berbew | 3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90N.exe
Size

79KB
MD5

c2049caf7f958ec8a2794c03de8e8340
SHA1

2afad8779b18357e3e838d32861f0e27b4062214
SHA256

3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90
SHA512

bd10dfb4bdb52272e166cc47fe206b0df6224cc10680f902e31b11160b6e6ec5e489a9063b0cc94536167e0a957128e36d7b9fe3980f70407025f9d6fdaa083b
SSDEEP

1536:5rYRpHRKWQ3/U48N7amRE5bUEYiFkSIgiItKq9v6Ds:GpHoWQ3/U48mUEYixtBtKq9vn

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pggbkagp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oneklm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocnjidkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfga32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1996	Ocnjidkf.exe
2356	Oncofm32.exe
944	Odmgcgbi.exe
1468	Oneklm32.exe
1808	Odocigqg.exe
3788	Onhhamgg.exe
3856	Odapnf32.exe
4632	Ofcmfodb.exe
2112	Oqhacgdh.exe
712	Ogbipa32.exe
5048	Pqknig32.exe
4780	Pgefeajb.exe
3916	Pjcbbmif.exe
4856	Pqmjog32.exe
2388	Pggbkagp.exe
1600	Pnakhkol.exe
4292	Pgioqq32.exe
3928	Pmfhig32.exe
4760	Pcppfaka.exe
4824	Pgllfp32.exe
4612	Pnfdcjkg.exe
5024	Pcbmka32.exe
4492	Pjmehkqk.exe
1016	Qqfmde32.exe
1740	Qceiaa32.exe
2488	Qqijje32.exe
3736	Qgcbgo32.exe
2644	Ampkof32.exe
3020	Adgbpc32.exe
4972	Ambgef32.exe
2564	Afjlnk32.exe
4684	Aqppkd32.exe
4560	Afmhck32.exe
4636	Amgapeea.exe
1472	Acqimo32.exe
4072	Afoeiklb.exe
4304	Anfmjhmd.exe
3372	Aepefb32.exe
2548	Bfabnjjp.exe
5072	Bagflcje.exe
4952	Bganhm32.exe
1876	Bmngqdpj.exe
2584	Bchomn32.exe
1088	Bnmcjg32.exe
4796	Balpgb32.exe
4120	Bfhhoi32.exe
684	Bmbplc32.exe
3092	Beihma32.exe
3572	Bfkedibe.exe
228	Bmemac32.exe
4364	Bcoenmao.exe
2908	Cjinkg32.exe
444	Cabfga32.exe
4920	Cdabcm32.exe
2092	Cjkjpgfi.exe
1980	Ceqnmpfo.exe
2412	Cjmgfgdf.exe
3896	Cmlcbbcj.exe
3984	Cdfkolkf.exe
2972	Cjpckf32.exe
3096	Cmnpgb32.exe
3832	Cdhhdlid.exe
3764	Cnnlaehj.exe
4936	Cmqmma32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Odapnf32.exe	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Gqckln32.dll	Oqhacgdh.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Pgllfp32.exe	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Hgaoidec.dll	Pcbmka32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Qqfmde32.exe	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Gblnkg32.dll	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Ehmdjdgk.dll	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Ohbkfake.dll	Oncofm32.exe
File opened for modification	C:\Windows\SysWOW64\Bmemac32.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	Ampkof32.exe
File created	C:\Windows\SysWOW64\Mglncdoj.dll	Amgapeea.exe
File created	C:\Windows\SysWOW64\Kmfiloih.dll	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Pgefeajb.exe	Pqknig32.exe
File created	C:\Windows\SysWOW64\Lqnjfo32.dll	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bmemac32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Pjcbbmif.exe	Pgefeajb.exe
File opened for modification	C:\Windows\SysWOW64\Pmfhig32.exe	Pgioqq32.exe
File opened for modification	C:\Windows\SysWOW64\Bmbplc32.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Naekcf32.dll	Onhhamgg.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bganhm32.exe
File opened for modification	C:\Windows\SysWOW64\Oncofm32.exe	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Gmdlbjng.dll	Afmhck32.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Pgioqq32.exe	Pnakhkol.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Bfabnjjp.exe	Aepefb32.exe
File created	C:\Windows\SysWOW64\Pnakhkol.exe	Pggbkagp.exe
File opened for modification	C:\Windows\SysWOW64\Qqijje32.exe	Qceiaa32.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Qceiaa32.exe	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Balpgb32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Anfmjhmd.exe	Afoeiklb.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Ofcmfodb.exe	Odapnf32.exe
File created	C:\Windows\SysWOW64\Lnlden32.dll	Pgllfp32.exe
File opened for modification	C:\Windows\SysWOW64\Afmhck32.exe	Aqppkd32.exe
File opened for modification	C:\Windows\SysWOW64\Ofcmfodb.exe	Odapnf32.exe
File created	C:\Windows\SysWOW64\Ljbncc32.dll	Afoeiklb.exe
File opened for modification	C:\Windows\SysWOW64\Cdfkolkf.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Afjlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Pqmjog32.exe	Pjcbbmif.exe
File created	C:\Windows\SysWOW64\Pggbkagp.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Bqbodd32.dll	Qceiaa32.exe
File opened for modification	C:\Windows\SysWOW64\Pjcbbmif.exe	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pqmjog32.exe
File opened for modification	C:\Windows\SysWOW64\Oneklm32.exe	Odmgcgbi.exe
File created	C:\Windows\SysWOW64\Gcdmai32.dll	Odapnf32.exe
File created	C:\Windows\SysWOW64\Pqknig32.exe	Ogbipa32.exe
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bchomn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3100	1500	WerFault.exe	160

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onhhamgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcbbmif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgefeajb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnjidkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogbipa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oncofm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbmka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnakhkol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oneklm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgcgbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qceiaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pggbkagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlklhm32.dll"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoddikd.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgaoidec.dll"	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjpmk32.dll"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baacma32.dll"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifoihl32.dll"	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnlden32.dll"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfiloih.dll"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aepefb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehaaclak.dll"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfenk32.dll"	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcmjaol.dll"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djnkap32.dll"	Qqfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1996	2420	3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90N.exe	83
PID 2420 wrote to memory of 1996	2420	3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90N.exe	83
PID 2420 wrote to memory of 1996	2420	3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90N.exe	83
PID 1996 wrote to memory of 2356	1996	Ocnjidkf.exe	84
PID 1996 wrote to memory of 2356	1996	Ocnjidkf.exe	84
PID 1996 wrote to memory of 2356	1996	Ocnjidkf.exe	84
PID 2356 wrote to memory of 944	2356	Oncofm32.exe	85
PID 2356 wrote to memory of 944	2356	Oncofm32.exe	85
PID 2356 wrote to memory of 944	2356	Oncofm32.exe	85
PID 944 wrote to memory of 1468	944	Odmgcgbi.exe	86
PID 944 wrote to memory of 1468	944	Odmgcgbi.exe	86
PID 944 wrote to memory of 1468	944	Odmgcgbi.exe	86
PID 1468 wrote to memory of 1808	1468	Oneklm32.exe	88
PID 1468 wrote to memory of 1808	1468	Oneklm32.exe	88
PID 1468 wrote to memory of 1808	1468	Oneklm32.exe	88
PID 1808 wrote to memory of 3788	1808	Odocigqg.exe	89
PID 1808 wrote to memory of 3788	1808	Odocigqg.exe	89
PID 1808 wrote to memory of 3788	1808	Odocigqg.exe	89
PID 3788 wrote to memory of 3856	3788	Onhhamgg.exe	90
PID 3788 wrote to memory of 3856	3788	Onhhamgg.exe	90
PID 3788 wrote to memory of 3856	3788	Onhhamgg.exe	90
PID 3856 wrote to memory of 4632	3856	Odapnf32.exe	91
PID 3856 wrote to memory of 4632	3856	Odapnf32.exe	91
PID 3856 wrote to memory of 4632	3856	Odapnf32.exe	91
PID 4632 wrote to memory of 2112	4632	Ofcmfodb.exe	93
PID 4632 wrote to memory of 2112	4632	Ofcmfodb.exe	93
PID 4632 wrote to memory of 2112	4632	Ofcmfodb.exe	93
PID 2112 wrote to memory of 712	2112	Oqhacgdh.exe	94
PID 2112 wrote to memory of 712	2112	Oqhacgdh.exe	94
PID 2112 wrote to memory of 712	2112	Oqhacgdh.exe	94
PID 712 wrote to memory of 5048	712	Ogbipa32.exe	95
PID 712 wrote to memory of 5048	712	Ogbipa32.exe	95
PID 712 wrote to memory of 5048	712	Ogbipa32.exe	95
PID 5048 wrote to memory of 4780	5048	Pqknig32.exe	96
PID 5048 wrote to memory of 4780	5048	Pqknig32.exe	96
PID 5048 wrote to memory of 4780	5048	Pqknig32.exe	96
PID 4780 wrote to memory of 3916	4780	Pgefeajb.exe	97
PID 4780 wrote to memory of 3916	4780	Pgefeajb.exe	97
PID 4780 wrote to memory of 3916	4780	Pgefeajb.exe	97
PID 3916 wrote to memory of 4856	3916	Pjcbbmif.exe	98
PID 3916 wrote to memory of 4856	3916	Pjcbbmif.exe	98
PID 3916 wrote to memory of 4856	3916	Pjcbbmif.exe	98
PID 4856 wrote to memory of 2388	4856	Pqmjog32.exe	99
PID 4856 wrote to memory of 2388	4856	Pqmjog32.exe	99
PID 4856 wrote to memory of 2388	4856	Pqmjog32.exe	99
PID 2388 wrote to memory of 1600	2388	Pggbkagp.exe	100
PID 2388 wrote to memory of 1600	2388	Pggbkagp.exe	100
PID 2388 wrote to memory of 1600	2388	Pggbkagp.exe	100
PID 1600 wrote to memory of 4292	1600	Pnakhkol.exe	101
PID 1600 wrote to memory of 4292	1600	Pnakhkol.exe	101
PID 1600 wrote to memory of 4292	1600	Pnakhkol.exe	101
PID 4292 wrote to memory of 3928	4292	Pgioqq32.exe	103
PID 4292 wrote to memory of 3928	4292	Pgioqq32.exe	103
PID 4292 wrote to memory of 3928	4292	Pgioqq32.exe	103
PID 3928 wrote to memory of 4760	3928	Pmfhig32.exe	104
PID 3928 wrote to memory of 4760	3928	Pmfhig32.exe	104
PID 3928 wrote to memory of 4760	3928	Pmfhig32.exe	104
PID 4760 wrote to memory of 4824	4760	Pcppfaka.exe	105
PID 4760 wrote to memory of 4824	4760	Pcppfaka.exe	105
PID 4760 wrote to memory of 4824	4760	Pcppfaka.exe	105
PID 4824 wrote to memory of 4612	4824	Pgllfp32.exe	106
PID 4824 wrote to memory of 4612	4824	Pgllfp32.exe	106
PID 4824 wrote to memory of 4612	4824	Pgllfp32.exe	106
PID 4612 wrote to memory of 5024	4612	Pnfdcjkg.exe	107

C:\Users\Admin\AppData\Local\Temp\3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90N.exe
"C:\Users\Admin\AppData\Local\Temp\3e8837101085a56090858f04e78ae8afe295e6f7baa9b5fea3ba50625f369e90N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\Ocnjidkf.exe
  C:\Windows\system32\Ocnjidkf.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\Oncofm32.exe
    C:\Windows\system32\Oncofm32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\Odmgcgbi.exe
      C:\Windows\system32\Odmgcgbi.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1468
      - C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1016
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1740
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3736
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2644
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1472
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3372
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2548
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5072
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1876
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2584
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4796
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:684
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3572
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:444
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4920
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2092
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3984
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3832
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3764
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4936
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1388
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        70⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3604
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:1500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 396
        75⤵
        Program crash
        
        PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1500 -ip 1500
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
79KB

MD5
42edb990117fab77e807f440a9d92796

SHA1
ac94525b8261613d5e99174bb8f1560340ad71ee

SHA256
eeb0495b259d21dea0c40ceee90a341acc128ce4e44e25bbd0c2b8ad248d60ae

SHA512
06226b7771a970fbe3b9568014e8e00f3e8215658a5497011ac536f67917b07a1be21d21aefd59305e2612fb603f737ffbd7e1957957baaeb07e06e68c19c3d1

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
79KB

MD5
4b4e2ef77fca23b8c27fa32f8b7fd030

SHA1
bf206d889c3710ecd965244cb24991935e0fb8d0

SHA256
194da70d7e5c485cc063e995076c7693d38c5de649977e6fcd60a2280087befb

SHA512
797e270f52128e6d4e7190bdac98d5e6d7bf8bdd1fb9f1ec093717d550bc1f7db5a48c2a6be1569b85cd61b133ff908547982e3deb1441ba4fbefec978870d55

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
79KB

MD5
4e1e13986e988831b78efc2dbb27322f

SHA1
79fd5fe191fbcd35b92aa57bed5136f9e3827b7a

SHA256
d1fdb55cc325bccb906fcfdb2cd863a2b42326960c6a849a9226f35345933c04

SHA512
cbed29aed6cfc976c13f78d1e571db5575e52fe6851541f32c9ef1bf65bf53724f674ee6025fd0da7b148c84f5f4298d10048b19bde9e7629fc05a9705404fb2

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
79KB

MD5
2c3a34a445bd53f648d3a4073872044f

SHA1
6c6c9d2d3d941a9ed446f3f5dfe5df8a7f159184

SHA256
505ae844de960530bd3e288181a4816c1acdcfa583468e8830089f13e8dac543

SHA512
ce59d73f3449d16afaf33bd9099f7f4f2f40d172d49dde9606cc37e3f422057ba6ed314966b97e0a2c71487a6d9ef36cc7159957110004c841b4778eec38f4dc

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
79KB

MD5
bbd93118784bbed44590d4aeab787f2f

SHA1
73c0daa2a86a445c48b10780becc46645bbbd2a4

SHA256
470d76c3c492440521b755e37ea3f771a3446264972bf0ca746a868d9e70692a

SHA512
f05475ba7b0a46ab737dce86eb884d25e0369ecc5d5cb0150e4ea04aa0b7524eca5193d16dd6abcb5e458cc370206acefc8e2a33b93fd652ba3ff392d629aaec

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
79KB

MD5
6ca3a33be432c0071efa59e979fb2425

SHA1
8e5fa991f04ae0e58dbca2826095e7de77b07fa5

SHA256
173911eafe31dc803ab1921ccf0a984b9dcf32e09aefa579d9318579925524c2

SHA512
a128436988575c2387cbe36e5c4cd8a9b6686d7b9a43be682143b617530e48caeeb936b2de2c68d16aff6d6ed4f015c108b11b297d4cbb1c52ccc82540df721c

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
79KB

MD5
57183802645e599d7094cb89499d2c69

SHA1
6887684c5d93b0d7da353f1f828ceb7db442df03

SHA256
599311e3a47f27903f1b41d653d0c653533d99bba4579c5520bd2c7e30c57d44

SHA512
26fb25f6357b3644fc7b00f03e52933f3c6376bc5a3c525c646f9d8441dec7ac668663d2133731c83fee0fd3bc08814a97ec83f2d5b1dc7e3d40776de2d3aef3

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
79KB

MD5
24231f52379206867607592689a1c878

SHA1
eb28a258dd78398ce7b4562e4a349f65a55abd82

SHA256
8eebbdc882fdac8f07fc98b5c98fe753da1e4871b6da3cd9ec292d3d20bdda65

SHA512
66ab8e5fb3b01099e7a41880f0c6057f8a06be25d082c3d6871afe5ee5890826c66831eb551dae508045d4032cb1612f73fc539551c7f9d4581a510f98d423c9

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
79KB

MD5
7a94c810b0d67d2137dcb368a6004443

SHA1
162e835f5b9cc556d5c9f91a839b36e55ea7fd0f

SHA256
c899dfbec9a830065162401a075e98d355b16e1495cb6ca4aea2433c769a3179

SHA512
59949447fcec694505d8c285eed258066b95a608f980af9eb81eae73c8bdf59ab6ca7d14e757e7c6263a5af2ca916f435312d7a9975f544e819fdf6c07936e13

Download Submit
C:\Windows\SysWOW64\Odmgcgbi.exe

Filesize
79KB

MD5
790f7da7773f9127c862761572100f20

SHA1
4a2f00d61b6633e9ad7dfb0217bdb49db43c5e3e

SHA256
1ad9390f0d4203520f3c049a38002a0f430e9ef7028f71a1d7a8ebd9ac2f98f5

SHA512
fcc54c956fb455aa636461f04ea56efade7c8ea3919a867ca4d1f23d34ff99e4045a247d9bfcae9d20ddac7eab1018b3b90e283b6dc9aaf1a737048ce40214d6

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
79KB

MD5
f311b7e49392b3f3aeade5475a82fc2a

SHA1
fa54df333a41df8bb798ed1ce211199346311706

SHA256
810e5b76b1a591a38c0abf92229a8a59620ff1b8478ba736e3834a85b230f651

SHA512
9ace59b498af0ae2d81843e193ae7d1e8c0ffa42290fab9079590f169c4464a448cf07efdbabb98435a4783dc5b73c3e6ce0b1c7fade756503e1630f4c0a0459

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
79KB

MD5
61a5271a83e117a468f9df4b4f7223e8

SHA1
1fe925f06197c390cf558ad8afcc1a029eb3c6d0

SHA256
4e3adfe2806553ce393fae71d1e321714dc55662d44e48b4f51bff9503517440

SHA512
017c478734e49455ae798328db33553825820774a3aede0c0b84739eecd24adb0072d0b6895593691961ba1cfb99855ca8de3900561602431c83a432e6f1b40d

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
79KB

MD5
72b6b97d2ad5c7825e3f538417f5e8d7

SHA1
81ea0ce2212c989425bab311fe6250dc2ba89b21

SHA256
d7a88aad4f00ac695b96c2a120153f322486b94b84fdf05d8dee63ea6d041ed6

SHA512
9ec01a3202693a05409285daa13c5e10f823311d38e0ed7d6a8582390c4b9a41c10a1f3ebe0448c6b3facda4204631ad4da0028bfa116cf76663c329969f6753

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
79KB

MD5
1833a7a8237fb5caf9e694849d49881b

SHA1
fac41daa0d8ad6965440af0840953d71ad03f375

SHA256
aeedb76dbecb67904b9ed4d3b01844ce404a26adff0ebae91dbe3e6347387096

SHA512
76129cd59bc44a5d7164b1ba4d164a3af65c1fe67d290f027801ee06c97decf54fdd984ab40778b8bbaf670f334b913110a0cf7be4da43ec49bbd30ab63698b9

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
79KB

MD5
6826f9220bead93373fbd173d15a5668

SHA1
9005f832c37a129edd58914908ff614ca6ae1efd

SHA256
44bb7fee740f787ce9b328c00b686c1d8076d39a487dbef91a00d51809b382ee

SHA512
ad7123dbf04d1d7186d16db667c803e2075d556a6e2e775ee361467d948cc857ad023b5575aebc82218dc313ae6ec9c5104e42cab2ea876dafd98d356bf8c27c

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
79KB

MD5
fc04bb5ad1457c12e2085d2075e9d4d4

SHA1
b6bf1d59b2083f6f0540fcb2c32c62743d0cccfc

SHA256
97594ece2f71eca33df88a5bb5a6c4fc719dfa96c844d5f1ba0b083cae11cb3e

SHA512
0ecd2522f6cbf18bbc068f127f3fa3893004b46d00aa79d81116eeba370a8c2a81c5a18775f64f8c8b2bae13d6760b91af7f9597805c05687fedba6a59fc12f4

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
79KB

MD5
61853653846991b54879ad6eb40cb0e6

SHA1
eee35d825a7f22e97cbb2313ce9362965f0b0ca5

SHA256
4b9e47bd71bf506b183380c2b11ff3b79f49475a5036416f98635a5cf3b43a47

SHA512
771540b72b27a6143f444b415999064d27bcd66dbdd6afcf127a079b7f2c3bfb6f9864cb2ff5241b0a8de843686c97a7e294d1405214b78aae8fd4c05e2cd294

Download Submit
C:\Windows\SysWOW64\Pcbmka32.exe

Filesize
79KB

MD5
c3206763ae49c02a899375c436efc443

SHA1
3147b35515a6e21f2196daa80d8922bf1ec6cba1

SHA256
62d86f919e4a066a07062f0e9c2ee3e4024f3df6369adb9b203129e84dd9d5a9

SHA512
466152ada11b575135ef49f352c8c32834b9c7a9b5631f1189528b87683a5b0c8f5e38c638c89080ebc13feba317d6d00cac63a396ea3ae492025dea1ecb5c58

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
79KB

MD5
091b2f57bf8e024f78457e8d86a16c33

SHA1
827f52507e2bfc1592b3b83e8411b6e1e5e3d2ea

SHA256
fc6217809aa817cd2420f10c811509455e1cbd5b82caee028fb2a541e54ee35e

SHA512
5aff94f2f91d3c059e5bcbe43a3f069c85d82aaab244bf2f8788caf205f2157c405f8598bd8e37cdded38d6de0b6213022e51861b751990fdfcfa0e7ed2b820b

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
79KB

MD5
1b8ba141b4859c7549c0f39595adf479

SHA1
2789407288f34a4ef00375e43d84a68ca28cc062

SHA256
113db97e2f132226ee093776c79f496b40535c827e280b0644a8f80bac642730

SHA512
2bf0375d71f6792a9bfceadb5e3f8e031e10cdf423180be3b3cc7a69df1cc9f5b18f43c5117f8d0db571be5d3f08195b5c99d6d0786e113ae862751a1f9590b4

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
79KB

MD5
d72d72765f5c83c4f2fd512bbe55a385

SHA1
3612385891b8de32acbb7f91bc2132712ce7806b

SHA256
e7ae762c981b98263a44fe2266331bd783806410952bc2a1028f332b6785fc19

SHA512
dbf7bb19a3a0e4c261f161b8417eceac43efba83abf728d4a53288f1804e505c97f28eb6738cace5f02aecf22f4bc9871161990c78fe7ff362833df570f915b1

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
79KB

MD5
ad74623dd2b4f3066d24605a929c2ea5

SHA1
5c6f403eed3e22c00ca5deb7211e5982f184995b

SHA256
c26cd615b4fd0f14a050b8584065f266a04b1b5f339481d21600dc8e90869065

SHA512
a55d1e2457db7ef072577a636bc6afab4d2cb6cd3115b23b85709938e2422861d1687c9957fe3d476b4b27d16a065b6b0a556fa13c4d1f54bec67eaa98d80e79

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
79KB

MD5
897531f4f59a364524d0ceed5771356f

SHA1
9ac5f02aba8d9c813338d3be9031f53e4b95af9d

SHA256
4bf7fd7213d813bf9f2645481dff6be4e5bd2f20b5b948906ad3812c0a28a6df

SHA512
d5fde3202bbd70f8929061ebf38c4d9017bbd2d822ecff7c52d530762342c5c2fc2399e7526ad68ad026ec49d8e311fec095b1c973a2298991eab507821928ba

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
79KB

MD5
15e789ee26ff950036f8fa45720b4c98

SHA1
ed0657b989521c8ef4b83807515de33b85acfafa

SHA256
c99e5a343886fc16842ca849c827790bb6c33511f519cc9e1ac6f32d9a5b1cb8

SHA512
874bbc9a96338bf6428c11356e7de727c3bb39676280f05b9c85daddd09caff10fa752ce58a0f4b3aac1848ab7d0008a3910f52ba7046ed5f0cb563a008bf466

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
79KB

MD5
1c249c3356a1a4b017579578aa20c6d7

SHA1
d1f62dceea5f8ae2973d1dc9874c5519a65b348e

SHA256
2c54af79b1bae8f28aed623c111ef67100e6a4172cd61828d6403311e18adf79

SHA512
7a6553fcbd9d8a7b87fb7a5a16f3f3b3d6c573704a7db687c8978d3c3645f59a66dca9ea342ff21b632a8a00bf9460fb7d4b15f305133c0efc0ba22246bc6a3e

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
79KB

MD5
e33477c33ea19dbb1b5ea8758fd51efa

SHA1
f7915b2ecf7c851cf99e2ced89dc4051511b83f7

SHA256
d9adcdc963aaeb45eb1169011204da04e1bef5f5e32cd61d51fc28644f285039

SHA512
63d4550080127cecd367077550ea1520ed5657459d4c8d5f845dadfec4bba194ca84ea891a2e5dd9e5dde636f3a77f5ea49f4aac7746ac12e02a132fa1442aac

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
79KB

MD5
63ce30db4fad6d1fc8bb49078ac2a862

SHA1
8f6d79ce992b64d4eac48a6f284fad0249e18e59

SHA256
2452ea60ebb6fa556f72e8ada64d9c7f6f01df97770266c34cafecb73e126a68

SHA512
45c1a36515dc5d455bc4e0b52e056bfaa81d24870aec6f4fd8f3c4540cd7873d62afae123ad037b6fcb4c709f75a08a42fad1786e300346a7df26ecfed016bfb

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
79KB

MD5
1026a5a03879a7f2dcc124dd8738ab94

SHA1
0fa3b4d5cbdc0b27093280bb6521a7e1ee0148f3

SHA256
80eb0af75bb4cb4a38a587a10c2e9b3e910a0f6ecdcb078ecf7f7e78f0cfecb3

SHA512
5cd16ed6e76528ae4e74b8a1bfc606d53849644390423dff0b41fd81fd61850a864233e08eec4806d992b2191e387f6477cd410b624ebb2b95b19867c9156bf8

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
79KB

MD5
24420cacc52f95f9e86069a001c5e556

SHA1
563eff12645e05be416884a901731551418c4ece

SHA256
760eb0d4bbe2fb984f2d81a6f6d95b40f644616423fcd29a07fd6510ce109c30

SHA512
868f29d63aecea6c01344f166adfb00a70f2bbd257978cad1a0f0af4d8cfd8f2348d040cc718658f94521f400b6abfe3d679cda20ec357ca03b763eedf88f72e

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
79KB

MD5
9cc2850ff8cb225affc56a17a4d4da52

SHA1
ff2fc8be4f8417b374db9816d4be1efb7705054e

SHA256
60c619e4507a11abff35fc37712e577222955651b5f727174145917c509dfe59

SHA512
7ef5b5f9a9b1b2fc3883a2444f9815fa99b558e5ba351b3526fd51c822134b8ef43803d37deea0ed0a73f70eab4cdf20c0304957393d1480c863a5015fa6b993

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
79KB

MD5
72e6fe775adbb327425300cff572de4f

SHA1
e7110dc2efb0b9d0c2154f5bfaee54287af989d1

SHA256
6b986440e46936756d8ab613645ce66052a85d4a60543c54687006dee03d790b

SHA512
ff70177e5437ddcf73ce5eadea68fb243cde14d4bf09aaab1b4b04439723f98c8204eccf1cd5d8f059aa2c7ec9e6d53e6ad68b48a4c25dc43180dc87d42611e5

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
79KB

MD5
2fb9472e63f974889c03c0c4364dbaa8

SHA1
37f6fc4ab6d7497acdbffb32727223908ee8e70f

SHA256
d4745002639d73dd0f2de370f5cd440ddda3fb77df458649d9a666b2ed83a924

SHA512
9d7bf7f340b6b59a1eace272963b9687aefeaf3015bdbfd5d7811c2c32c9d0f51644b64c86caf4e02294b5339260224426fd170626dc95c5dfd1c251f90479ac

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
79KB

MD5
6018856fb20dc45464c9c5130faa374f

SHA1
d105955f7ed4868e29d8d12542704cfca23d99fd

SHA256
fa0654b130ed5d342d86a249c1fc626d3d35267e83e9e7168667fc44eaaa4aed

SHA512
175e66fd2c9799b895158f752c4462082a180bf6c3f3578e8e80de129e06049b3242ff6ee1a81d7a9d057b5d33da27919e67ffa7ed5fc786a2d1e56dfac5b256

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
79KB

MD5
23fada8339e622c7551d280a6c4ea43c

SHA1
fbc0f896d7ba6bea44dadf156ff09b8c80c87a17

SHA256
1217659a0ac54af8e06a75e726c5905ddb94e74104083024e6e97e0cb16e0bb8

SHA512
da54873ad58d328dc613fc7947e50087152cc1f43f644b2f93f86796a3deafb53707f85a61ba43c44364e28d2aa560bd9254fb8216af0088fe0c4d79f1150421

Download Submit
memory/228-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/444-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/444-523-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/684-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/712-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/944-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1016-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1088-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1388-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1388-509-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1468-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1472-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1500-503-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1600-128-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1664-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1664-510-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1736-511-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1736-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1740-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1808-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1876-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-520-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1996-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2092-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2092-521-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2112-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2356-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2388-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2412-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2412-519-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2420-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2420-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2432-508-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-473-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-208-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2548-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2584-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2644-229-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2908-524-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2908-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2972-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2972-516-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3020-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3092-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3096-515-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3096-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3180-497-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3180-504-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3372-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3572-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3604-506-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3604-485-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3736-222-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3764-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3764-513-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3788-48-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3832-514-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3832-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3856-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3896-518-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3896-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3916-104-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3928-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3984-517-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3984-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4072-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4120-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4292-136-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4304-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4356-479-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4356-507-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4364-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4560-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4612-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4632-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4636-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4664-505-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4664-491-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4684-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4760-157-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4780-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4796-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4824-160-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4856-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4920-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4920-522-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4936-449-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4936-512-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4952-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4972-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5024-182-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5048-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5072-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads