berbew | 600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78N.exe
Size 60KB
Sample241109-vjjkjayckb
SHA256 600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78
MD5 3e7996e9ec725cfca9037b3f67ae5320
SHA1 aa73f6bd30a5441217159819edf30c1df83ec54a
SHA512 b396c58689599c97790a9fe4b36fe17b5c107c5e6f66b98b67f4ffa6d382f83a1ee4c21fb260280109b3328461c958824ab2857295b7d1119612756aca381fee
SSDEEP 1536:Deugj87OiLS08N5iGgQMMclfvKB86l1rs:iugvyS0qrMXFvKB86l1rs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3688	Pggbkagp.exe
1296	Pjeoglgc.exe
1200	Pmdkch32.exe
2524	Pdkcde32.exe
736	Pgioqq32.exe
2424	Pjhlml32.exe
4160	Pmfhig32.exe
1964	Pdmpje32.exe
3508	Pgllfp32.exe
4924	Pjjhbl32.exe
4920	Pqdqof32.exe
2636	Pgnilpah.exe
2880	Qmkadgpo.exe
3620	Qceiaa32.exe
2388	Qgqeappe.exe
628	Qmmnjfnl.exe
3060	Qddfkd32.exe
436	Qffbbldm.exe
2984	Ampkof32.exe
2248	Aqkgpedc.exe
2684	Acjclpcf.exe
3888	Ageolo32.exe
4752	Ajckij32.exe
508	Ambgef32.exe
3504	Aeiofcji.exe
1592	Agglboim.exe
5100	Anadoi32.exe
1708	Aeklkchg.exe
4536	Agjhgngj.exe
820	Ajhddjfn.exe
4056	Andqdh32.exe
2460	Amgapeea.exe
2260	Acqimo32.exe
2952	Aglemn32.exe
372	Anfmjhmd.exe
1596	Aadifclh.exe
4540	Aepefb32.exe
3868	Bfabnjjp.exe
5056	Bmkjkd32.exe
3172	Bagflcje.exe
1780	Bcebhoii.exe
4704	Bganhm32.exe
3848	Bjokdipf.exe
3408	Bmngqdpj.exe
2824	Baicac32.exe
1420	Bchomn32.exe
1824	Bffkij32.exe
2084	Bnmcjg32.exe
3780	Beglgani.exe
400	Bgehcmmm.exe
4416	Bfhhoi32.exe
1660	Bjddphlq.exe
1288	Bmbplc32.exe
3612	Beihma32.exe
4360	Bhhdil32.exe
3120	Bfkedibe.exe
216	Bmemac32.exe
1056	Belebq32.exe
4944	Bcoenmao.exe
4972	Cfmajipb.exe
2844	Cmgjgcgo.exe
3280	Cenahpha.exe
2680	Chmndlge.exe
1348	Cfpnph32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Ghngib32.dll	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Ambgef32.exe
File opened for modification	C:\Windows\SysWOW64\Bffkij32.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Gblnkg32.dll	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Bjddphlq.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Pdkcde32.exe	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Ciopbjik.dll	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Pgnilpah.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Qffbbldm.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Andqdh32.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Dbnamnpl.dll	Pggbkagp.exe
File opened for modification	C:\Windows\SysWOW64\Agglboim.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Gmdlbjng.dll	Andqdh32.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Pmfhig32.exe	Pjhlml32.exe
File created	C:\Windows\SysWOW64\Odaoecld.dll	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Qmmnjfnl.exe	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Aadifclh.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Abkobg32.dll	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Pggbkagp.exe	600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78N.exe
File created	C:\Windows\SysWOW64\Ehfnmfki.dll	Ampkof32.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cenahpha.exe
File created	C:\Windows\SysWOW64\Pjeoglgc.exe	Pggbkagp.exe
File opened for modification	C:\Windows\SysWOW64\Aqkgpedc.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Echegpbb.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Ageolo32.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Qgqeappe.exe	Qceiaa32.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Baicac32.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Cdcoim32.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Aepefb32.exe	Aadifclh.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Pgioqq32.exe	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Nlaqpipg.dll	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Beglgani.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Ajckij32.exe
File created	C:\Windows\SysWOW64\Aeklkchg.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Ooojbbid.dll	Anfmjhmd.exe
File opened for modification	C:\Windows\SysWOW64\Bcebhoii.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5580	5484	WerFault.exe	183

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmkadgpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qceiaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqdqof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pggbkagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkcde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgllfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfgfh32.dll"	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnamnpl.dll"	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcmjaol.dll"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ochpdn32.dll"	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjgghdi.dll"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qopkop32.dll"	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfnmfki.dll"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 3688	3468	600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78N.exe	83
PID 3468 wrote to memory of 3688	3468	600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78N.exe	83
PID 3468 wrote to memory of 3688	3468	600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78N.exe	83
PID 3688 wrote to memory of 1296	3688	Pggbkagp.exe	84
PID 3688 wrote to memory of 1296	3688	Pggbkagp.exe	84
PID 3688 wrote to memory of 1296	3688	Pggbkagp.exe	84
PID 1296 wrote to memory of 1200	1296	Pjeoglgc.exe	86
PID 1296 wrote to memory of 1200	1296	Pjeoglgc.exe	86
PID 1296 wrote to memory of 1200	1296	Pjeoglgc.exe	86
PID 1200 wrote to memory of 2524	1200	Pmdkch32.exe	87
PID 1200 wrote to memory of 2524	1200	Pmdkch32.exe	87
PID 1200 wrote to memory of 2524	1200	Pmdkch32.exe	87
PID 2524 wrote to memory of 736	2524	Pdkcde32.exe	88
PID 2524 wrote to memory of 736	2524	Pdkcde32.exe	88
PID 2524 wrote to memory of 736	2524	Pdkcde32.exe	88
PID 736 wrote to memory of 2424	736	Pgioqq32.exe	89
PID 736 wrote to memory of 2424	736	Pgioqq32.exe	89
PID 736 wrote to memory of 2424	736	Pgioqq32.exe	89
PID 2424 wrote to memory of 4160	2424	Pjhlml32.exe	90
PID 2424 wrote to memory of 4160	2424	Pjhlml32.exe	90
PID 2424 wrote to memory of 4160	2424	Pjhlml32.exe	90
PID 4160 wrote to memory of 1964	4160	Pmfhig32.exe	91
PID 4160 wrote to memory of 1964	4160	Pmfhig32.exe	91
PID 4160 wrote to memory of 1964	4160	Pmfhig32.exe	91
PID 1964 wrote to memory of 3508	1964	Pdmpje32.exe	92
PID 1964 wrote to memory of 3508	1964	Pdmpje32.exe	92
PID 1964 wrote to memory of 3508	1964	Pdmpje32.exe	92
PID 3508 wrote to memory of 4924	3508	Pgllfp32.exe	93
PID 3508 wrote to memory of 4924	3508	Pgllfp32.exe	93
PID 3508 wrote to memory of 4924	3508	Pgllfp32.exe	93
PID 4924 wrote to memory of 4920	4924	Pjjhbl32.exe	94
PID 4924 wrote to memory of 4920	4924	Pjjhbl32.exe	94
PID 4924 wrote to memory of 4920	4924	Pjjhbl32.exe	94
PID 4920 wrote to memory of 2636	4920	Pqdqof32.exe	96
PID 4920 wrote to memory of 2636	4920	Pqdqof32.exe	96
PID 4920 wrote to memory of 2636	4920	Pqdqof32.exe	96
PID 2636 wrote to memory of 2880	2636	Pgnilpah.exe	97
PID 2636 wrote to memory of 2880	2636	Pgnilpah.exe	97
PID 2636 wrote to memory of 2880	2636	Pgnilpah.exe	97
PID 2880 wrote to memory of 3620	2880	Qmkadgpo.exe	98
PID 2880 wrote to memory of 3620	2880	Qmkadgpo.exe	98
PID 2880 wrote to memory of 3620	2880	Qmkadgpo.exe	98
PID 3620 wrote to memory of 2388	3620	Qceiaa32.exe	99
PID 3620 wrote to memory of 2388	3620	Qceiaa32.exe	99
PID 3620 wrote to memory of 2388	3620	Qceiaa32.exe	99
PID 2388 wrote to memory of 628	2388	Qgqeappe.exe	100
PID 2388 wrote to memory of 628	2388	Qgqeappe.exe	100
PID 2388 wrote to memory of 628	2388	Qgqeappe.exe	100
PID 628 wrote to memory of 3060	628	Qmmnjfnl.exe	102
PID 628 wrote to memory of 3060	628	Qmmnjfnl.exe	102
PID 628 wrote to memory of 3060	628	Qmmnjfnl.exe	102
PID 3060 wrote to memory of 436	3060	Qddfkd32.exe	103
PID 3060 wrote to memory of 436	3060	Qddfkd32.exe	103
PID 3060 wrote to memory of 436	3060	Qddfkd32.exe	103
PID 436 wrote to memory of 2984	436	Qffbbldm.exe	104
PID 436 wrote to memory of 2984	436	Qffbbldm.exe	104
PID 436 wrote to memory of 2984	436	Qffbbldm.exe	104
PID 2984 wrote to memory of 2248	2984	Ampkof32.exe	105
PID 2984 wrote to memory of 2248	2984	Ampkof32.exe	105
PID 2984 wrote to memory of 2248	2984	Ampkof32.exe	105
PID 2248 wrote to memory of 2684	2248	Aqkgpedc.exe	106
PID 2248 wrote to memory of 2684	2248	Aqkgpedc.exe	106
PID 2248 wrote to memory of 2684	2248	Aqkgpedc.exe	106
PID 2684 wrote to memory of 3888	2684	Acjclpcf.exe	107

C:\Users\Admin\AppData\Local\Temp\600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78N.exe
"C:\Users\Admin\AppData\Local\Temp\600f290795fa04396ef2864f729e9c84ca24e8ff1a6b495a887f950ee40bef78N.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\Pggbkagp.exe
  C:\Windows\system32\Pggbkagp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\Pjeoglgc.exe
    C:\Windows\system32\Pjeoglgc.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\SysWOW64\Pmdkch32.exe
      C:\Windows\system32\Pmdkch32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2524
      - C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:508
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3504
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5100
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1708
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:820
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:372
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3868
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3172
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3848
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3408
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1420
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1824
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3780
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:400
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1660
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1288
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3612
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:216
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1056
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2844
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2680
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1348
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4052
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4236
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3348
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3756
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        71⤵
        Drops file in System32 directory
        
        PID:3668
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        73⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3188
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3796
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:60
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1396
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2676
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:536
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4936
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4080
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1160
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1228
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        90⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        92⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        95⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        97⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 408
        98⤵
        Program crash
        
        PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5484 -ip 5484
1⤵
PID:5552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Acjclpcf.exe

Path C:\Windows\SysWOW64\Acjclpcf.exe
Size 60KB
SHA256 3af137099b801ff721e3dea76b92f83fff73fe10c7d32cecb8820c72aface148
MD5 7f9959e5b33db5b70579a5aaf309dd05
SHA1 6c4348b17f319dd2b1d38d209bde507d7e1daffa
SHA512 c58451a3af64078284ff163758d03d6f72d3d03172863e6ee887a532fc02f5892c1a4d0fd170de3c359a72aa2a0f029b6913933ea2501544a1d97efae3c007c6
SSDEEP 1536:DnsY8APg+t6EPSQqkQNAx45MBM+X7uHUGW06B86l1rs:uAPHED2Q7gClv6B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeiofcji.exe

Path C:\Windows\SysWOW64\Aeiofcji.exe
Size 60KB
SHA256 cfe891933f8e967a4709ab25ba7d3e23a432f3dc0054dde60e3eb1d88fcedfa5
MD5 92f2248647fad14453a42aba4249eaca
SHA1 a634863d5ed335b93f2d307007a0ee6208139f7f
SHA512 1d2afb44fb977aa5090d5b6b79e26176a6716f0a50d5192574b8b883402c69057c21c2a575328545c5c5bf36b17852c75d5f26ab79b07d57be12a18e34217c6c
SSDEEP 1536:D0xPTNpc3+e0y67GTycPvt59ecG/IrX5P9sB86l1rs:uxe0y6xCvtbedwrbsB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeklkchg.exe

Path C:\Windows\SysWOW64\Aeklkchg.exe
Size 60KB
SHA256 be7adfb48f59833719e636163651037c84fdfabb2461d069e38edf1394f8030a
MD5 cd801651288c7587fe03806a7faf34da
SHA1 1816719e8d4c09ebbc22270d9dda5381318007b7
SHA512 81a9c539967be7fce3184f74ab6c547a97438206952f947cd5dece09c2facced0b6e186abe5f3327c252a95caa0aa98ff1de1b035aff18f0ff4ff529c6f80488
SSDEEP 768:DoR0gY9RWBx3nr1oVgtp1Unhg0bCCCUHM5gTPM80eWAmhJY1/1H5AB+XdnhMl/Xm:Dbn9K3JoVgSnhgwi5gSmqB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ageolo32.exe

Path C:\Windows\SysWOW64\Ageolo32.exe
Size 60KB
SHA256 e41352202443d9debb1a1845f1f4ef06eb87c9c0ff18182e09dc5a9b36b097e4
MD5 18f1ec1e9c4cec9cc6783baa91dc3b1f
SHA1 444b597a3858bf07b9feb31c92ca5e4392889a99
SHA512 38eacf2d533132c073d9b0978626c7913a26043db4a52a9aab5036c4fb14e914f10c3e580f90c60476f7c1fd3640f2ed3d46a9c85e4514116902b585f4a00b80
SSDEEP 1536:Dh1nhlQLCkR9obZ8M7jng8rvaY8AkoM4cgEIsxFZQypB86l1rs:l1hlQNR0PnVGY8AkoM4cgEIsxFZxpB8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agglboim.exe

Path C:\Windows\SysWOW64\Agglboim.exe
Size 60KB
SHA256 1ca66b95ffbcb8b113417514037e367294d09b0e65c8ed56759810dbcacc462a
MD5 21835160f5f405b79b90215214019377
SHA1 d4473f0f6383c9919efb071752ecabbd8a626b60
SHA512 1db734928d822b5fa2eb93a1db93049f8c262e8bd25a6167ab2cd48e7479db1b4c9411ea90f9a9a4d48c6a8a4964523cfc172013d070c70ca80d1f99b3a8b7dd
SSDEEP 1536:DPUdNOG+CH6AmSoYXFb298A7I+wB86l1rs:DiNNRDXFQ7I+wB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agjhgngj.exe

Path C:\Windows\SysWOW64\Agjhgngj.exe
Size 60KB
SHA256 412f893261c7adeaabc632195bffdb26cde46837541fa5e12961f58b251a5b54
MD5 fdba9a5d1dedfafc2f1f8ac6563f23f1
SHA1 d5ed4127e448c4c28ea136c201207254828d02f6
SHA512 944a2897d806529856833dd84e8f77bcf09d8ae08623a3f3482b95253411554a57c549a1e8e15b4e19a4decf55af80b6aef8894aea61f812d413c8b8a9163745
SSDEEP 1536:DuMNvUVZuRdLovSnsmQLbjvMnQYB86l1rs:tCata6s9LkQYB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajckij32.exe

Path C:\Windows\SysWOW64\Ajckij32.exe
Size 60KB
SHA256 c4d302ee23ea055c2bde9018170f971c7de88d276d395949cf65027e52e914ca
MD5 dcbcdf3d0bb57d58600664ad359dd297
SHA1 e0aa149fbd255002a3af30cd4a0985bdde717808
SHA512 34461f2a80b9b6355e1816e15b1b9c9f21a666bc01183e73f34bfae436b3f3fc949953a72b87d2e4d52c51401877abbeae5c0b414e9911c0d3aac87f05f07eec
SSDEEP 1536:DAr69gncGG3gTCTKd/uUPkMDJ5TnOdu3l9gk1YGB86l1rs:ET6WG4JUd0B1YGB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajhddjfn.exe

Path C:\Windows\SysWOW64\Ajhddjfn.exe
Size 60KB
SHA256 b063e58ded2fb295635bb6e88aa26a506044ff8c130a89178baba6eb7dff12d9
MD5 d1c6dc0eba695188e081ada2bde1f442
SHA1 a5625ac8f1b663a6e134af45aa504e6eddee64c1
SHA512 16977e9b6914bf35c345f1a56d076e0cb3f47f726abddea00fa410d1a0d7ae5f82db2db73f33f2dbe9627d3418c1efd41a45246e573c98992da73397a084277e
SSDEEP 768:DoW4eGejuZDjsruBxnWM8D9TC886JBorvF7ZAl1kgmwiscg08ndVLHB3ktxlE/1j:DV4ojCDqMygxcm8cg083WtxUqB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ambgef32.exe

Path C:\Windows\SysWOW64\Ambgef32.exe
Size 60KB
SHA256 8a7b815056d68c25a07ce8c8726fc389c057df340eea686ae63928cd6ac6cf1a
MD5 4d1ce69e5544ea12d1fc777e4a9266f9
SHA1 bf8a2f320062c551e46d666ed0bede3b53df0e29
SHA512 210f4b033ac295d765ce158f6d7d8a17474a87b6d3622d1053e659a07a9fe13e0b3554598a9b12784f49c69096bdc087592c7e1b8919fd6605aca4bc65ebdf1e
SSDEEP 1536:Dkcn4slBu/To0yIvQ9QK6n4Y2mWe8g/kNnWB86l1rs:1eyfXcZx8ICnWB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amgapeea.exe

Path C:\Windows\SysWOW64\Amgapeea.exe
Size 60KB
SHA256 02ede32057e0868a76436fa4a09c285424e400c7d43ceac128fff4a4cfb64b54
MD5 166805b3b735a976369e6bb8fb3ea91b
SHA1 46640d791ceef32447999f750c4ccea55217ad49
SHA512 9eb7bc872764b8c76c452689267a57848d88dc8709e21506490df02831a3017ab6885d48d18ccd41f5a1c94b74b937666bea35e63c469bc03a2323cc4b9ed243
SSDEEP 1536:DG3uChvuZlSquJR56ffrvi/N+TWAd+DiA/SyB86l1rs:WuOmCquHqup6yB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ampkof32.exe

Path C:\Windows\SysWOW64\Ampkof32.exe
Size 60KB
SHA256 cc5bbfbe87064944717082c3a06b9723e244c54b409428bac2d1d2510f3c9995
MD5 6bd926618bc9589bd3a679fc8fae7e74
SHA1 462c20f2bab3560e7f1fcb37f4f7cb6d7eac9719
SHA512 23a1cb3b1522e53a83b767bf19b41d2883a5a668c09a3118bc693430078cb4c641c32c9448689bc8e718ff736d42d578cc4acf6bc93c8217cb8551315c76dd54
SSDEEP 1536:DT+VGivd1BAb3gfNIGW1NWFUhEZbtB86l1rs:3+VGYd1ezHGWLeFtB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anadoi32.exe

Path C:\Windows\SysWOW64\Anadoi32.exe
Size 60KB
SHA256 cc3364ed5437a275e35f85c87987eb5aabcc31e9ea12b7113797e2905be36390
MD5 91194f753567206dbcfae93a0e29a57c
SHA1 c822c6b413ca9b730a778e45ec88a915be35d293
SHA512 45c5291f4d3135531cb94adbeacab370b132d3fc0a4ea3df15a277b20cc7dd9e5b013349352c3c56c02851c8fcf5456a6efa33c495da4afe065ec41869b8f8cc
SSDEEP 1536:DVSZ8LRxzd8ouTL8w86+UiHExzUsUflFKyHIqZeB86l1rs:oZ8VxJ8oMgw8PUiHwsH9kB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Andqdh32.exe

Path C:\Windows\SysWOW64\Andqdh32.exe
Size 60KB
SHA256 db9c658e8cc8cc77cffc802adfe04223af80a0652178e8e0788aaa0df104f6f9
MD5 2a91a0668310f944581caa8e62a51569
SHA1 169459a87e09e78f3357a4bd166c0473e21eb407
SHA512 d34bc296f71f06c471d87171cd1bec5fcf559a1db3e7c8c91f96db2b637f1fd9b252df1f5f48d25a92120a91007bab838282d40f8ef02af571d8bd2f3909088a
SSDEEP 768:Do2f8yVOaZAMt++2dFlVHB4QySjq41pcWN0VhRVHPo/b465LnHNvknIV/1H5cDBG:D/EyoTPtrb6WN0Vh7Qk6LkySDB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aqkgpedc.exe

Path C:\Windows\SysWOW64\Aqkgpedc.exe
Size 60KB
SHA256 4e1792391a1e6bd6de5ae9c2716ad5818e24acb4222269eb6e92021bb972b4cc
MD5 926a010a0ef4584faea6229cd52cd89e
SHA1 4b613ba5e7b211ca5579e2cc5187e483fe28f41b
SHA512 9b57157399b6a93d369f7e302046139b318ec5ddfaf8bb7e22807cc7dac334a14ead4ed9e3e389b30c9b303e5fdef51e7467268497b5ed7591a03127bbd9e64d
SSDEEP 1536:De/vfRWG3iKSrR/XYcsZD0isDjDPW3B86l1rs:mvZx3ipr1YZIH/bgB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfkedibe.exe

Path C:\Windows\SysWOW64\Bfkedibe.exe
Size 60KB
SHA256 d39ba2312173f1f64d33d65a9789195b70a35d772583b68763f3ea5b604bd1d6
MD5 ad7a8c45fcf91df0f28c4ef83b473ae1
SHA1 4db0ffb2b2d11cf2896fc65f819359ecbd67c17c
SHA512 49dd5edcb4b2ec777d96efd67f1a185ec5f047a6b69593ebb7a5a8a2f5bc3ae8527db3d43297123690c0fe18bf0e5df741e22728246f7ae1d181e3a5d513ac70
SSDEEP 768:DovUI63/6pl+YJANjSrHno1c3nM87vsNfJYGE/1H54B+XdnhMl/Xdnhps:DqUIW/6plpYjSr8cXTUVJYGmiB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjpckf32.exe

Path C:\Windows\SysWOW64\Cjpckf32.exe
Size 60KB
SHA256 6a39da67d65fb2ece623506f28628d4b3fcd399d7b36ece1050c72727acf2035
MD5 761e8b7d6b25d4f5b5bf02cf2d332e3e
SHA1 208424a7dbb9a880fadfef737ee1605f7685ee17
SHA512 d859859f349b9363e0338c9e548518dd6509b361bb35351755692e9ca52d9073f9c7c1342528a9f2fba305b6ffef806102a14e6e82aa3e3b6aafddc5f6314ad5
SSDEEP 1536:DXCQfTyBzfgcG2V+c2R3To9Z0eKktrQIpb6WB86l1rs:eqTS4cHVG3T00bktsIpbjB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmgjgcgo.exe

Path C:\Windows\SysWOW64\Cmgjgcgo.exe
Size 60KB
SHA256 5b8d8b2aae257a5610283c499901bca3fad8e5092a43e82838c8223f4223fb33
MD5 f081af2eae30b95e618855efe9ea1152
SHA1 dc6ffcc901d15b4ce0ad1e9ccedb2db40606a945
SHA512 1e30e84ff2339c5ab949346279b7e11007f81912df9d92440d66ac192b9585c8a300f60583eca6698ca268cf73e872f1e534f8b1a2e79ec478d8310214b744b7
SSDEEP 1536:DxwhNcaUFhUEHCKAcGhBxPwYsCB86l1rs:6hNH+UKAcGhBxPXsCB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daconoae.exe

Path C:\Windows\SysWOW64\Daconoae.exe
Size 60KB
SHA256 7a8f4dc3c75b9f476d3f69a5f4d493891ed5693d2b9bdb46a2c03ef0ccd655d2
MD5 9e91a4f7741cd7db82bc035de8a135f8
SHA1 ca1efb295d12c7e068394601695782159e2504cf
SHA512 b2d5f2acf63a0eb264015217b61cf39b8b844046ca99766c0f6dc37bae2a9297d815f382e1d0f80b2d857860755ce6cf566298f3033fdd804f41d32e4bd6e4da
SSDEEP 1536:DdRLcqYqaeko7oMOmvxoIJRgbmSTlZL6WFeUB86l1rs:J9lhcMOmvnviv7UUB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdkcde32.exe

Path C:\Windows\SysWOW64\Pdkcde32.exe
Size 60KB
SHA256 fc8df05ae6a60d5aa75148e737b2fa6c8af00ece44429c495b397b0a6e326cef
MD5 9c9b72d623de4d719e4198a077f37d73
SHA1 409f65eefdc70026b3136054d93bcbd492a816be
SHA512 15c26a181767499030d45d238ef25efaafae66d914ecb8952f44d22dfb090465c5dedd79212b952ab6d4c3a59c878d3838e08eb0a6b82ab0a262d69a1cb316dc
SSDEEP 1536:DqHy7kgsGdzXsmOPJHIun7cARPA0B86l1rs:WHy+G67xHJ7nDB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdmpje32.exe

Path C:\Windows\SysWOW64\Pdmpje32.exe
Size 60KB
SHA256 572a9d6da7b7b2abc364f04e6bff0175ba7043925a95aece414e07b03be4d2bf
MD5 82b6bc55edaa18c4a9d28872aedf758b
SHA1 78a508f0640d311afbdda29fdbe5d48fdaee3eb7
SHA512 6f0e910dd2a53be066060944e046dab466b2e4e1a2b62c927e1784657be92aa7c129fda14be5de0812cd1d17a0af9e795ab530e8d9505c88ad9b003a20931cc9
SSDEEP 1536:DJPQSsJNYQgedU6S8ePuS74F8uuuuuu6qspr/LtB86l1rs:N4NPYQ/SduS74F8uuuuuu6qo/LtB86lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pggbkagp.exe

Path C:\Windows\SysWOW64\Pggbkagp.exe
Size 60KB
SHA256 a4fa727fae07abf5881ddf1db3f01365b1805867a8e795e30cacdcb4483d7846
MD5 393b0305d412ae1c6f2107d259a58759
SHA1 d65727a4839d2a68d26c2cf1121e5177c2349c74
SHA512 76f348ec6a823c1a01d6e602fc5d7d175e0f9292de0d52f92c9dfef810c673ef30b27d90d152d6405a19c2296ff4242e2579a12090ea1a8e3e1d48e95721323b
SSDEEP 1536:DfRaBzCmvRem6omunji59KyS1ozwNK4Vd4hcpIdB86l1rs:VWzJpz6olY8fmhHdB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgioqq32.exe

Path C:\Windows\SysWOW64\Pgioqq32.exe
Size 60KB
SHA256 4e136c550329386ef37648aad465a44ad59fd94534be42e9341760bcec7d527a
MD5 f86af274798cd48793699b3c9f83ab9b
SHA1 b5477bc1cea5fc13903a3f1d22baad7cc348ff46
SHA512 eb4e99c1d5b1f33cbb09bc0f0e90e28c8e46445d8de4d38887577f9f2df8c898c7dd14ff6501618a7ac44cca5c9d15898ad48610ee9fe5ee1cd59489bf6c1947
SSDEEP 1536:DK2QGzGS1+ImpRNkvXKH1jKCqgSHyu8Am3TC7EzhB86l1rs:u2QGzGS1+ImSXKVj5myNRe72hB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgllfp32.exe

Path C:\Windows\SysWOW64\Pgllfp32.exe
Size 60KB
SHA256 5271dfb45d0b0e9dd6e65311d1ef5ca899cf5fda0ff12650d211381c273bfc36
MD5 1c0bef247c436a638e99e4c5ca65b9d5
SHA1 332ab33798fb0d5d5c30780c07169a0b275428dc
SHA512 fe72856220a80da36dd486209c55351b6b805b98c7b0b8770b81f4a50195a57300138dd244ec404d89b9a4e2d981c672ac8715747c6122c6b60c09a825b3d367
SSDEEP 1536:DFsx4od74rWlFT0FNC/C1Ov1Ot/2i9skvB86l1rs:pZCECF8NCq1gc/2EvB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgnilpah.exe

Path C:\Windows\SysWOW64\Pgnilpah.exe
Size 60KB
SHA256 b9a64502e46d8d28f61a06f0de15c8b81b4ae356ffefcf9916db0196663b3b9b
MD5 e63190aae41679739b957e1b19b9d9f0
SHA1 14da4793c8192cbac75de1ff06b410eb1dba56e6
SHA512 7158807f3ef18a6f35c1b66604b0fbb76a5c8a24c583adcaead2d5594a2dd475d93dba944082c35827513d12b61d5d1285318c3be6ad87dc1147237458d140e9
SSDEEP 1536:Dmdi6xzlXZMZTHwxHznHmWFQRUB86l1rs:36xzrMZEJFQRUB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjeoglgc.exe

Path C:\Windows\SysWOW64\Pjeoglgc.exe
Size 60KB
SHA256 ac2f7c06d8e979edf0efe68f38ded79972479f6da8d0b1eba14b81e57d5ae97b
MD5 13c54d2e6a4bd111c608e8cb4f328acf
SHA1 84406bf270e8c64b028b0e06e149a40cbb50a20e
SHA512 dbb18cc9b68285724c2c49fa3ac1b77cd1c778bd8def7d7e21f85950dcd111eef922ec3af4614ce9711a009fb664a6a60914e0bff85d9e2be95375c30ef3f13b
SSDEEP 1536:D3+TAh7knG9YU0ZmCclf09HbtcbI+11lqNOCX/8pVB86l1rs:L+OTNOmCcl89Hbt8I+11lgqpVB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjhlml32.exe

Path C:\Windows\SysWOW64\Pjhlml32.exe
Size 60KB
SHA256 b9f9d7cfde63ddf5dd31c334a1cbe488fda9774c5fddeeb74ebeb8703b4ccef7
MD5 cf6e95f3dafe912488498ace9240ff15
SHA1 8255c7330ed235db7661805baf90151725804add
SHA512 fb971ad86c1da061d6d774088e5d198d611562283c68524365f9ebd400a5532b23f3e078d3b1c8e7a37b375abf9d2fede4f50230032ebde8b24db05e962bafc8
SSDEEP 1536:DxCMnx2ySeUSZbXI2dlYusnj8rwZs8yCB86l1rs:lEySeTBlhCB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjjhbl32.exe

Path C:\Windows\SysWOW64\Pjjhbl32.exe
Size 60KB
SHA256 184b1a03392960d9d097c71eabd90eb5d20e5624385415c25a5e710647eb3697
MD5 69a91279a9c7887d814aa2a419daeb9c
SHA1 c47bbc6a6dd157a8a092347ee1672f51de6ab8e0
SHA512 e457dc89c932919ad70c8e1aeeeeba8ed2d66907e6de26382fb3c369cc29ae49c0d6c47511d6568eb8bb4358767d55a90a595eeb479e287175fa5ebedf0478d2
SSDEEP 1536:Da2lNJT53WEQUTf61v7nESJMACn6+XE5B86l1rs:mmeUTy1DTJMACn62iB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmdkch32.exe

Path C:\Windows\SysWOW64\Pmdkch32.exe
Size 60KB
SHA256 b0718bb2e0407a09aa38ae8a1f5a5b10a9a2b4bebc264f795dc055bdd3ee60a2
MD5 3a793bf5b86ae9120f6470bdeeafd5e6
SHA1 51dcf052238a059f8ae6d4708199afa3dcc12950
SHA512 5f7475011d3162e84ad9a5adff0845cac631b39089e309cdc4ed0cc8198255ca7e266eeb2a737e4a3f421fab0661ca3c333d9ac93a97e11b5d952dd8b237c74e
SSDEEP 1536:DH8gxjxbY1TmCLVsSSGJXu9QmJpJw7omB86l1rs:Ywxb+mdaI9ddmB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmfhig32.exe

Path C:\Windows\SysWOW64\Pmfhig32.exe
Size 60KB
SHA256 feb6555adbf8e0542ee7a3866cce8a1969a30bcd928c3361e7f7889f99e70bac
MD5 9767d706d5ff0f30187e707a3723b00a
SHA1 9952c8f92f725bfbc7804d117b0e5e917036fccf
SHA512 06b395e302884848b2fe3df37ac7ceec1b19037e16fab920b3e4cbeba816e8d7db9836d0c768413a10a78ff9041cea118fb0353e3fc636ca8e80fd09f7ab6d8d
SSDEEP 768:DoMqHgAr5r7r9GHtgfLj+95em5YPCFzUOIOIgNizdr1MAVHFM7B/1H52B+XdnhMM:DqrV9GNgfsZvID0wl6DUB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pqdqof32.exe

Path C:\Windows\SysWOW64\Pqdqof32.exe
Size 60KB
SHA256 9b17624a020428d71539855182b0396b31ceab55d0a71f02840427b443eccfa1
MD5 d2de9948174b968a156bd1903bce727c
SHA1 7b0aa0b16137bda7e84f746907d5a2500a67d7c4
SHA512 42a62b844f424156743b4f88978e2807f0db49703f106f2fe1c002603c20d93718f7d744f59590a7b3ff2f25d83c87620a1b200fb5f47c56222f82646792a5aa
SSDEEP 1536:DgDCRH5ns+z3ttwdggJScggc2nQJsXljh2mo4B86l1rs:kWRH5Jxg4cgl2QJcbo4B86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qceiaa32.exe

Path C:\Windows\SysWOW64\Qceiaa32.exe
Size 60KB
SHA256 8a52452935955cec3fe1f67af4671e62cb86c5cf7367893573546661c6351559
MD5 e65e8e01c08739c4db6dd5ab5fefd08f
SHA1 1b699d860ef742acd23e96a5064b4cc8b85cc078
SHA512 bf14f48b8c766a4fe027c1aa85302f0501731bcdb51123e291de364a4dff52fedb19b24f5ac1560dd4b52707825e36aaf69aa4cedd6ad2d52bc081d1fb26b5ec
SSDEEP 768:Doanm3hSlUZpXHgqS6NFKvLURJCOJts2OKfgqiDBet2lXXc6b/1H5COB+XdnhMlO:DVmMAXHQCrcOQLKoqiwti9gOB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qddfkd32.exe

Path C:\Windows\SysWOW64\Qddfkd32.exe
Size 60KB
SHA256 226b163ff5084d8432367722a347003d8d35db48d49d18539eda4abb2ccdc79e
MD5 1c00d2d9c0fb87825ac4349d4209f34c
SHA1 b9d626129040f9007de6a1a8e9b76f4b44c66fb3
SHA512 aadaab5637253a5a3b9d9e3d82c606f77cc37bbbd030d07e10e97f9c0594e512255005ae3a65d59d90214339af867f22b07a95e22d8bfa2db1f87605876e7654
SSDEEP 1536:DssO/bqBzw2Pry7S6qwLcNa0hfzcgCB86l1rs:gizxzy7S8LSaucgCB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qffbbldm.exe

Path C:\Windows\SysWOW64\Qffbbldm.exe
Size 60KB
SHA256 def09a3a00cb7ace4efdcd0801ec4654ae87306b07e539212dead0446027afff
MD5 7b847a3e86f36871adfe75b461fd6f33
SHA1 94257e318408a118723f3dd9ce393ff2ff0347da
SHA512 c47b6ee567be2ed5e479f46d9d0c3cc0ba07d7b9ebb2d1bec4efc8087870d70ea2ccf1ea9e1c489f1173e49fc2ba26302c69beefbbc04d9531142aba8b04c60e
SSDEEP 768:DohTiEO0E7Myb1ZCI+/0LtuOoQbSX4OeS719fl+bdTlbn0lD7whgAKTvs87jGp8E:D8i/7vyi//c4w8BhHWZFRB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qgqeappe.exe

Path C:\Windows\SysWOW64\Qgqeappe.exe
Size 60KB
SHA256 7b70e9837295d79edb2ecdaf8ade9731a5d469524ff5179c3fb79eda7b057c03
MD5 5a09c7e8d5594726d95a633e489b582f
SHA1 b2debfe573746106b035b4068ac94b0119039e67
SHA512 4124d6e63440872e65601e94c49b7337dee08b2bcd3ed2c26221586dd58456debe238e96123071ecc4bfb4e4c9494ee3331635da69aa3c1194726fb8930131d1
SSDEEP 1536:D5u0brpa/Ex+1TYKNMwu9CZ8uNMu39AE2B86l1rs:FBa/J5Y5wtZ8uNWLB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qmkadgpo.exe

Path C:\Windows\SysWOW64\Qmkadgpo.exe
Size 60KB
SHA256 6b95e060cc38c96e397efe211335867dd56e2f46c1ad442785754bdddf0d0156
MD5 c46b988c6284fb742e7688e2c1df07d7
SHA1 0c968d2ac838bde0d699d421ab98e662ae92f723
SHA512 97c1eb3bc0cdf5b40b04f25180dd0d5c7a2102003cef259b5c2b8fbe7252c741f649d8693b9d19838c69eba2421b0be38fa831e062de84f92292093f2146b4bc
SSDEEP 1536:D6TwUmz1YwU+KBMSCYbfEXrJaXHxG1RFmrB86l1rs:eAziqKBJvbct/1+rB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qmmnjfnl.exe

Path C:\Windows\SysWOW64\Qmmnjfnl.exe
Size 60KB
SHA256 6e00f1e4a533bf16a239c65b5a2ab03c2b92a77261763a049ceb36257225fa59
MD5 160ffa15e2f6c6ac3b9189bbd486c4af
SHA1 e2531e1b6f5988635b5c82872f8f4b333fccb751
SHA512 5816d40fdfa6e85c5c8444fc03c17644b4db7c3903a30883f384b2875cdf69c52e1bd701032cbab6e763a9e85c902e235172112f24d3d41aff79492cc23bde7b
SSDEEP 1536:DYhYpwiPxfQ/cfR2MvwDVl0n8n69cJNQS4Nxg13zB86l1rs:EKrPF26vwDf/JNQS4L83zB86l1rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-437-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/372-357-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/372-292-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/400-457-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/400-391-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/436-153-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/508-207-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/628-223-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/628-135-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/736-41-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/736-125-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/820-325-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1056-444-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1200-107-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1200-25-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1288-411-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1296-98-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1296-16-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1420-430-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1420-365-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1592-224-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1592-298-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1596-299-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1596-364-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1660-404-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1708-312-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1824-372-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1964-152-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1964-64-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2084-378-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2084-443-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2248-261-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2248-171-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2260-344-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2388-214-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2388-126-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2424-48-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2424-134-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2460-337-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2524-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2524-116-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2636-189-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2636-99-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2684-268-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2684-185-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2824-358-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2824-423-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2880-108-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2880-196-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2952-355-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2952-285-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2984-247-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2984-162-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3060-145-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3120-431-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3172-326-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3188-749-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3468-1-0x0000000000434000-0x0000000000435000-memory.dmp

Download

memory/3468-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3468-72-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3504-215-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3504-291-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3508-73-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3508-161-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3612-417-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3620-118-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3620-206-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3688-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3688-89-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3780-450-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3780-385-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3848-345-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3848-410-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3868-313-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3888-276-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4052-764-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4160-144-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4160-56-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4360-424-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4416-397-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4416-464-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4536-248-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4540-306-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4540-371-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4704-338-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4704-403-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4704-810-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4752-283-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4752-197-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4920-91-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4920-180-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4924-81-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4924-170-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4944-451-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4972-458-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5056-319-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5056-384-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5100-305-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5100-233-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads