berbew | ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe
Size

512KB
MD5

c1a84d6ff9105a5b324674885e32dcd7
SHA1

2a528e73f8d705897eaaeedd7f34451998798443
SHA256

ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966
SHA512

2c0d9ff29e00017b156e9e8179c573e8ccc3b36b75829d57687c74eeb388fed48471068e99f222f4dff7572f89cff4d3c08cd0686a08855bf1ddef689eee2e56
SSDEEP

12288:zlwGyXu1jGG1ws5iETdqvZNemWrsiLk6mqgSg/:zlwGyXsGG1ws5ip5

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbdjfln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1248	Olhlhjpd.exe
5076	Odocigqg.exe
4828	Ofcmfodb.exe
3688	Olmeci32.exe
2732	Pqknig32.exe
3552	Pnonbk32.exe
2352	Pfjcgn32.exe
1168	Pdkcde32.exe
4228	Pmfhig32.exe
3784	Pqbdjfln.exe
968	Pgllfp32.exe
5012	Pcbmka32.exe
3904	Pgnilpah.exe
740	Qceiaa32.exe
536	Qgqeappe.exe
3088	Qjoankoi.exe
1368	Qnjnnj32.exe
4260	Qqijje32.exe
4896	Qcgffqei.exe
3700	Qgcbgo32.exe
1300	Ajanck32.exe
1544	Anmjcieo.exe
2376	Aqkgpedc.exe
2832	Adgbpc32.exe
2648	Ageolo32.exe
1532	Afhohlbj.exe
4108	Anogiicl.exe
4716	Ambgef32.exe
4472	Aqncedbp.exe
5048	Aclpap32.exe
4628	Afjlnk32.exe
4500	Ajfhnjhq.exe
3352	Amddjegd.exe
4140	Aeklkchg.exe
3296	Agjhgngj.exe
2700	Ajhddjfn.exe
2960	Amgapeea.exe
1408	Aeniabfd.exe
3652	Aglemn32.exe
2088	Afoeiklb.exe
4664	Anfmjhmd.exe
1708	Aadifclh.exe
2468	Accfbokl.exe
2280	Bfabnjjp.exe
928	Bnhjohkb.exe
2196	Bagflcje.exe
2324	Bcebhoii.exe
1480	Bfdodjhm.exe
3288	Bnkgeg32.exe
1576	Baicac32.exe
1620	Bchomn32.exe
1080	Bjagjhnc.exe
3300	Bmpcfdmg.exe
1564	Beglgani.exe
1836	Bgehcmmm.exe
2112	Bjddphlq.exe
3832	Bmbplc32.exe
4424	Beihma32.exe
3292	Bhhdil32.exe
4420	Bjfaeh32.exe
4728	Bmemac32.exe
1632	Belebq32.exe
4884	Chjaol32.exe
516	Cjinkg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Hmmblqfc.dll	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Anmjcieo.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pcbmka32.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Anogiicl.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Aglemn32.exe
File created	C:\Windows\SysWOW64\Bjddphlq.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Ekphijkm.dll	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Anogiicl.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bmemac32.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Bmfpfmmm.dll	ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe
File created	C:\Windows\SysWOW64\Anfmjhmd.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Adgbpc32.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Mbpfgbfp.dll	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Bmhnkg32.dll	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Gblnkg32.dll	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Pnonbk32.exe	Pqknig32.exe
File created	C:\Windows\SysWOW64\Lipdae32.dll	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Jbaqqh32.dll	Olhlhjpd.exe
File opened for modification	C:\Windows\SysWOW64\Qjoankoi.exe	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Qgqeappe.exe	Qceiaa32.exe
File created	C:\Windows\SysWOW64\Bcebhoii.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Baicac32.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bchomn32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cabfga32.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Olhlhjpd.exe	ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe
File opened for modification	C:\Windows\SysWOW64\Accfbokl.exe	Aadifclh.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Qeobam32.dll	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Fqjamcpe.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Afoeiklb.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Hjlena32.dll	Amgapeea.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bmpcfdmg.exe
File opened for modification	C:\Windows\SysWOW64\Beglgani.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Dbagnedl.dll	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Qceiaa32.exe	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Qnjnnj32.exe	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Olhlhjpd.exe
File opened for modification	C:\Windows\SysWOW64\Pqbdjfln.exe	Pmfhig32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3604	1660	WerFault.exe	178

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnonbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbmka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olhlhjpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qceiaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odocigqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olmeci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgllfp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbpfgbfp.dll"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffggf32.dll"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeobam32.dll"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baacma32.dll"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcmjaol.dll"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efmolq32.dll"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cajlhqjp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1248	1100	ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe	82
PID 1100 wrote to memory of 1248	1100	ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe	82
PID 1100 wrote to memory of 1248	1100	ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe	82
PID 1248 wrote to memory of 5076	1248	Olhlhjpd.exe	83
PID 1248 wrote to memory of 5076	1248	Olhlhjpd.exe	83
PID 1248 wrote to memory of 5076	1248	Olhlhjpd.exe	83
PID 5076 wrote to memory of 4828	5076	Odocigqg.exe	84
PID 5076 wrote to memory of 4828	5076	Odocigqg.exe	84
PID 5076 wrote to memory of 4828	5076	Odocigqg.exe	84
PID 4828 wrote to memory of 3688	4828	Ofcmfodb.exe	85
PID 4828 wrote to memory of 3688	4828	Ofcmfodb.exe	85
PID 4828 wrote to memory of 3688	4828	Ofcmfodb.exe	85
PID 3688 wrote to memory of 2732	3688	Olmeci32.exe	86
PID 3688 wrote to memory of 2732	3688	Olmeci32.exe	86
PID 3688 wrote to memory of 2732	3688	Olmeci32.exe	86
PID 2732 wrote to memory of 3552	2732	Pqknig32.exe	87
PID 2732 wrote to memory of 3552	2732	Pqknig32.exe	87
PID 2732 wrote to memory of 3552	2732	Pqknig32.exe	87
PID 3552 wrote to memory of 2352	3552	Pnonbk32.exe	88
PID 3552 wrote to memory of 2352	3552	Pnonbk32.exe	88
PID 3552 wrote to memory of 2352	3552	Pnonbk32.exe	88
PID 2352 wrote to memory of 1168	2352	Pfjcgn32.exe	89
PID 2352 wrote to memory of 1168	2352	Pfjcgn32.exe	89
PID 2352 wrote to memory of 1168	2352	Pfjcgn32.exe	89
PID 1168 wrote to memory of 4228	1168	Pdkcde32.exe	90
PID 1168 wrote to memory of 4228	1168	Pdkcde32.exe	90
PID 1168 wrote to memory of 4228	1168	Pdkcde32.exe	90
PID 4228 wrote to memory of 3784	4228	Pmfhig32.exe	91
PID 4228 wrote to memory of 3784	4228	Pmfhig32.exe	91
PID 4228 wrote to memory of 3784	4228	Pmfhig32.exe	91
PID 3784 wrote to memory of 968	3784	Pqbdjfln.exe	92
PID 3784 wrote to memory of 968	3784	Pqbdjfln.exe	92
PID 3784 wrote to memory of 968	3784	Pqbdjfln.exe	92
PID 968 wrote to memory of 5012	968	Pgllfp32.exe	93
PID 968 wrote to memory of 5012	968	Pgllfp32.exe	93
PID 968 wrote to memory of 5012	968	Pgllfp32.exe	93
PID 5012 wrote to memory of 3904	5012	Pcbmka32.exe	94
PID 5012 wrote to memory of 3904	5012	Pcbmka32.exe	94
PID 5012 wrote to memory of 3904	5012	Pcbmka32.exe	94
PID 3904 wrote to memory of 740	3904	Pgnilpah.exe	95
PID 3904 wrote to memory of 740	3904	Pgnilpah.exe	95
PID 3904 wrote to memory of 740	3904	Pgnilpah.exe	95
PID 740 wrote to memory of 536	740	Qceiaa32.exe	96
PID 740 wrote to memory of 536	740	Qceiaa32.exe	96
PID 740 wrote to memory of 536	740	Qceiaa32.exe	96
PID 536 wrote to memory of 3088	536	Qgqeappe.exe	97
PID 536 wrote to memory of 3088	536	Qgqeappe.exe	97
PID 536 wrote to memory of 3088	536	Qgqeappe.exe	97
PID 3088 wrote to memory of 1368	3088	Qjoankoi.exe	98
PID 3088 wrote to memory of 1368	3088	Qjoankoi.exe	98
PID 3088 wrote to memory of 1368	3088	Qjoankoi.exe	98
PID 1368 wrote to memory of 4260	1368	Qnjnnj32.exe	99
PID 1368 wrote to memory of 4260	1368	Qnjnnj32.exe	99
PID 1368 wrote to memory of 4260	1368	Qnjnnj32.exe	99
PID 4260 wrote to memory of 4896	4260	Qqijje32.exe	100
PID 4260 wrote to memory of 4896	4260	Qqijje32.exe	100
PID 4260 wrote to memory of 4896	4260	Qqijje32.exe	100
PID 4896 wrote to memory of 3700	4896	Qcgffqei.exe	101
PID 4896 wrote to memory of 3700	4896	Qcgffqei.exe	101
PID 4896 wrote to memory of 3700	4896	Qcgffqei.exe	101
PID 3700 wrote to memory of 1300	3700	Qgcbgo32.exe	102
PID 3700 wrote to memory of 1300	3700	Qgcbgo32.exe	102
PID 3700 wrote to memory of 1300	3700	Qgcbgo32.exe	102
PID 1300 wrote to memory of 1544	1300	Ajanck32.exe	103

C:\Users\Admin\AppData\Local\Temp\ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe
"C:\Users\Admin\AppData\Local\Temp\ffdd34f2efcb0351ee84a9456319ba8b8055193372ed270e5be39c248f9db966.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\Olhlhjpd.exe
  C:\Windows\system32\Olhlhjpd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SysWOW64\Odocigqg.exe
    C:\Windows\system32\Odocigqg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\SysWOW64\Ofcmfodb.exe
      C:\Windows\system32\Ofcmfodb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3688
      - C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3784
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1544
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2376
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2832
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        26⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1532
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4472
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3352
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4140
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3296
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2700
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2960
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1408
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3652
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:928
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2196
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3288
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1564
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3832
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3292
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4728
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:516
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:228
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3396
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:452
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2328
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3432
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        78⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3616
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        81⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:884
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2036
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        85⤵
        Modifies registry class
        
        PID:1788
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        88⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4460
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        90⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        91⤵
        Modifies registry class
        
        PID:2332
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        92⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1492
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        96⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        97⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 408
        99⤵
        Program crash
        
        PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1660 -ip 1660
1⤵
PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aclpap32.exe

Filesize
512KB

MD5
b12183acf1b630f351527c32d9b53fcd

SHA1
91e1fd60d27bf5e774e8124efbcb26ebba9e8400

SHA256
e9ce932bc23a951bc294aca450b2ef7a5d82eb183888fecd7f47a5a6d9e8b038

SHA512
29ea20920afbe1a5acf38e7a48f474174a7de85b0bc73d07d469622700674fab670d3548b9d6237f6e30faf4465df87e61fbef12d779a928184fb4864b216b5c

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
512KB

MD5
3b03f43ea17d5091e0cb728c730116dc

SHA1
b553df3894497755ad4eb7eff3ebb77e658559b8

SHA256
8daf706dd39a0fcd93fe3ce8aabe167ddabac95439931d20236c41bc7b1559b0

SHA512
d96ac49d643359b57a2bc345e32746070d2e77b3a55891c950fcf1ae81cad4f404ea8f1d77f54c9fd5a6ec13fb9465d1957ee7d7fc05d1f1b770e4ca3ad55d84

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
512KB

MD5
4dd06c9a8129f2e6c6e2cdbc77751ee4

SHA1
6fbca942b55161fcf639e4c5ca52148c20a15ee5

SHA256
7f98d88973d692d29629b8e0b4528bacd924fd90b0b56590d763c1912fee7ad2

SHA512
4ec5da12e3c1fecc104ce3217231a6693acc41f0475e24494d5835fa6b930481c0461518378ed1e7bc2176efb8726ecb2a4ee53d27a8a6f3389dc364e461c377

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
512KB

MD5
ce341afffc2114a74c5c6fcd1344a245

SHA1
0bbab4e615df7bad6410d5bb31ec80b107a1e44d

SHA256
0282f5845c8958972240b71436df0540b1e36e4b04bb6e07518783a1d985dbb0

SHA512
4e2a7c7c34a385cc956b6a8dff19c29556fa2cc3761a45455a4db59f554942119361e62c5402858e657a7c3fcaac38108e34d5226c3a0f7cd29edba776131895

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
512KB

MD5
9fe6f83a19acf7cf4e7477f2c9cfbb1c

SHA1
1940bc4f83005bdcc5b138ac077e9339a99afe48

SHA256
a0a34bb2a734e73ab3550a7e1ce88cd8f033a026e0e747059f36341476e39b16

SHA512
29e9e1465a315752a39a0555b5d3375a3c4669044cebdbbb45085516fa43b15af8b6d458c8c35637ec12d6247efd06b8fb6d49bc4d4d594c7f03abcc41e390f3

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
512KB

MD5
73ffe55bc7ae0f1547a6ff9b3540ba91

SHA1
36bd429750d32c6b70e2c78faadb2febba100c4e

SHA256
fecdfe4e786e4dc2a829af211eaa10ac77667286a70a8f98604a2e34a4c56ba1

SHA512
d90d6fcfc44be2196bc91574d5c4d3aaf49b7bf5026d7ff8ba10519ea5c7c6c7d3832660f0a1e827e05ae66a7ee6ffbd42a076a13f3337e818a7a4d0a7e77848

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
512KB

MD5
8f0c9b412cf6536aace6a3e983d6aff3

SHA1
96b623f7498de38a684437fc6b2d79b59303c9b6

SHA256
ad89a8cc1c3b7bdf0d0fa454a0866546ba9a92d88a4e0898f721fa8839a1caed

SHA512
25f3c7d9e5dfdf7d6dcfcd0925aea789b84c0cf0136075b4a9921d2cd434e34bfe44a78146d19984cf5746d9fb97fa7eb3624b9dacaf387d3a53c2946ced943f

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
512KB

MD5
3734f3b893268dc720143ff84cb6d908

SHA1
bc61bb8794e8b9efe32aea2bb7fc3397841b7b16

SHA256
6a58b80c184355ed04ffe1b8b48ef77ab8458d14641bdbfee30888a847937b56

SHA512
7310a945a50f4fcf57b027d9716251325afaacc9d0e471514ce2e6345c91bd488b8804392a8351d396651846578e73ae3eef0f41a9cd187fe824cee17c506841

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
512KB

MD5
be2a145b02092233af0d7f102ec592c9

SHA1
f948c45496565cc1ea480cd120955c91ea653fad

SHA256
16bdcb2d6f3460124089e41d531a83a9a109cdee05996ef6f6c7f12e55584ed1

SHA512
b55d4cf11a83fe5f52701604a66a703d9154ec4c7fe730a61dabb46ced40ce0fde52fa42439167f3bb459ef5b428a5b8d402f1eb5daba5e2f30a95104b4f5c15

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
512KB

MD5
6d1c8d3ea17338ab8b04b566505eba8b

SHA1
8978056b68e6bbc25713c5e8c4e6212f4c5dd80b

SHA256
4bc6b6a06650b3630067dd6c1ffbdcb5a6f359c5bc7f8fa82c925c8fdbbfc10b

SHA512
e6bdeabc0d97e7529ff1776489676e5057f487c70b51df8868d0085a7620917a3f9c7d53f938f261bec3b83fa87a067c5007a382bd57eb4663fd53646cb5135c

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
512KB

MD5
4c92d45caa8b404e38bcda582d2f8674

SHA1
cd63d1be9bb0d42fc01f9593529a50b7c7844df9

SHA256
0be880bda99f7b0000b2961111ecf184750e8d08e7b8c92aceacc80245577adf

SHA512
cffdaea0c77ac2525775052b15e7fd301eea221458959d3a18f04ce8bb12551988d03b22f7b4152d83f9e0a65a4fa0f67901dd89d8080fcb1b17c70dc1a0afc5

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
512KB

MD5
2ff8cc0c40e5d25f014897f676f07711

SHA1
849b95353c19a0b102d11fbb407c3d8bcfa715e8

SHA256
c9adc05bae20ef449ad940c05a757199830c391d3c3927ff62d0969efdc95342

SHA512
98820b46268b88e59c472b52127e59462e60e42a61dfce293855140b4f48194580cff37a18faeea6b1ed655906d5d2b43d68bf684dad1dd94663e402d79ea17c

Download Submit
C:\Windows\SysWOW64\Elocna32.dll

Filesize
7KB

MD5
5d5d4b5b356e82e59f5920b98126cd83

SHA1
7af705482534c06f1e71bbef5d155c813e652c1f

SHA256
1fb4dc5134cd442dc8668f81759f650ab38014f4dc329d7a0e1cb7bfec87323b

SHA512
dab860f1d3d9ae605cf894194fc574be228fa8de42dc23faffbd640f390f2693bd46dbe61e2dcca541d8122946ae2dd39659a394b2593e7940547d15a384daba

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
512KB

MD5
19b550571ca5593759e7bc8b0bfd0278

SHA1
e9c5d903ed7ad1ce0484c653084142ed1e9f98a2

SHA256
488796381b3b37d4802177c704fb604e806b41f78852a715a3ff80a435f7e54c

SHA512
541b4d698d954616343e97033918158691142ee6de8cff232c741afc0ae7d20cee138101d58ef4a827966afbfe79e72d60af6fdc7bba0cb99d278f5c886810cd

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
512KB

MD5
bafaf3c35c49148f32a625ec1f48e811

SHA1
3e4142b31a8a1804e5cbe6a7c7cd982be322018e

SHA256
616ef053408539d42b654513192d277d92fbd4c103763e31cd7265bd4ec7e62a

SHA512
4c28abcb1b49dc3f2a94e6428e99d192c9d7c497de61e0c99aa30f0c61965b7ef5021164343a8e0933adb7101b5c4c9d487f257d51205765235cfd453b76d20f

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
512KB

MD5
b70b9768a18a221ca0d7763c533179ac

SHA1
690d29487e96562f807eb46b86e4e3dc835668be

SHA256
3252c67a10c020198f9d2be5512a70bfdb96ec755c791b7a82219e6ebc9ea31d

SHA512
0576bb5a62b4dcc1f2fe8974a0de9421ff1c0bad003780db1916df6f1186701d5b9c5968986e513b823aea444a3473d5714624deef160e6dc064134486bcb8d9

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
512KB

MD5
fe9151033bb48750d39fe25d2271631f

SHA1
d2fe3a169fe45532396a9959ed587519e542e6d3

SHA256
0b7e4daa3084eddd022cf6d4038f5415562de6e6e59b426a3ca4571c33723e7c

SHA512
9c06e999d15257f956d26b97a27e832298639de6df8471abef9de7d3c33518eb275d6e4828a2e74f4dce12cceb96267b089981a884ad31b108117c24ae7b332e

Download Submit
C:\Windows\SysWOW64\Pcbmka32.exe

Filesize
512KB

MD5
928c8008d0d193e6e64e667f3b972b23

SHA1
b8ba024057eae70eb5f8d18cad4e7dc754519a5b

SHA256
76ba4d1863d41135aa23514ff1311d11f0052aafd406380f8522d144538b9bcc

SHA512
041c2792eae1c6a8a6a28fea064d49464d0cd2e9c47b9f03e66336dc5c0123017862ff4ce61ba3c206a005149185b20f520929e6386a246b3d8d9c3a6ecb92b4

Download Submit
C:\Windows\SysWOW64\Pdkcde32.exe

Filesize
512KB

MD5
6e2bd13d7198d3048e102108b2773631

SHA1
710cf7db689c72b2d1e2e22d15adf48ea9bab518

SHA256
b80f05670bf7ab677b25709661bee8bb1676e860c66d3aedfed5760f417cc5da

SHA512
7a5c120622516f23036b8943cc5ebbc827a6def32c9acd02549ff34c8d0fb232015915e3aa2862f1a1caa2764b6b8762e236a97a6f07aa983698445bdb675de9

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
512KB

MD5
ff9f20b5d68e24520a2832079e49ab49

SHA1
2f0cb5e0dfcbf53be6969f11af75f61bf1f55a47

SHA256
c36afdd912f8de2025fb86942ee45a212bef04436f0bf655d0add752726403c8

SHA512
47a30124d2f6b5e27fa7bc4a6f9182de0b9ba3db4e51f9105184b91cbbb1d9a7b46747bab700b516c1b5e671bd57556d5dccb380dc0a0cca1d5c93ec4a842ba6

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
512KB

MD5
e9f7a5259466b1eda67a8e3b12bb9761

SHA1
c11670008b019d0df14814314ea1fb7bdd5063be

SHA256
d8e756770e7a7fe16003902841c2b0b70b71c8bb4d6aa48665dbde895aecc1d2

SHA512
977c0b4ae8d0525e513d354d45e07d317b651a4b752160a7dff5c38fd5ef25104849b1d4789cd5df50f23cb3b8e3eff21272e0ff635f7d4b7e267c2adda7d375

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
512KB

MD5
44bb24a819ede86ca902b845568ffefa

SHA1
4ccc1e81c06d2dd53d32060d7b12711111d182d6

SHA256
9ab48a55b4611692103fcb8f82e25cbd650fd63e3781fa62fa648b917ba7ab03

SHA512
5fa99dcdd340add1da38404621fa813cd22ab9036f52fceaa55b65353b9a0b4b6fbebccc6792bb95a8ee8dde767dbb2469591c6ce660414784b0c5c9ece6176b

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
512KB

MD5
6e850e06a49668030628efc69dc80f0a

SHA1
701db8186e6642ec525f7c0dbed87a2e6d5672a2

SHA256
c31c81f4475d051de725323251a400224298e7a57c5345b93d61f7209ef8dcc1

SHA512
8784eb4f7a56f0cdc8f2910e718a60e2e6f323b85c7877ed6d9d6e9816273b0ef6d5c0fec0bdd3e168c4e9a1f930aab606a6cc061ebba3ea423cf25ee8bb18a9

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
512KB

MD5
5a4c7d2f1085183d06563b6a81caaaa3

SHA1
2851c30cfc1e2c8cd1856d0e37d0e4553587aedc

SHA256
3935921b96debe3a70548e9231c8f43844604b1c377990e16172e069a231d0cb

SHA512
1cbc6a0c665e9374f2806ddb3997916278191f3eb4b7c7aabb213fc7988ee6b7801a8da8c372445e7e313d64b27756b9d76573a2943f583c34da16df2db2cfbb

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
512KB

MD5
0274c29caae622f0517dea34ac8f4acb

SHA1
d0f65f98cd46543b9495d48f1279f95e5e0abaff

SHA256
960aa191d2b6b5178e1adc7dad9c7a287e009fd62602f256ba3c1c82fc53b205

SHA512
65fcb7cfa3033284317c636afc60addbe8a3ae634e5b5efd56d72c087676b21eeab3bab3144065a5b0a70510de215f8ff53ae11f97f363c0df6794990aac7fdb

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
512KB

MD5
7f15181dad4be860cda4f50ec14fb128

SHA1
302f469867fe14b5e98a7bf8681fbebb4675edfb

SHA256
5f02c1bd48657b4aa4486334ca8cf4bf3103753962ebb28117a589da40a188e5

SHA512
154d4bfca6a0842707382837a4b8310f7ffe2f0c506b3e84ba2ee29cebbc3ed6281d558e703cf7f53a808bf4b2ac4839b28bb03cecb242d325ec426710330221

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
512KB

MD5
f6cfb973a7b7f26f60eac76766384dae

SHA1
57ca51c83ea89bba2b77c613c5a32a68255d5de9

SHA256
f2514516fd050c0e6f621d91e0da48fe3db3a73a83d16eb6ea9d9a43f64f908a

SHA512
80ee2a30d55cf6709e70e499e416ddc360f389859380824708d86da6f246a9806f63948c2a8babd79f7368dab218f4cf43541a554dbb65933a35f80e85a25187

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
512KB

MD5
6bc83fa3b36b80fc4006858ea4c6d702

SHA1
94db3b46814100dea983fc04d54b9f9b0cf6f9bc

SHA256
134c481ce397c34581dee27b0270b0d05f2ee6d4ef100e008f0286695937f772

SHA512
54267ae9ec57407f2735793390e27650f022f81e55074dcd94534c3d37fea1cae80471767f742af4e294950d7d6a90c3fa5ce8e54f3e1870c95b33e1bf08cc94

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
512KB

MD5
eb0b3ae3dd0b40dc3769672f1f75c5e7

SHA1
4dd560f7447577fafcf821df152320b83b369f7a

SHA256
23c0fa5b65264a3bf7da6b1d45300ab5f7f954c794700296b01285451241868b

SHA512
da630693d54c66bcd9e4ad881549ee186ac2b14b2b388e0a8481ac4b1c7e0e6e74861076ce7e03164f66f2e5b836cbf586cfd21940aae0d4544774d1bb14b173

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
512KB

MD5
b3c9ff5ddd2785304c845c09bed41566

SHA1
dba56df942381a5b99f3131f25b45bdee5883615

SHA256
8714b1ddd08d4ca0b468d14021136a993706decd74f58b3f45785924a1f6743f

SHA512
61ea5d560f127b1d548b8cf9bead26742b40dc50f39c8b6ed82890fec64b8ccabd05a0ced31f46638bca7a30fa8b3c6f17c5bcd168148413c3d20d02f58325a5

Download Submit
C:\Windows\SysWOW64\Qjoankoi.exe

Filesize
512KB

MD5
f6b0f85e2cb0465047a243a08194f838

SHA1
5aec50f014fb1d1372c17a05b22c3310609c22a5

SHA256
957d1c896c03ce5bf105bf0df333009f00345102c36303d7056f7801b4f009fb

SHA512
3860b80f510e1bd299f74d9702c8b8727c046939274a353d3467a1908fc9f461b1e4ba42211c3698a35476215e82310eb82bcdd3c9d948f324d62fd03812eaf6

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
512KB

MD5
abc0e00a933b8f734cb55a5856f953a9

SHA1
42cb7d2231f2ab200f870a13a80a7cdda8654846

SHA256
2e556169175821893e7a89856e4e0b2054fdc0487b7655c917d3c31daecd8a23

SHA512
f23b1540ea7a757ea1cda96b033fb3956543c9e0d2e77bdec4d99ed6db95fb4d836a45469b21931d88c813fa21f74274b1b2045af621ac5f8f774cbf022bb9fe

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
512KB

MD5
d9592266216d24bbae0369cfecb0edd4

SHA1
2c188abd869851b443a1708086d7b21adc3c252c

SHA256
196a2cab6eceaf8cbb8ae72ac2cd31e820394cc5dff9e1ce5c4ad0d9a80f9bb2

SHA512
6c2320822f2e1eb24ca636d39599182c555b80ba64381c8b7288be259349371d09e18d4ee8c9f9018ba89b33e7f3d42b90192feced1e29675c3ede64325e4fed

Download Submit
memory/228-459-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/452-507-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/516-453-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/536-124-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/740-116-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/884-550-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/928-339-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/968-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1080-381-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1092-531-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1100-548-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1100-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1168-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-556-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1300-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1368-141-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1408-297-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1480-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1532-213-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1544-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1552-543-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1564-393-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1576-369-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1620-375-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1632-441-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-320-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1788-578-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1792-599-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-399-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2020-495-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-564-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2088-309-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2112-405-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2196-344-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2280-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2324-351-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2328-519-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-597-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2376-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2468-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2648-205-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2680-477-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2700-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2732-584-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2732-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-197-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2960-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2992-501-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3088-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3100-488-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3288-362-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3292-422-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3296-278-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3300-387-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3352-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3376-571-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3396-465-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3432-525-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-590-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3616-537-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3652-303-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3668-585-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3688-576-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3688-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3700-165-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3784-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3832-411-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3904-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4108-221-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4140-272-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4228-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4232-471-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4260-148-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4292-592-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4420-428-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4424-417-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4472-237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4500-261-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-513-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4628-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4664-315-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4672-483-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4700-557-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4716-229-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4728-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4828-569-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4828-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4884-447-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4896-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5012-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5048-245-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5076-562-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5076-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads