berbew | 9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b.exe
Size

135KB
MD5

1b7cfdabcaf7f5e7b425be2db4f4d2f6
SHA1

64d3edb9379977c7bb9d7d032d4df7f5a8534649
SHA256

9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b
SHA512

be7409865fe708478fa30947dd75a3ed66a4bc968e40dfca3ac76ffafeda843bf9054ad9911083428f729fe94343c01dfa06df2773cfa39909c91701ab047ac1
SSDEEP

3072:JM4mieF8HM4pfSVyFNATBK8Qr5+ViKGe7Yfs0a0Uoi:HeF8sAfk+ATBK9cViK4fs0l

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfjcgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmidog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhfajjoj.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
960	Ngdmod32.exe
2024	Nlaegk32.exe
636	Nfjjppmm.exe
2608	Njefqo32.exe
3512	Nnqbanmo.exe
3516	Oflgep32.exe
4604	Opakbi32.exe
3280	Ofnckp32.exe
2640	Olhlhjpd.exe
3256	Ognpebpj.exe
1480	Olkhmi32.exe
4376	Ocdqjceo.exe
992	Onjegled.exe
712	Oqhacgdh.exe
4072	Ojaelm32.exe
4140	Pmoahijl.exe
2380	Pfhfan32.exe
4856	Pqmjog32.exe
1704	Pfjcgn32.exe
948	Pdkcde32.exe
4868	Pmfhig32.exe
4040	Pcppfaka.exe
4760	Pmidog32.exe
4824	Pgnilpah.exe
3640	Pjmehkqk.exe
996	Qdbiedpa.exe
3380	Qceiaa32.exe
4112	Qfcfml32.exe
1240	Qddfkd32.exe
1772	Qffbbldm.exe
2844	Aqkgpedc.exe
3668	Ageolo32.exe
2288	Aeiofcji.exe
804	Agglboim.exe
2204	Acnlgp32.exe
4408	Aabmqd32.exe
2564	Aglemn32.exe
1360	Ajkaii32.exe
1708	Aepefb32.exe
5040	Bnhjohkb.exe
4636	Bebblb32.exe
2220	Bganhm32.exe
4584	Bjokdipf.exe
3168	Baicac32.exe
4560	Bffkij32.exe
2768	Bnmcjg32.exe
1188	Bcjlcn32.exe
2072	Bmbplc32.exe
1600	Bclhhnca.exe
4292	Bnbmefbg.exe
5020	Chjaol32.exe
1864	Cjinkg32.exe
2600	Cmgjgcgo.exe
4120	Cdabcm32.exe
4888	Cmiflbel.exe
2276	Cdcoim32.exe
4452	Cjmgfgdf.exe
432	Ceckcp32.exe
4532	Chagok32.exe
736	Cjpckf32.exe
3244	Ceehho32.exe
4540	Cjbpaf32.exe
3768	Calhnpgn.exe
3856	Dhfajjoj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Beapme32.dll	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pmfhig32.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Nnqbanmo.exe	Njefqo32.exe
File created	C:\Windows\SysWOW64\Efmolq32.dll	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Aabmqd32.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Onjegled.exe	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Igjnojdk.dll	Pmoahijl.exe
File created	C:\Windows\SysWOW64\Qdbiedpa.exe	Pjmehkqk.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Olkhmi32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Aepefb32.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Bebblb32.exe	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Pfhfan32.exe	Pmoahijl.exe
File opened for modification	C:\Windows\SysWOW64\Pfjcgn32.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Pmoahijl.exe	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pmidog32.exe
File created	C:\Windows\SysWOW64\Qceiaa32.exe	Qdbiedpa.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Pgnilpah.exe	Pmidog32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Hppdbdbc.dll	Ocdqjceo.exe
File opened for modification	C:\Windows\SysWOW64\Qceiaa32.exe	Qdbiedpa.exe
File opened for modification	C:\Windows\SysWOW64\Qddfkd32.exe	Qfcfml32.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qfcfml32.exe
File opened for modification	C:\Windows\SysWOW64\Ageolo32.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Dpmdoo32.dll	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Onjegled.exe	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Bnmcjg32.exe
File opened for modification	C:\Windows\SysWOW64\Bclhhnca.exe	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Olhlhjpd.exe	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Ghngib32.dll	Pfjcgn32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Aabmqd32.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nfjjppmm.exe
File opened for modification	C:\Windows\SysWOW64\Olkhmi32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Nfjjppmm.exe	Nlaegk32.exe
File opened for modification	C:\Windows\SysWOW64\Oflgep32.exe	Nnqbanmo.exe
File opened for modification	C:\Windows\SysWOW64\Ofnckp32.exe	Opakbi32.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Ceehho32.exe
File created	C:\Windows\SysWOW64\Booogccm.dll	Opakbi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	904	WerFault.exe	156

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfjcgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmidog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhacgdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onjegled.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlaegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qceiaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngdmod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olkhmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfcfml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflgep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojaelm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoahijl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkcde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnqbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qffbbldm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiclgb32.dll"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahicipe.dll"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acpcoaap.dll"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfiloih.dll"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoqimi32.dll"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aepefb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghngib32.dll"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcnha32.dll"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njefqo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekphijkm.dll"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onjegled.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpllc32.dll"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldamee32.dll"	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdlci32.dll"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkknm32.dll"	9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oadacmff.dll"	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifoihl32.dll"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlaegk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Booogccm.dll"	Opakbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjmehkqk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 960	3736	9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b.exe	83
PID 3736 wrote to memory of 960	3736	9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b.exe	83
PID 3736 wrote to memory of 960	3736	9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b.exe	83
PID 960 wrote to memory of 2024	960	Ngdmod32.exe	84
PID 960 wrote to memory of 2024	960	Ngdmod32.exe	84
PID 960 wrote to memory of 2024	960	Ngdmod32.exe	84
PID 2024 wrote to memory of 636	2024	Nlaegk32.exe	85
PID 2024 wrote to memory of 636	2024	Nlaegk32.exe	85
PID 2024 wrote to memory of 636	2024	Nlaegk32.exe	85
PID 636 wrote to memory of 2608	636	Nfjjppmm.exe	86
PID 636 wrote to memory of 2608	636	Nfjjppmm.exe	86
PID 636 wrote to memory of 2608	636	Nfjjppmm.exe	86
PID 2608 wrote to memory of 3512	2608	Njefqo32.exe	87
PID 2608 wrote to memory of 3512	2608	Njefqo32.exe	87
PID 2608 wrote to memory of 3512	2608	Njefqo32.exe	87
PID 3512 wrote to memory of 3516	3512	Nnqbanmo.exe	88
PID 3512 wrote to memory of 3516	3512	Nnqbanmo.exe	88
PID 3512 wrote to memory of 3516	3512	Nnqbanmo.exe	88
PID 3516 wrote to memory of 4604	3516	Oflgep32.exe	89
PID 3516 wrote to memory of 4604	3516	Oflgep32.exe	89
PID 3516 wrote to memory of 4604	3516	Oflgep32.exe	89
PID 4604 wrote to memory of 3280	4604	Opakbi32.exe	90
PID 4604 wrote to memory of 3280	4604	Opakbi32.exe	90
PID 4604 wrote to memory of 3280	4604	Opakbi32.exe	90
PID 3280 wrote to memory of 2640	3280	Ofnckp32.exe	91
PID 3280 wrote to memory of 2640	3280	Ofnckp32.exe	91
PID 3280 wrote to memory of 2640	3280	Ofnckp32.exe	91
PID 2640 wrote to memory of 3256	2640	Olhlhjpd.exe	92
PID 2640 wrote to memory of 3256	2640	Olhlhjpd.exe	92
PID 2640 wrote to memory of 3256	2640	Olhlhjpd.exe	92
PID 3256 wrote to memory of 1480	3256	Ognpebpj.exe	93
PID 3256 wrote to memory of 1480	3256	Ognpebpj.exe	93
PID 3256 wrote to memory of 1480	3256	Ognpebpj.exe	93
PID 1480 wrote to memory of 4376	1480	Olkhmi32.exe	94
PID 1480 wrote to memory of 4376	1480	Olkhmi32.exe	94
PID 1480 wrote to memory of 4376	1480	Olkhmi32.exe	94
PID 4376 wrote to memory of 992	4376	Ocdqjceo.exe	95
PID 4376 wrote to memory of 992	4376	Ocdqjceo.exe	95
PID 4376 wrote to memory of 992	4376	Ocdqjceo.exe	95
PID 992 wrote to memory of 712	992	Onjegled.exe	96
PID 992 wrote to memory of 712	992	Onjegled.exe	96
PID 992 wrote to memory of 712	992	Onjegled.exe	96
PID 712 wrote to memory of 4072	712	Oqhacgdh.exe	97
PID 712 wrote to memory of 4072	712	Oqhacgdh.exe	97
PID 712 wrote to memory of 4072	712	Oqhacgdh.exe	97
PID 4072 wrote to memory of 4140	4072	Ojaelm32.exe	98
PID 4072 wrote to memory of 4140	4072	Ojaelm32.exe	98
PID 4072 wrote to memory of 4140	4072	Ojaelm32.exe	98
PID 4140 wrote to memory of 2380	4140	Pmoahijl.exe	99
PID 4140 wrote to memory of 2380	4140	Pmoahijl.exe	99
PID 4140 wrote to memory of 2380	4140	Pmoahijl.exe	99
PID 2380 wrote to memory of 4856	2380	Pfhfan32.exe	100
PID 2380 wrote to memory of 4856	2380	Pfhfan32.exe	100
PID 2380 wrote to memory of 4856	2380	Pfhfan32.exe	100
PID 4856 wrote to memory of 1704	4856	Pqmjog32.exe	101
PID 4856 wrote to memory of 1704	4856	Pqmjog32.exe	101
PID 4856 wrote to memory of 1704	4856	Pqmjog32.exe	101
PID 1704 wrote to memory of 948	1704	Pfjcgn32.exe	102
PID 1704 wrote to memory of 948	1704	Pfjcgn32.exe	102
PID 1704 wrote to memory of 948	1704	Pfjcgn32.exe	102
PID 948 wrote to memory of 4868	948	Pdkcde32.exe	103
PID 948 wrote to memory of 4868	948	Pdkcde32.exe	103
PID 948 wrote to memory of 4868	948	Pdkcde32.exe	103
PID 4868 wrote to memory of 4040	4868	Pmfhig32.exe	104

C:\Users\Admin\AppData\Local\Temp\9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b.exe
"C:\Users\Admin\AppData\Local\Temp\9093c7ec823159b6b541f399318d96dcc827ccfceeacd718d1993b641df2af6b.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\Ngdmod32.exe
  C:\Windows\system32\Ngdmod32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\Nlaegk32.exe
    C:\Windows\system32\Nlaegk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\Nfjjppmm.exe
      C:\Windows\system32\Nfjjppmm.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2608
      - C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        23⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4760
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3380
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1240
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1772
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:804
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2204
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4408
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1360
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        43⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3168
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4560
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2768
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1188
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1600
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:432
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3244
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3856
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:1504
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1980
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1060
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 404
        76⤵
        Program crash
        
        PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 904 -ip 904
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
135KB

MD5
e0e28e7961592c45e88380d3cadcb90e

SHA1
261d97f318898c9e059847738fd4001b40007796

SHA256
eb940a26b8ee75c0842425d9ac508ed1943f72570282b9dc1191ed9ed9f1cbc2

SHA512
51d554e117b9a09724b74cb22f0d1c6f20c264eba3132ec1872d4e48606e7bbe7040d05631dc9d7ccc078e23f50dfcc3bec9e47ef0685b77d751c5256a794ce6

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
135KB

MD5
d891b21afe791bbbabcbc73dca9fb9a8

SHA1
16c6042fb5a3f384ba48b1f6391c05e1670ee79b

SHA256
866bb5d63a185fb4ea902e6d7ccf0c1a5df45357a0d85932f23de6c156227a75

SHA512
0bbc1a5edd443f1d3c10983bf79a889fa2f60baf6110b7e7762f27224de4b75c4b25876b596272c4fb71c506874f4986ec8194825e58708910543400a1a428a1

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
135KB

MD5
40e2061e567189d5e553d4783ffdba5e

SHA1
df465b8f99c148a59fd0af07ca9776913d343155

SHA256
05c60d3e93664fc6bc9c1e52b2e90a85cc207e0ed57f635021a9aaedae01e66c

SHA512
3b0f0072c12b10fa15233ab4f8655bfc7668a221959ed0ff643d0c5b52c61bc4303636d23f2168204e2b4900a420f8def5cfdfdb938bffa9e6ec0116895dcbce

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
135KB

MD5
48bb331e98d04655a78478d8bb991cbe

SHA1
4fb7811c8a69c1379516e26e38e2b6bb1f6edc30

SHA256
bdf2354073f47e243aee45bc285919fc81604422d7648fa0ff6aae9f515b2f16

SHA512
fcda3e2994bfc00490e0da71bcb317f2479302667c276904085fd7959ce6816aecbe6582ca11f5ba1ac2da3b3989fd8f589af7dba7565f068f45d6250653350f

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
135KB

MD5
bf49407cb8e76aa2e2c3fd8e815cabd3

SHA1
ccfebb4b58578052065405fbd63dd1746cae6a91

SHA256
74acfd0e6105b64885cb8c2d749f9505419ee871a546fde7ff3c22fb1c02f80e

SHA512
700c63d47d96b087dcdd6d33b4f3d7329a6bbe11209d6a5d3fc9ad17b85050b39a3eb1fa20bd1f2f7714e75762f5d61e88e56c5ceabb8cd507b927310dd2b21b

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
135KB

MD5
053f9693d24c11018800b78d44b274bf

SHA1
4390ded087cccb2a0d4eb08fb55d0a921ad0a0ee

SHA256
0f7eee300383735ad34a65c85f5a20d9cca842cd4676215be18542b19088f285

SHA512
0742ed664e8a4d1165f23da8101760c23e1c5404e7526fc087ece358397cbecb4b59472c71c79591e000066f0a25798fda7bcd35d2da01b6df38dd33b9daeaf4

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
135KB

MD5
0c10b44c24d73e4fce2f3148eb048641

SHA1
756874a725e24a167446a232f3ee2a9d9629ba98

SHA256
35990642855707a05cd7cad37f279603cd30722ffb2069c4c4be44076b1133cf

SHA512
52a5397c247d4f41320c888031e44fbef711c93c36507d3e4f77d94636ea1ffd527f2314872fd796d20cecdb6c770192962d47e15e27e2afebf73893151d31a1

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
135KB

MD5
91f9af1f71a6f52baee0bbbfcfe38b9c

SHA1
9a732469e0cc978bc67d45f68127795c41712237

SHA256
566df050da413fd8efe93aff49b5e5f442f6dd050437c3317a53ca96e97d24ec

SHA512
7b303db3904515863574fd6a3bdc8d1cbfc076742d2b2f51f6b5f4e1e8528bf968ac9d9f932294f12d4515cb4a3b549324e8b8a7c6fed5fdcadf5262bb06a8f8

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
135KB

MD5
1e624fe962cd15e2695fc6dd31d5822f

SHA1
9af280937f66bb2b1af4f53b88403d52c2af22af

SHA256
027a87833b5d08a522ee5e7b3bba2df65094374661f0095f4cc4868d0d702bd7

SHA512
8966aaae1d73ab2fa9eb40d6157d5242f1e9c38b41197935c6bcc7b2d39e1f1c0e22c1354cbd51d36c2d32b709f2e51ab60cc980a29ce88ef3d620d2f2e5b5d0

Download Submit
C:\Windows\SysWOW64\Nfjjppmm.exe

Filesize
135KB

MD5
fcd7f6f9d5f4ab8e114e23c09c6b531f

SHA1
b61fbf2d2fd6dff8dfb31e2fa83bf1d567501968

SHA256
585418b33b8b6d796e53f73e7d9b3f468ded03ab623673c9043de43637b1f372

SHA512
f9d18f4770a02128d6810a7ed70f4ed503ba42df49471d8b6641eeceac8e254f1b0e6b64fee944604ac8f62904d71205fba6553bf73eb5a6124993c6baca4ae0

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
135KB

MD5
8e501561e74543535945546080d92b9e

SHA1
11e6d2d4478d18e5f7b2704bb1c5051893294239

SHA256
fd2b657d9bdd24a404304f96f1c33b6f25a20b02f905994efe7281b62a9bc707

SHA512
425b2078ccaaeb41f6331660931de6490d4b56b136e4650fd4b156d7d8ff2a5d0c049e821369273966a13e403414f59a3f66e28f87f37dd90cd1a30cac03ec33

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
135KB

MD5
dfe0aaab7b7d0e1609123229efc08ab0

SHA1
d102f75f9fd48498067143cf3b7dbb2dd9e87559

SHA256
463caf0a0469ba69944d3b12556b0d931a661f2e0a53db7058875e1309fc7caf

SHA512
60e9f982387419aeeae75eacc3d1a22d98c8f457b3cb071f8701a7ba22c24fbf77840c9ad1dfce6f15bed11ae861ce958b384182f76c7c82af443b5d8ad709fc

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
135KB

MD5
15aba84bba2a15018a53a46815d9af19

SHA1
699fc4204f5c85ada0205405f189198c658231da

SHA256
20837e5248e6720c996934f29b44d8044b6004f2ed716c1d71aefd32ab0e11fd

SHA512
6c0560da2354bdc52be1956215c94040a53d9d734ed069a3dce40fdad177d2377a8eeba4f68b4a20152dd245ba1651465715d06aa6d1ce1e5720cbe68f1c9d3d

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
135KB

MD5
0ab78795ee3126227b2d9011c29df3a9

SHA1
545405fe3e4a36b369a24809dc5f1795599289f7

SHA256
1807210a0b224d7b831a23e80a6b00771382db1b98421308236007fa3f02420e

SHA512
90f3f7945ff6939cf9b1c1396a7c75322d20db093935bf620b3d2f84de035fa8e098f53c758b4ed261ec34f06f921a68a7019e8fed2ebc6970028c694954a627

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
135KB

MD5
47a1c52976c264cce6ba53bfc640c0a8

SHA1
f0bd1e8611b51f6e729d9009898d3b8611ac8b9c

SHA256
445ead44814522452b3117cb1f93c0c94e8497f32954eaf9137d32b303c1cfe2

SHA512
65f365693b387b92601b4add4e7ba472863731f8da1ccc8d18ab6aa160038a18fa84c52562d7e0799cf8bf665a05c8525112695744cade91ac1599d6b72bc72a

Download Submit
C:\Windows\SysWOW64\Oflgep32.exe

Filesize
135KB

MD5
d2e8195bf3b45a47b8f9c7acf90e6483

SHA1
fa958f81350e8018c47a396daed0a1289aa8a13b

SHA256
83fc124c383a83feebf6a3515ad34f3a245f86116cf2ff59eae031d5ec2eadb3

SHA512
a58b0eebd5ddb8a7f9a0bdf7bd92740b7490d175ec0ab2d24af739d39440605c064cbdffdcaa860e4f156504edfaefbfafb2196e09c3cd579bd4e9223a9d43dd

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
135KB

MD5
2fb4ca9b0fc07e78ea8b6920f020318d

SHA1
5b7c394ea4efab9ed83dec41ba13a52a11d5b4af

SHA256
ca7bb842dac1e5ffd8ecc78083053353bb6e68548a9f9d6ad556836da2fa00fd

SHA512
a5f4976a27aafb48661258980265822cfc8dc98f7ec4322216d5eaaf92ee9aa3832cf93361e18fc0777c729b7d2dd3740275abc65f0001ccb3d2ca41dc1f030f

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
135KB

MD5
618cc185c188f79332011d5c83b9af0c

SHA1
9649d198b8c53da0289c44fd4efc5347960675dd

SHA256
567916abf7c40f240f5a4b88be56294421dee68527d046303dd17b31a25bb2ac

SHA512
f12f1c9e398a562b13077f68cdbbc7cd60e3213345cc4806a33fd4331feaa09f0edf92954078ff51d6dd52d0d4470b6e25be50f588d0dd840b111e127cecfe3a

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
135KB

MD5
b217ea4c204f2fa79b40f6101afe688d

SHA1
9ac9e9ebb7023f63a28c0e8b1b7a1073117e204b

SHA256
6ee64fa3a63e85235e21ac5a3d2cbe51c96e96261c8bbb8fda47cb0e038e813b

SHA512
694be85ba9480b24fb0eb1f1d49f85d5dc92c67b6c4f86489a5f4c3ad800eee51206259aa02859388e667b4ed9c9c4f736989c73aeb9693e12062892e6c6a0de

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
135KB

MD5
569b74090b20e89b74a11950f2793a4b

SHA1
4c1f609fa0feb1efb280e67d3b48577086bc6702

SHA256
a168a8ca544b1bb3b0e7f800661bba952cd96a5a96d2d26aa1f930b4725b70cb

SHA512
fdc9c31cf617ca83d6d9400ba812db3d6e0a2d664ec212c0f189c671c809e1594b70cb1253fe887a5d6e9650c839c7ca4bc7861030167fd71e0878440435e777

Download Submit
C:\Windows\SysWOW64\Olkhmi32.exe

Filesize
135KB

MD5
a8f242476ed9b46c6ab40ce1c0a66d62

SHA1
3f4ece3cda0f92912a065163d08e16ef421dc920

SHA256
943f8e93501b11458539721498aad69c7730c9fc2a65a4b1fcf7a5375f145d54

SHA512
ec7ceaef378c619235754d1c9f0ea988fac0e935aa48bd6c0446f54a347e4ea70c177f3e875667604030b2bd07f064b21795d67519f2831b2d019563ff681151

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
135KB

MD5
47af5f775b6b14b6c8c0d134dc510d33

SHA1
32b541df6f05da7f2ae4984228d63655b038f57b

SHA256
6e98498bea4de137b773609225afd24fb0365ba7afca793f1e763a8df8fb4687

SHA512
f0be3f974c1e03c82ed298138d4936ddb078aca41a339d9837225429a8f3945cac75426085e0f86da9bbf018d767eaa3bd640e47c28975c390f54b3a2cf6d8e4

Download Submit
C:\Windows\SysWOW64\Opakbi32.exe

Filesize
135KB

MD5
09383d1757c823c4b654be74653c108e

SHA1
4e9f4792c8dad9adf87b946d44ef387c7d9351d4

SHA256
39eac0708fd7fdef8113fd8fca62f1a27438da423a50de0eef5c57ddbae58c00

SHA512
c1c27a89591451a846d33af2c619fd7fa55377d865ba9a033a64fb333bfb4e895dbcaa0e54352cb479bfe0b7824ea6df7f80b5852a92ffea40791489b1e2bf91

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
135KB

MD5
c070642ed3275dfdf9c6fd5ed6a452fd

SHA1
08bc70cf4a010ca09442682008b38740a1d64946

SHA256
8c8dddd3118bafe6df6a881e54b9d711fdba649f52519234414e21540b43c30b

SHA512
fdd91668f79c9dcbbd87c2173fd21cbe777e65d4129d5a4514b768cfd10c5fef24a378918b835d1527134bcc2750908ac82912ecb6b04f7541365dbbf59b732f

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
135KB

MD5
6794b622add8bc64deabdd2d000da644

SHA1
b7fa77c0ff27269c0dd2fe8571310d3299366524

SHA256
0d051b0db791e2cb6b523d707d47702e88daf0ed2f3d5675c86726347c8d35eb

SHA512
453e852e0fe2ae536c15501dde9ea48e42a7dd29db3316108d68987193cd07d5b2b74e1c44746b308afc3fffdefcbf5157a29557f37a77d4624bb816bb63db9f

Download Submit
C:\Windows\SysWOW64\Pdkcde32.exe

Filesize
135KB

MD5
2d7e13f08bb2851b35cc048ca209504d

SHA1
692d773734f45f17e1bafcd2bfc87b78766e7653

SHA256
40f1a3ed3e53a68ef32f7bdc9962f107c5053249a4ac6ccfd6b7aca69d454658

SHA512
98f20aa3f2386783e9c66e51803efab2bbf690539d2c4ee7ab8e3a2569806eb42e22bf8c3184ec5ee970dae734aa1e95c25bf12caf52a61fb2a0be9728b1c408

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
135KB

MD5
a690c9ee364e5e3e9efe58956a24c0f8

SHA1
3dd5fcaea9d5e44a739f9f42481a7b214104e022

SHA256
9060f0cc8435457b558f9b2518596a1af3a9e50bb0df76c9f708c46f50ad1684

SHA512
6b6ce24ecfa945e222cc94f4fcc9db81ddc3a3560a6e72519307dc004f25b1167dca7c5b34a6351c46aab48330a4ab2d3c44edf06af033f6573996afedcfe5a6

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
135KB

MD5
1cca96a81b0a3e3594da1a5197a10ae1

SHA1
c1ac2786016eecb102b57333e56ed4bd01b76da4

SHA256
8bbb4acde8e7d7d93c3b30d859ab54201395308da6c77e07281449877c9693a4

SHA512
d136e278ffa494f825c06f0d3ca02ba0662483db0d9bed6eeadb4f376b296161acacb0c0d91dfb31db78b3cfb6c40f73cd87127d9011f3421583378dc7e8a118

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
135KB

MD5
c0b1dda2e84598d5362b00c7c345af88

SHA1
4d2d5e00205bde3563581d94ad5417313c82e062

SHA256
1011c2112218bf5f7ba54452e30228b6493874da605223362a72b2df3790f7e8

SHA512
4718c9d43d6689394a1b1258d32c63c5f1c8a916b39a8b5e1ac103cb233fb637127620fb3e9635bdc32fc925e84f5fc6bf26e454aff06ee8d62fd5fe22924b1d

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
135KB

MD5
dab6435180630beb614428777827b69e

SHA1
2ced143c391db629e4dec5727b02430067d87226

SHA256
4bc302d4f3073a7b68c7006623e2495d63be9ef02fe87c1ae6d4c66517b5355d

SHA512
dd865aeb49fca8c4ffb7223af95fae5cfc9c419a21833c58c902f83efc989fe2983c16690244e57f54c54a1ee1b2489165774f1e9cf92dd3d97dcf9b0f82f1d0

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
135KB

MD5
6092b9969f8e4452cfe6359460d1ce75

SHA1
2fefc5b1ee084986cebed3b46a6858d5af11f3cc

SHA256
2129cf7022ff7d8b733c4a2216b9af04ccfacbb9b1d47cd7b927908d5c0c2914

SHA512
829001fc751ac7dbf94ceb4c11ee205c5189a11572eb9755f72e2ea2b3bf3ebe0bdeec35b98a58c75a47d65ae8abcc0fccd253c0ad5b7f5561a9b31d4c8c533a

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
135KB

MD5
20911bf8c6612ac8a9a31a32f83af0d7

SHA1
a6396b54d5acd830e6f68c421ac340018c4c6b73

SHA256
88ecaf768f38f3065717ea2cd4d17ed62bb66304757204f99bf5885470420d16

SHA512
4d6a385bad2122071f438ae85d94dd0c0a3c94bd68f6e14cd1c71030e44d6004244ec9980117baac501ae6cb5f777bd3ea9ff19be5dedbead42c8ba7d43dceff

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
135KB

MD5
beb446918d6b39c59e0725b1dde95751

SHA1
d375222da2a29f226a3e0887818f6bde13e9a4fe

SHA256
1f3a960af31edefae03be65644742308454e11171eb8a7f890a409571ca8ef27

SHA512
b01e4f55cab6ee8cfde0d9c3f1617cf861b8d0abff2939f82eb447bc6829a176ce5907dec6b2ea9c7af07a3c44ec4b290aba1491c9848b88b989c5d7298ceff5

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
135KB

MD5
e41efc2460da3cfac19090ef6a8810eb

SHA1
22517af5face631f435cf0ebb057aba069d2e85e

SHA256
971fb2f2ab84ed9048bde759e806fa0059bfa2aa04059908f5b3d6d60a8034e9

SHA512
fc1d12c23b45625db4ea8e811adb0139e3e045985b6b42f587bc3c2cfaddd50b59a3741f8b1393d4b658b33245dde8df848644ab4e28df4f9efb71bba9f8411e

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
135KB

MD5
2ce013b677d201c6dd80ec1cf9ab08a9

SHA1
67e9264c90ca2dacbe95142ab8c9dfa85592c34e

SHA256
8b55b4937195630ccfe7df483d7cf3c2720ec25beefea2daa22534a449330a83

SHA512
bd0cf941dcea117bc9d5ac90570eec115a7c57521a76418d6a7cc1ba1f1d06c194829bf9b0974837e88d3eb4fc8870ccfbd1280e6602402dc74a6d1bae58c4b1

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
135KB

MD5
af172f55aeaddb5499ca49b39691fea1

SHA1
b0d5a3e49b2d4beb170fca4aceb5b35c0d12ab81

SHA256
88dd4c8d8ba484a679dc4eb4bd23afbff9a8b53ad70a27a8c2a0839a0f29587a

SHA512
9f1b14779cb1cc1ab6eaccd9a86b073e2fb9c10eb308302fa590b8bab69230dc00c2692150f4096e1a03f863fe018c21ce3b57865bce438e6c57353426ef973d

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
135KB

MD5
0c816f00591db4ff8a6915c25b91c9e6

SHA1
9128bc19b8e4d2501918ce28743974aeb95782bd

SHA256
a91daf4398e7b5b676a8230e7d4e0cf0af951d349da917b85ba963c04ce064d7

SHA512
db5046ca2d1c479ba0b26212fe1975f83ff77774414d70c5a232b6cd90ad8d2eb144c0b9569cc28192ae10796eaf1f573f270de507ed153b6c726cd3d96bd1d5

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
135KB

MD5
af56533a2d3c58126ec9bca16a688cef

SHA1
7291aede9c34be14956b7ebfd4127c882d89f495

SHA256
47ce1312966ae76a13b31d7f4fad102fcd81b26687316c453b23eb096f52cb4e

SHA512
909d08eae256767ec5f2d99f37a99eca77281a1e08169a0ef4e6ac9eed3b58be57005d80b452c812354c5d208369872a9489972fabbada566b2701b5809c1d36

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
135KB

MD5
01f9c88430b61002a9832be49ee1997a

SHA1
f365d009e1629e1cc4b61084a2c912fa9512e850

SHA256
beb62aa0b29dbbc025ec563d6d03ad51b685b7c7d33ebca31577d0a8ff542024

SHA512
cc010091582b151749e6dc89b905e9129e1b8c639744db7082b4b512a308c09ec10771934ff7449d4adea774b09b644b515466e7906b5956e7b9a387ea7799ba

Download Submit
memory/432-413-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/636-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/712-112-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/736-425-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/804-269-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/904-510-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/904-509-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/948-160-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/960-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/992-105-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/996-213-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1060-467-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1188-347-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1240-516-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1240-232-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1360-293-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1480-89-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1504-455-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1600-359-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1704-152-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1708-299-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1772-240-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1864-377-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1980-461-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2024-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2072-353-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2204-275-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2220-317-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-401-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2288-263-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2380-524-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2380-136-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2512-479-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-521-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-287-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-383-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2608-36-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2640-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2768-341-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-248-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-519-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3168-329-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3244-431-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3244-529-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3256-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3280-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3280-525-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3380-221-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3512-41-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3516-527-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3516-48-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3544-473-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3640-200-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3668-256-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3668-520-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3736-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/3736-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3768-443-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3856-449-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3856-523-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3980-511-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3980-503-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4040-176-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4072-121-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4112-225-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4120-389-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4140-129-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4292-365-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4376-518-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4376-96-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4408-281-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4452-407-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4532-419-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4540-437-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4560-335-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4584-323-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4604-57-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4636-311-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4760-184-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4760-522-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4768-514-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4768-491-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4812-489-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4812-513-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4824-517-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4824-193-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4828-497-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4828-512-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4856-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4868-168-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4888-395-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4888-528-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5020-371-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5020-515-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5040-526-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5040-305-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads