berbew | 49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe
Size

94KB
MD5

3f99afd12dc366baab452986bbef5214
SHA1

b6e56e9037d058bf42d1af5400d12e0df6260956
SHA256

49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a
SHA512

8dade7e0b9d2c60b8459e779f537e084f9badd7c133440a94d34479f297d9ffb81a1ec9eb0dfcdfaaeec2220c27483c525969458e208f4e83b9dd7a4c1df31cb
SSDEEP

1536:OGCoDytavjNoaYwo1tnaI1wrGhb4rfhZ7hbx1v7BR9L4DT2EnINU:OGCk9BKwg/wrGObVv6+oJ

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3324	Oqhacgdh.exe
2800	Ofeilobp.exe
2388	Pnlaml32.exe
3636	Pqknig32.exe
3496	Pgefeajb.exe
2156	Pnonbk32.exe
220	Pclgkb32.exe
1336	Pjeoglgc.exe
2868	Pqpgdfnp.exe
2840	Pgioqq32.exe
2496	Pjhlml32.exe
1496	Pqbdjfln.exe
3068	Pcppfaka.exe
5080	Pfolbmje.exe
4044	Pqdqof32.exe
1680	Pgnilpah.exe
1832	Qnhahj32.exe
4064	Qceiaa32.exe
1520	Qjoankoi.exe
4808	Qffbbldm.exe
1112	Ampkof32.exe
388	Acjclpcf.exe
4016	Ambgef32.exe
3172	Aeiofcji.exe
3124	Agglboim.exe
1444	Amddjegd.exe
4572	Aeklkchg.exe
4264	Ajhddjfn.exe
3640	Amgapeea.exe
3600	Aabmqd32.exe
2088	Aglemn32.exe
4376	Anfmjhmd.exe
3488	Accfbokl.exe
4680	Bnhjohkb.exe
868	Bganhm32.exe
2160	Bmngqdpj.exe
3800	Bchomn32.exe
3136	Bnmcjg32.exe
4104	Bgehcmmm.exe
3828	Bnpppgdj.exe
3612	Bhhdil32.exe
4000	Bmemac32.exe
3868	Bcoenmao.exe
3656	Chjaol32.exe
1408	Cmgjgcgo.exe
3056	Cdabcm32.exe
4256	Cfpnph32.exe
404	Cmiflbel.exe
2900	Ceqnmpfo.exe
4840	Cfbkeh32.exe
4444	Cmlcbbcj.exe
4604	Cagobalc.exe
876	Cfdhkhjj.exe
3388	Cmnpgb32.exe
1620	Cajlhqjp.exe
4540	Chcddk32.exe
1804	Cmqmma32.exe
4660	Ddjejl32.exe
4980	Dfiafg32.exe
4048	Danecp32.exe
3348	Dhhnpjmh.exe
4336	Dfknkg32.exe
736	Daqbip32.exe
3524	Dhkjej32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pgioqq32.exe	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Kjpgii32.dll	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pjeoglgc.exe
File opened for modification	C:\Windows\SysWOW64\Qnhahj32.exe	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Bmemac32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Pqknig32.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Hmphmhjc.dll	Pgnilpah.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Pnlaml32.exe	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Pgefeajb.exe	Pqknig32.exe
File created	C:\Windows\SysWOW64\Pnonbk32.exe	Pgefeajb.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Pcppfaka.exe	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Pfolbmje.exe	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Dbnamnpl.dll	Pclgkb32.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Bnmcjg32.exe
File opened for modification	C:\Windows\SysWOW64\Bgehcmmm.exe	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Ampkof32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Pclgkb32.exe	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Ampkof32.exe	Qffbbldm.exe
File created	C:\Windows\SysWOW64\Gmdlbjng.dll	Ajhddjfn.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Pgnilpah.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Lommhphi.dll	Accfbokl.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Ddjejl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	4480	WerFault.exe	154

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofeilobp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qceiaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qffbbldm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhacgdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnlaml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbdjfln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnonbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgefeajb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqdqof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acpcoaap.dll"	49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfhhm32.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljbncc32.dll"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifoihl32.dll"	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blfiei32.dll"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbpfgbfp.dll"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ochpdn32.dll"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feibedlp.dll"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfenk32.dll"	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 3324	752	49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe	82
PID 752 wrote to memory of 3324	752	49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe	82
PID 752 wrote to memory of 3324	752	49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe	82
PID 3324 wrote to memory of 2800	3324	Oqhacgdh.exe	83
PID 3324 wrote to memory of 2800	3324	Oqhacgdh.exe	83
PID 3324 wrote to memory of 2800	3324	Oqhacgdh.exe	83
PID 2800 wrote to memory of 2388	2800	Ofeilobp.exe	84
PID 2800 wrote to memory of 2388	2800	Ofeilobp.exe	84
PID 2800 wrote to memory of 2388	2800	Ofeilobp.exe	84
PID 2388 wrote to memory of 3636	2388	Pnlaml32.exe	85
PID 2388 wrote to memory of 3636	2388	Pnlaml32.exe	85
PID 2388 wrote to memory of 3636	2388	Pnlaml32.exe	85
PID 3636 wrote to memory of 3496	3636	Pqknig32.exe	86
PID 3636 wrote to memory of 3496	3636	Pqknig32.exe	86
PID 3636 wrote to memory of 3496	3636	Pqknig32.exe	86
PID 3496 wrote to memory of 2156	3496	Pgefeajb.exe	87
PID 3496 wrote to memory of 2156	3496	Pgefeajb.exe	87
PID 3496 wrote to memory of 2156	3496	Pgefeajb.exe	87
PID 2156 wrote to memory of 220	2156	Pnonbk32.exe	88
PID 2156 wrote to memory of 220	2156	Pnonbk32.exe	88
PID 2156 wrote to memory of 220	2156	Pnonbk32.exe	88
PID 220 wrote to memory of 1336	220	Pclgkb32.exe	89
PID 220 wrote to memory of 1336	220	Pclgkb32.exe	89
PID 220 wrote to memory of 1336	220	Pclgkb32.exe	89
PID 1336 wrote to memory of 2868	1336	Pjeoglgc.exe	90
PID 1336 wrote to memory of 2868	1336	Pjeoglgc.exe	90
PID 1336 wrote to memory of 2868	1336	Pjeoglgc.exe	90
PID 2868 wrote to memory of 2840	2868	Pqpgdfnp.exe	91
PID 2868 wrote to memory of 2840	2868	Pqpgdfnp.exe	91
PID 2868 wrote to memory of 2840	2868	Pqpgdfnp.exe	91
PID 2840 wrote to memory of 2496	2840	Pgioqq32.exe	92
PID 2840 wrote to memory of 2496	2840	Pgioqq32.exe	92
PID 2840 wrote to memory of 2496	2840	Pgioqq32.exe	92
PID 2496 wrote to memory of 1496	2496	Pjhlml32.exe	93
PID 2496 wrote to memory of 1496	2496	Pjhlml32.exe	93
PID 2496 wrote to memory of 1496	2496	Pjhlml32.exe	93
PID 1496 wrote to memory of 3068	1496	Pqbdjfln.exe	94
PID 1496 wrote to memory of 3068	1496	Pqbdjfln.exe	94
PID 1496 wrote to memory of 3068	1496	Pqbdjfln.exe	94
PID 3068 wrote to memory of 5080	3068	Pcppfaka.exe	95
PID 3068 wrote to memory of 5080	3068	Pcppfaka.exe	95
PID 3068 wrote to memory of 5080	3068	Pcppfaka.exe	95
PID 5080 wrote to memory of 4044	5080	Pfolbmje.exe	96
PID 5080 wrote to memory of 4044	5080	Pfolbmje.exe	96
PID 5080 wrote to memory of 4044	5080	Pfolbmje.exe	96
PID 4044 wrote to memory of 1680	4044	Pqdqof32.exe	97
PID 4044 wrote to memory of 1680	4044	Pqdqof32.exe	97
PID 4044 wrote to memory of 1680	4044	Pqdqof32.exe	97
PID 1680 wrote to memory of 1832	1680	Pgnilpah.exe	98
PID 1680 wrote to memory of 1832	1680	Pgnilpah.exe	98
PID 1680 wrote to memory of 1832	1680	Pgnilpah.exe	98
PID 1832 wrote to memory of 4064	1832	Qnhahj32.exe	99
PID 1832 wrote to memory of 4064	1832	Qnhahj32.exe	99
PID 1832 wrote to memory of 4064	1832	Qnhahj32.exe	99
PID 4064 wrote to memory of 1520	4064	Qceiaa32.exe	100
PID 4064 wrote to memory of 1520	4064	Qceiaa32.exe	100
PID 4064 wrote to memory of 1520	4064	Qceiaa32.exe	100
PID 1520 wrote to memory of 4808	1520	Qjoankoi.exe	101
PID 1520 wrote to memory of 4808	1520	Qjoankoi.exe	101
PID 1520 wrote to memory of 4808	1520	Qjoankoi.exe	101
PID 4808 wrote to memory of 1112	4808	Qffbbldm.exe	102
PID 4808 wrote to memory of 1112	4808	Qffbbldm.exe	102
PID 4808 wrote to memory of 1112	4808	Qffbbldm.exe	102
PID 1112 wrote to memory of 388	1112	Ampkof32.exe	103

C:\Users\Admin\AppData\Local\Temp\49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe
"C:\Users\Admin\AppData\Local\Temp\49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\Oqhacgdh.exe
  C:\Windows\system32\Oqhacgdh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\Ofeilobp.exe
    C:\Windows\system32\Ofeilobp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\SysWOW64\Pnlaml32.exe
      C:\Windows\system32\Pnlaml32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3636
      - C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3172
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4264
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2088
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4680
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2160
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3136
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3828
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3612
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3868
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1408
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2900
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:876
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4540
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1804
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3348
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:736
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3524
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1304
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1048
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1084
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 416
        75⤵
        Program crash
        
        PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4480 -ip 4480
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
94KB

MD5
1eb190d5e67a286664b51c80f5831958

SHA1
942d273d9fe25cc9ab87680bcc095a69d27e9603

SHA256
3bcee948d0dd1f2ce1b0a26734882e96dc4550e7770b8d995c131e17b4eadbf5

SHA512
3deae6776322c03017e3d4f3a20cdd2fbd348c344163307742b484195ee2d0b463ca333eb51300fae88d628dbbbee1a876004d86137ae3833f652e50251729de

Download Submit
C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
94KB

MD5
37860cc62b135981a41fd5681a302081

SHA1
30e82530d18180867a07cdbcda6bec6b1c9dcbb1

SHA256
68ed312de5855d036684d7b19476bd1c0c005aa6186b93cf57f5b8017dcb7c44

SHA512
da4b96ce8c8118f2204cb373b3f15a8d831d3704cd09ae9e711c72f23d23c24b8daae0bf122685a440c7d84802d3b7aabf17250a2f462c171de75df8da6c5231

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
94KB

MD5
0471b3f94741866dfb0166e7346f07c1

SHA1
da84d917726febc457e3e64e5ef49a7b95b7f80e

SHA256
cf751acd75eafeda84c55714522c3d108fb400b163747ecd1cf3b70b79929733

SHA512
e138055492f6d2215dd20426e812480763146c5b03d63348915ce0f4bc46119ffb86b6fac0e52db428ca466da11b62d523d79b239268945d5b1ae1f367a1d544

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
94KB

MD5
2dd3f518a855ed7ac5f234cfb80c21d8

SHA1
222e3cea19155b76e6298cd5c01caffb11dcb09d

SHA256
ffa3a00a968f668aaf0748c3a8f67c03590e67cc203121ca7bfbaefc60085712

SHA512
7fe08c34d423e018313c77d9c4876d910a1dd80ea8685bf493d63ac65e4098375b0846b1bf009e3baac6e487f15f124343a6b45dd2eb76427426f56dc300287c

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
94KB

MD5
676086b7cde36f9c6fe9eb13254476e0

SHA1
85b1be548959342eef6b533d360c40ce16347a6d

SHA256
c0a9dc7f080163152ede2a2251540fd124ef7aa6bf8eed77970b229791954e10

SHA512
f6adf7eb26849141fa8ca1a1de9510bf2a7d6f2714779b2c3439d8637624932333df38d4ed562205544c40ff472a31cf9f8c51d5cff5a53591cc5fe726ad910b

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
94KB

MD5
803eac0bccf9f2bc058aede04d4a617d

SHA1
24a57bf5aa3ca1c36fc5baf41ee596188d8853e6

SHA256
db4a27b336ecfdd010fc2bd4fb1c7b03e059ed74cb80f65d5a12baef5df62382

SHA512
a8908f8267b27baf3fd3dcf09f90d0b7f8c5532dc17ce4e7d88a5fe173e299c54773ef3a2fbd130b8e74229a021efe38bbb0092846a04eabd29d7e1da93404ff

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
94KB

MD5
f5b17bf122485ccc1dcdfd2792b5b4b5

SHA1
5cb2079ac561c8d5e7638d7f0d554925f70263be

SHA256
8b8cca3fee2f30f24cea271c80ccf1cacc689d49f5c151dd848451b70140fe7c

SHA512
a6dcdd4b27ce59e6d9918fb7b017248a6c4d203b9990d5d45316d027f3f5604a08618ab5b4e4bfce2d650cf92099fbac5ee1a39bc0004b82a302ba6fd45daf02

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
94KB

MD5
0626194214a1b6106c53b2ed52bce8e2

SHA1
7789823f1d7b1cd0ffe94f92d0e89b6bc88ff174

SHA256
ca3b7bfbdaee6b2db362621e06226cb0c9ba30fa1f8ec37e33e3298e8b3ddb93

SHA512
fefc06c37b12749f685a75f83b7dd4541c69bd148d889093599833f98a9ed97e07dbcaf6e988cea8124603b2b11bc512cc15742d275368fc7d912e3d11101d12

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
94KB

MD5
de0d3b4d0d1a16fd5078271973420fbb

SHA1
29717017c750fa4e5700186b68fc46f4aaffb13a

SHA256
8be06600792556442de761ee99f1b65f67b8dcb71554f11e5257aadfeb07c92b

SHA512
71b00643ea6bfaa1b6091a80164be5671524d55a03733ed1835857980ea28264b20e75af9900f5dbd2abf46a7ec75bf1f9b2db8d9501e088220f5500851afeb8

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
94KB

MD5
85cd4f7fae4d7822155b9d62642d0b53

SHA1
4d9e7819257f9c45758ef60fe7f29e87e02064f1

SHA256
6cd1a327d75b7dcb020a20d3a497b1b6138c034cf1042c367dce3b8a51db145e

SHA512
540e3bf6156d4c994c8e996a693e76e4fb0824762e9359a454c19fb71cb9e9836e4c8d9c6a382a8f704c2edce6e4f12f0585bef319941859f7e1fb76fc5eabe6

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
94KB

MD5
dbfa79b3f0101634da28fc136aec3caa

SHA1
b087630e8f4e5ab0f22951c0723c6d26e6305247

SHA256
7541316dc0d46bdb0970bf429cd4e3ae5b377ace67315dd30acc43ff6a6d052b

SHA512
25d8224d7135b38ee857c66f87ec8d5421b13ee050c3d3209b3f5a76b60af27a0e3fbc784dc9760dc5fce6b668863cde9ee0e1955411eec481e3f8800fff8427

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
94KB

MD5
1b0753c19a09377887ba4ad1f685101f

SHA1
ef4f8ae19f7a53a0c36a6024da08fd3e5516e054

SHA256
b53c87582dfe2d5fac47d5dc54ea1796e3c75c705199a01ac02db16c99ecb114

SHA512
f13fe11f72e502f5f79b94bbaf71aea6f6e5f3cb5775ab06960bc724ad45e0161541528dd6a53e7aa329466bb3fcb4b5565fe22eeb54206cef6a85d595d43473

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
94KB

MD5
d51f65ac7909e4c70e3a0256065ea6bc

SHA1
bafe9ddd015cbb1866f95a0a5ce446e5ba06a999

SHA256
6932c93db195ebb31e474ebfe6bc0d9dbef482baccf6a9fd71ddacb00d7df065

SHA512
034f799842c8da53b3f56827fa40156b7089bfc19cf1d9fe321fceae92488c52b20efa41761cb92970e67606b7475e89d572ac1bd85cfad568b31a08f9a7081c

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
94KB

MD5
df36e0b08ded9710723be02b6d9847df

SHA1
20f7aca4ae5ea2662b5881e241dd92ac1bb70b98

SHA256
df043c861ba611ba61bc4e29e103491a334e2cb461cb5c7a83d4d9d617d1e0ec

SHA512
6233cf21b5214475f76cae6271faca71e546f24ae0d5bb5aa03bb5bc547641c7e1773da150af6942c382585daaeefc75ce8c207c1683d32f2edb57d59047ca11

Download Submit
C:\Windows\SysWOW64\Bnhjohkb.exe

Filesize
94KB

MD5
353ff8a9a28304e16727abd885f0916a

SHA1
05da6e0b35e24e01d23cc1127da6e99cc5db6292

SHA256
6dc3d046f50d8255d8709f1e0ad2c513fb35ce37018e98febaea2700bc8908fd

SHA512
5cf1b800759b6a8fb7350b07387d2933f93665c5eaba0a0023f75d5258c0d02d472230022a3b54e2bf1da217c3c5c93a86f34338032651477216c67e2f8d4424

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
94KB

MD5
24657610aca05c7bc5e0642af211ab73

SHA1
76b230f85f08d2d9a436e35898409b3e9b444206

SHA256
f6711cdb1bf0ab3b8a99c02ee3d63fb8fe30ac8a1007e9c6adf43331a7d3b401

SHA512
203b72e014aaf5f4163277637234da3baaac86f17a65ee27137dd369319260bc8439019fe08ff4671f42ee2b725d35128da5633cd67496be1d161844833e0e85

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
94KB

MD5
d2464d1159b539165197ebde3c9f0db6

SHA1
37e90c9c03ce4c63eb260aa93b964928405db6d0

SHA256
615b0509f31dfb19c1ff9019c6a0beb72ded7c14fbb93fb56952944d2d4dc513

SHA512
14e33ecdac957d8f3d2895703dffe41a4b32828ad81a2340f58e3278b43b0eaaa3dd6c31358c0036ac581964c25302cbc0c9d7d7806fe1faf7a8e31d981203a9

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
94KB

MD5
dedc457f7a805a2f257a871290630960

SHA1
742531a26d7707b483a13fc1cbf21e5e786b8eca

SHA256
0a0e9088971a084d50dd87ebff786163a4e91b7ad5bd54f187d799e5adb7200f

SHA512
c2c89ab5a474538aa3adae45b9f18d4f30479a04253861587253d84bf739fe559ec72c341831290926b65ebaee46865d938111ccb668668d19064b4b94333693

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
94KB

MD5
3c3e9905e835a6cb4fa4d6eb25e9146a

SHA1
8ee57dc4e6b9dc64ef11f99c413fa5eb670c6bbe

SHA256
f0d1949bd3c95d60a03c083003b8a6372dcf82e982bec22c4ba8ce422b60af99

SHA512
578faa8cd7b3802dfed8a2f20bbfdb6bfa346308c3f4094ad817c77f5d4fb2dd98d127c48b5c696352105354f7762d6717f41d838ebd649fd05b29a4120d3942

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
94KB

MD5
02ded26c52dfbd484f49ae4e1528989c

SHA1
09ce81e37f3a2a5dc3fa81a4fbc6ef1738a2ca24

SHA256
4608349f587bcf6ab2bb7bb22e7c5acaa12c6e610d00f0526335d5563ed5134b

SHA512
78e8c5712c733dce8288f3c7f8792e300b557b3d7921e3a8c6c093014e2f2c2e45aa1533582636da2abd75e666bd5751d39da961c7460456195ae877b952329d

Download Submit
C:\Windows\SysWOW64\Ejfenk32.dll

Filesize
7KB

MD5
b2cb8bf56d9d08404cf43ff27a568704

SHA1
4532fb6a419b57645c78f83e5eb92767aab75ac7

SHA256
1a6dc33c55e266dee1f31518b84744a7185e39ac6338f4cd49435c82d6b34632

SHA512
3024d95a893b50df4270c550c16083c88240476ab2c54e3e61dc5856cd0c4a7c63be29a13fd6104d6c76c0b326de26e0f5465210c46761e72d7e4156ed6eeddb

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
94KB

MD5
1ad26ac87c9c31db4a1681d2826efcd6

SHA1
dd5be27b07794ddfab98b8443d3931a44b7efea2

SHA256
aaf12ae6400e78b0b916acd8736ae19bf9ddd31af56d917d6e7fd462f82b2d92

SHA512
834ccb3d03574f4b308d81dc14be0f2a7feec7f7a7bbee89b0072f4c70b736aa809d272e5770bc828b010676b0894ea119a241111163666ff8e045d7031a3a82

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
94KB

MD5
48d1a7e8474d60605a72027c887538e6

SHA1
4164d42fe3b75947ab9e106c245490309b86e40f

SHA256
35d8271ed2be40986ba7f19dac4e2ec56591eb76baf945ff1052d6e5c2adde5e

SHA512
5f92dd18de4fa8c127cf12aeb68506b374be9761b4bd73bb32e1c12c1149c137a041c7e8d46a3a39ccf0993b55650c2a226c8d2b145f1a07bc516e7d4c52d52f

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
94KB

MD5
f2173ad59cfcf87524e2264a7038ca2e

SHA1
214e59934ef81c1b272bf3a0275ffaba5f808348

SHA256
c93d223ac4f99f979841b6d6b3d9606d8ee27c5c6bcdc194e45e9cce5a6af794

SHA512
cb90855db43a75be92c5d97c63f630635e9428cbe24795c60d907a9e19157da89533da49a4d053b8e71c1d1cb5f3e15b6fdb32209cef929392e4b63929228657

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
94KB

MD5
126ebd19d5c1bda9fdc8a8f774c133f6

SHA1
0042960718b41668fa623b1abb4c2594860778a4

SHA256
05151f975d675961bc844a2a33dffaa771a1799a21707000bae76cbce5eeb049

SHA512
83d9c8d0bd9da102177d8dd2a563e026c3c339ecb00ef698828709873a433ce6258878f1e3de7e3195bf2f02ff5be8d66194056398ff183bf2dcad6c95980e98

Download Submit
C:\Windows\SysWOW64\Pfolbmje.exe

Filesize
94KB

MD5
580a995e94e2a2ba7d4b1ca3f79654fa

SHA1
d363504c2a236ac363fcd3b852693bb70b99a528

SHA256
7e0e57f1ad0b6bf9e4149b097823a54a27104da65fb58f2174a5f3d0c26b3204

SHA512
44bbee0f6e6c293696a7a618923ca05ab461c4eada5767e9e26c97a5d07d8459abbb40bfa7488d5fd92cbc1d9e81739d64ffc27387d90c378dc4766ae2985974

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
94KB

MD5
76d18b81b26b35ba8193915802e3096b

SHA1
7214004ed6627af4587af6167f65b351dac7dbc5

SHA256
0692a6d33e1feb3173e872bab60cafae6cbebf1049a053ec85974ee1cbbdf7de

SHA512
43675de1a6dcf3ec1627f6ea06270466385277aff9920f611032b8e2e85c57cf52592f967b20748fe1897da39c8b000aa1fe22f0c8860931575a7c57520da0f6

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
94KB

MD5
aee16a443003089b7c2c01547c9dc9c4

SHA1
80c012fb6f2b56f4e1bf627ab62ef98cfce30654

SHA256
c1881c486ab90a79b6eb68f33aaf6e71d5233a027e9a0f056ce116939ec10b50

SHA512
284a7298f80df416382f209a8cc1036fa23bc5441e6e8837eefaf3b70df13d6853ffbd89538bf13b140fd6daea869fbdaeb3e36c47738d7bf87fec0aff2c5bb9

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
94KB

MD5
d12c7f0aa4f3b81891e0224ded773f8d

SHA1
76b4f8825ca003be28c7f32a704fc3fde2d0f414

SHA256
bb2dd95eb494e3fb453a64f4e7271eeadc80b1852b61aa682cd8cce61cab55b0

SHA512
3c53170f7d6070e4cc4dc11a25178abf55165f6f9cf39eed67838ad226cc25e3adaad774f7b4ba5cae149485c6b96a25e1bd5da6d4d7f6dc0a9ac27e2150ca17

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
94KB

MD5
6fd7c7ed53316e0c8349be25fd54d6ef

SHA1
37e41fe47a9de544ebe38b9cb66e22bc2219f1cc

SHA256
80f0113d1b68948c3ea1a242903b9591e073c6abde88a1484a1de41a7e45bddf

SHA512
ebe36b37ed4217fdd275d265415c0a982b6704f566dd655f250f06a34dbfb3561715484c6f16107305302fcffb0a103ad32ee51dc5f0063bc04449720ec9fd89

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
94KB

MD5
e3c1a3071ddb5b34ca07f138749c9dfd

SHA1
bf1aa74d9ca6756d64c79fe48bfc4ae22d22b379

SHA256
75e59ed762b94d6d1ce03cffe96d60f917b95553b2dcaf5a7efe755d9910b9fc

SHA512
401b39d30178c178488814801d5dd904e4701479a7618bed986f0f2df84fbce3b605e86bc3b3d7bffcab589b237487ff7d12e012d36d8c194630d7bd6765670c

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
94KB

MD5
f637a165d9540f3d0341129cc59d4af5

SHA1
85b2ee78c334123bcfb5fb5fa71be177ffae23d3

SHA256
5ea6a255a105fbaa78e6477b3a1564ba6ef4a867f77eb14a5f04e7f389015bcd

SHA512
fd8a96c322e2f5cc819a2ffeec7293a7beed3137a50a6a8d3cd0aad9cf38ed1fddb6fe53672ea36726ff4b94907e1e7e60c0a35743bc5e662585d3e3d7985b32

Download Submit
C:\Windows\SysWOW64\Pnlaml32.exe

Filesize
94KB

MD5
eca115e90f68f8dee8cdb58c0fcf90cf

SHA1
022ba0e1d05f0a95456ef954b971ee5bef1d1c0d

SHA256
c08cbe501b17bdc63eab5db39770d1e1515006e8a9e03933bc24b20ada866606

SHA512
27626a0837fb78d65e29486f6a2d880eb12e2c9e85f2be0074fc1f439034f1aba8fe72b6a66b5c9962063ba50fc0d2dabb9946fa2ce7d4d96371ece91362927b

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
94KB

MD5
2f0d898dfb85ccfea46c050dbc4c58f3

SHA1
496768159e8ff04551ce01b498207158c4af0b0a

SHA256
9159f06423e7836733676667524002fa749f661b6386daab9cc4d647cf3f4d42

SHA512
c99c6251b1d5d9432fa4c90daf2cbebe58f3d5f8cfa43d411c01755829d17badf1df006a2cd31ba0b4183022cdb7136fbc48a55108dcb967268ddcef334745f0

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
94KB

MD5
bc0e4daba4fac0b1ee2846550412f4f1

SHA1
d851d7879761df18b66a28a747f73565dc732539

SHA256
106719c530ee726882ce5061943bae8bc6a1339cf84f571a5b7103334b10eaa0

SHA512
e82ecf4e07b5b9723b81b13343f9e6b6dcbc7b46cd07e2852ea774b84cc142f02636cca86335b13ee44230a94ab82085fd0b0035fac3dc6bddd716232742a597

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
94KB

MD5
faf77170e17dd0cfa51f32686db2830c

SHA1
abe0c210af136c7c1ff5780ad737fa9853e94c74

SHA256
a3cc80338a319d9246cc31f4381e4ad5a60f4d4b5f9ffb33359477ea1ecab994

SHA512
c7ab0f1611d9a3586cce4520a753eaee65a3068cdfb3659af5180a4b7200be6ea180820f8f4b4a43c15f3d1c0e7b9eb09865ff8da90f5893592b07d5925e34b3

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
94KB

MD5
3da17023433e2427a73d811961df6ae8

SHA1
c244efb8e561db50e50331cf0c2535d05e6efca4

SHA256
0a98f33b1893c6874e852edca24e0c3c23ee29cd39bb872de95806043d819f9e

SHA512
acb68c4142b991b854dab8ed831f4c707f064b47751de2fa2aef72abfeec1eb2a3c2e42a70489f05763407c5951b8468fe3921699bb21105e0b559c96ce57add

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
94KB

MD5
aaa577a3ad0fc4da785aeb3ffe05e6c2

SHA1
d08090f6a459197889b46ca690b47d4852766eca

SHA256
c6480a8e77377c964162fff0414f3d2998f9b767ea578922f7316c04be9f5f8c

SHA512
252f709af5e9cc02380cd0adaff30f22c0333164c32c85d4813f024b2897cf3b5e49c58fc9f0cd736d70e0e614cce7b891461cde9698a816aea1c1efbb1b420e

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
94KB

MD5
8fd7cd40f980ce817499b574b713f4f1

SHA1
291db190b8aa4dd6f79b582473e556f8b81bece0

SHA256
7a4e345b1b2267ef523f7bf17a4904b61bf43551ddce89f81d6b017864d39e7c

SHA512
00cfb5d71abed2e7d6338ba0dc4b43547078a893def75e6656bb0f10147cdecb55e0215e9b28b54a912b5fcc4898b096076ce45ee04832d59ddda3d446b4c2a0

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
94KB

MD5
35887f14cf819e6508170f82c11d5c5c

SHA1
15afdb73c0d174cccf9008d8420e0a132a9b2c5c

SHA256
99051ee7480d22653f76e77b372a9ed0be24d58714c16956a6643f515a665d6d

SHA512
1ebf4d1a0e2b52a7f47949913be1cc521396e4af9d90569719fa3f17fae2ad5ec2d07e2d77763bb4a3e6765276d8e747525b6e7a8ef95ea035bd83057488e273

Download Submit
C:\Windows\SysWOW64\Qjoankoi.exe

Filesize
94KB

MD5
497e8b7364b109be38b73a9ba55def30

SHA1
519f9b9ff151559c9ec1ac95b207b8d784193868

SHA256
09fbd60dd3d54a71f288d2ae18362ff8c6e55e0a613ada89491b3e9a2fc15427

SHA512
03b46078f2be18b3b37ded959f2c8f5ce258b22fda1d1a97bc605ba8bcd5add602bf8ecd691e732ca8232299639860b7806728dd3c443f0d93fa484653cb635d

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
94KB

MD5
fc7f2385c165746d5b2b51853e6a8154

SHA1
9c5342c98b2f316d0097cc749259cdc5685275df

SHA256
a050bde394fcacf7e84f637441aeee3a90dc30d3b4ce9104a4c02121d8b007f5

SHA512
5bd0062f314251258cbc4785479773eaab44593e85ad5a467a07cbb9ccfa24d6a00ebed5dd085f5cd57f54e77f09d9215bd759e6c8662384b1eed8a1cd393ee2

Download Submit
memory/220-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/388-175-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/404-352-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/736-513-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/736-442-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/752-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/868-274-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/876-523-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/876-382-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1048-505-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1048-490-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1084-496-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1084-504-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1112-167-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1304-511-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1304-454-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1336-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1408-334-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1444-213-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1496-95-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1520-151-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1620-521-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1620-394-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1680-127-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1804-518-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1804-406-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1832-135-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1904-507-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1904-478-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2088-248-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2156-47-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2160-280-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2388-23-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2496-87-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2788-506-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2788-484-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2800-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2840-79-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2868-72-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2900-358-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3056-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3068-103-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3124-200-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3136-292-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3172-197-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3180-466-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3180-509-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3324-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3348-514-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3348-430-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3388-522-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3388-388-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3488-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3496-39-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3524-512-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3524-448-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3600-247-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3612-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3636-31-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3640-232-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3656-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3800-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3828-304-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3868-322-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4000-316-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4016-183-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4020-508-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4020-472-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4044-119-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4048-515-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4048-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4064-143-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4104-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4256-346-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4264-223-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4336-436-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4336-520-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4376-255-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4444-370-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4480-503-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4480-502-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4540-519-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4540-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4572-221-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4604-524-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4604-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4660-517-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4660-412-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4680-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4800-460-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4800-510-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4808-159-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4840-364-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4980-516-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4980-418-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5080-111-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads