9a1a32ea807a2c0cf088b5acb5beec1cf607bfaaba7956cd34d51bfb227e2415655a8337e80e5738507d441eb2d4c82d0fa60e353296fc008a0c2
SSDEEP 3072:43N05n8BvzbPdKfXcTY2yX4mW2wS7IrHrYj:43mV8JzbYfstyomHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnffqf32.exe

Path C:\Windows\SysWOW64\Cnffqf32.exe
Size 128KB
SHA256 1d9560f2e3b3a3052a7793d3c253299612fb15a32e01b0ff9409ae0ee64ee30f
MD5 e18309c23951257961ee53afdea65d4d
SHA1 2a33a04cc33ab02ec8add07ee29140cf3fe7f430
SHA512 e28b5fd709c822501139b1d470cd4184f758b433ecb8210591b2f0752d281c7deb9a934ccebc6893347271b64ff3c7d300d6b0c70abb07db86170eb1553a09c8
SSDEEP 3072:3OSD+FyYbgvFlw0eAj5DaS9XDmW2wS7IrHrYj:l+Q/3j5+S9zmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daekdooc.exe

Path C:\Windows\SysWOW64\Daekdooc.exe
Size 128KB
SHA256 59f71f8d6ef26fe87bdd46423e1b5bbfe600624009c578acd684d2e746c27c2f
MD5 f9791a3c6de5a97de3fa0133b091d3ff
SHA1 2842a69f487f4d7a35d2e338fa3b4246db9debbc
SHA512 0b8cd60c87d11371a396f7ab588f0cb7ace768ebfefaeebeb81f9cd106f12b6e90c4a544672a0f0c0c2827045445048bfd03c2ad9b4789a7bec15c6ca03a519f
SSDEEP 3072:VSNBOWWwqYx5I9UI1OT7XlmW2wS7IrHrYj:V/FBw5FI1O3VmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Delnin32.exe

Path C:\Windows\SysWOW64\Delnin32.exe
Size 128KB
SHA256 d5077c93530553d7df50dcc75a26ea9f8412380ec334be67d5993628de60b8cc
MD5 4c778965c77ae136b48dd01c3608da8a
SHA1 a1498fec10db2ea08bad19375d9d5cf5b692fbe4
SHA512 f1a5817405a921dca07c3dba0d30e8cb3d9c8c70bead376ab1c2a94ffdf01beacc19cd721338f1b7267d9305dc6eda24b8611e42b6be5da31dd9d29e84ad3c35
SSDEEP 1536:a3ugvYMD+aJ0g54YPh6BYPhWWtx21MCa0hXUZcWiqgF72S7f/QuMXi1oHk3CYyq:a/f+4gYP4BIhPrb9OXUmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Igjnojdk.dll

Path C:\Windows\SysWOW64\Igjnojdk.dll
Size 7KB
SHA256 d791faa3a4f29d5fed10cdaae9041c8d070eb6ef23605b02d67b13488b1d6724
MD5 d61bf38fb0f71872aa6f79fa117bb6f9
SHA1 218a425f80f4563a090daa3661cf3c515b9f5cb9
SHA512 e8f4c0015517673088aefc8d3e54a1221a8521bcc2a82e1648bb561db020982c82d9441af2d516dc9be1968feb0288d526ee8be0dc6037769b982a3849bed2bc
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWCbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPQq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oddmdf32.exe

Path C:\Windows\SysWOW64\Oddmdf32.exe
Size 128KB
SHA256 4394bfe0a3873df3087085b59c1c5dbda30629db582bd7ecbab208ac87af14ee
MD5 b5bb281df15151e708196b4d1acfbd18
SHA1 be9284bf45f44c3e2ce169e8c283771b1b95b4bc
SHA512 34fa7359f57729b853f42b46e1f227fe4d4faa0a22eb0533c2d8a4d25d4cd78e699541046fbae7bbc13452b4f51cbda137c12612703e3a35021cc005ba8dabc2
SSDEEP 3072:8ttH31SPvGxPwRwl+zxtFOxXFmW2wS7IrHrYj:OtH31SneYMVmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojaelm32.exe

Path C:\Windows\SysWOW64\Ojaelm32.exe
Size 128KB
SHA256 24845bdc4b9253e188a5470ac16cf55bf570a5ab6e336bfd1e45078e8fcdd520
MD5 91398ebf0a6fe922d52c4071274ff778
SHA1 e530e7d28e77998a26e2c05e7066bce35f5bf79e
SHA512 5d530fd3b9433f0fdd2e4ebd47f326a12674e18dfecb093b60e6bb83da644af6fdb16d4836cd8fd72c9e0f351f56e851ab7212d31c7ffeef15747ce338f75910
SSDEEP 3072:sQTSWZCG7bN5mR4ds+QzYNYOXYmW2wS7IrHrYj:fjlbNoR4y+QMNYOImHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojoign32.exe

Path C:\Windows\SysWOW64\Ojoign32.exe
Size 128KB
SHA256 18db803b2d786e9f3e3d9a2360e23b7a86b61fdb4e6caf9be5b1189f124ed624
MD5 f304f74385dd78f2ef71bf437f2dc6fc
SHA1 21a579e521bfab1e2592ea8deb32458ffa1b783e
SHA512 380a69bea238a86cd676a245d3e0b3848fd226b86a275fb380464defc97997567a59b7dc08e6b2fd169dbb04da7aff91fa64b98675a9b1114145febbee8b156d
SSDEEP 1536:kEyNwQixjjkOczmRIXei75xUyMhXGkZcWiqgF72S7f/QuMXi1oHk3CYyq:kDifEGXFmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pclgkb32.exe

Path C:\Windows\SysWOW64\Pclgkb32.exe
Size 128KB
SHA256 791316bc19a8fc6d8229636755845753e3aee5d23aaf738f514fe966270191c2
MD5 0d1b0391aba249e3e9267e6ad175d1a8
SHA1 c0dd9aa2df75796f90f91b68000e4d40d34dca76
SHA512 843377f4d93dca9e2af0c8278f7ffde41a5a53639786c94f003d140a987e2dca0bb9b049834f3f97c3d69062341bd3e5eed530ae2b991ceb6187da01f6ec8f3b
SSDEEP 3072:C65fiJ3pe8ZDLqPC4higwjNigyoXHmW2wS7IrHrYj:95fc8mnqPC4h3wj7Z3mHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdfjifjo.exe

Path C:\Windows\SysWOW64\Pdfjifjo.exe
Size 128KB
SHA256 092336f881c0ff888bc6b832b0ebda83e7e3ac8e25b7e3df6b0a39e47be8979e
MD5 8f26eca5d719fcc7d5d822f086d9cd57
SHA1 74232a509318eccf8a90af68e678bd498611b44e
SHA512 f1c953615786be441fea3357bcd2447662107043a05c498cf0bdd9d86a0da057065f7673bc92beb154a9389dbaf56ebdd404a31d8091904a3ef8e37d72b29fd1
SSDEEP 1536:eC4ozYY9LV9pglODlxLs0bZddJ6z1etRrhX5kZcWiqgF72S7f/QuMXi1oHk3CYyq:F4o9pglOrLpb/dYYTtXKmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdmpje32.exe

Path C:\Windows\SysWOW64\Pdmpje32.exe
Size 128KB
SHA256 61d5f968143b78e209e2c3c0eb214c9388f37b8ba9b05d9c8bba7800a142ca7d
MD5 8a95d7e8fb3e0ab7cee66e1c99f51aa8
SHA1 645ab01c411e1e0df0342494fc9d9f008ebfd386
SHA512 981200febbd11e8bdda797ee223bb4c7e7fb1ab2aa580a8d31bbc8ac993d532a428ff8633f2a3b31b5786cae3c8da65a248659eda8b7686897b5f2064ec900b7
SSDEEP 3072:sb9DzNGSQkmwAI8JPSrXxmW2wS7IrHrYj:sZDJGSUJ6rhmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfhfan32.exe

Path C:\Windows\SysWOW64\Pfhfan32.exe
Size 128KB
SHA256 c3306c7630199884b48c03429094d3e41d5ec2caabf663895a69e17c74f46a56
MD5 e92a8e6143fe52cad0d33a33c6a656dd
SHA1 4fccfc858caf091fdd49ae8acb2581f472d5ef59
SHA512 825852d68d90ba64942bf7691868630bd8116773af1066b2e040ccdf9f60c15df8046d3787d2c249cfe4b5136363cc0305244989978f7d72220a99d41ac9ee5f
SSDEEP 1536:eC4ozYY9LV9pglODlxLs0bZddJ6z1etNbhXCZcWiqgF72S7f/QuMXi1oHk3CYyq:F4o9pglOrLpb/dYYdXCmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfhfan32.exe

Path C:\Windows\SysWOW64\Pfhfan32.exe
Size 128KB
SHA256 046ee324af38381f10cec190c7a790d6e3481248a962d5e787b590905a6c6f80
MD5 a857cf1a3d791f3eedf5bb8287c679a9
SHA1 760377d832f3069b851180b5980073c605a7d16b
SHA512 6f266a9f5de6de589cf413df7760ab4570de561fa24ff4aae9272894d51d5d19c6f722fe6b3d4090ad19416e19cea35e86649d893a486dca5fadfc49aa4e45da
SSDEEP 1536:Zc68oSOViUhaKLhBWQ2OU3xW3yv5rHOm4biyAdfZ5YddGbhXCZcWiqgF72S7f/QI:ZcXoSfENGNHRdfZmWXCmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfolbmje.exe

Path C:\Windows\SysWOW64\Pfolbmje.exe
Size 128KB
SHA256 3b20b543976804706895816292a279560f71b46e946c8cdcf3bb44505a02165d
MD5 917ed92cf6950cc93cf97c2a1ee0c565
SHA1 bc756298b692fcf58a4eae90cedcfb59f81f6a54
SHA512 ba103518c3f282db67a93d97dbe8140fa44a1a29d61c3a3a04348ffd6225c3290738a914cc818d093149004a3537f14db9d0888b970aa053d38e98649bf1c877
SSDEEP 1536:N6eH+qC1BYeepB/5z+QirXYLbNFun6xYbbAXml4xTQjOxhXMpZcWiqgF72S7f/QI:VoBUPHun6xYAsyXUmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgioqq32.exe

Path C:\Windows\SysWOW64\Pgioqq32.exe
Size 128KB
SHA256 a168efb916a822d4aed4a8cc5bd190a8dc83674bf1ac43f43c2aea565b27d8cb
MD5 b785ed5d342d2dad93c591cfacd875dc
SHA1 cfde5bd71b476195783f9095cf4d5965bbdef6f9
SHA512 601c4ac9377c3985d11c8b68bc60b340cb867559b53b809886e2530c1797b0c54c0fc56be108b8f610dd815f0c850a3ba7e93e1c9e1f9dca44a4b095533c2075
SSDEEP 3072:Z/Febwz8/iKNxqmMCDBG2XYXMmW2wS7IrHrYj:VdIR71IcmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgnilpah.exe

Path C:\Windows\SysWOW64\Pgnilpah.exe
Size 128KB
SHA256 5e2e1e84e762d6034d710deb402f6b8463be06314103d31b586060d77a6e9d7d
MD5 1691d2b904a2cce10193e9ebd486a6ce
SHA1 8c07d1ad43ad314e9cf8280216c53b6dce5ea159
SHA512 25a00bec9d913809a1f52d21e1434c0e38a645b497a505ae98e659ce46df1eb4734655d667ac03fadf22044b9415cd2aeab4a17908443768f8fd9d8be1e03088
SSDEEP 3072:KpHD9YFxAwoVUV2JLj0d+zLXgHmW2wS7IrHrYj:KpjMdu5JLjkiLCmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjeoglgc.exe

Path C:\Windows\SysWOW64\Pjeoglgc.exe
Size 128KB
SHA256 f03150ecf8bed1b21f15dcd682347c2f671430453d1c937acb1ba67a864db488
MD5 fc1d5b7c442b2fe76d2b35459ddf7834
SHA1 a16106ac67f3ed1131fb81dd010486be2d21714f
SHA512 a0587f8fc74034ae635b4b62464e36892dbf59117cc64171e9610410220f8249521399f07598fe0fd70f6483e9f223ea183d0c054afb5b1b178d5d03b128a090
SSDEEP 3072:kboTTWUCy6c8D+PlyTMyl11lKfa/AzfnXLmW2wS7IrHrYj:SeTWUD6cPPleMyl11lKfa/Azfn7mHwMN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pncgmkmj.exe

Path C:\Windows\SysWOW64\Pncgmkmj.exe
Size 128KB
SHA256 c0b5e6825f67324dff01c6dcf7152aaadcff12b2adc15b4a0a40f602b656a9ab
MD5 7494dd4af96b1248fd9cd8009beb6fc2
SHA1 d0d98efeabcfd14379a4f66ef73432edb082670e
SHA512 4f31f523616aaad609d4b63b3afbd78e5dd8a9a10f49f0c5439c81776064adbc507461f78b5e9daa2857d8300bbf067790a6822be545be48f603cf12c5cac52a
SSDEEP 3072:QiAj8eNIxx6Am1vyUsSXXmW2wS7IrHrYj:yjb2xc1vRnmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pqdqof32.exe

Path C:\Windows\SysWOW64\Pqdqof32.exe
Size 128KB
SHA256 711f38ea6ca984fac61de54574de2dbe4b6f2935592f4063b2dfbf64e30e6cd5
MD5 d0a7215781b2fda2c243e1eff06e63aa
SHA1 e794cfd42a5ddafc8ffefa7c73320e2ee0380e13
SHA512 7b890876ab124987eeb3ed395e98e58cde398866eacb6bfeb1394161123e9ff762a962e705afc5d0fb482acc8d1825d82ff1b1ea9489cf6fb22d91a20a6fc3b5
SSDEEP 3072:esydRZheiV/xaqoX6cOp5XIgRXCmW2wS7IrHrYj:7yd78idoXyISymHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pqmjog32.exe

Path C:\Windows\SysWOW64\Pqmjog32.exe
Size 128KB
SHA256 e1370c887ecdebcf55513fe7fd94589ca60c0476343d9349ecdb279c29563a9b
MD5 3544292c2f19a3d522bd8bd8421ff33e
SHA1 54649eacb91ba7cdbc4d115644b6e70913b059c6
SHA512 f6ecbcc385e8b434768a67df7eab7c2d0ee5bca10b57338add24662cb79d2a804ab588f215d5b31f87d803aaf8ed431fa6af12eb4b0747a15a39877c542dac4b
SSDEEP 1536:cNE73T/fPZxPz0xOioj/FtdiDytqjzCG9jFhXwZcWiqgF72S7f/QuMXi1oHk3CYj:17rBt0optyN/XjTXwmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pqpgdfnp.exe

Path C:\Windows\SysWOW64\Pqpgdfnp.exe
Size 128KB
SHA256 91901e9bf9aeb7e8a3cfb69133b7bfb7c8541a249847d1c6ad39b9507139a0cb
MD5 afe3fd60dd5ea12d53256f39564a50e6
SHA1 2790ff3c7602e3d8c2391f19853aed7b73f38af3
SHA512 2cecd186a3245f514fef439d7129a0627cc1a01b988cf8c5647e5603e4217fcd1b7f88aeaad71e1821e08378b0473505a26b5e88385e7d0b3940c05365032b4c
SSDEEP 1536:YN2hn7Rehb32htBn6DXPtTGiG3X5mhXiZcWiqgF72S7f/QuMXi1oHk3CYyq:YG7whbnDFTzwp0XimW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qddfkd32.exe

Path C:\Windows\SysWOW64\Qddfkd32.exe
Size 128KB
SHA256 08fe3edd81d9b15367e620737560f6e5625f483f9562778df2697ad85af128e2
MD5 1daf13073866d3c9718010999d76e1af
SHA1 b9981881e38b4ea704a15aaf51eb8e9152832fcf
SHA512 9cae6d546cdc55000765872095b50755a203ed7a14f8f4364b6a80793f368bd84768b4c85a7c2ec7717b55d503fbabd95b394a4cca2cf50536ae1f339e85600b
SSDEEP 1536:0oDn4A6m3Bf2RueTTk0/Tzt4y3m4is0TTQ0EhXzZcWiqgF72S7f/QuMXi1oHk3C6:xD/6m3muC5/S4z0I0eXzmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qgcbgo32.exe

Path C:\Windows\SysWOW64\Qgcbgo32.exe
Size 128KB
SHA256 02d4fc96165a531d5140b2feb6fd8241f920f1db6fb2bbdc04cf29fcfe171f5a
MD5 ee83a2cc68c093ff445d8de4df8e621c
SHA1 f356c32d7675601ec9f3163ec32a411cbac899ee
SHA512 28f47ab6e04d22759eb8935c5d9c3008f58d1ef9723edc06a029c20f161308b265004f974476df40f3334e74ae179d2cc376903c2414892d28d21252df397547
SSDEEP 1536:Lwtcz56ajLDyQTRykhWnprTERUlvSqRk9dWThXHZcWiqgF72S7f/QuMXi1oHk3C6:LEa1XW4RPqi9dW1XHmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qgqeappe.exe

Path C:\Windows\SysWOW64\Qgqeappe.exe
Size 128KB
SHA256 3f83ab4f5164da058f0626d1c5bef5071e15842876161b428920e897c2299e89
MD5 30745a578bc224021283c9a0f9731adf
SHA1 92c0a20922b62137b047907a9b0f2ea65582d09a
SHA512 346f0bb1c8ea2f15fa02d72ff9d8ff118a7362e145601becb39a254c56a6823c7420b9dfe4b4db9b734d8750a26ea5ceca78d748c0062c495075dc72a576c79b
SSDEEP 3072:RSpO/uJnNXPaOoAGTsgrXAmW2wS7IrHrYj:j4hgzTsgrwmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qmkadgpo.exe

Path C:\Windows\SysWOW64\Qmkadgpo.exe
Size 128KB
SHA256 f29760b0eb167a00e97f076e1ee9f74973c136a82adcfb152f7561c2c5799755
MD5 31a03ef6f3ef71bfbb61fbf9880b1e6d
SHA1 db13f71ec7cb50ce4caa9988eac971d2cd0a3572
SHA512 dcaaaea636f40b929c723e3c2be153dd3f30478affbbcb4cdf902090e3ad5ca399a10a66849f86cdbe76234c05525fc1d1f942f4a41e08238c2ad6dd333037f3
SSDEEP 3072:WrY/iH3rOKHY4VfzZ6SPJyXXmW2wS7IrHrYj:QHbL44NZ6SUnmHwMOHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qnjnnj32.exe

Path C:\Windows\SysWOW64\Qnjnnj32.exe
Size 128KB
SHA256 95e5037bac5ddb10bceded6b7366380a9952e453840046e296bb42ff572f9b33
MD5 1a76ed21fbc87e9dfd95d013a955a21e
SHA1 94f1718ccdbe14f291ac7bd0bf99c30692a50339
SHA512 ec993e1d1d4091fb6893961a12774a8cd32374dfca694f82ef144fb1c8d159ce382a70ead573f44d607013fea570107753629754d1285c8fd77e37763c6d3894
SSDEEP 1536:/SC2LoafByczufRkEOqMisuwAu3va/xOo//hX6sZcWiqgF72S7f/QuMXi1oHk3C6:/SfLBZycgOOu3i/xj5XXmW2wS7IrHrYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/428-143-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/684-88-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/716-352-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/716-460-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/760-388-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/760-454-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/808-207-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/812-400-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/812-452-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/848-181-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/880-456-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/880-379-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/912-450-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/912-413-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1116-119-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1136-231-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1224-458-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1224-364-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1328-358-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1328-459-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1532-292-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1532-470-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1580-466-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1580-316-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1664-39-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1780-248-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1940-223-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1952-239-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2064-457-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2064-370-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2072-346-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2072-461-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2140-340-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2140-462-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2252-443-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2252-445-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2260-453-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2260-394-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2336-328-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2336-464-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2412-15-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2664-23-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2744-72-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2828-111-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2840-255-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2852-304-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2852-468-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2860-473-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2860-274-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2924-128-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3100-469-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3100-298-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3108-192-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3192-406-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3192-451-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3220-160-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3292-31-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3432-184-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3484-47-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3500-103-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3544-471-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3544-286-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3596-472-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3596-280-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3692-55-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3844-465-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3844-322-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4060-79-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4132-334-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4132-463-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4164-216-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4208-446-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4208-436-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4448-268-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4448-474-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4528-447-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4528-424-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4568-167-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4576-455-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4576-382-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4656-200-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4676-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4756-63-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4772-151-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4780-135-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4792-262-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4928-437-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4928-444-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4948-310-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4948-467-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4956-7-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5028-422-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5028-449-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5080-95-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5104-430-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5104-448-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads