berbew | 7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28fac

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28facN.exe
Size 64KB
Sample241110-bqjdkavrew
SHA256 7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28fac
MD5 15547afe700498242bf6912fdc2bf5d0
SHA1 5dc33dba6351a14e02a34acac527fc069916bf0a
SHA512 b44985f0e950fea0329b9e70b08261d4968cd6f4facb4e88f90d85842f0786fbf07bb677c20fac69c6b2f2143cf4659d0230bacebf76da63c588adbe312a8de3
SSDEEP 1536:H+L1CGmL/xuohE4SOxUCQJWEXUk7qK2tvb01SV1iL+iALMH6:Hg1CGmTJaOlxEEk7M1QSV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anadoi32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4588	Pnakhkol.exe
2052	Pqpgdfnp.exe
2652	Pdkcde32.exe
4596	Pgioqq32.exe
2336	Pncgmkmj.exe
4084	Pdmpje32.exe
1072	Pcppfaka.exe
3868	Pjjhbl32.exe
2848	Pmidog32.exe
4480	Pdpmpdbd.exe
4072	Pgnilpah.exe
3956	Pjmehkqk.exe
4584	Qqfmde32.exe
4924	Qdbiedpa.exe
3208	Qgqeappe.exe
1092	Qnjnnj32.exe
2824	Qqijje32.exe
1088	Qcgffqei.exe
1352	Ajanck32.exe
4792	Anmjcieo.exe
2988	Aqkgpedc.exe
4220	Adgbpc32.exe
3872	Afhohlbj.exe
4988	Anogiicl.exe
5028	Ambgef32.exe
5092	Aeiofcji.exe
2860	Aclpap32.exe
2660	Afjlnk32.exe
2500	Anadoi32.exe
5080	Amddjegd.exe
3988	Aeklkchg.exe
2292	Agjhgngj.exe
2880	Andqdh32.exe
2184	Aabmqd32.exe
1868	Aeniabfd.exe
1652	Afoeiklb.exe
3760	Ajkaii32.exe
552	Aminee32.exe
972	Agoabn32.exe
4496	Bjmnoi32.exe
2980	Bnhjohkb.exe
1900	Bebblb32.exe
1856	Bfdodjhm.exe
1460	Bjokdipf.exe
684	Bmngqdpj.exe
1980	Beeoaapl.exe
1872	Bffkij32.exe
3032	Bjagjhnc.exe
4288	Bmpcfdmg.exe
2388	Bgehcmmm.exe
4284	Bjddphlq.exe
4928	Bnpppgdj.exe
1232	Banllbdn.exe
2776	Bclhhnca.exe
1764	Bhhdil32.exe
2284	Bnbmefbg.exe
4900	Belebq32.exe
208	Bcoenmao.exe
2276	Cjinkg32.exe
2628	Cmgjgcgo.exe
3308	Cenahpha.exe
224	Chmndlge.exe
2844	Cjkjpgfi.exe
3644	Cnffqf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Qnjnnj32.exe	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Cenahpha.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Bjmjdbam.dll	Pjjhbl32.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Afoeiklb.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Ciopbjik.dll	Pncgmkmj.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Pjjhbl32.exe	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Qdbiedpa.exe	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Deeiam32.dll	Pgioqq32.exe
File opened for modification	C:\Windows\SysWOW64\Qnjnnj32.exe	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Pmidog32.exe	Pjjhbl32.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Amddjegd.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Qdbiedpa.exe	Qqfmde32.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Pncgmkmj.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	Aminee32.exe
File created	C:\Windows\SysWOW64\Ihidlk32.dll	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Adgbpc32.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Bclhhnca.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Pdmpje32.exe	Pncgmkmj.exe
File created	C:\Windows\SysWOW64\Pjmehkqk.exe	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Hjlena32.dll	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Hhqeiena.dll	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Odaoecld.dll	Pcppfaka.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Qqijje32.exe	Qnjnnj32.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Phiifkjp.dll	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Gjgfjhqm.dll	7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28facN.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Pjmehkqk.exe	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pdpmpdbd.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bjagjhnc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5444	5356	WerFault.exe	176

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pncgmkmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmidog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflgme32.dll"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agoabn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baacma32.dll"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqfhilhd.dll"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nedmmlba.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdlci32.dll"	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmjdbam.dll"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Agoabn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgaoidec.dll"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28facN.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 4588	364	7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28facN.exe	83
PID 364 wrote to memory of 4588	364	7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28facN.exe	83
PID 364 wrote to memory of 4588	364	7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28facN.exe	83
PID 4588 wrote to memory of 2052	4588	Pnakhkol.exe	84
PID 4588 wrote to memory of 2052	4588	Pnakhkol.exe	84
PID 4588 wrote to memory of 2052	4588	Pnakhkol.exe	84
PID 2052 wrote to memory of 2652	2052	Pqpgdfnp.exe	85
PID 2052 wrote to memory of 2652	2052	Pqpgdfnp.exe	85
PID 2052 wrote to memory of 2652	2052	Pqpgdfnp.exe	85
PID 2652 wrote to memory of 4596	2652	Pdkcde32.exe	86
PID 2652 wrote to memory of 4596	2652	Pdkcde32.exe	86
PID 2652 wrote to memory of 4596	2652	Pdkcde32.exe	86
PID 4596 wrote to memory of 2336	4596	Pgioqq32.exe	88
PID 4596 wrote to memory of 2336	4596	Pgioqq32.exe	88
PID 4596 wrote to memory of 2336	4596	Pgioqq32.exe	88
PID 2336 wrote to memory of 4084	2336	Pncgmkmj.exe	89
PID 2336 wrote to memory of 4084	2336	Pncgmkmj.exe	89
PID 2336 wrote to memory of 4084	2336	Pncgmkmj.exe	89
PID 4084 wrote to memory of 1072	4084	Pdmpje32.exe	90
PID 4084 wrote to memory of 1072	4084	Pdmpje32.exe	90
PID 4084 wrote to memory of 1072	4084	Pdmpje32.exe	90
PID 1072 wrote to memory of 3868	1072	Pcppfaka.exe	91
PID 1072 wrote to memory of 3868	1072	Pcppfaka.exe	91
PID 1072 wrote to memory of 3868	1072	Pcppfaka.exe	91
PID 3868 wrote to memory of 2848	3868	Pjjhbl32.exe	93
PID 3868 wrote to memory of 2848	3868	Pjjhbl32.exe	93
PID 3868 wrote to memory of 2848	3868	Pjjhbl32.exe	93
PID 2848 wrote to memory of 4480	2848	Pmidog32.exe	94
PID 2848 wrote to memory of 4480	2848	Pmidog32.exe	94
PID 2848 wrote to memory of 4480	2848	Pmidog32.exe	94
PID 4480 wrote to memory of 4072	4480	Pdpmpdbd.exe	95
PID 4480 wrote to memory of 4072	4480	Pdpmpdbd.exe	95
PID 4480 wrote to memory of 4072	4480	Pdpmpdbd.exe	95
PID 4072 wrote to memory of 3956	4072	Pgnilpah.exe	96
PID 4072 wrote to memory of 3956	4072	Pgnilpah.exe	96
PID 4072 wrote to memory of 3956	4072	Pgnilpah.exe	96
PID 3956 wrote to memory of 4584	3956	Pjmehkqk.exe	97
PID 3956 wrote to memory of 4584	3956	Pjmehkqk.exe	97
PID 3956 wrote to memory of 4584	3956	Pjmehkqk.exe	97
PID 4584 wrote to memory of 4924	4584	Qqfmde32.exe	99
PID 4584 wrote to memory of 4924	4584	Qqfmde32.exe	99
PID 4584 wrote to memory of 4924	4584	Qqfmde32.exe	99
PID 4924 wrote to memory of 3208	4924	Qdbiedpa.exe	100
PID 4924 wrote to memory of 3208	4924	Qdbiedpa.exe	100
PID 4924 wrote to memory of 3208	4924	Qdbiedpa.exe	100
PID 3208 wrote to memory of 1092	3208	Qgqeappe.exe	101
PID 3208 wrote to memory of 1092	3208	Qgqeappe.exe	101
PID 3208 wrote to memory of 1092	3208	Qgqeappe.exe	101
PID 1092 wrote to memory of 2824	1092	Qnjnnj32.exe	102
PID 1092 wrote to memory of 2824	1092	Qnjnnj32.exe	102
PID 1092 wrote to memory of 2824	1092	Qnjnnj32.exe	102
PID 2824 wrote to memory of 1088	2824	Qqijje32.exe	103
PID 2824 wrote to memory of 1088	2824	Qqijje32.exe	103
PID 2824 wrote to memory of 1088	2824	Qqijje32.exe	103
PID 1088 wrote to memory of 1352	1088	Qcgffqei.exe	104
PID 1088 wrote to memory of 1352	1088	Qcgffqei.exe	104
PID 1088 wrote to memory of 1352	1088	Qcgffqei.exe	104
PID 1352 wrote to memory of 4792	1352	Ajanck32.exe	105
PID 1352 wrote to memory of 4792	1352	Ajanck32.exe	105
PID 1352 wrote to memory of 4792	1352	Ajanck32.exe	105
PID 4792 wrote to memory of 2988	4792	Anmjcieo.exe	106
PID 4792 wrote to memory of 2988	4792	Anmjcieo.exe	106
PID 4792 wrote to memory of 2988	4792	Anmjcieo.exe	106
PID 2988 wrote to memory of 4220	2988	Aqkgpedc.exe	107

C:\Users\Admin\AppData\Local\Temp\7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28facN.exe
"C:\Users\Admin\AppData\Local\Temp\7a26254828fc66756ddbc8f56167e7cddf1ebc7731bc7600bb0e112c10f28facN.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\Pnakhkol.exe
  C:\Windows\system32\Pnakhkol.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\Pqpgdfnp.exe
    C:\Windows\system32\Pqpgdfnp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\SysWOW64\Pdkcde32.exe
      C:\Windows\system32\Pdkcde32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4596
      - C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3872
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4988
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2660
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2500
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5080
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2292
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2880
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1868
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3760
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:552
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:972
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1900
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1460
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:684
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1980
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1872
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4288
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        51⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2776
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1764
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2284
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:208
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:224
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2844
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        68⤵
        Drops file in System32 directory
        
        PID:1384
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3188
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4128
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2868
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2248
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4448
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        76⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3416
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1400
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4092
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3284
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        84⤵
        Drops file in System32 directory
        
        PID:2300
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5040
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        89⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 396
        91⤵
        Program crash
        
        PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5356 -ip 5356
1⤵
PID:5420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aclpap32.exe

Path C:\Windows\SysWOW64\Aclpap32.exe
Size 64KB
SHA256 9003fb6e1d2cc9542a8e312c125c72be0f5cb397d7e6084e9133db2ffa54dbe2
MD5 2f5aabc4746079f09153a26f48481c4b
SHA1 659316a32ecf89d1db5c3a145eb7a32b17804a82
SHA512 6686f9ef307fbffb715284370521adc1b90e7c7b969cdaa81ea1462c54c9d83ab98bb44bd0b6416b4679065380ffd4260acae2d1476418d06428892ea5d51a22
SSDEEP 1536:qVwxamzL0GGqeWV5yH/ZMe7nHTV1iL+iALMH6:MiamUJYVWZ7HTV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adgbpc32.exe

Path C:\Windows\SysWOW64\Adgbpc32.exe
Size 64KB
SHA256 7b51d3a061be686c6bb4531c36df11bc05690aba71301c63f3cc5e2fdb4c945a
MD5 5407215802787dd4be952878ff9eaeaf
SHA1 68b611e66d8caf1b3425a6d1039001acd985d90d
SHA512 5e5a22573ac4cf711484007be1d7a1874072c2823bef3b9a964e364b42d1056009437bb5da934ca7dd47adc00b47a057d9df6f72bb6bb712a371018ce9aa7dd9
SSDEEP 1536:yrovsZEdnrq7hoOvQTDpSVPsuinX95VpGI5glqV1iL+iALMH6:yrURrqthvQTDpZBpfggV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeiofcji.exe

Path C:\Windows\SysWOW64\Aeiofcji.exe
Size 64KB
SHA256 ddeaf8a04fcb81125a3a6380b723ee8669c49dadf8b7f831ab8370b78ac4a95a
MD5 25eedbadc78752dc2e77031e85d9202e
SHA1 eb74b4db27c2dc8e85ddfb73790c3a419a88a77a
SHA512 47d02b5210afeb3ad3661035908c2d046f78ba5bc09b61c4c5de1cbbbff966657afe340bb5bcc473c94432ba0c0ec6c62a74d4041356fb42a32be62fa684c4be
SSDEEP 1536:6yjifwlYdspGKpYN70ZJfXJiqP/5V1iL+iALMH6:NlCswKpYN70ZJhT5V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeklkchg.exe

Path C:\Windows\SysWOW64\Aeklkchg.exe
Size 64KB
SHA256 c8207c2dd9962e30c81ea390a62d0edbc8ea77353eb98906ffef304ba1b629dd
MD5 425f97f8868d0d3191f41919e48faf96
SHA1 c9339794f7e050a0738fe6eb6d7725130f5020f3
SHA512 bf21b612e1feb295ab28a21de5dbe41c2929c02478e32c72b1dda3711b90171e4165266e8740b5f265edf352ea864cdc13245dfa85f9512fd97da71d16c44652
SSDEEP 1536:XaWy7n2jmRYhGh/Hf4CtZA3FkV1iL+iALMH6:Xm7n2CQG1f4iZA3FkV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afhohlbj.exe

Path C:\Windows\SysWOW64\Afhohlbj.exe
Size 64KB
SHA256 049f5a14751bc1eb12c62ec119dc08ea6ebba7917a5b21dbd03ce5f8ce1056a9
MD5 bc0688cd4f9dc81ef6181c5010f72889
SHA1 d4efc9337651dfc8c9210f11efeb599c78cf0a22
SHA512 4ff80726660caab03bb0cbb39a3f25c138b9f3b754c18623dc189db987dab608efc61a8b871cc954d4d78a842cef9ed9119570fa5e26138d4bafecb56a848ed5
SSDEEP 1536:ecrAoJGW8Kf6AcQmL6d+PFtA6X6V1iL+iALMH6:VEGy33qV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afjlnk32.exe

Path C:\Windows\SysWOW64\Afjlnk32.exe
Size 64KB
SHA256 83a8df65a8513409860e2fb05d42718b56ac63d97f29f23b083f2b95a3c6b677
MD5 2ec8d5ddf3297da08251bec4a49fd979
SHA1 c85c5ddbacad3187aefcd88317ade7e5238d578c
SHA512 2b83bbb63404d73f1ee2e2b1b580f9ff85201bd6d57b8611edca8354db5f8fab6b282f73d53f3cb639e0fbb366fed550863d06c7011c034a398a7988a4d2f6f6
SSDEEP 768:8LYQxPlXBtibr9ERjOYmZuWPx4cBfxhdA/z6JerG4OuOtigj5Gt/1H5fXdnhgoEu:8LYEXin9QAUcBfxTDjC/V1iL+iALMH6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agjhgngj.exe

Path C:\Windows\SysWOW64\Agjhgngj.exe
Size 64KB
SHA256 6321c10d17285bb38bb3cb8af30d16626008d3bf08d8eff1ecff27b978789063
MD5 65308bcb1d5c203902340a725ce9b036
SHA1 ddafab111dd7462b56e5f5ef4a61ca78391ede17
SHA512 5a2b743c9179b59739b153e22f141dc71cbe260b406d989626e151e14fb165d2d13edb418004e8b253eb4dc61cdb1cdabd091e24b6df64aae0e014922ca416b1
SSDEEP 1536:thrTPyN3WOKxSocQ08JzhS8V1iL+iALMH6:ta3Wb/Lw8V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajanck32.exe

Path C:\Windows\SysWOW64\Ajanck32.exe
Size 64KB
SHA256 020bfa35d4afc8c1794d4969435a4fed10f8850b86c7ec38648b75484743f9f5
MD5 69746288599f52cb1a57e591d8d0abc4
SHA1 f8bdc2ea518d8a267b2382391b36c99c2464e32e
SHA512 7cd79983855d7a4748d5b8967eacc4a9f5ebeacd5b5fd6edd47e3e4b63ae46f01086d2c633205ddb1960f7e751fe274c99ef18dcfd5a7da9e7f082a4b15714bd
SSDEEP 1536:/mVgRylKivTYtqqtvUbhBBbObpf+V1iL+iALMH6:/ZB8Y1+V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ambgef32.exe

Path C:\Windows\SysWOW64\Ambgef32.exe
Size 64KB
SHA256 c1f6d205e1223d521b055dc05f54bffb9c0caafc69c5182aea1934007c8dc8cf
MD5 9a5c251dfe76e547f8ed30414ea512c8
SHA1 aa36d7cc5ce32651bcde7a4c70017b0a9369fd9c
SHA512 f10660044383cedbc1c13cf5145ee78fc2e6dd7e333fd5569b664569185cce996ec19994b6818042d12027e3943d10da95215201076d1a673804a52f7bfea18e
SSDEEP 1536:NkWGnXURrBdYkxFo7AJ3jvCMYYg/vg/j355V1iL+iALMH6:NkHnkNd5x+W3svIL55V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amddjegd.exe

Path C:\Windows\SysWOW64\Amddjegd.exe
Size 64KB
SHA256 33f9aa8c3be10f7f5e55c1a85a0ee605114b565b76d3d7d36f51561242bf629b
MD5 ac717fe21f75ea6b7a835e14ae3026e1
SHA1 83645b5dc263250255f76f34072a49cba4e6b130
SHA512 f61ad8afa4264363484f12273ad48cf39ead40999fe69316843c3f3e8cdf47c68af33aac077fa03a390a8cd4281c6a69f4ed7b757d87bd0ec1b92b01b9808e7f
SSDEEP 1536:08cbZUhYl/p4qgUEoJ7i4WAZV1iL+iALMH6:cZQYl/pJrJWHoV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anadoi32.exe

Path C:\Windows\SysWOW64\Anadoi32.exe
Size 64KB
SHA256 1827eac63baab9376a6ad1bb31ffd683b29066d231e991c96e57c8f19fb60950
MD5 b5aa7beb6d6f5335c7c8a05b67634a11
SHA1 22df0191e0cbce853e231ba89d3e2a3e3b96c148
SHA512 76586040e86c08350143bde34a735a33013f2626c978489f0b4f1f02a7b3ac8c0102cfc0aa2bffc45ef5ec8ebae1434692749382567569aa2a3801dbc043f771
SSDEEP 1536:U6oW8ijTL+9GuHje5KgmxzbWNNI2tL6V1iL+iALMH6:U6okvL+E3KgcmN5mV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anmjcieo.exe

Path C:\Windows\SysWOW64\Anmjcieo.exe
Size 64KB
SHA256 8efe3561076d10a38902efc5641631557cea38a3792b032936b453aef44f6c2f
MD5 89cb329857ed9edf954d179cb1a93f6f
SHA1 e417ea9b5488210a4c0fb93164fc8b62422267bc
SHA512 90b33e56e3a99417109f76c841388de4b7f77349149034d33051c2b319bdc7c10430b94b9cb581cdff86d037371b85a441a69efe597d73a96226c8bf0cf4ed64
SSDEEP 1536:pxsNcHJJdynTolwSDuc3s1N/mjYmV1iL+iALMH6:pxsNKdynTmDuc3s1NejYmV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anogiicl.exe

Path C:\Windows\SysWOW64\Anogiicl.exe
Size 64KB
SHA256 b274158758c8dab7b15a83b3370004dbde810fb950caed2d5e9fea74687487ec
MD5 ee8b05cf3a977b3f99b6427c1c759933
SHA1 8ddee67d6cf216ea9b1a89c8c1460320aee165d0
SHA512 30908a3e129fc4fbd2f10cba4f168414c89a31e8fd6244b4c07b0f8fdba4cf3fe5c53d2f6480780b52fbe402e46b0b57fe39e4cbf587ce34e188a58c2604df5d
SSDEEP 1536:vC0NPMDKULZyCLd4lu9YtuWfijF373viQrTY2V1iL+iALMH6:zPEvLZyVOYtuWqpr3viOY2V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aqkgpedc.exe

Path C:\Windows\SysWOW64\Aqkgpedc.exe
Size 64KB
SHA256 8f09479d5218db97368406d6a32e59fbfb1c8cdf42c41ef63ee7fbcdba4cfb0a
MD5 c6ad820b3497ea12e6642781e788b396
SHA1 5184d50464a87f71d163fc7320d6fdb8694d176d
SHA512 b7d219efec0876ab32964cd879c10eaa76f24e722b9e9930d3afde4516b5694d93a4d9ad3237e82b3cd6869102cba6c71adb2d4265764ff78847f3a12cc2a7a9
SSDEEP 1536:+Lk4d1sPyZ3UZ1n6Xi9u9SDRywV1iL+iALMH6:2AyZNS9iSl5V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dgbdlf32.exe

Path C:\Windows\SysWOW64\Dgbdlf32.exe
Size 64KB
SHA256 0340fff987fbc9f23627881404e0c4190923ff43469859dfe00a3c7c80920686
MD5 e23949abaf3de6a66942259dfe520ac4
SHA1 9b16479760eca1542bbd6d98858f6ebce7ad6da0
SHA512 cad417e631f4f6a2d06debf6a641c16fb04205659e57336842c5f58595f6b36643a556e9bdf22681a1e976ac318522c6e9a176590b626704a8c38fcd050ab048
SSDEEP 1536:6GKB8p1CvsP7J/SxmAer5sA4rV1iL+iALMH6:9KGpLJ9Dr5sA0V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmllipeg.exe

Path C:\Windows\SysWOW64\Dmllipeg.exe
Size 64KB
SHA256 5b3c70c23a98d4e2e7778bac2aca91f11295461fa20783d804865bbae80cc697
MD5 88e99c887defe2c0d05bd3ae59578777
SHA1 24c66489d61099bce31fba555fa1433b03d65fbd
SHA512 557d2a561a00190057776d1c28b932b9d93aa76742efe73f549195aaeab23c16c5f7812ac9f5435ba324e772bfaac3e039db99b3e59e379408763242af3aed8c
SSDEEP 1536:xO3sNIQl9QhHGKaKidLeGeSGV1iL+iALMH6:xA2lmHGkUGV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dopigd32.exe

Path C:\Windows\SysWOW64\Dopigd32.exe
Size 64KB
SHA256 3a207455fd7ecb11320dc95a93b026dcb7d8d9c9d43912ad5429a46721776bbc
MD5 e668a1134abab0024faee0aebdbf29a8
SHA1 aa6e1860903b18f79c74b64978ddc81c707f9270
SHA512 2d98effaee19f339a7c62344cccd435cd582ee54c4053839c32b3b2af7f6556e65f9f5e150a350c6e939deb4af65fd050d925cf740df6a2e4b3f6a8b30b8c80b
SSDEEP 1536:DoW9LqN+37SOuKBvoHngmU0GhGes+jU3ZlXGHpV1iL+iALMH6:DD9o+37SOuKBvanlU0Gvgp0HpV1iL+9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pcppfaka.exe

Path C:\Windows\SysWOW64\Pcppfaka.exe
Size 64KB
SHA256 281881ad40c6794b69a95c7c069c0c3876d8d3777e9757e7024998a8ceea2bae
MD5 f168e83ac9b5f70b256dfc8613d7adfe
SHA1 5db298a34a2336120923c6f3fd5c5c3f6d9b07dd
SHA512 069501dc78f970e4e438142b5731c171705c1b828637495d0d7398065c5cc050e0e0f6034466a834d734a1028abd74ee230d5175189b92cacc5140cba9a398c1
SSDEEP 1536:PoNLIw9adpnWBNGfBWkgpLvBzXRRRRRNDCmV1iL+iALMH6:gNLmdpeGoZdtRRRRRNOmV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdkcde32.exe

Path C:\Windows\SysWOW64\Pdkcde32.exe
Size 64KB
SHA256 426184365930097762dcacff044f32858aeac040f070cb8041d5e89da4621929
MD5 c80ace299a68a3ea601f644367d8eac0
SHA1 c44799b9e58231ac6a4c783949f5e320036b909e
SHA512 6687bddbfd80d8f7d21c08ac89fddd5964ec48f10d813bc32e7a03f1931816fefbb9fbb849e4287467b796ecdbb0a5035d721dc09cc7d5aa7f085a2572515a22
SSDEEP 1536:MPh0DHDfBsZVCd19r5+W7WX3EBV1iL+iALMH6:MqjpSkVrQWgMV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdmpje32.exe

Path C:\Windows\SysWOW64\Pdmpje32.exe
Size 64KB
SHA256 193b03fa69e97b6a08ebb7d2d43adb50cbb6216d8e0056a8aefa61719c972f58
MD5 f41b75f95e00bd65524f560225eec570
SHA1 cb88b7d176e94726eda979361b437e98f1c6ca17
SHA512 9fbf6775d7984d8f22863947e36c3a636099ed4bdf90e85530cebd0bae1cd456c35fa2623e526c8519ace8818fdb5cc23bc5f08843cf5c8144a4755eb63b3f71
SSDEEP 1536:8EVFWdye14b8Sl1SQCfzN3l4qMK/T6V1iL+iALMH6:rqX14L3ggq5/T6V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdpmpdbd.exe

Path C:\Windows\SysWOW64\Pdpmpdbd.exe
Size 64KB
SHA256 3b37185798b59a91d6308b733966656de16a9bafc9beae783f719008860b7b35
MD5 6029a998b0bb044ba230e25e6b6fbdc4
SHA1 5c0b7e80615bdd0574ec00f294de32cc9d65c8c2
SHA512 35abd7ace4220a73c646a682cc220d89195c757d076a237489a9f272acffcf35b865bdca8705c0640a76e8a68ea8c28eb628f8a65d7f10f5a615b4e9bad73a02
SSDEEP 1536:DNtZ3DstRVsg9NEfYcXHe2yV1iL+iALMH6:5jApp9NSHe2yV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgioqq32.exe

Path C:\Windows\SysWOW64\Pgioqq32.exe
Size 64KB
SHA256 e03e63ef4c8e08a31b361cb26679faf02d6c40d0e4484932f751e805ecd2da58
MD5 fe0b2fac52b61bf42fb3a0570c355dc5
SHA1 9825393ddbef9b826ef7cc11128958318a4bfe7b
SHA512 c67d8986e98512ce754419aaca13521bc5a6498eac77217eb562c32f63c129fec10d014d580f79a882fdbd3d921d6c65ab92e2c3d299c321dd5c59c5fb1ac312
SSDEEP 1536:tZdkmXA4/0v7EzV/J84/sKdTHV6X+V1iL+iALMH6:tPk20v7Eh7//V0+V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgnilpah.exe

Path C:\Windows\SysWOW64\Pgnilpah.exe
Size 64KB
SHA256 f3a5bfc2622469d483aebcc35e7eb447929a64f491f3c1941d98d1a24504312e
MD5 c6e1186f52769c21bc81ef1a44c1036a
SHA1 be8369a4a10ec093919ab56fd185062b8e60cde8
SHA512 35d5789a2c7f11fef007361aaf822e33b948319ae431f1631b16cf6760294def9267f84e446cc3c87761567600f3d9ae9461a4ed34d0fbe12f9a84f63d9987d4
SSDEEP 1536:t9vCsFc83T+hW4Al15ncu7xV1iL+iALMH6:48D+hUl11cu7xV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjjhbl32.exe

Path C:\Windows\SysWOW64\Pjjhbl32.exe
Size 64KB
SHA256 481440bbb34dd40f64d8d6796ec2ee6a4930dcca8f14b15db9f7471648ff742c
MD5 bfa3a2fd0f4e0b53c4afdcef867bdf38
SHA1 592c268fd9eab5b2887930133105ae2786650f0a
SHA512 319feb5a936b0c89ebb545eb163d948eeddfd97a0489ee212586bbd4dc58c60154246e5c217efec4a637934b99193829589ddf7cfdd60d2f3603f945bf75a9f6
SSDEEP 1536:nusUEJUZjfWr6HfDDTpppn6L7I8V1iL+iALMH6:nuiJILtbpppn6PRV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjmehkqk.exe

Path C:\Windows\SysWOW64\Pjmehkqk.exe
Size 64KB
SHA256 8d7010be5394ff52f42f56af3f5223c5b32a2db9fe8267a67ba2f90d9e701a4f
MD5 48bc41868572ff2fa2248431546aee16
SHA1 1f4f35c14899f4a4f69981a1567b3c889d71cccd
SHA512 28841e963a7b5a9084047ca23dd2701490482c7a657b29859ce7b179cd759fcede6485f8354492e07f50fff203157d26ef62b0dec05db683961e6d7a2ea9cf15
SSDEEP 1536:LgHFiHxXLQPL/L0HAok5Rn2BXEBhCq+3+V1iL+iALMH6:LgHFEXm3cALnSU6qO+V1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmidog32.exe

Path C:\Windows\SysWOW64\Pmidog32.exe
Size 64KB
SHA256 a90d07459ea1a4fba51324cbb82dccc5844ae334c9a4b7e1fa8e3844bfb0043a
MD5 3f4f4d681be6ae56987303405a3bd365
SHA1 138a2d4bdd9164f129e975abe4bfa6f11db82573
SHA512 dfc7478966cef38688ea83e859b2dda5097a4eec363462acb65f09d2f9c70e91036ac24c5a4ef03bb3435090d53ee797a8f7809feb6abdec9745405983618fee
SSDEEP 1536:14mIlVw2gnChM7tOtD/KQuUl5lfmV1iL+iALMH6:14dlVR/sQ3l5NmV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnakhkol.exe

Path C:\Windows\SysWOW64\Pnakhkol.exe
Size 64KB
SHA256 a4f33a7c273df1a47bd53b7585ba0c5a8b9d6f7e2ce6ee215a4cc1dd56c5994f
MD5 bc115e4c5b66b43ff16d547a9036626d
SHA1 eb4702a1c8be292c2f653872cfe5124317cb1ead
SHA512 ae8ef67c237ecfa59399d648b60bf22162cd5511503e19f82c82796b04c5169bfd2c437633fa96fe5e3d54ad2b6fa7543b29fa4f1d4fdd291fdecd87621e8b7c
SSDEEP 1536:bij0ERVXiuWrFeoghgtXZJaZCfbBEV1iL+iALMH6:qyrMmtXZJaqaV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pncgmkmj.exe

Path C:\Windows\SysWOW64\Pncgmkmj.exe
Size 64KB
SHA256 56f2658e9b9728d3dc3e85a01b291bad764a1739ef98976593de43a47ad3f3a5
MD5 0d46b3700ef6d9871767d443c441041d
SHA1 12123d79694bdfd25150db1a412d465c59c05db6
SHA512 d49a2c244fd4779878e3764690050297a2ef2aebb006f82218625d9411c46410aa7426b2be3323097fabb37e24b92e87383dae40d23819d5a0f5bcf75f08366b
SSDEEP 1536:tPS+8n/qarshxtu72Ck8E4SLrO4PlFQPV1iL+iALMH6:I+8/qarshx872fP4S/9GPV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pqpgdfnp.exe

Path C:\Windows\SysWOW64\Pqpgdfnp.exe
Size 64KB
SHA256 cc5e66fc0747ec38bf1547e5276ecefa418a381d7fd0dbb9c956ac35926c0f45
MD5 07440cd47ba0736aa91e8c602a4027b1
SHA1 8538974cae0195bfa8e7f23f0172411de950dea3
SHA512 e2c72f2d1dd8cf85cd8cf1fcd319e402350edb1b637d4188fd57f0be536ee4f9f1a0958f6f6686351d917556d5029684953220cc066087d06f4dc332f5f3e0d8
SSDEEP 1536:UM7vszxdlCgHVCop4XeIGW3qV1iL+iALMH6:XLodlCmVCaIGW3qV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qcgffqei.exe

Path C:\Windows\SysWOW64\Qcgffqei.exe
Size 64KB
SHA256 46a81c83480e6138818a5a83bfc078054fbde77f85f71dbccf9c1965f4fe52d1
MD5 2381f0d08a2cff7be0ee86fea0a71a5a
SHA1 ae1215c0156e645d86ac3bfbc34c4756c232a590
SHA512 858e61a27fe307ee6bf8c12c69df36e0c96ac2af89a9be2d2871f75e5d7d240333660a6262762897a748f1fb0f93d21aa387e9966ab0833658f83b17843a494c
SSDEEP 1536:aJtm/W61DHm2qzzFdthdWwEhYlDOKV1iL+iALMH6:sg/WjLRhMwPDOKV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qdbiedpa.exe

Path C:\Windows\SysWOW64\Qdbiedpa.exe
Size 64KB
SHA256 58c58f66e631db0b23f943ffb9e5271dbef61b75029be5325a199396d1e2de15
MD5 8fd8e3b9799c0f84a689ee1703e445f6
SHA1 885a204e655269a2a17f1c79a5ae94f917eb741c
SHA512 fd38bb9c2411db3cb833db61d67580236bcdd7b65c5f6b7f338592d1ea50748608984fbc4a7c96a0252bce64a26d9c16c55f3b59e776917f7eabd3f12452c972
SSDEEP 1536:miqDqaG2DpQfZxaqbd4Wd7gi7ib7FTyV1iL+iALMH6:miS6ZUqdCb9yV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qgqeappe.exe

Path C:\Windows\SysWOW64\Qgqeappe.exe
Size 64KB
SHA256 a04362a009c5aff1cc956c8d251a52f01a20f29318f74042f2c2c3e7e7276683
MD5 7c9670cb9e2cf82d52730d3fd4a85f15
SHA1 1aa70d9ce1fa6807f168fd8ebfcd65d8dc509fba
SHA512 4b919ed78096d0b1c632e40f7f037e58154db760cd3e9c64ca36868cf82bda1298e18a506175eecdbaa1ade8e2baa68a18688ddaab0d8c130536a7b4836e2605
SSDEEP 1536:OOY5YavfdbfmoEnZt6InGp0oh3HIgHV1iL+iALMH6:850FthnIeYV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qnjnnj32.exe

Path C:\Windows\SysWOW64\Qnjnnj32.exe
Size 64KB
SHA256 356547b039a5b491a45f4673aa252f0247bd9f6578ec9fc01c25e8c6379ba771
MD5 0789eff08b6e06d62da73a87514b4802
SHA1 dd555685180f638578397bcf4a18127f8ef6b36d
SHA512 33aa60eb8d9eb2eee65b6b9b8a7535081bd601df40e649086ed70fcfbf7e6e901668253f76960df3da7cb9f41873d4e778b690c2f66675102232900d6f62dde6
SSDEEP 1536:7oBKILCEBnpvB9NsLZVVNXM15a0V1iL+iALMH6:aKILn/BjWz9y5nV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qqfmde32.exe

Path C:\Windows\SysWOW64\Qqfmde32.exe
Size 64KB
SHA256 4571edfbc43f27aa9904518a7efe5b13d3dbb6928fb903b53cc1b58463127ccb
MD5 27d80a0f66b4f2dfac73530fee1cd10e
SHA1 ad5cff678cba490869e222056b5b5152cb61d2c3
SHA512 8fff101dde108d170786f58db4dc65d37aec7ed044ced77461366960c9787cd15caae3dc45b551d2a5f808a5319a8db55c286201c5c794b80e8b4d8f19b3a759
SSDEEP 1536:4fPZCMbWIdBXdN6sYveUFEvcEjCCkV1iL+iALMH6:EPZv1dBtN6VckV1iL+9Ma
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qqijje32.exe

Path C:\Windows\SysWOW64\Qqijje32.exe
Size 64KB
SHA256 096a35886536e67907761aa7f8d0c066dfa4fa713cb7dd59f3a570be02634f8c
MD5 bf6b46dc15fbf179def62e0ceea949c1
SHA1 601304d41f7627eb20e941efb9df8620bbb0fb18
SHA512 fc251c46ffdfaa2838b761b4fc3b814d089be6da0c7bd50511236ec1edda179ba2b36a98fc59393ba5ec6725caf87e04a54f634511c9f0a23acb13286c79516d
SSDEEP 768:hvvDFXMdMFh23/TlpIUW3Ja4KqH2Ym8gJRcc/1H5Z4DMXdnhgoEqErtE1oHEzkAr:hvbydjP5g3Jl7Hq8+N86V1iL+iALMH6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-414-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/224-438-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/364-534-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/364-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/364-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/552-297-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/684-335-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/972-299-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1072-588-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1072-56-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1088-144-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1092-128-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1232-384-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1352-157-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1384-462-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1400-522-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1460-329-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1652-285-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1764-396-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1856-323-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1868-275-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1872-351-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1892-528-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1900-317-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1980-341-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2004-504-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2052-554-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2052-17-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2184-269-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2248-492-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2276-420-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2284-402-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2292-256-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2300-561-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2336-40-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2336-574-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2344-510-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2388-366-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2500-233-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2628-426-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2652-29-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2660-224-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2776-390-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2824-136-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2844-444-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2848-72-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2860-216-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2868-486-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2880-263-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2980-311-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2988-169-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3032-353-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3188-468-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3208-120-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3284-548-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3308-432-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3416-516-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3644-450-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3760-290-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3868-64-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3872-184-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3956-97-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3988-248-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4072-88-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4084-48-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4084-581-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4092-540-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4128-474-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4220-177-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4284-372-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4288-359-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4312-456-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4448-498-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4480-81-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4496-305-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4576-360-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4584-109-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4588-547-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4588-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4592-555-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4596-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4596-567-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4792-160-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4900-408-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4924-113-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4928-378-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4988-192-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5012-480-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5028-200-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5040-568-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5076-541-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5080-240-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5092-208-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5148-575-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5208-582-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5268-589-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads