berbew | 759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe
Size

89KB
MD5

c4127a849a8fabe1bc6f83b6c6a847a1
SHA1

d732df9ea80f43d36236ae8c3d7cbc6c53bcdf21
SHA256

759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20
SHA512

aedeca234f62af7f19594e52a2ec433db1c4d72f7017ec75c8bb9a68a252c96b7b06da9d845f5b611b14583d802c96a8e0e4eff5623cfa7a6dc2ef28532a1aa8
SSDEEP

1536:1s/8qPKbNuyYHqRB3neLezbvq1yXTl8hEgq05OrJTAPSoJqRQND68a+VMKKTRVGR:i/XPKuBHqRFSezm1yXTl8hEgq05sTAPR

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amgapeea.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1924	Qgcbgo32.exe
4680	Anmjcieo.exe
3616	Acjclpcf.exe
4776	Ageolo32.exe
1592	Anogiicl.exe
4860	Aclpap32.exe
1240	Anadoi32.exe
464	Aeklkchg.exe
1920	Afmhck32.exe
3468	Amgapeea.exe
1460	Afoeiklb.exe
2244	Aepefb32.exe
3172	Agoabn32.exe
1048	Bjmnoi32.exe
440	Bebblb32.exe
2776	Bfdodjhm.exe
4924	Bmngqdpj.exe
4212	Bffkij32.exe
3624	Beglgani.exe
1580	Bgehcmmm.exe
1100	Beihma32.exe
1196	Bhhdil32.exe
3668	Bjfaeh32.exe
2236	Bapiabak.exe
4404	Chjaol32.exe
2368	Cjinkg32.exe
2356	Cmgjgcgo.exe
1844	Cabfga32.exe
616	Cenahpha.exe
4832	Chmndlge.exe
4464	Cfpnph32.exe
2556	Cnffqf32.exe
3268	Cmiflbel.exe
4984	Caebma32.exe
2272	Ceqnmpfo.exe
4780	Cdcoim32.exe
3708	Cfbkeh32.exe
2960	Cjmgfgdf.exe
784	Cnicfe32.exe
4040	Ceckcp32.exe
2092	Chagok32.exe
3964	Cfdhkhjj.exe
3100	Cnkplejl.exe
2268	Cmnpgb32.exe
3264	Cajlhqjp.exe
2912	Cdhhdlid.exe
944	Chcddk32.exe
5060	Cffdpghg.exe
4748	Cnnlaehj.exe
3212	Cmqmma32.exe
4516	Calhnpgn.exe
1068	Ddjejl32.exe
4016	Dhfajjoj.exe
1204	Djdmffnn.exe
1968	Dopigd32.exe
5064	Danecp32.exe
3932	Ddmaok32.exe
2684	Dhhnpjmh.exe
1112	Djgjlelk.exe
548	Dobfld32.exe
4872	Dmefhako.exe
208	Delnin32.exe
4900	Ddonekbl.exe
3312	Dfnjafap.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dknpmdfc.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Chagok32.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dkifae32.exe
File created	C:\Windows\SysWOW64\Phiifkjp.dll	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Cenahpha.exe	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Dmjocp32.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Aeklkchg.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Aclpap32.exe
File created	C:\Windows\SysWOW64\Afoeiklb.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	Aepefb32.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Pjngmo32.dll	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Agoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Hmcjlfqa.dll	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Afmhck32.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cnffqf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	2172	WerFault.exe	158

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phiifkjp.dll"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjpmk32.dll"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhkdnkh.dll"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aepefb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 1924	3132	759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe	83
PID 3132 wrote to memory of 1924	3132	759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe	83
PID 3132 wrote to memory of 1924	3132	759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe	83
PID 1924 wrote to memory of 4680	1924	Qgcbgo32.exe	84
PID 1924 wrote to memory of 4680	1924	Qgcbgo32.exe	84
PID 1924 wrote to memory of 4680	1924	Qgcbgo32.exe	84
PID 4680 wrote to memory of 3616	4680	Anmjcieo.exe	85
PID 4680 wrote to memory of 3616	4680	Anmjcieo.exe	85
PID 4680 wrote to memory of 3616	4680	Anmjcieo.exe	85
PID 3616 wrote to memory of 4776	3616	Acjclpcf.exe	86
PID 3616 wrote to memory of 4776	3616	Acjclpcf.exe	86
PID 3616 wrote to memory of 4776	3616	Acjclpcf.exe	86
PID 4776 wrote to memory of 1592	4776	Ageolo32.exe	87
PID 4776 wrote to memory of 1592	4776	Ageolo32.exe	87
PID 4776 wrote to memory of 1592	4776	Ageolo32.exe	87
PID 1592 wrote to memory of 4860	1592	Anogiicl.exe	88
PID 1592 wrote to memory of 4860	1592	Anogiicl.exe	88
PID 1592 wrote to memory of 4860	1592	Anogiicl.exe	88
PID 4860 wrote to memory of 1240	4860	Aclpap32.exe	89
PID 4860 wrote to memory of 1240	4860	Aclpap32.exe	89
PID 4860 wrote to memory of 1240	4860	Aclpap32.exe	89
PID 1240 wrote to memory of 464	1240	Anadoi32.exe	90
PID 1240 wrote to memory of 464	1240	Anadoi32.exe	90
PID 1240 wrote to memory of 464	1240	Anadoi32.exe	90
PID 464 wrote to memory of 1920	464	Aeklkchg.exe	91
PID 464 wrote to memory of 1920	464	Aeklkchg.exe	91
PID 464 wrote to memory of 1920	464	Aeklkchg.exe	91
PID 1920 wrote to memory of 3468	1920	Afmhck32.exe	92
PID 1920 wrote to memory of 3468	1920	Afmhck32.exe	92
PID 1920 wrote to memory of 3468	1920	Afmhck32.exe	92
PID 3468 wrote to memory of 1460	3468	Amgapeea.exe	93
PID 3468 wrote to memory of 1460	3468	Amgapeea.exe	93
PID 3468 wrote to memory of 1460	3468	Amgapeea.exe	93
PID 1460 wrote to memory of 2244	1460	Afoeiklb.exe	94
PID 1460 wrote to memory of 2244	1460	Afoeiklb.exe	94
PID 1460 wrote to memory of 2244	1460	Afoeiklb.exe	94
PID 2244 wrote to memory of 3172	2244	Aepefb32.exe	95
PID 2244 wrote to memory of 3172	2244	Aepefb32.exe	95
PID 2244 wrote to memory of 3172	2244	Aepefb32.exe	95
PID 3172 wrote to memory of 1048	3172	Agoabn32.exe	96
PID 3172 wrote to memory of 1048	3172	Agoabn32.exe	96
PID 3172 wrote to memory of 1048	3172	Agoabn32.exe	96
PID 1048 wrote to memory of 440	1048	Bjmnoi32.exe	97
PID 1048 wrote to memory of 440	1048	Bjmnoi32.exe	97
PID 1048 wrote to memory of 440	1048	Bjmnoi32.exe	97
PID 440 wrote to memory of 2776	440	Bebblb32.exe	98
PID 440 wrote to memory of 2776	440	Bebblb32.exe	98
PID 440 wrote to memory of 2776	440	Bebblb32.exe	98
PID 2776 wrote to memory of 4924	2776	Bfdodjhm.exe	99
PID 2776 wrote to memory of 4924	2776	Bfdodjhm.exe	99
PID 2776 wrote to memory of 4924	2776	Bfdodjhm.exe	99
PID 4924 wrote to memory of 4212	4924	Bmngqdpj.exe	100
PID 4924 wrote to memory of 4212	4924	Bmngqdpj.exe	100
PID 4924 wrote to memory of 4212	4924	Bmngqdpj.exe	100
PID 4212 wrote to memory of 3624	4212	Bffkij32.exe	101
PID 4212 wrote to memory of 3624	4212	Bffkij32.exe	101
PID 4212 wrote to memory of 3624	4212	Bffkij32.exe	101
PID 3624 wrote to memory of 1580	3624	Beglgani.exe	102
PID 3624 wrote to memory of 1580	3624	Beglgani.exe	102
PID 3624 wrote to memory of 1580	3624	Beglgani.exe	102
PID 1580 wrote to memory of 1100	1580	Bgehcmmm.exe	103
PID 1580 wrote to memory of 1100	1580	Bgehcmmm.exe	103
PID 1580 wrote to memory of 1100	1580	Bgehcmmm.exe	103
PID 1100 wrote to memory of 1196	1100	Beihma32.exe	104

C:\Users\Admin\AppData\Local\Temp\759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe
"C:\Users\Admin\AppData\Local\Temp\759ba3bb622eaca580bac022eed2862863235e8d509ad78ac497cfd22660fe20.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\Qgcbgo32.exe
  C:\Windows\system32\Qgcbgo32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\Anmjcieo.exe
    C:\Windows\system32\Anmjcieo.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\SysWOW64\Acjclpcf.exe
      C:\Windows\system32\Acjclpcf.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4776
      - C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1240
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1196
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2236
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:616
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2556
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3268
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4984
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3708
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:784
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2092
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:944
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1068
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1204
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5064
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1112
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:548
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4872
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3312
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1016
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3608
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1660
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:652
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3516
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1188
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 408
        78⤵
        Program crash
        
        PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2172 -ip 2172
1⤵
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
89KB

MD5
74065fc37991fc44f42f73bd519c2686

SHA1
a19c7167cd4226c948ce42d004d40a0d4603f2ff

SHA256
bcf53dc0509ff8bac9e3863609d37f41728bccd1778ac74b448059a61bcd46fd

SHA512
b334576dced697a8dcf2e1698c6a86837df4262ded559444a762c69ce0272362ae50c93a3f640852066310ac06e9e43340eb54319458d601bd2106842aaf3572

Download Submit
C:\Windows\SysWOW64\Aclpap32.exe

Filesize
89KB

MD5
b0051d51228e0a32c280c20d4302293e

SHA1
2f8c264405fd4d9ff8adc2e0efebcd1efcbd062a

SHA256
4fb041614b6e1f0bdc4ffd73e7de376386fc0afe94b1f3d3be062df610beb5cd

SHA512
64ff1cc2594e31e8c1b54ddde431161ad93674dff9473e1d907597ef99ffb1f7e5df6d91a4bea83116ce9c07137a39b0b3501c1670a0bec59a612154091f8a04

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
89KB

MD5
4ef5b2ddf2011d417b427408a438b3ba

SHA1
76b626b7fbee047c1cba037ef4506e9de10c1498

SHA256
217d83e90dc3685143a5a1d826b05c29f09745590e91b6cb4c9c2b1b0785de5e

SHA512
60de2b270fe9158f9b683750d58a2ac0875de2db3f60b09624299532b11ce85379fa3f54ed6c40bbfb4a388c19e4a10942306d0db0ce3fb044dfb88f3794ce8f

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
89KB

MD5
3e899aee378515f4e4f2cb7721b74997

SHA1
a58bf6d137331f4dc2c5ffbab08f8e0960e2b305

SHA256
dee776d956d1d13e6dbeb29c0bf34ea3767096313df92b0d2d63790a2d3f07bf

SHA512
5a71aaf33b87e1757df8276238c87e0b6c6edfb479c4caa5121789527ad8ceabe1a21ee79a45b5d15fbbfb18838aefd6d29a02a7472404a075cc54e8dd079901

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
89KB

MD5
3e846a5e6fdf53fc501b77fee8f90123

SHA1
67a551f3f36ffb224342b841641ad2c90ca4ecb5

SHA256
aef98bbed3765f6db0d4cf71e6658f732bbad0d3bfbb8eeec4d28654c85819d6

SHA512
2d2e617410284095fb9f7e470c2c319e2f3d4931d6e0dbac4f5c9efc57696df9bb3afdbd37df26f16101cf7ffc8a322c778553f92ba8d35d307c89b131f77cbc

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
89KB

MD5
285db4411368ae6a78c1a58a40fbbb06

SHA1
c893d085b24889f41c992f2b700e5269426115e1

SHA256
b7896403d08a59147444123f54428ee4fd8f3f5febaab06b6f83a6ba00b93d58

SHA512
0591183a4a4389a3081d4e11437164f6d6c1dba3f509aad74b0393e1d8e7c584ed7b611bf80cc228e3a8a05fa75a881e9d00d1142351ccf04c128e012e33df19

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
89KB

MD5
5972e8feecb6fb78d51fd9a4e7539ff6

SHA1
b94d718ed8e342ebd498e6a3144ae0fbefe2dbb1

SHA256
5d6e92877e52c482a8652dd2e78d748fe85881f34701e0965e5abf2ecc524fc0

SHA512
88679b51a0b0c4f3a85dd260d4a174bf2426ca3b54caccbc10be00a8e4bc691a218ba66f2f9442b47006453a316c6fe4415f5055c89c74ae9397e7c5e039363c

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
89KB

MD5
db5687e47d0b7f5e98044a68be995847

SHA1
19acc4fa81cdb662f7bca80fcccee209de3b5e80

SHA256
cf11eba7c532f09d6b1597f521a626f3b88d8aba53be452c914b233e97cdb24d

SHA512
0cfc27095c98624485ea755b4a36f15bd3806728a3287151a157696351b3a31c8dca169f7eb56ce2a6203b7d0ef24a0e7c503ea71069e90faae37e93a3395f87

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
89KB

MD5
98fc2d5eb80773fc745d52542f40b598

SHA1
d4442eab2ffd70458c012a8c61c341f50e38f970

SHA256
18e68172573c532cbd2bcf5a44742d681f496241f76942e50752695ac4fdaa12

SHA512
ad6a75ba68c4eb1b1202c17998e5ab72f53bdb46c3c8f5aafe4c335ced48a1f5f178d261502c2527a15b4aff284b13ad2aa027d5e27c8e5bd3e61e7ebc7e5fb5

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
89KB

MD5
85628542b0ca0b6fed985434495c8919

SHA1
44a62530547096fa89d8d483ff0e1ed64a0e5703

SHA256
a9dde74b1e0ea802bd02b9ad43788c598522cf2e395c0f985d0fe89a48867fe0

SHA512
feff25fdac88cdbd9ff511ff760b235496a6f3b768a374d72a6e96151ce55c6faa46812a45c8e4acda8ca2f84f9a29c2ddcfb84bee01b5c09680b4dcf1eb0d4c

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
89KB

MD5
79f6ecaec4364bafbf9ce958ab73521c

SHA1
3caae47bb3fa3e9249a6c73cb158204a9164b5ac

SHA256
dee6ec0f05d8d33b91a97d72c8356a9ea627b19202e78f7a0e5120e7a66562f3

SHA512
9aaabd202b44a650fd17dcbc2000c80fcfd691727e624b45e2db4075594bdeaeeffee25ed4af36ef56228feefa08762d66f17e4c81fd84cb3513640f457e467e

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
89KB

MD5
e5fc95a824431ce50c08faad8fe6feba

SHA1
52d4ae06a4c31e798b09b4de9ae28ecd4e5bf107

SHA256
c95c0973ab3d5e16ff22f2cb42fe71649ded392de139e516ef7e36edc73813d2

SHA512
0ca05938cb46666a3b3f881d6d0dccea0b0cf9e8cf34c4ab4eeb0500658ba62e2c414824d8b68785cd13bb55d81283b3e58b666a295f1dec57507a05001e2a58

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
89KB

MD5
d36c97ab3c8092f2952dcb854dd9cdb0

SHA1
b2fd462f3b8a72c5993a19c5272c258dbbab2001

SHA256
831f60c903be8920e6190b5d7f2aa0432c8146817d6ae2808d3f3dcf2284fcec

SHA512
17e8b86ee35294191588d3b59521387f625e1e1e9b1cfd9f390474779cf416782acca05405680c7f85eaf71da95e9fc87e9d403d22c3ec7c75772e2f71a47fb4

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
89KB

MD5
7ab3785e97974c456ba54dd2fe3ef2cc

SHA1
4a49ae9139a81e4a241fd25b38b4bb921e7b495d

SHA256
16ab8bccb95a685ec3271254974853ef11c876e8d9d12019daceae40e9a26645

SHA512
d3b6cca3aa2876e50065cd1341d694d41befefe139a7f7be7138a20c3104245c8c074227d10b7044e93158f2a0115915146ede1fef967497cb470a9d36912916

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
89KB

MD5
aba56a2b56108520224a46a33f14b3b1

SHA1
d4c5928e535d2358e68404575e0bf8a3b31fe3af

SHA256
d35456a9362dd1b5b426e9a0ced2d4aa0d8e446c60a038e8f0c41f5ce9072a44

SHA512
f3e078a5cca2517ba88516ad4615d8aefab7ce3235bdb51c262882057ed59d3c36243fc42d7b6418a90419ac081caef3c4c6b540c6931dc9af848a3c050cc288

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
89KB

MD5
59bafd4dadbcbb05b5a381cede3a8ab3

SHA1
450fd9386e11081e8ee56cbbfd9ac8ee2df5b225

SHA256
0821c47417dc19fe2adca6c7b96b86f0fb30ab5075ddfddc49ddf34b27388c56

SHA512
b857d444c35aa050263f1ac8bb3cd736fd954b2ccdcac4f4ca0519c84c47f4ecb8fbe4035f30a8ea6cdf0122f769adc9824868ddeee128fcf0001d7fdb0a1249

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
89KB

MD5
cffe53d87ddceb5247a76b8d383a3900

SHA1
ea63c811de9c6ac36e82f454556cdd15d7a5b02b

SHA256
efa2449b8c82d2353b71d248cc6fc5b0a06e24b3e8564f73177d9ba855c9897e

SHA512
7b081db8dbfe89d117f0208e81038968ef7eeb67f84ec8e271337b16b08ad843d35abc3e19c1806a29c1c91dc5ba20ae8b2ae7da422614db084c091840dcb16d

Download Submit
C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
89KB

MD5
10371cc73c16c560789ef9f4c371ad95

SHA1
d1e7dc334383115f60e7e034bf1123afd25da6e4

SHA256
8d69a905e8a1b13c7820c5db65674687362020769f2b7fa11783d03da935467c

SHA512
88899a0583bba777cf354736226518b62deb3dc7f3f7e53bcc0849f887e6193ebdbaf964049d6d041f58230fd5cd3292da3644b74e6d773b4315924716388470

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
89KB

MD5
8c9fcb28c1d28a160a1ed1b1fb3e2f4f

SHA1
cf3506b21c741ab393fb1290b9538301ea3c061c

SHA256
65f75d99187c8005e744753738314829cc86f2d540e4c2ca3e757c0d47cc2a85

SHA512
0e29bb6e4f9b87bbccccb33e485627be80f7e11ea982e9062ca4e1355662650e0f31f4b8b517175fa3af6e36a1d36ee257830f81f74b990c14cacd415b2839c4

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
89KB

MD5
356dec7d1ef70f92f4b505766f29a670

SHA1
57b8ae22a7759288029c723bb71f9be0e296fb4b

SHA256
644d93a956a565966d2b7696fb65f90e40d166d95af5e35e35cd78b61970fb51

SHA512
53cf5953a013bcf63b0490ee53e236c042405f5bbbddc41885e1c3a81c8a66bcd0baaa86141cf6db64439cb61ce65b7f68792024b46ea053f6923967e195ce18

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
89KB

MD5
8405864b8b2f582199080572e96b1719

SHA1
bbee2b237de0cb029a1ab6773ef988f52ebfc71b

SHA256
09b494813b081e3818ddd61e4523bfa441b3ced6d6d48d5af73c3e21bd59c3a4

SHA512
82f3a2bc733d825e759f9d1cd78c59605c7a0548bfd6bdfcc5df9b7a4f1e961d953ef25cfca323d3002fe62fc741d806d5dd349c53256700951fde9e68d40ea6

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
89KB

MD5
e94fee1733db539cfbbc7d453703e794

SHA1
251584cf27640792e09c578228896ba842c3a960

SHA256
4db2764ad2dd333efdbe796b404911583cfbc776c2623775fdd928a4de95bba9

SHA512
0661ea6210b97c4484a59186d20e3b9c8299cf91db06112343480ed605d7a340b86792fafb45e791d28b462360fa155342a4afa0e762d189a8185b6c7dc26de6

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
89KB

MD5
fdf5f95a13ed16bbdfe00642b22e7e58

SHA1
64a127922e5ce802e740b156e87c96f5ec198753

SHA256
ce49c9499f496c10e101459614fcf0641489ade2c066a0a021dd69bd1eb05dd6

SHA512
53aee6ee3ea203ead5b1a97a0e8907bedce907b45bd7a0b851b3d41e7487de472a4370a9c8470c68bd80c064a6a644f92c39bfd676adb53de69cd4feb3f6aeee

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
89KB

MD5
513ca3f49653f588569afeb29d55ab84

SHA1
72c3bb9ce5d9b689e5c97136eaa12713995b5acd

SHA256
f9ab1910667155edf69f4d1421bc44cb2a49d9079631103be5a71d186ff186b8

SHA512
606ca832ae2f7c61952e1c3fb6de3130a1c1a5412c6059afbfe57a08789362e0c55ec2ac94ef5f5fed6d97f90f0e5cc4b78d7ff39028212dc009455ef68f31ca

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
89KB

MD5
49bdc20996d4c9c0c24b634b2c490892

SHA1
f98aff286fc09b9a98b11e2c4b58f9ca1c58ecd1

SHA256
e39e60eda84deec2a561b521c574054a1fdadce296a8c558c9456565a6a45544

SHA512
976ba270607fc3077f067174f25eb7754392d4920c9caa59132608a736e6a2f1291c510a18f6c4e83b36fcddd2ff51567b0b4217f1ff6155ca9dba935bc81889

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
89KB

MD5
38afda02de00274d95cf13cdc04012c9

SHA1
9bed466d12782ad84458e4c9b448bbdbbf918626

SHA256
61ff3b4c8c44638efca74ef911f997ef80c1465c673d57fd80e76689b36b96b8

SHA512
b8dacce46ce68636079e64d6cfe88b61c90268df9a112a2c3f68f309ca8805654030df5cd503d67e0ec4bba76f47623c80e4fab0b8ff7b4069f59de3d2d488bc

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
89KB

MD5
81a3260e0ae9551bb28a15ed9477ebcb

SHA1
0d26a4b43be7400f9868c53e16c604b25dfb986f

SHA256
0f3a5f30373e3f797e4d37a25a024db6a3a47467048c695bc650e1dca6e695cb

SHA512
8d2ef36c9df5d7a50ea7e7e4f79538e6773d398ac859175f11d5c838909bb0cb3a3649fdd801792a763c1853db787702b1a973bff650537a0ea0bb7ba26eaf9e

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
89KB

MD5
9e3da9f639c0db22a16d4e0c7693e343

SHA1
4adfebeab086fa006c7913166fa3786a2961ad5d

SHA256
90485139bca33a98450b32032cd4e32ca2455553cc2c4942590589eb3c1daeea

SHA512
2ab6f02de631efa97b3e4551b1353fc96c9216654e7a0a40a29bfa6fabd88cf1f8d33c79ebcd8949ca99ba872c1c109e0d6604d2ed999ce2e787b401ee5977c9

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
89KB

MD5
7fbf52525be70e0102d422bb0820e09a

SHA1
f2cfb0970c7104cfa1a7de1432907e2e1791ed5d

SHA256
44b365f47523c0d73ee2b85b36833a7ce53a3d10af36f23115d4d76833ff6213

SHA512
fff0dfa616cb91a4fb07effe0f0cd1ad3a30595b20c82e536db43487bdd3af84e2a4edb2b7edf2dc20f3394d2dab9a962972085fcbc24f3f90402817e945c17c

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
89KB

MD5
c72d9ab15d8ba502b7d1bcd1a74cecbd

SHA1
1418902e84d72969dfbb5aa96afe6209c6facfd3

SHA256
1e3633121bd6c46125e8f9f1bd7b5ce13f1c59c15bc4e05e69c1094d7135ee77

SHA512
08a0cc916a2f0423281c3795c7af07fc7a04cd5b4f4d53ba4bf6281f20db9aa4127bb22da29fa7e2997a4fd6e99f43ffd08d403dbc2d105db1d096bdfa231630

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
89KB

MD5
f5e923704c7a823be69aa7a376ac4ab3

SHA1
9aee3d1244ff3507050331186b533fac410a91e7

SHA256
0767561b30eb3e25d8cdf66e1259850e44740a298b919a7dea08d22e43b30c3d

SHA512
8356c9651f21e7e6ff93a8e880d38dde5a4ee7049ae83c13c4aa4b86b1db57b5267266c1757a66d36b75d574a78f38be0fa7f8f83b85dd001f098d824de1b5a8

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
89KB

MD5
6d10aef37640ded5c8ebb06d5cc3e3b2

SHA1
773233fa1a6150f602de7ba58cd4312ceefd7b58

SHA256
5c87940966f6a8134adc6ab6258ccfa17f86c6f5b6712b5925081a40230b2af4

SHA512
af68a656bfec82e3ce9e9f12c6752f2a12d56f53b04aa29c1be0a5ca2d9cfb346b6e7ef44aabd9ef459dc86b3b0b07cb0df6547d2653f59115c6be4dc3a9f8d6

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
89KB

MD5
c19ddfa9ee01068160ccc79b0cdfd22a

SHA1
5be5067fdafed2aec904b590152649716660cf54

SHA256
93eb028b8f11e2cf30e021edd62cd1790f66382d456a13ddbd033a0aba27b3f2

SHA512
e31cec936f2262c40c55355c0d15cd733ab0a75f8e4dccf24404136be1c4a5dd321432cac4e49eaf7843d2ea77c6fdc4bc233610931f4b5d65023007efc8c3da

Download Submit
C:\Windows\SysWOW64\Ghekgcil.dll

Filesize
7KB

MD5
85385efcc33d1973559f54363c250a02

SHA1
52653e056329954c5ec2feae2ba6f443a11cfbda

SHA256
041354e7e861bf38a0ba5cc4238c54863408553b4f522be139cc41e104850d06

SHA512
077d83d693e6bc178959b22f4faf19165f595fa97f64156573637dc4e1f3ff7f9a68bb5f683b372afb824d82772b787114e76d8b124e58814e70ae601d2b9d31

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
89KB

MD5
fd0629861465adb511795076ab0d025d

SHA1
f5827cb55ee0beaf30ad32d8ee053ccc019d0b33

SHA256
360fa8cc532ee8b7ea163040734b169f52f20c9827951625619c79b7ae0d2a18

SHA512
8dc11a41001792ca7c33809f1ac725a39ce3756bde974dd2e616dd9f944f0dd9675d7a9db648b7c04c3b0f3a97d966e5e1de05102f2cb978aedcea85e9db75b2

Download Submit
memory/208-465-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/372-494-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/440-219-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/440-126-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/464-152-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/464-63-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/548-452-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/616-256-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/652-518-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/784-326-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/944-374-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1016-488-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1048-206-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1048-117-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1068-404-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1100-179-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1100-273-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1112-446-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1196-193-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1204-416-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1240-143-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1240-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1460-178-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1460-89-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1580-171-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1580-264-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1592-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1592-125-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1660-506-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1788-483-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1844-247-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1920-161-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1920-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1924-88-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1924-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1968-422-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-339-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-295-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-207-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2244-99-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2244-192-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2268-356-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2272-302-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2344-512-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2356-238-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-229-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2556-282-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2684-441-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2776-134-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2776-228-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2912-369-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2960-320-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3100-350-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3132-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3132-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3172-108-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3172-197-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3212-392-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3264-362-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3268-289-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3312-476-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3468-81-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3468-170-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3608-501-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3616-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3616-107-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3624-162-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3624-255-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3668-198-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3668-288-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3708-314-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3932-434-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3964-344-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4016-410-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4040-332-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4212-153-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4212-246-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4404-220-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4464-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4516-398-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4680-98-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4680-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4748-387-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4776-116-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4776-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4780-308-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4832-265-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4860-133-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4860-47-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4872-458-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4900-471-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4924-237-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4924-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4984-296-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5060-380-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5064-429-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads