berbew | c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2024, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe
Size 96KB
Sample241230-de4apswkgj
SHA256 c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a
MD5 830c3745d37a4c0c2ea7e118cdda7782
SHA1 e7d24807134c13422096ef56631166c896b8b44a
SHA512 a8a56e9f16122c395827076e862b4626d5df503099c1dc4e34e4d73db1f2f88a3ba79ce05bf728c6f4a10646fabae0aa54eba517e2276ae6c3e82f3acff5c911
SSDEEP 1536:t+yLc8hCQ7YDaAdPqlgpzje79euzqjYhgN19+2L27RZObZUUWaegPYAS:Hc3RqlgpzqhqN19D2ClUUWaef
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmidog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfjcgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdpmpdbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2112	Pmannhhj.exe
4388	Pclgkb32.exe
4412	Pfjcgn32.exe
1704	Pnakhkol.exe
2252	Pqpgdfnp.exe
4976	Pcncpbmd.exe
4004	Pflplnlg.exe
2480	Pmfhig32.exe
3344	Pdmpje32.exe
5028	Pgllfp32.exe
748	Pjjhbl32.exe
768	Pmidog32.exe
1872	Pdpmpdbd.exe
2192	Pjmehkqk.exe
1388	Qmkadgpo.exe
2056	Qceiaa32.exe
920	Qjoankoi.exe
1900	Qgcbgo32.exe
1736	Anmjcieo.exe
2928	Aqkgpedc.exe
3552	Acjclpcf.exe
3228	Afhohlbj.exe
936	Ajckij32.exe
3240	Aeiofcji.exe
3296	Ajfhnjhq.exe
4508	Amddjegd.exe
1748	Acnlgp32.exe
2300	Ajhddjfn.exe
3868	Acqimo32.exe
2336	Afoeiklb.exe
1156	Aminee32.exe
2312	Aepefb32.exe
3916	Agoabn32.exe
1208	Bjmnoi32.exe
1792	Bmkjkd32.exe
4112	Bebblb32.exe
1756	Bcebhoii.exe
1680	Bjokdipf.exe
2064	Bnkgeg32.exe
2936	Baicac32.exe
1020	Beeoaapl.exe
2316	Bgcknmop.exe
2712	Bjagjhnc.exe
4152	Bnmcjg32.exe
4820	Balpgb32.exe
4136	Bcjlcn32.exe
1676	Bnpppgdj.exe
4436	Bhhdil32.exe
3032	Bjfaeh32.exe
1896	Bapiabak.exe
764	Chjaol32.exe
1620	Cdabcm32.exe
2860	Cnffqf32.exe
4600	Ceqnmpfo.exe
4456	Chokikeb.exe
3584	Cnicfe32.exe
456	Cagobalc.exe
3528	Cdfkolkf.exe
4316	Cjpckf32.exe
4968	Cajlhqjp.exe
4048	Cffdpghg.exe
1928	Cnnlaehj.exe
1868	Cegdnopg.exe
1068	Dhfajjoj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kboeke32.dll	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Qoqbfpfe.dll	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Amddjegd.exe	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Pmidog32.exe	Pjjhbl32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qjoankoi.exe
File opened for modification	C:\Windows\SysWOW64\Anmjcieo.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Hmcjlfqa.dll	Aqkgpedc.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Afoeiklb.exe	Acqimo32.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Acnlgp32.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Bnkgeg32.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Pgllfp32.exe	Pdmpje32.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Bcebhoii.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Daqbip32.exe
File created	C:\Windows\SysWOW64\Pdmpje32.exe	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Ajckij32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Qmkadgpo.exe	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Acnlgp32.exe	Amddjegd.exe
File created	C:\Windows\SysWOW64\Ehfnmfki.dll	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bnkgeg32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Pjjhbl32.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Mjpabk32.dll	Pjmehkqk.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Ddmaok32.exe
File opened for modification	C:\Windows\SysWOW64\Pcncpbmd.exe	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Pkmlea32.dll	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Ajfhnjhq.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Bmkjkd32.exe	Bjmnoi32.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Ddmaok32.exe
File opened for modification	C:\Windows\SysWOW64\Qgcbgo32.exe	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Anmjcieo.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Maghgl32.dll	Amddjegd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1616	220	WerFault.exe	161

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfjcgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgllfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmidog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcncpbmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qceiaa32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akichh32.dll"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffggf32.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbpfgbfp.dll"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkmlea32.dll"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoqbfpfe.dll"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjpmk32.dll"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeiakn32.dll"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kboeke32.dll"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laqpgflj.dll"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcmfk32.dll"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdlgno32.dll"	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbmhofmq.dll"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajhddjfn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2112	1132	c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe	83
PID 1132 wrote to memory of 2112	1132	c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe	83
PID 1132 wrote to memory of 2112	1132	c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe	83
PID 2112 wrote to memory of 4388	2112	Pmannhhj.exe	84
PID 2112 wrote to memory of 4388	2112	Pmannhhj.exe	84
PID 2112 wrote to memory of 4388	2112	Pmannhhj.exe	84
PID 4388 wrote to memory of 4412	4388	Pclgkb32.exe	85
PID 4388 wrote to memory of 4412	4388	Pclgkb32.exe	85
PID 4388 wrote to memory of 4412	4388	Pclgkb32.exe	85
PID 4412 wrote to memory of 1704	4412	Pfjcgn32.exe	86
PID 4412 wrote to memory of 1704	4412	Pfjcgn32.exe	86
PID 4412 wrote to memory of 1704	4412	Pfjcgn32.exe	86
PID 1704 wrote to memory of 2252	1704	Pnakhkol.exe	87
PID 1704 wrote to memory of 2252	1704	Pnakhkol.exe	87
PID 1704 wrote to memory of 2252	1704	Pnakhkol.exe	87
PID 2252 wrote to memory of 4976	2252	Pqpgdfnp.exe	88
PID 2252 wrote to memory of 4976	2252	Pqpgdfnp.exe	88
PID 2252 wrote to memory of 4976	2252	Pqpgdfnp.exe	88
PID 4976 wrote to memory of 4004	4976	Pcncpbmd.exe	89
PID 4976 wrote to memory of 4004	4976	Pcncpbmd.exe	89
PID 4976 wrote to memory of 4004	4976	Pcncpbmd.exe	89
PID 4004 wrote to memory of 2480	4004	Pflplnlg.exe	90
PID 4004 wrote to memory of 2480	4004	Pflplnlg.exe	90
PID 4004 wrote to memory of 2480	4004	Pflplnlg.exe	90
PID 2480 wrote to memory of 3344	2480	Pmfhig32.exe	91
PID 2480 wrote to memory of 3344	2480	Pmfhig32.exe	91
PID 2480 wrote to memory of 3344	2480	Pmfhig32.exe	91
PID 3344 wrote to memory of 5028	3344	Pdmpje32.exe	92
PID 3344 wrote to memory of 5028	3344	Pdmpje32.exe	92
PID 3344 wrote to memory of 5028	3344	Pdmpje32.exe	92
PID 5028 wrote to memory of 748	5028	Pgllfp32.exe	93
PID 5028 wrote to memory of 748	5028	Pgllfp32.exe	93
PID 5028 wrote to memory of 748	5028	Pgllfp32.exe	93
PID 748 wrote to memory of 768	748	Pjjhbl32.exe	94
PID 748 wrote to memory of 768	748	Pjjhbl32.exe	94
PID 748 wrote to memory of 768	748	Pjjhbl32.exe	94
PID 768 wrote to memory of 1872	768	Pmidog32.exe	95
PID 768 wrote to memory of 1872	768	Pmidog32.exe	95
PID 768 wrote to memory of 1872	768	Pmidog32.exe	95
PID 1872 wrote to memory of 2192	1872	Pdpmpdbd.exe	96
PID 1872 wrote to memory of 2192	1872	Pdpmpdbd.exe	96
PID 1872 wrote to memory of 2192	1872	Pdpmpdbd.exe	96
PID 2192 wrote to memory of 1388	2192	Pjmehkqk.exe	97
PID 2192 wrote to memory of 1388	2192	Pjmehkqk.exe	97
PID 2192 wrote to memory of 1388	2192	Pjmehkqk.exe	97
PID 1388 wrote to memory of 2056	1388	Qmkadgpo.exe	98
PID 1388 wrote to memory of 2056	1388	Qmkadgpo.exe	98
PID 1388 wrote to memory of 2056	1388	Qmkadgpo.exe	98
PID 2056 wrote to memory of 920	2056	Qceiaa32.exe	99
PID 2056 wrote to memory of 920	2056	Qceiaa32.exe	99
PID 2056 wrote to memory of 920	2056	Qceiaa32.exe	99
PID 920 wrote to memory of 1900	920	Qjoankoi.exe	100
PID 920 wrote to memory of 1900	920	Qjoankoi.exe	100
PID 920 wrote to memory of 1900	920	Qjoankoi.exe	100
PID 1900 wrote to memory of 1736	1900	Qgcbgo32.exe	101
PID 1900 wrote to memory of 1736	1900	Qgcbgo32.exe	101
PID 1900 wrote to memory of 1736	1900	Qgcbgo32.exe	101
PID 1736 wrote to memory of 2928	1736	Anmjcieo.exe	102
PID 1736 wrote to memory of 2928	1736	Anmjcieo.exe	102
PID 1736 wrote to memory of 2928	1736	Anmjcieo.exe	102
PID 2928 wrote to memory of 3552	2928	Aqkgpedc.exe	103
PID 2928 wrote to memory of 3552	2928	Aqkgpedc.exe	103
PID 2928 wrote to memory of 3552	2928	Aqkgpedc.exe	103
PID 3552 wrote to memory of 3228	3552	Acjclpcf.exe	104

C:\Users\Admin\AppData\Local\Temp\c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe
"C:\Users\Admin\AppData\Local\Temp\c11c4cbf0f3a395121bbb8149d83cb8a820987d9aa14ab21ba68f353d03f237a.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\Pmannhhj.exe
  C:\Windows\system32\Pmannhhj.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\Pclgkb32.exe
    C:\Windows\system32\Pclgkb32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\SysWOW64\Pfjcgn32.exe
      C:\Windows\system32\Pfjcgn32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1704
      - C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3228
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:936
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3296
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1748
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2300
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3868
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1156
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        33⤵
        Executes dropped EXE
        
        PID:2312
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3916
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4112
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1756
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2064
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1020
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2712
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4152
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1676
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4436
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:764
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:456
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3528
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4048
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1928
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1868
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2572
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        68⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:816
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1844
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        72⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4472
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1168
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2576
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4348
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4548
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1404
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 396
        81⤵
        Program crash
        
        PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 220 -ip 220
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Acjclpcf.exe

Path C:\Windows\SysWOW64\Acjclpcf.exe
Size 96KB
SHA256 254fd84638a87420c839e8ff778a1b3a2a7b2aa46fa7e0c293b7f9a58624dade
MD5 c43eeb18f8101ec35e85719bcda2a791
SHA1 6453ab15fc6be27d26daac28b39e4e45976cac3c
SHA512 e92c9bfcc929e45cf0b9ff7a61af713ee6e62ba2c97f765871929aeb1c65ae70a9f96e7b9223664f6a38175925005be749eb2aefa1b824a46c38433da144c9fd
SSDEEP 1536:Ux7Ay9DMuRUF8q3NL0S2VfayrTFTU872Le7RZObZUUWaegPYAS:11R3V+hrTS5eClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acnlgp32.exe

Path C:\Windows\SysWOW64\Acnlgp32.exe
Size 96KB
SHA256 e88daab4e77b4a34485f28e6a28e3965140f67275839e13ba9ff957a5c16ba85
MD5 f0e4ad449bc2773f23512141b20354c1
SHA1 2cd8a669fdbf31c4cf1d0b2912a437d4f06f01e1
SHA512 211fb5aa34818a73ce039d1ea05eb75cf2ec6652173587e19624e33ca0de193923a20e926ebdde77c4c1df6d3a9dc2274582f3d565bafeca89d1e3d262c623fd
SSDEEP 1536:SQ09YmmmzuAgPv593K7ve7OGXK812/2mdpDdlU02Lo7RZObZUUWaegPYAS:SfW9B5hK7veqRnDdlUNoClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acqimo32.exe

Path C:\Windows\SysWOW64\Acqimo32.exe
Size 96KB
SHA256 2373a782975e4f38f57c5a406eacda0605c759ca231d79fa30467270578b11bd
MD5 2f1e96be8e24a33d1e2bd699a5c30b65
SHA1 1693fa32998a8faa3e5c1197b1c0beadd82cca6e
SHA512 1109a99a83de397f0e23e5a5e5426faadc4d8a44d748d3d859ee1fe14e2212b79ee05902b7e1b103f1cc17a4e6b347cf2a6b02f4ca7378ae19328827fb2e8bbc
SSDEEP 3072:e5Idr48auUvABw2dIRkwFJ1xG0AP0TkClUUWaef:e5Gr48auUwdIRkwFJ1xG0/kCWUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aeiofcji.exe

Path C:\Windows\SysWOW64\Aeiofcji.exe
Size 96KB
SHA256 6e56adf1e72849face24e7f0090663ecf2392598ce40780b83e0c4f87a921a0c
MD5 bc33f93ba86cfe665a2626ffaf9061a4
SHA1 3a5931d525ef688ce0f7f90283af52fc48f8ec90
SHA512 e403f2c962ccee0e77f98100bfe88a11a297877479243ac80f2d1953a34830f9a1088d24767403b500c6deaa77e56332eb2da48d63eb509bc19768f0134f851b
SSDEEP 1536:mX8nm/i8VaUSoUA/Kk/Ifbtp1iPrIfCwmBhnPy2Lo7RZObZUUWaegPYAS:MpcA/K8Ifbx6eCxxoClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aepefb32.exe

Path C:\Windows\SysWOW64\Aepefb32.exe
Size 96KB
SHA256 dcba6b5201203ee530289cbef676d4cde5095db57ac1944e363211b9f240378c
MD5 ce95aa896d11cbaca165893070795d9c
SHA1 b4ecbec1032288d94bc4558ec16aecddaa7d4e19
SHA512 a6e3201edc49124213cd3f76c8baa61670746f66edcfdbdf89a49fceead7b44a4a3d52c1f23b075da016029036fac35b2540912786912c7934de8b1f4e7e5050
SSDEEP 1536:rEnYGxMNDDtWzY0xk99MkQV/e6ELyU/g2LN7RZObZUUWaegPYAS:KY6kDDp0NU/RNClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afhohlbj.exe

Path C:\Windows\SysWOW64\Afhohlbj.exe
Size 96KB
SHA256 cd9c5a610f4daa85ea14397e3584cfc70b26f7fd8602b0dd6a8e8e77d7c7cb2f
MD5 83dc3740e5cf1f3f7bcf44302d70ca85
SHA1 eacb1850e03451c384993fa3769481a137369b5f
SHA512 68ef7dc6b3d796b7e93d8a8e0176657e44dc5923169be911e52faf8a3a488ede1592c3f3c488e5e0c1c2d81196c7fe1a0aee36f5f31be1f18d0c5d1781e08faf
SSDEEP 1536:VCMw5JpBz9iNL4z/53ii3lTdmRAx2LPn7RZObZUUWaegPYAS:wfpBz9iNszNvuPClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afoeiklb.exe

Path C:\Windows\SysWOW64\Afoeiklb.exe
Size 96KB
SHA256 b989423e65ef09cb1d0d6c05ee0023f83b76184828f7673116c3587af46f6c82
MD5 3cc0f9f7c7ba58277b78759b0adc5752
SHA1 9825c1d95ab2b4ed4e8a12a59bfe00005773775a
SHA512 99bce9d430bcf2396d65bb32a97cfcc1cfefbdd67cd4291189dffa63a37aaafaf13663739c2b9b924b09187309d8a20925646921076c53475cb01f69b4d49663
SSDEEP 1536:Wn4FW02RGLtrVpssssssssd2u02LT7RZObZUUWaegPYAS:jKGZrV3BTClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajckij32.exe

Path C:\Windows\SysWOW64\Ajckij32.exe
Size 96KB
SHA256 3fe3d51ccc0459c083d3d04fa68055237f4af873ec4311bc103aa5dc0c8e3c66
MD5 bb192f9f9e6ab8a577af927d07360f9a
SHA1 22d853a0d5294c98ddd5317bce9f9bf838c4c8cb
SHA512 0b216a8b15bf50346d109e2433cb54d1dd8186c01de5a7b8d93f6a9fb3b2fe829949b9f4082a96b73640f535236d6ed4fb9d9cb3125b8c0a7fbcb6d8469a001f
SSDEEP 1536:WLIsF/JMQDk8/2L2k7RZObZUUWaegPYAS:WLzK2kClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajfhnjhq.exe

Path C:\Windows\SysWOW64\Ajfhnjhq.exe
Size 96KB
SHA256 5b517dc9a59f2d6f9f847af5dbd43ea90f77a2260f61097d8a6f01a04b925812
MD5 b8e2773535c7d776f0ab745cc72ad654
SHA1 7a5b163d9bb6a11874207755721e399eb80d3971
SHA512 abacc06ae416a99702d1e369fdf0e46c2630767116963743c2f0825467f6bc9310ec0a195d97a7c696bf59bf8bd7839980b3bdbbd3820afe851e63e56f00f33a
SSDEEP 1536:r+0cZ3qgGxsSWa64Fo+rw+zHlD2L37RZObZUUWaegPYAS:r+RdqmMjDLm3ClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajhddjfn.exe

Path C:\Windows\SysWOW64\Ajhddjfn.exe
Size 96KB
SHA256 889482d9e4a2a3b3b45ebcde48a623dd6b92defd679fc03e5ef8600f174ac248
MD5 3c7e6563bc82cfa6603a31f36d000803
SHA1 5a7386cfd649d7831089e2b113e604ef3531c1f3
SHA512 54a451236495b8ee171c12ae5daf5f4b8c46dc727b978b68210d8d09a851815b6626f6acabc8754ae3f263eff21a109956757e292ecb779f56b401110ed90400
SSDEEP 3072:JL2D0bQIIIIIIIIIIIIIIopYSClUUWaef:Qo7YSCWUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amddjegd.exe

Path C:\Windows\SysWOW64\Amddjegd.exe
Size 96KB
SHA256 43bffa4c8cfc80d822972bd7c558b220689f8c084705f9805487ddbf57f20f68
MD5 0c1bec87416e3b0eb6db0eefdd965fd4
SHA1 edd18d2893a31300ee8c31e4b41fbf8917f64bf5
SHA512 117e291d789253a1559234a66e302993b7ed0590013f55235be972f3fd08b778037e161e1b6be97ffd1aa15d56956de58155b33acc63d7d58a8d933150a97586
SSDEEP 1536:U+o41rJgONdgjalL/9aZup06visRl2LIv7RZObZUUWaegPYAS:Uz4JJ1T/Y6viFqClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aminee32.exe

Path C:\Windows\SysWOW64\Aminee32.exe
Size 96KB
SHA256 79acef08e847a838ffa8e61ea6a00a86c0cb357ace60e6b977239cf2e01bb9d0
MD5 946ea40481d24fbb83894c0328b74366
SHA1 4e7113335c4a8ef56a733e9d3f7a60fbfe8670c6
SHA512 fcdc0a60d369446ce1e4bb484270490a0c2ff3ec1e106ec6d75709a6379d985cbd6a4844717ea9617a116ba302b9f953a673ef2370837595789f8c26e1e6e77a
SSDEEP 1536:KnNo6+xgI7PxRHZ2goWGjPbSOsIwE6zMS9lQ6V2Lj7RZObZUUWaegPYAS:oOhW6xRHZ2gGjPbSOFkBGjClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anmjcieo.exe

Path C:\Windows\SysWOW64\Anmjcieo.exe
Size 96KB
SHA256 ee3d7b16d2320e1fd04011d1c133217f78d5b404fb1f291d41e84f085ff71b8c
MD5 1647f3ae3d882c3953b4a608f6a5577b
SHA1 f2d9ef7dd629f0a9f78fd29d3faff72727925446
SHA512 95b514c17bda11f01f06488250d04d7945ead5681199b8fb4bdf6f8a7a3683cdaebbd7fb74bcc2aaa965e81174a86bb3279d50838494f87855cfd6a8de8f0785
SSDEEP 1536:gNvy0Tjhq0WyxBt25tUCn34FNCmjb2Ln7RZObZUUWaegPYAS:gNv5jE0WyxT25t74FNTj4nClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aqkgpedc.exe

Path C:\Windows\SysWOW64\Aqkgpedc.exe
Size 96KB
SHA256 6092309f64a665ca0eb3211ce760237230e629ec862899033f7ec0770e1fb6f0
MD5 d892e8dda5e9c5c0d8268fb948f6d9e5
SHA1 830105a49ed583eca56a8d9af496b1ad64b2de0e
SHA512 9ee1ec3fe45a25a21eaf6094e5ac4d9ef6122384923869e3fe3e0ca4f162b5d371d8af71b1d862da524ef982879b3e292474e3fa1be8028c0159f43960abc7e0
SSDEEP 1536:Eo1nBdZuP7/vwsVKF/YuG90mthzVDg2LqZ7RZObZUUWaegPYAS:L1Bdg2/9G90m3VV0ClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bcjlcn32.exe

Path C:\Windows\SysWOW64\Bcjlcn32.exe
Size 96KB
SHA256 f204313ebb159b1422ccb298653c668c0ef65251b7fd2024e04bc6bf6358ee72
MD5 406b4e04d434cd04c0b07c13ca0334e2
SHA1 005b9f9e7fe1dd6eb0d7d7c2b29a1df1aad12094
SHA512 463fbf66118d07ae271bb953096ad1cac9ff00bfa63e7fe5a51036ea0ca9571d62d0b9c2a93bfff42ae52effca2e707a8d026453d1e656a7065a4eaf9de854fe
SSDEEP 1536:tK2Sjc4JleGgE98kVhJk5j5NNrqbUX1XheHQ12LC7RZObZUUWaegPYAS:tK2KJbWE98kVhmzrOUX1RQHCClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cajlhqjp.exe

Path C:\Windows\SysWOW64\Cajlhqjp.exe
Size 96KB
SHA256 ff55ef7fb1ed15f73cebdf489aa5cb8daa969aac16dece77690c4fb6dcf2218b
MD5 59299c145b63787e6736fcac29501adb
SHA1 b364b0226164a6d954e3d17dd60d4bfea3e4e2ef
SHA512 daeef64cdb9603da23852c4548253abc7358eca0e07d457ef4a2304d7ab4734aaff6729d50b0db3cc58b6f87c02f523bbc4b440af0d6858865a22cea827fda45
SSDEEP 1536:pNVP7fVQpptiiVAONUSX2LOG7RZObZUUWaegPYAS:pNVPzVQDoxLS81ClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chokikeb.exe

Path C:\Windows\SysWOW64\Chokikeb.exe
Size 96KB
SHA256 ff97aeb9eea7982d327b84fdaf30ebfedd76724f758027797a11cee9d4fec3fb
MD5 85935f130df6e703ffb47baa87a094e9
SHA1 68a50bd4277e4b0cb9433313b55e683f1bd90ede
SHA512 0769e03cec0fe811edcb8854414c0568157c347ac3d5d0a364fe45ec53548c40312ad378207086ab9f75285bb682f369bc82b64719f675c1dddd3294115a111c
SSDEEP 1536:KWD7dPmBBfpsyMRLh/i5h7ApYDeoG2Lql7RZObZUUWaegPYAS:XD7dPmBppxMP/ir7KkYClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnffqf32.exe

Path C:\Windows\SysWOW64\Cnffqf32.exe
Size 96KB
SHA256 ddf6d3032e899cbd2a8f348b2893e4905aa008f4de30c8f3ff318a8d8a3dbb0a
MD5 0e8f58090cc659d915954d90cedb8e22
SHA1 8ee2c242a9c75b9868da32490c585800be1d7e30
SHA512 02557b2fd41607d568e571d1213134e561b4cd76c95edf05ed608a63084cf3158472e62648aa213d753ba50a138d3ab8b985b3bae016ac62520518aed03d0bc0
SSDEEP 1536:ZcL7vIJ2CsP24Ty8k5GwNNLuke/FR2L77RZObZUUWaegPYAS:iVCsP2ukDzLukedq7ClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daqbip32.exe

Path C:\Windows\SysWOW64\Daqbip32.exe
Size 96KB
SHA256 a4ab4640e12846eac07e63d007fc1d07b034ae05ff026f3de89a5f625b00354d
MD5 dc46d01398344ff7400c47ee775d7963
SHA1 232bc5dadc5f5033326bf250ce5498bcf42966b0
SHA512 3cf48d8cacf312f99a1865a32f43e93a61aff1606c61ee20c2489c019e16cfe273d9ca1f8e041f8855dc52c21454357988b82e68c9bf32f7631cdeeff815880c
SSDEEP 3072:ITUh/UdTo60rpTAMQQQ0sb7SiClUUWaef:I4MdTo60GbSiCWUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dgbdlf32.exe

Path C:\Windows\SysWOW64\Dgbdlf32.exe
Size 96KB
SHA256 e9e33d51c28015f0d0c84496061a819b14ce82e1eb54af0eac6f29c0361e117a
MD5 f52b098b45150d9c1281a455665a62ca
SHA1 a9f7118ec3dac81b8d3573f75ec58489aeb2f501
SHA512 4dd600225e48046c77e3950a4670375a8efb3ab3c135f694420191d81de297ee92484c0a651e0f20b5bafa1d86947ba724d090b7bd60ce6a0bde4be9b9935550
SSDEEP 1536:szE13kIqlb4oIdU8ccRtnl2LCe7RZObZUUWaegPYAS:s4yWoVFcRtnWjClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhmgki32.exe

Path C:\Windows\SysWOW64\Dhmgki32.exe
Size 96KB
SHA256 3498a81ab132bffb4d01603a0daeba7a4838350838664186c1c9fb5f4d15a4b9
MD5 73aa406bf0d27e63167afa22cc13ae06
SHA1 91f4ac7128c9d3d1e6c609148061218b1d50002a
SHA512 add64d625a3caf7f5e9fc7944a8294070cb985ee1673ddf39babd098df70cae3b66c8b8c9785a44317feab5247db224771578bbb36bc00a9243088f7ffd5801a
SSDEEP 3072:wjDeXjOEI3h/238TvNtR5y5fPuMS3Y+wClUUWaef:wjDeXj5I3h/238TvNtR5y5fPuP9wCWUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pclgkb32.exe

Path C:\Windows\SysWOW64\Pclgkb32.exe
Size 96KB
SHA256 16d8708bf1a46e958ad0a0be1fd47f703cc3a0b65d7cd6b5936692e6e88c580c
MD5 e74a3fef61da219ca5cc070ffc004918
SHA1 5032eff55800a190ff8b87b9f4637f8c240f3cc0
SHA512 a6e3fbc5eeeb972f1f82579521b2a343680f3eccd5050f4893fa58a080feea558d9339416fb8438582e27bc18521e344c66d4bdcc5df50fd8a0a8fd57429b5b6
SSDEEP 1536:wTaSzK3SFn8O/oJGqd/Sa7m2WTr72LV7RZObZUUWaegPYAS:wTZx82oJGG/W2WnYVClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pcncpbmd.exe

Path C:\Windows\SysWOW64\Pcncpbmd.exe
Size 96KB
SHA256 7ef6359916698626d649bdd321405e74dba218c0b129bc1fadf5cf9887dd4419
MD5 c8f2cfd3091bd6db2124f87f2bdb4087
SHA1 efdaf1e4329405309824d380ec11df3e2aa71357
SHA512 22f9596a00e0663d6cc5cb4cce2a2356a0e0841d5024d43334e875cfcb9a5a0a3bc20f12aabc8d622c1fe5e9ef7c2d5135db19508d643cadce9e6758e3b1e11e
SSDEEP 1536:c9SyutUdLPbOyUQ3LD8DIE2LB7RZObZUUWaegPYAS:lyGcjO7WLAsdBClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdmpje32.exe

Path C:\Windows\SysWOW64\Pdmpje32.exe
Size 96KB
SHA256 45383db011565a9f78a064939f9abd98afd4d7b0e3d99b08869fd45934a3ef03
MD5 3cde0ec3d75950e9fb25dfa0e9802c6a
SHA1 386c8f5c1c70db0438c2ae43ffbfe5256309ca0a
SHA512 42e346c41bc2897342e09cd14fc9d8e622a1b80bf9d89fa13c143a7a05369166700e2b59e2963b3c4995b204a2771dea042f2a6b7d68307288f324f7fa2ae3fa
SSDEEP 1536:hzpGAANP1kJ481rIoNN/+2L/7RZObZUUWaegPYAS:DGAUPOJ4Urh7/D/ClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdpmpdbd.exe

Path C:\Windows\SysWOW64\Pdpmpdbd.exe
Size 96KB
SHA256 9d6e999a97d13f15d6d790fa2266c24a215b5b8b04a698a8d120fb0ba187b59c
MD5 517febc09a8a53bbcf1666ffcb63774b
SHA1 35c0fad60331cc6cffb9e4a18773687ef57cd484
SHA512 f199d3d50bde0707e867adeddf4dfe105d0d862f5feba3baac429e271ce0430df07ed3c3a735022c9a11dbe2a837490cefe7509e82ee2a99f9e00a9c7d81db25
SSDEEP 1536:EfRSh+U3CgkdQRxAVHeF2L77RZObZUUWaegPYAS:EfRytkdQ8He27ClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfjcgn32.exe

Path C:\Windows\SysWOW64\Pfjcgn32.exe
Size 96KB
SHA256 6c7efb05564ab13c825e1d4feb426041f3da642ebd8c79906ea671f2dd9cc218
MD5 4dea84a9780e19b0b16406996a4bec7a
SHA1 4493a7d230cb42bc8b5a044797530e4cba7b6087
SHA512 76e75e38669b56767b7caf7992b6407dd812be7e0286281731e412ab9df1eaea97ec4dd4b6832ff2e428ff0553ac7d0ccd05075e1d80226c09146bdccf71fef9
SSDEEP 1536:Bl161okpukKiOU3vLFYdAYelYnAEQyfgK2LH7RZObZUUWaegPYAS:B2DukNOyLFYdAYe0AEQy4XHClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pflplnlg.exe

Path C:\Windows\SysWOW64\Pflplnlg.exe
Size 96KB
SHA256 b49790deb0d8fe75e8bd64c6e6421e5d637fbfcdae141b37b1666fc5d754ff4b
MD5 eb7711177ef2e15e03be6569f11cb914
SHA1 0f24e00364d3113e298abd8ea3b811faa2b06703
SHA512 086e022bdefa58aa0e9d6252f167f7172d46e0531fdfc73b3fbc8a2ef563841c0d23cb3bef3c68833b13967db61f0cb63f5ea8252f3860494fdd7e6c13a29f32
SSDEEP 1536:IXn4BMIgR2fohkpMClpn++vFv/r4zc2LL7RZObZUUWaegPYAS:axIgR6ohiMIn+WZ6VLClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pgllfp32.exe

Path C:\Windows\SysWOW64\Pgllfp32.exe
Size 96KB
SHA256 cf5aed8fd2f29ab5f4703ca8b17887d926fd290f07398342c28e458978dad937
MD5 9f35a32099023b5b2bd83c61534639fd
SHA1 a16f44a21eeefffd2a044a5b70ebbdc93c87e451
SHA512 20dc575e3b55f5097138896d7270253cc7e9b78115077d8f197862b1fc1ee0448e7f77bca12e8daaaa3597b3bde90e949575470f29c362075bb496dbbd1c4173
SSDEEP 1536:qlO5zM5IMGA/llkTo3uML3tlgVOdDyY9sP2L17RZObZUUWaegPYAS:qlOvzmbMo3uML3AVcDy21ClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjjhbl32.exe

Path C:\Windows\SysWOW64\Pjjhbl32.exe
Size 96KB
SHA256 eac000d6209202be5ca5747cfc8624a2e86c4ef45a1dbd63bdb1d4654d4cf1bd
MD5 9fca18470a8ea4aa9d4636800c1abdc9
SHA1 763133552291bc76b7a5a15a0c1c40512e7e4375
SHA512 41bd60395eb1bad75624248965c2e8abdc898f0f8cbdb91acef964c7fd7d5aceb6981e64e4a9e45bcebe3f0874c0bde78c636b345094ca578809c7baaa1bb3ed
SSDEEP 1536:wlSf3itzeUa80rPxWPWEEn6Lm2LQv7RZObZUUWaegPYAS:wlGitzp4SWEEn6PSClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjmehkqk.exe

Path C:\Windows\SysWOW64\Pjmehkqk.exe
Size 96KB
SHA256 26fea8903f573dff358fdc1bb9e1222a001fd6e267e9d6cd4f64b1a5fe0c6a78
MD5 e2aa66424a27d1c82035a87e16cd0069
SHA1 5b7e8df2d8043898047837e9e3c6591638af2730
SHA512 c88e753bd403123807d123b654042d0b3b72fa20d26aa3620a5a1f006aedc889e7613c4c4188216d121156513985b621fe8439b34638c7ccfc697377b5632324
SSDEEP 1536:TZf/UWh2pqlrcYosxnsyCq+q2LB7RZObZUUWaegPYAS:TZfc42pdTsJuqOBClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmannhhj.exe

Path C:\Windows\SysWOW64\Pmannhhj.exe
Size 96KB
SHA256 600973778cdf3bc9d8914c60160a6e699f43a615e4dd204a25251ad2f6c389de
MD5 b26c5a00670e1b5074314aadd9b24762
SHA1 737c253fccddf05b60572a674a572faf78cfda5d
SHA512 0f32edce0ed1b397ba93a9a3b268657e3e61c9276de7280d5ecdbd8e3c67f7462928a2c539b1b0a1642320a4414b13c6f4301463a487f9197c23560d161183fe
SSDEEP 1536:YyPMLvFkAOFIRZk/wiFdnZ6X2Lp7RZObZUUWaegPYAS:W+wsI4npClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmfhig32.exe

Path C:\Windows\SysWOW64\Pmfhig32.exe
Size 96KB
SHA256 2f250dda81745ce5b605c59affab3fef3c18d7711e008e6be33152f127a9364d
MD5 a8b00d2c19bd105669b0eb5450f1fae0
SHA1 2dcef8e96e23938dffbf497e9ea68967587b9266
SHA512 e40b667a0eced37e581e9e721b1e6259f45fed9e789ab6b87a8469959d356957933ef6cdfc373332e77180a621ea1605046f4dd4b18143a907176623c1d00166
SSDEEP 1536:DibQD0FeK1ZHXag/6LYW4X22Lc7RZObZUUWaegPYAS:NCHXachW4rcClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmidog32.exe

Path C:\Windows\SysWOW64\Pmidog32.exe
Size 96KB
SHA256 ccc6f44fa405f51092c4a0990de92f99a002e4004538de273fcea46dd306ebeb
MD5 5c6f9c0da3a1c732bb8fa19b45231b4e
SHA1 e4822574ddcaf72b1b3a3cbd55b237a6fac35465
SHA512 290dd786640d700ad91959c578cfebe7068e5b66d0f91c3625aaae26f2363b97a37819f78586dec83a2cd828553bda2c9719f7ea08dbcc678cb1a4bfaeb62c6f
SSDEEP 1536:d9dSCT8/LEkh95oerLnUw4QNUySlS2Lz7RZObZUUWaegPYAS:d9M/V9Ce/Uw4QuySdzClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnakhkol.exe

Path C:\Windows\SysWOW64\Pnakhkol.exe
Size 96KB
SHA256 0742db4a5ba7ee2110f80518e23903c154c1eae529f05af687929a397f29ddb5
MD5 6539678b6c840536522426e4d90a14a5
SHA1 30a8f3ba1616d6d155070846f0e04eb22853ff15
SHA512 6305e86e47145a55f952bda8d961715eff81c41f557233d8b3b7ad95a87535e2ecd25b6c8a8718d494e426d6aa87a879b78abb8d7f42e09a4d3de47e3bd7c216
SSDEEP 1536:vPx+TngZYBkr+XSHs3bG2LJZ7RZObZUUWaegPYAS:vPx4ng2krCSMffClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pqpgdfnp.exe

Path C:\Windows\SysWOW64\Pqpgdfnp.exe
Size 96KB
SHA256 c5b33dd5bc31ba5a62adf73f80a6773100ac6e06cf03602c1a4b0aa508bfeea2
MD5 42432b70dc1888ffd40a19c15a2dec1b
SHA1 e420257c76457097ab9d89c5a67b85abf8f761a1
SHA512 86f88f2c2f8847e06c77fc4d36961e7ea3df85124b7a50700e80a9c985755d30b7b5ff8ccb686fc0446d796f648b1ab416ac2c38d0b1f200673c45525321ffb8
SSDEEP 1536:03tscJXofWC6Edxk/pHGWq2Ll7RZObZUUWaegPYAS:03+wXzEfklGW3lClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qceiaa32.exe

Path C:\Windows\SysWOW64\Qceiaa32.exe
Size 96KB
SHA256 dc4717201032deab8395fe1997d03c84837ff36bf43912f15848d908e8bdedce
MD5 70205b492abd99574492792ecc06bb92
SHA1 0072c392440fc1f10a2037746caa06ae462b7908
SHA512 ee1a17a634f8c0ff7c393dd19937370a151fc5a4939a22baaa3781430aaec02ece4dc6b59a51954b294d350a37039c84cc5588367e67978476df4cbae9c1351a
SSDEEP 1536:2aC11Fq1D5sKp2vS2LEq7RZObZUUWaegPYAS:2jFql+hClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qgcbgo32.exe

Path C:\Windows\SysWOW64\Qgcbgo32.exe
Size 96KB
SHA256 9de92ac84b71cbedba16e64439bc7c6a828723ecf3835b240e021c35e59ce5ef
MD5 2e679b6bebaaa8cd63eed7ce3542c79f
SHA1 0a29f40e03dbef0588416c0e362fca0450dcbd6b
SHA512 cd13b296c300e7f8e64362dadbd072a42de743f195d70f4061291a6460f1d67f10bf20c165b9e00851ae98c06f0044f232464ce126f343477ff44f025420d4dd
SSDEEP 1536:1QFx/IbWpAs3lzIMl2LJ7RZObZUUWaegPYAS:1QUWesVzI/JClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qjoankoi.exe

Path C:\Windows\SysWOW64\Qjoankoi.exe
Size 96KB
SHA256 44ab39542bf41a078afbd58624fa664d580699c51cf2b7b03f1eccac820d23d5
MD5 820376b315fca6463940286d2fead690
SHA1 d88ff3655785bdae1ddd9eac8b7989d1d1ec4ad2
SHA512 c5a5c1f6217b26a577a8a2619680bf199e14971db1fbeb9f4d42ccb9e5fea3f1bb4d1097d52da1861da62e2ff1bad8ac36d14be820a0c626dfcee40d3a90e1ce
SSDEEP 1536:Emh0jzwt94opFzf09GILpN2xDy2LQ7RZObZUUWaegPYAS:Em+z4bTs9pN25QClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qmkadgpo.exe

Path C:\Windows\SysWOW64\Qmkadgpo.exe
Size 96KB
SHA256 29eb8e172550515c96d940839fb3ef2f40f5260c40132f431e1ebe7c192fa281
MD5 bc2021a7d896ed3ca48e8d51ee293164
SHA1 3d276c6d754289f7fbd4f6ddc158b7fdfded532a
SHA512 dcd5c38048d3ad0492098d97a49d595d8bc22d5e1d9d18cb5a50a1ee817212e9874c723fdbb264635ee824b389d8596f1eeaab0abbb395d6c72fca7761e6ca00
SSDEEP 1536:VTgESuglgBiepiwtQ08MGsqIkg0D3ll2L57RZObZUUWaegPYAS:VEESuazepNQ0RG9D45ClUUWaef
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-543-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/220-540-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/456-407-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/748-89-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/764-371-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/768-97-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/816-467-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/816-565-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/920-136-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/936-184-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1020-315-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1068-449-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1068-570-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1132-539-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1132-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1132-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/1156-248-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1168-497-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1168-555-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1208-269-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1388-120-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1404-542-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1404-533-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1620-377-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1676-347-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1680-297-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1704-32-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1736-152-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1748-217-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1756-287-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1792-275-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1844-559-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1844-485-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1868-443-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1872-104-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1896-365-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1900-144-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1928-437-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2056-128-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2064-299-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2112-8-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2192-112-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2252-40-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2300-224-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2312-256-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2316-317-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2336-240-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2480-64-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2572-465-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2576-509-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2576-551-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2712-327-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2860-591-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2860-383-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2928-160-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2936-310-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3032-359-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3228-177-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3240-192-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3296-200-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3344-72-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3528-413-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3552-168-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3584-401-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3852-563-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3852-473-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3868-232-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3916-263-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4004-56-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4048-431-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4112-285-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4136-341-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4152-329-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4316-419-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4348-521-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4348-547-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4360-503-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4360-553-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4388-16-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4412-24-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4436-353-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4456-395-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4472-557-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4472-491-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4476-479-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4476-561-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4508-208-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4548-545-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4548-527-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4600-389-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4776-515-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4776-549-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4820-335-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4968-425-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4976-48-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5028-80-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5116-568-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5116-455-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads