berbew | 3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213N.exe
Size

285KB
MD5

137986393e886ea9c50f8da4e33ce6f0
SHA1

953b126fc68ea78d15fba7d8e1ecda98198188d5
SHA256

3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213
SHA512

2e04716580f11d2e5aab33f588fd027fbf53ca8ea3efe2a74340fb85509f3c525cc2a0b10241946871ee4aacfb3d0b94a4aefe3001d94783796898d38fa178eb
SSDEEP

3072:4zO1QWi3Xys7ePUqbeEKVcbMloVRr3uMg0kAqSxYiJ2QM4GKch:4rx3Xys7e6EKQIoi7tWa

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2332	Pjhlml32.exe
2264	Pcppfaka.exe
5100	Pmidog32.exe
4280	Pdpmpdbd.exe
2104	Qnhahj32.exe
2484	Qgqeappe.exe
968	Qmmnjfnl.exe
4300	Qffbbldm.exe
452	Ajanck32.exe
4704	Ampkof32.exe
3992	Ajckij32.exe
4240	Ambgef32.exe
4772	Afjlnk32.exe
3464	Anadoi32.exe
460	Aqppkd32.exe
2320	Afmhck32.exe
2880	Amgapeea.exe
3632	Aeniabfd.exe
1128	Aglemn32.exe
4564	Afoeiklb.exe
1516	Anfmjhmd.exe
2816	Aminee32.exe
4116	Aadifclh.exe
3704	Aepefb32.exe
1268	Accfbokl.exe
4396	Agoabn32.exe
4024	Bfabnjjp.exe
4064	Bjmnoi32.exe
3388	Bnhjohkb.exe
4456	Bagflcje.exe
3900	Bcebhoii.exe
4312	Bfdodjhm.exe
1108	Bjokdipf.exe
2572	Bnkgeg32.exe
3684	Bmngqdpj.exe
2316	Baicac32.exe
408	Beeoaapl.exe
4956	Bgcknmop.exe
1976	Bffkij32.exe
2120	Bjagjhnc.exe
1488	Bnmcjg32.exe
1592	Bmpcfdmg.exe
3312	Beglgani.exe
812	Bcjlcn32.exe
5104	Bgehcmmm.exe
4052	Bjddphlq.exe
512	Bnpppgdj.exe
5032	Banllbdn.exe
4792	Beihma32.exe
2228	Bclhhnca.exe
1984	Bfkedibe.exe
1892	Bjfaeh32.exe
4432	Bnbmefbg.exe
1416	Bapiabak.exe
3304	Belebq32.exe
1552	Chjaol32.exe
1196	Cfmajipb.exe
748	Cndikf32.exe
4784	Cmgjgcgo.exe
1364	Cabfga32.exe
3756	Cdabcm32.exe
4948	Chmndlge.exe
1840	Cfpnph32.exe
1004	Cnffqf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Afoeiklb.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Ljbncc32.dll	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bjddphlq.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Cdcoim32.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Dmjocp32.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Afjlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Bnkgeg32.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Dmjocp32.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cnnlaehj.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dmcibama.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Bgcknmop.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Bjmjdbam.dll	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Mkfdhbpg.dll	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Qffbbldm.exe	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bnmcjg32.exe
File opened for modification	C:\Windows\SysWOW64\Cabfga32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Ehmdjdgk.dll	Ajanck32.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Ajckij32.exe
File opened for modification	C:\Windows\SysWOW64\Ajckij32.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Accfbokl.exe	Aepefb32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Hjlena32.dll	Amgapeea.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bmpcfdmg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5648	5556	WerFault.exe	183

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qffbbldm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingfla32.dll"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoqbfpfe.dll"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcppfaka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmmebhb.dll"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2332	4936	3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213N.exe	83
PID 4936 wrote to memory of 2332	4936	3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213N.exe	83
PID 4936 wrote to memory of 2332	4936	3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213N.exe	83
PID 2332 wrote to memory of 2264	2332	Pjhlml32.exe	84
PID 2332 wrote to memory of 2264	2332	Pjhlml32.exe	84
PID 2332 wrote to memory of 2264	2332	Pjhlml32.exe	84
PID 2264 wrote to memory of 5100	2264	Pcppfaka.exe	85
PID 2264 wrote to memory of 5100	2264	Pcppfaka.exe	85
PID 2264 wrote to memory of 5100	2264	Pcppfaka.exe	85
PID 5100 wrote to memory of 4280	5100	Pmidog32.exe	86
PID 5100 wrote to memory of 4280	5100	Pmidog32.exe	86
PID 5100 wrote to memory of 4280	5100	Pmidog32.exe	86
PID 4280 wrote to memory of 2104	4280	Pdpmpdbd.exe	87
PID 4280 wrote to memory of 2104	4280	Pdpmpdbd.exe	87
PID 4280 wrote to memory of 2104	4280	Pdpmpdbd.exe	87
PID 2104 wrote to memory of 2484	2104	Qnhahj32.exe	88
PID 2104 wrote to memory of 2484	2104	Qnhahj32.exe	88
PID 2104 wrote to memory of 2484	2104	Qnhahj32.exe	88
PID 2484 wrote to memory of 968	2484	Qgqeappe.exe	89
PID 2484 wrote to memory of 968	2484	Qgqeappe.exe	89
PID 2484 wrote to memory of 968	2484	Qgqeappe.exe	89
PID 968 wrote to memory of 4300	968	Qmmnjfnl.exe	90
PID 968 wrote to memory of 4300	968	Qmmnjfnl.exe	90
PID 968 wrote to memory of 4300	968	Qmmnjfnl.exe	90
PID 4300 wrote to memory of 452	4300	Qffbbldm.exe	91
PID 4300 wrote to memory of 452	4300	Qffbbldm.exe	91
PID 4300 wrote to memory of 452	4300	Qffbbldm.exe	91
PID 452 wrote to memory of 4704	452	Ajanck32.exe	92
PID 452 wrote to memory of 4704	452	Ajanck32.exe	92
PID 452 wrote to memory of 4704	452	Ajanck32.exe	92
PID 4704 wrote to memory of 3992	4704	Ampkof32.exe	93
PID 4704 wrote to memory of 3992	4704	Ampkof32.exe	93
PID 4704 wrote to memory of 3992	4704	Ampkof32.exe	93
PID 3992 wrote to memory of 4240	3992	Ajckij32.exe	94
PID 3992 wrote to memory of 4240	3992	Ajckij32.exe	94
PID 3992 wrote to memory of 4240	3992	Ajckij32.exe	94
PID 4240 wrote to memory of 4772	4240	Ambgef32.exe	95
PID 4240 wrote to memory of 4772	4240	Ambgef32.exe	95
PID 4240 wrote to memory of 4772	4240	Ambgef32.exe	95
PID 4772 wrote to memory of 3464	4772	Afjlnk32.exe	96
PID 4772 wrote to memory of 3464	4772	Afjlnk32.exe	96
PID 4772 wrote to memory of 3464	4772	Afjlnk32.exe	96
PID 3464 wrote to memory of 460	3464	Anadoi32.exe	97
PID 3464 wrote to memory of 460	3464	Anadoi32.exe	97
PID 3464 wrote to memory of 460	3464	Anadoi32.exe	97
PID 460 wrote to memory of 2320	460	Aqppkd32.exe	98
PID 460 wrote to memory of 2320	460	Aqppkd32.exe	98
PID 460 wrote to memory of 2320	460	Aqppkd32.exe	98
PID 2320 wrote to memory of 2880	2320	Afmhck32.exe	99
PID 2320 wrote to memory of 2880	2320	Afmhck32.exe	99
PID 2320 wrote to memory of 2880	2320	Afmhck32.exe	99
PID 2880 wrote to memory of 3632	2880	Amgapeea.exe	100
PID 2880 wrote to memory of 3632	2880	Amgapeea.exe	100
PID 2880 wrote to memory of 3632	2880	Amgapeea.exe	100
PID 3632 wrote to memory of 1128	3632	Aeniabfd.exe	101
PID 3632 wrote to memory of 1128	3632	Aeniabfd.exe	101
PID 3632 wrote to memory of 1128	3632	Aeniabfd.exe	101
PID 1128 wrote to memory of 4564	1128	Aglemn32.exe	102
PID 1128 wrote to memory of 4564	1128	Aglemn32.exe	102
PID 1128 wrote to memory of 4564	1128	Aglemn32.exe	102
PID 4564 wrote to memory of 1516	4564	Afoeiklb.exe	103
PID 4564 wrote to memory of 1516	4564	Afoeiklb.exe	103
PID 4564 wrote to memory of 1516	4564	Afoeiklb.exe	103
PID 1516 wrote to memory of 2816	1516	Anfmjhmd.exe	104

C:\Users\Admin\AppData\Local\Temp\3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213N.exe
"C:\Users\Admin\AppData\Local\Temp\3aa2466f6625f6c49980450d935fa2efc80d0ba6e7b34b8f26531799a92b6213N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\Pjhlml32.exe
  C:\Windows\system32\Pjhlml32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\Pcppfaka.exe
    C:\Windows\system32\Pcppfaka.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Windows\SysWOW64\Pmidog32.exe
      C:\Windows\system32\Pmidog32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4280
      - C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:460
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2816
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4116
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3704
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4024
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4064
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1108
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2572
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2316
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:408
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4956
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3312
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4052
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:512
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2228
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1984
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1892
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1416
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3304
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1196
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:748
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1364
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3756
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4948
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1840
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1004
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3540
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        68⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3612
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        69⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4984
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3456
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        73⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1260
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        74⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4800
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4388
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        80⤵
        Drops file in System32 directory
        
        PID:3780
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        81⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3964
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4860
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        86⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        87⤵
        Drops file in System32 directory
        
        PID:1848
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        89⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3544
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        90⤵
        Modifies registry class
        
        PID:3204
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        91⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:816
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        94⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5296
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        98⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        101⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 416
        103⤵
        Program crash
        
        PID:5648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5556 -ip 5556
1⤵
PID:5624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
285KB

MD5
ec560495436cf6e309b466ec8ac846fa

SHA1
6e127c6d644106a2bd80f9bd8873c3c8fa23f2f4

SHA256
4b4e4a45aef45c5e32e34b4a389602df58be345c58a085760a2d1e51674c6270

SHA512
b98b0d15d874812f698300f79b632f6a9c91921208ea42c1341d079b9523bedd86f1cc4540fdf711bc48ac2363c5172fa90ddcd24b2e56700dd171f5319e54d3

Download Submit
C:\Windows\SysWOW64\Accfbokl.exe

Filesize
285KB

MD5
a0ff6597e0a43655818433252890f59e

SHA1
f67708be232b0a49122697642f626b91fa7bff22

SHA256
57cb3dc8abaea79b8e5a3fa44a4a8244a6f838a19390c828526acb287affcae3

SHA512
83e3bcda21915086602ddf0f29c17a6cc5b2d701f646261fe131a83194be02c5457ce67b9ac240b37af213fcdc4735bd51ab370c44b5e6898897fbb8ded5993b

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
285KB

MD5
b34159759faeccb2a6e854abf02b4e5b

SHA1
08b243e4d8e34e68ba4d2a833238bbfb3d9844ef

SHA256
a8062f1ff2b2dc2954b75ff1c0377f52413df544788df2a8318277b3eb418852

SHA512
01c0681306931e5bff0d003bbca6aac6baee54814a51db143d2b35954c790f1d4ebffeeaf9533a7ca2bd371c63df9d98c0d3f47048ceb948fc8f9b63b8b0dea9

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
285KB

MD5
0a8643367b126b12c04fdc026f1b6b64

SHA1
e40485ef2a3f530e57e1c1175420c090d043e443

SHA256
4f31b4e311fe2987cb1f038ffab2627975750d8896cad4c62bac4257d1aa0c93

SHA512
5e602e59c741464a8403aba0b9901a97a58794f77443f6fe23b82aa7b6a01ef78fee358b31516b4eac6f7758cb7def53f5d47ec69595e87c274b10bdeff56935

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
285KB

MD5
345550ee09ba91025374693d1fb22b8e

SHA1
a9d2c0a9f48d9983e5256dae58fb0834501b2918

SHA256
b5526faa945ec17962a16c8bc9e76ebf2b27c4c63ae8bbd6334b30481ff7cace

SHA512
c163ac1a3a78f9bec5043371298f0333438628b5927dd3182c77dd2518c19118540b56df381f5e1807888ce24bc26a23750ee7b765f2761f8537ea06374c25a0

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
285KB

MD5
531acf0c6294697a72110242b588a9b2

SHA1
83321c1b7c11ed87df4a0aad4ee7c98a3aa4eb8c

SHA256
fc7c5b007ce6a3e5c22fc88e651b9176273160c5af60bcec9f636682b7e10660

SHA512
b128e62879d5242196b62cc57e1508297934e34aad1b28ddea01691063f108b7c28e9f5b32c5a4d6bc78b0e53526b803cc7c1856cc96e6ddcadcb5777607901c

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
285KB

MD5
5e28e97a8b085605612a82893660bf28

SHA1
2a876d9e16cd9dc80724feb1b92142e5df1729ba

SHA256
5601316c9696281b1e87f63d14e37fe6faa1ecba3744378595a6f0d4293135ff

SHA512
6e6b07caf9e591264f1f462d2898f0e36bf8255c8fe02abc66bea791ab327204e23a37c8d30a715b93c914829157588762ebde7dc6965be1a241f6f5a4513fda

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
285KB

MD5
c5ee856db568cbdca7b604a69617ef0c

SHA1
97d31556efae87a80d8009745fef672c57d3b1d6

SHA256
afcfe8ed9cd50a3713591581570c2784fe223188bbf179174d9ef8d5c589752e

SHA512
a229da98b2e92511deb5a72ccd8ee8b1be5478c7b81c90785de5b0a79ab159d3ca7b3e7ff55840148455894fa4fde5b42fa33de85d88c4e95caf1e7c9e4f15a3

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
285KB

MD5
64ec2cde922cbc0b2e09a541bd330c80

SHA1
8d19cc1ac6bc08097882ba84e0655e2690014a38

SHA256
d9497d1ddc7dc4a5ff661620e4bca6dc884823e2f90acb9d2d20dea1cdf183e9

SHA512
fbb8e433052a312743eb5724ee0834908c0c014fedae8a4c2a479caa1be996dc23bade40f31826b2c5ba65d2e94dba57bec87ac62761349ed849ea2da9bfa446

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
285KB

MD5
14e34aed8d1264ab4f17d92991f7ab48

SHA1
ac35a79fa8d5a58bb36df05d4b45dfec9a6d4b4f

SHA256
b37753821160f1a88e8ac9048e2a0eb00de04e484bb392cb22356ff8a6e217b8

SHA512
babacfc017008d103aaa435cc8341967cb95ba12e55c73169a9d3d1c401e1f4f77bc4de662876569988df5d738ce75276e3a03a2ef767a810c5d519d98e20225

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
285KB

MD5
46fb4002031d4424d28deb6259037f3b

SHA1
a05caf94f228366b84788f8f00b71399f20aea40

SHA256
bc02be758b52fd262740e7defb6fdae9cc4e45b2cef574c7714aef60db03ff74

SHA512
b25a07c7ee3cf614b6f660d6ff138e6e865ee4f4fb632c67a8beff3692a46eb1c04cb758b82b9cffd25370e8e9a0de3cb48901b5b4af0d34a4e92eaae1fc41a7

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
285KB

MD5
9c43671f080204891a21d18875b84e00

SHA1
3043e77b3334ae21b4031e8443ffa28917e17674

SHA256
e9a2cde5190eafd079974c93e69caa7750a53e0bd0305c725eac9f60c3f2a014

SHA512
b50dcc136629d7614a299547388cec0c5be58cd09b73c2d723e88dc0c234bd1243b35644c4a4fa97f039d5ed7de5c8d26a1baaabf772c056511534d5f6f62eea

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
285KB

MD5
41d6e3dd5e55d6e363cee53dabf0df7e

SHA1
04918424fbbd3ea720fb9ea8167124e4ae3c270a

SHA256
c6558e7e1c7699e5920ce06263991ac9436b496ceb37dc73b770bf393d41db9e

SHA512
d0cc4ac1c0acee3903cd56732e0b36c2ac54193456035f86604ddfd49381afe93760e7947a0debe4fb51e29019bb98a89ec926dc42ae37b0c387f54e1249bc82

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
285KB

MD5
be9297fb8d3cc5d1698ac1e3c8ad1968

SHA1
3f2b35184961ca45f27d1ee63a500c9099acdb16

SHA256
30f582c10e05e66537fa89f0e00dd35e4df96114832fa87511aab544e874b145

SHA512
d15df0cc04a170fcc5a3f019b45d83dcd911620f107e44136ec938bef8cfdb4ba9c3737be67fb9ccc583782823b149e0f740240c12a13e55034600eb863527ac

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
285KB

MD5
a2bba881389891c8f57c70b2a56b6ef5

SHA1
2c6391aa675a8a1711051a2d85cd7cac7dc81343

SHA256
27478f7869cfb5832929419d44ec9659a9ceeb4a8f16604e928f33b9a7119b04

SHA512
b4fba14a698310fd9e3635f02e01d0b3d1e8e77c6a6a8e20902c24c2afebeb8a64d71d588a5f897fc85baf76d05f9f59993d809b6757a7d7235f7d03c188e4ad

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
285KB

MD5
5afadc40b5034fdfffcdf97e95e5b0d6

SHA1
41a36d273292db2661af32b638c24cadff3cd3a9

SHA256
a4ecdcfa52a9ee148014bad9bb238cb158a01f938ebd84edf8b0cc22b7a9c344

SHA512
b6bcb5255bde811bcd679998f6955a0b7de2aa633201a4fd27273b95e6c2c5f67695349731c6a5f5f53b7db741f6cdc63078f145c7191a90a6a3a01565cd3bc1

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
285KB

MD5
3fc6408ca7c6d0e570b576a8743112f8

SHA1
8456cac19c68cadbcdaa6ac68d56a24834450204

SHA256
6005aefcf9c83b267c9e6fa51f285c1ed6662167a52af3fac34369a8750e458e

SHA512
ed19eec1457cb1d58f67ca8e60f258a86d93b78165a627ef3ebe0739501eee3ad1795e3a864f8a07cf0309775de3409a23858a392d42434874dec7976226ee45

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
285KB

MD5
e4d947131f635a80ba6d4be45daee912

SHA1
130001a2727f10021a961def6d6eeac8d1bc0522

SHA256
7d0fb2a2d2de30d08957510f3448b6aed27d4b7e94d20cace4b8e61f0acda159

SHA512
03b5fb6411ea8f87a6d3ce1cdfbcc83ebfaf332d111ec268c0b112ddef58d9f5e435aa7ba460a14884e18641e951f5030254252c7b07cc101c621afe20d5e1fe

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
285KB

MD5
54f8773ba8fd94025a7527bb706d9023

SHA1
33baa7aeb0cb16371fe296de652448ca9f935fc4

SHA256
f4809e845ea27a3e739dbf2573b78dd7c0c950961ab760acfafded6e65ab7814

SHA512
6cb1988ff68deb97d151c50cdd3130d03ba0b25648280f2bc3a59c10e81f99bdf3cbbbf0ed3356470cbdd1cb865fa7ba9da07458706e228db78fe934a966b065

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
285KB

MD5
836d5a12d195562168c01faa169fdf0b

SHA1
d8273edb5d7c13d94cd539c161aec989ce8608a5

SHA256
690449b8f236021426587b28e45425752b7761df417f5fb6857a97b605e6d33f

SHA512
aae7a1b368ab477482aea31b39a0492d79a12067b0fb0681bad105fd55a48740a5636182e0ff777789435475b372b8970033a8136d6643c3d334ee0e9a6de46d

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
285KB

MD5
7b6445bbb85f1a008c11256226be7d24

SHA1
d110e4305fece795dcd2485a8bc851a0ddbe1bfc

SHA256
d239c69f86e494c0242f85dd923722929b912d7b93d61f8c174dd1973b81263b

SHA512
db713ddc98136b95fdc6762f6ec0b24e41263ffad7bdd9e603338610f7d179fbe0113d52a5c308128529ec684e584b2797dc5ce9cc2f0c003bef5444485559a8

Download Submit
C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
285KB

MD5
f59d7324a8c89689deabc1a791a0252c

SHA1
edc4ba99c4d61cd3cc65ac70124b3049a0a26324

SHA256
559cf9de94a7b0308904970f9c18c13fc20c3705de9a35c9fde45774e8d72ad2

SHA512
da07beb80de8a0bb7d9ce7672880f63d6ae553786d47cc795009c2a625dea92bffb9fb68dd125f2f1a5c8ace88747e0118885b7510c20f813cdf2809b8a380c4

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
285KB

MD5
ecc797e781f3a687e4307173df3ef411

SHA1
4e24ea2a525c2409888e08ec6ce8c37ff9e3696c

SHA256
844aa2dad6356e609271e464f68715f55f92125456589bb3e9ee6948e49e00e5

SHA512
f8d4b731fa0cf2f7a92bf94ee5f8df42b1bb174a0f73aacb7632b66d1be838babfc68fb31c413a096afe3bec381249e5b28251c861a43c4b3d242011684d101c

Download Submit
C:\Windows\SysWOW64\Bnhjohkb.exe

Filesize
285KB

MD5
2365539ea9ac83fa84e87354ad4f6ee6

SHA1
f8094046a508fc7735e1749892c8ca693028bae8

SHA256
88ddb826f5a3c61cdd18e14fc1bd840134fe8b4ea4b4c0024453c3c1450f4aa3

SHA512
49161a9218589b2ff73300890a7fa2df8aaeeccbdf376985078d3b94b0382aab4d55e61a23c3638f88c9bd6ed11466052229fed70d7b2a2d91aaa4b7767965a9

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
285KB

MD5
5843069aa24b8d0381a3116301a05096

SHA1
6199c31dabc293adbdb08b09efe9ba0db7fb642f

SHA256
92d0b0fdb6923b65b0959f7dfbd4fbe954b8d01c027df84f427915c93615bd9f

SHA512
f4b75072a33c7efc856419593afbaf93240c89753ce6858d8adc60ea028836769ca0a155b165652a2a563cfbaea29c1e5ba349a678fa7d3666294570043dca36

Download Submit
C:\Windows\SysWOW64\Hmphmhjc.dll

Filesize
7KB

MD5
b026c84460f1f34b4839b48a60e9d7a7

SHA1
bdb4cf7b7409a9d7119d0162008d4cd3ca5e3e46

SHA256
e2cc796c2b083ff1245790340c6ae68ffc535d6611a6e4294613cb36c4d230bd

SHA512
9d7b5469f9b7423420f7edc83268bfbeae8312a0044c56d60cfd20e7018ee49eaf68b39e7631c57acab9b59209968de9ecadd52697c2ee5d0a0145cabc208eb3

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
285KB

MD5
21bb4abe5e7b8853e81b2ca70b9e0b73

SHA1
ef34c12f639d21c00617de590a1c746b7d18b833

SHA256
68537bc21cadd5cb15f4bef632d968c4701056f4cf2468d7abd8e277b0f3de0d

SHA512
0239df86bff0cbcb329ebf1b542a573c758a5f40938ee4c685378ba6282827bb289a6ba9a95834d92d8f1e71ee7b384aeac69fc51a3ccfc0249079985ab20878

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
285KB

MD5
95a1b4b58638b78cd3b032dbcc474b0b

SHA1
50b31e9171ebd45e4d1b5bcb3b7de2219ee99fac

SHA256
317e6ac3eded57485d824980ab895e6a85231d689e855f48a5ae78bef6feeada

SHA512
9e2d5de1fc7ac791ed7a5062edd6e33c40ec38f65d662724efa04f8c23e47412cb1bdd89f9c5cd6792ab9cc819f24439effbc9031c2b6e56167eecd75930fb21

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
285KB

MD5
423e83d43a6690f5aec5ace6668b2966

SHA1
bc0166d7c1d9ae1948a5ddd4fbb190aa67f27f8e

SHA256
ad9994924186326ac43774798d28f30319a072670ec3416c4624ca26d4d49a2c

SHA512
e4b8ccc8a477689164dde10b28a1b7a6ebfaeaa33a4dfbe10d2ffbdd6e47d0cb8c86ff4fa9c48b1b93db0fd4319bba53701ca75f3e7f7ae730990f7d99f1bf23

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
285KB

MD5
2a3b264137d582a4ba59ab6b2e2fca72

SHA1
2c4881d886a8e48b2577a6f742fde2526edc3234

SHA256
4d933979026d90d76d46ec442863d8f8085ff22422d81f5fc51cf975db7da4bd

SHA512
d579f339f6a35fea3e4c50ed3fbd5c6a5b1e0c047beaebb631f4e06c0bb09eea3173ca3a2ca10e9443976b5027cfbcc8fcb3a7bceb8ef5e80205e768391456fd

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
285KB

MD5
6e2c1135d7221f37ccfd04b80a85c61f

SHA1
86a8719019ba7822f58395b1ddecc14dd4eef765

SHA256
fdd2000a0e287c782fa54acc55bafedc46db2c3a4e87ab6e28a50ed57eeb8ec4

SHA512
7c2c71096f585db69713b29fe1f5ce75d20cd6c22133c6a1be3f4d87f25e81a093934500e1bded5e57c8a7ca94493aa3201560a004dd3a13e2dfc81908b3d983

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
285KB

MD5
bbadce77c2af7b969383cc7dddf41f5f

SHA1
edcec5a7642d1c9a64690eab424261307561b31c

SHA256
0a9231c4f7bc900c9740861c4f712a5ba6ab45d6e28c2b95851d0c99bfd830d9

SHA512
52fff452ba986ca26dab08c6223c8b97e0750a0f594c2b308b868d19dfe0c504e1d4d60680971907e1746cb4111c7fb578cae201b1be7c2b98766cd37a820f5a

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
285KB

MD5
14f30e7c2e5652c3a20cf03ab4b9f433

SHA1
69b3ae4c33b907f9dbdf71f977f890baf62597d3

SHA256
00e8274e54e968235b436ad68020f88647a1e4d4a0e96a1a005975fa5ad2cb6e

SHA512
54f7c319588ec33a1941f77cd014f01db1dfd5e9a668122a994b46c532f2643bb89a6e9565ec24277209900f75847ba5c4f5a61d7e6c0aa2f05d79854fe570d4

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
285KB

MD5
f535f0b20864baf5cda66d9d978bad51

SHA1
3a975929fd678eb158dc2ddb0c090b8e7b53ab25

SHA256
4ae111c8c1a17b5e8e20fda11e897a6abd0bfb7bce69b8874506e07e75954e06

SHA512
2d00009f68753595630ee3fc310a93ff58b3d00560b68a7434628459dce0c8e32934f4a85fca8d053b22902e84386e5caf335813629cce7bf92e29a6680c05e8

Download Submit
memory/408-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/452-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/460-124-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/512-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/748-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/812-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/968-597-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/968-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-453-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1108-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1128-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1196-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1260-501-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1268-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1364-429-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1488-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1516-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1584-571-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1840-447-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1848-592-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1892-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1976-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1984-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2104-583-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2104-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2120-308-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2228-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-563-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2316-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2320-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2332-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2332-555-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-525-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2484-591-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2484-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2548-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2572-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2880-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2988-585-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3180-465-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3304-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3312-326-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3388-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3452-578-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-495-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3464-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3540-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3612-471-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3632-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3640-477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3704-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3756-435-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3780-543-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3900-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3964-550-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3992-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4024-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4040-513-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4052-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4064-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4116-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4240-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4280-31-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4280-576-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4300-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4312-260-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-564-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4388-537-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4456-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4488-519-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-164-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4704-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4772-103-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-423-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4788-599-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-362-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-531-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4852-507-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4860-557-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-549-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4956-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-483-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5032-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5100-570-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5100-23-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads