berbew | 931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857.exe
Size

64KB
MD5

9dc40303ba12de900decc2a4a4b5358e
SHA1

9c7772901627747d33320702fca0e1a3c1769668
SHA256

931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857
SHA512

de004758fbff9234f249307725ecb18d535a1b88da1406999a74d75f47cea28e9eab890134278b80698e7d02921cbdb5b1c5e8c2ba51bf01e3e76cb3b8105182
SSDEEP

768:4q6pfEugRclE98sigxy0OGJnMwWJx4SQiYvsZU42p/1H5/BXdnh0Usb0DWBC:56adv98sigQ7WMww4os42L5rDWBC

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3400	Pgioqq32.exe
2556	Pjhlml32.exe
2640	Pmfhig32.exe
3684	Pqbdjfln.exe
3428	Pdmpje32.exe
4736	Pnfdcjkg.exe
4956	Pqdqof32.exe
4000	Pfaigm32.exe
4980	Qmkadgpo.exe
3952	Qdbiedpa.exe
4372	Qgqeappe.exe
4540	Qmmnjfnl.exe
4040	Qcgffqei.exe
3028	Ajanck32.exe
3196	Adgbpc32.exe
2720	Ajckij32.exe
2456	Ambgef32.exe
4032	Agglboim.exe
5032	Anadoi32.exe
3740	Acnlgp32.exe
2220	Andqdh32.exe
3268	Acqimo32.exe
2768	Anfmjhmd.exe
3960	Aepefb32.exe
1756	Accfbokl.exe
2528	Bjmnoi32.exe
4660	Bebblb32.exe
3908	Bganhm32.exe
1216	Bjokdipf.exe
1928	Bnkgeg32.exe
4764	Bmngqdpj.exe
1664	Beeoaapl.exe
4092	Bchomn32.exe
936	Bgcknmop.exe
5112	Bffkij32.exe
1136	Bjagjhnc.exe
4300	Bnmcjg32.exe
2356	Bmpcfdmg.exe
1592	Balpgb32.exe
4908	Beglgani.exe
4240	Bcjlcn32.exe
3024	Bgehcmmm.exe
4720	Bfhhoi32.exe
2032	Bjddphlq.exe
2672	Bnpppgdj.exe
3316	Bmbplc32.exe
4564	Banllbdn.exe
1896	Beihma32.exe
2224	Bclhhnca.exe
2056	Bhhdil32.exe
3204	Bfkedibe.exe
2600	Bjfaeh32.exe
664	Bnbmefbg.exe
4788	Bmemac32.exe
4984	Bapiabak.exe
3804	Belebq32.exe
1108	Bcoenmao.exe
3412	Chjaol32.exe
1484	Cfmajipb.exe
2100	Cjinkg32.exe
1552	Cndikf32.exe
1464	Cmgjgcgo.exe
1036	Cabfga32.exe
692	Cenahpha.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Beeoaapl.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Kgngca32.dll	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bffkij32.exe
File created	C:\Windows\SysWOW64\Balpgb32.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Elcmjaol.dll	Pjhlml32.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Acqimo32.exe	Andqdh32.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Pgioqq32.exe	931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857.exe
File opened for modification	C:\Windows\SysWOW64\Bmbplc32.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Qeobam32.dll	Qcgffqei.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Cdfkolkf.exe	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Ajanck32.exe	Qcgffqei.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Nlaqpipg.dll	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Ajckij32.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Qdbiedpa.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Accfbokl.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Cndikf32.exe
File created	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Qmmnjfnl.exe	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Phiifkjp.dll	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Dbagnedl.dll	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Qdbiedpa.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Agglboim.exe	Ambgef32.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Ajckij32.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Balpgb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5164	4088	WerFault.exe	179

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbdjfln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfaigm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqdqof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmkadgpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhqeiena.dll"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgngca32.dll"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echegpbb.dll"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chmndlge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgldjcmk.dll"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndkqipob.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agglboim.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3400	5056	931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857.exe	83
PID 5056 wrote to memory of 3400	5056	931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857.exe	83
PID 5056 wrote to memory of 3400	5056	931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857.exe	83
PID 3400 wrote to memory of 2556	3400	Pgioqq32.exe	84
PID 3400 wrote to memory of 2556	3400	Pgioqq32.exe	84
PID 3400 wrote to memory of 2556	3400	Pgioqq32.exe	84
PID 2556 wrote to memory of 2640	2556	Pjhlml32.exe	85
PID 2556 wrote to memory of 2640	2556	Pjhlml32.exe	85
PID 2556 wrote to memory of 2640	2556	Pjhlml32.exe	85
PID 2640 wrote to memory of 3684	2640	Pmfhig32.exe	86
PID 2640 wrote to memory of 3684	2640	Pmfhig32.exe	86
PID 2640 wrote to memory of 3684	2640	Pmfhig32.exe	86
PID 3684 wrote to memory of 3428	3684	Pqbdjfln.exe	87
PID 3684 wrote to memory of 3428	3684	Pqbdjfln.exe	87
PID 3684 wrote to memory of 3428	3684	Pqbdjfln.exe	87
PID 3428 wrote to memory of 4736	3428	Pdmpje32.exe	88
PID 3428 wrote to memory of 4736	3428	Pdmpje32.exe	88
PID 3428 wrote to memory of 4736	3428	Pdmpje32.exe	88
PID 4736 wrote to memory of 4956	4736	Pnfdcjkg.exe	89
PID 4736 wrote to memory of 4956	4736	Pnfdcjkg.exe	89
PID 4736 wrote to memory of 4956	4736	Pnfdcjkg.exe	89
PID 4956 wrote to memory of 4000	4956	Pqdqof32.exe	90
PID 4956 wrote to memory of 4000	4956	Pqdqof32.exe	90
PID 4956 wrote to memory of 4000	4956	Pqdqof32.exe	90
PID 4000 wrote to memory of 4980	4000	Pfaigm32.exe	91
PID 4000 wrote to memory of 4980	4000	Pfaigm32.exe	91
PID 4000 wrote to memory of 4980	4000	Pfaigm32.exe	91
PID 4980 wrote to memory of 3952	4980	Qmkadgpo.exe	92
PID 4980 wrote to memory of 3952	4980	Qmkadgpo.exe	92
PID 4980 wrote to memory of 3952	4980	Qmkadgpo.exe	92
PID 3952 wrote to memory of 4372	3952	Qdbiedpa.exe	93
PID 3952 wrote to memory of 4372	3952	Qdbiedpa.exe	93
PID 3952 wrote to memory of 4372	3952	Qdbiedpa.exe	93
PID 4372 wrote to memory of 4540	4372	Qgqeappe.exe	94
PID 4372 wrote to memory of 4540	4372	Qgqeappe.exe	94
PID 4372 wrote to memory of 4540	4372	Qgqeappe.exe	94
PID 4540 wrote to memory of 4040	4540	Qmmnjfnl.exe	95
PID 4540 wrote to memory of 4040	4540	Qmmnjfnl.exe	95
PID 4540 wrote to memory of 4040	4540	Qmmnjfnl.exe	95
PID 4040 wrote to memory of 3028	4040	Qcgffqei.exe	96
PID 4040 wrote to memory of 3028	4040	Qcgffqei.exe	96
PID 4040 wrote to memory of 3028	4040	Qcgffqei.exe	96
PID 3028 wrote to memory of 3196	3028	Ajanck32.exe	97
PID 3028 wrote to memory of 3196	3028	Ajanck32.exe	97
PID 3028 wrote to memory of 3196	3028	Ajanck32.exe	97
PID 3196 wrote to memory of 2720	3196	Adgbpc32.exe	98
PID 3196 wrote to memory of 2720	3196	Adgbpc32.exe	98
PID 3196 wrote to memory of 2720	3196	Adgbpc32.exe	98
PID 2720 wrote to memory of 2456	2720	Ajckij32.exe	99
PID 2720 wrote to memory of 2456	2720	Ajckij32.exe	99
PID 2720 wrote to memory of 2456	2720	Ajckij32.exe	99
PID 2456 wrote to memory of 4032	2456	Ambgef32.exe	100
PID 2456 wrote to memory of 4032	2456	Ambgef32.exe	100
PID 2456 wrote to memory of 4032	2456	Ambgef32.exe	100
PID 4032 wrote to memory of 5032	4032	Agglboim.exe	101
PID 4032 wrote to memory of 5032	4032	Agglboim.exe	101
PID 4032 wrote to memory of 5032	4032	Agglboim.exe	101
PID 5032 wrote to memory of 3740	5032	Anadoi32.exe	102
PID 5032 wrote to memory of 3740	5032	Anadoi32.exe	102
PID 5032 wrote to memory of 3740	5032	Anadoi32.exe	102
PID 3740 wrote to memory of 2220	3740	Acnlgp32.exe	103
PID 3740 wrote to memory of 2220	3740	Acnlgp32.exe	103
PID 3740 wrote to memory of 2220	3740	Acnlgp32.exe	103
PID 2220 wrote to memory of 3268	2220	Andqdh32.exe	104

C:\Users\Admin\AppData\Local\Temp\931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857.exe
"C:\Users\Admin\AppData\Local\Temp\931fc3a7f1562f40ce04d32ed4ad0fe3249172b4eee5d1e23e4331467fa0f857.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\Pgioqq32.exe
  C:\Windows\system32\Pgioqq32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\Pjhlml32.exe
    C:\Windows\system32\Pjhlml32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\Pmfhig32.exe
      C:\Windows\system32\Pmfhig32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3684
      - C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3268
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1756
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3908
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1216
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1928
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1664
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4092
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:936
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4300
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3024
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4720
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3316
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1896
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2224
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3204
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        53⤵
        Executes dropped EXE
        
        PID:2600
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:664
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3804
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1108
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1484
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1036
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:692
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5072
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        67⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4792
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:60
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2676
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        72⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3244
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        73⤵
        Drops file in System32 directory
        
        PID:4844
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4772
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        77⤵
        Modifies registry class
        
        PID:4236
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3532
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2792
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        81⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3180
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:748
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        85⤵
        Modifies registry class
        
        PID:4308
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1204
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:952
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        91⤵
        Drops file in System32 directory
        
        PID:3992
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        92⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1908
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4380
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3772
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1892
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:532
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        97⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2412
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 404
        99⤵
        Program crash
        
        PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4088 -ip 4088
1⤵
PID:5136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Accfbokl.exe

Filesize
64KB

MD5
a3e9355576e01633798fd1bfe6fd5c43

SHA1
7c762bf6158e0791be5cd504542d84ddec4e8fe3

SHA256
52e5a869b9f3497bb4635b070831f6235c02dc9d6ea862f52cbc03248b21ec00

SHA512
4eb92bc40e34a797ca539f05893a6a799b34a4a8b0bff6cca28a2c24e63a07f54a75c019c8901fe170cdbeaf4ac1dc183c9b7a0a861c4e74079a25ffab977130

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
64KB

MD5
40378d39de8c67a2783810cbad0d7d3d

SHA1
47700463280997307577aa97c12d4a9bc9b44e9c

SHA256
cddb314ef12a797df7ba2bb8dbf6e915d090cb06d72daff3dc9f119394ddc965

SHA512
eb790a3bd3efeb6c90d80e6236e70245ac93e26efab92949ef79c0ec3190d3486a82405a584d78d42cd3ddb5ca48662db62431e50bbf0769379a010e0f28c3a7

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
64KB

MD5
bd9372bee8bdc30ae96a5189459bc262

SHA1
fa67929364b46f305407f687f1ac72ab6b29c8c6

SHA256
65a8d00fe528fb0251ac2fdf98bb89e7f45c224fe5c3eaeda1bb03707db68fa7

SHA512
a9419e07aa296bc2af87083bc89729c9b41453bb6297524a50f5a02ef17fda2baacdab38e0dba0bce1b1d56f4507a62f41136857a6aa5fd0f088f9980c26b6d1

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
64KB

MD5
5bbfea99ba6315faaf8e924f4da188f1

SHA1
395545ecbb835e185757f86a75d3ae70774222f6

SHA256
f5c53b6198969eeb03526dab9eadaa10f46fe31c0a6b9d2bb6d2947ebb5ca080

SHA512
dd91c81fe9ddf68952897df811ab3fb860022af5b6618804f214a485eb4ffd13c049ba0b353f4274be5c850e51e9b3363ada24f7d037222edd798652b517ce0f

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
64KB

MD5
7ddc9f141fb8d375a100da0707dae9ee

SHA1
cb5650b7eeafd298848ca51e72d70c7fea272606

SHA256
17695c951f8300928c2ca2df1c0849f303fa9e26f1b2a757990990f105620f3f

SHA512
6f70f7c4fd96d5331d837004f6deaed3847dd065cf1d28dda80bdacaf7f1e5c9e32a4faee24d6427b8047d27ad6e3bed141ebdea79516ca5136192b74a4cc74c

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
64KB

MD5
586732a303392fb00f002177e94de52d

SHA1
0636af674ab4fdb45168bc2baf830642109cdbfa

SHA256
125a998740479b9d53c68390b3f13deb1f455e5d9052a873937ea9f5ed6195ba

SHA512
2e330ab0cd6b62366131571a33613a3c56186b46f82ad5458bf36d591fc4ca687870879c53d43ecd0e7c3aaa62e7d26476b293173d62e7e6a1953199ddf14071

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
64KB

MD5
d6caf04ca903c3bbb2e1e825917d3d2d

SHA1
504c3bdb47b2a1db34017d8451e9ccf350d5ffdd

SHA256
c809a5f3a2c7028a4bee51d88db48471a0171786f3c0a6c5f95e4e0ebd0f9e89

SHA512
8829f55d8c8b9479a445dea9593da041306f62c866158d4c038b57ce9d77f51a5fb088b912226221c0f9e4be1214f3744e90e804397da6a9583d0c27d55731c9

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
64KB

MD5
c65f5413c33bab4a033e9af27685bc2e

SHA1
fcb4386e0ac74d9cd37444ba14c6ba356b6db5f4

SHA256
f3d0ad4fa77a1dbd20c512ec9bdf00460cb1aa3feac7346e95240045ec780cb2

SHA512
97550a2861596f3c461336ac165c24ed0da4118d4a9023dc69901e95466f4cb78419ba19020b2c97ac2dc9b46316fccd4eae7be110a2546fc6f6302e03800d50

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
64KB

MD5
6b48e0a382ed54619863af5a3b795f9b

SHA1
e524963b485b08744e741d87fefae20468f76608

SHA256
52e9b59d0f114c96daa63c52ac12ee176c20e7727a7a77825fac35cc10ae3ff1

SHA512
e18d0557e5ee95f0385f9abfa666a3c96d834cbf61248cf231ef4d37613ddb1c72de170873801484a9933ed7963ee1f7af00ae5ff0fa363b6dd2e02898e51856

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
64KB

MD5
14f32aac64c203d8031167519078f0ca

SHA1
2d1d1aaf918daa93a50ae2265e8ce451ebfe63b7

SHA256
c6add5a85950c0466994afe8aa36d54700a82d2a575fce62fbd5a00ca0ff2919

SHA512
322af45e9ffc974a0466c797def4afac9a0d4e0a501c009b0051b6cf4ede4bcb0788ecd4235b55575ca867a0bccf708bdc47bbb793e2e746273c1e18ddfd66e6

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
64KB

MD5
311a1b40ece20f1e49e83dd60eb69df5

SHA1
09290072f52f0c978bbe18695a9b4f4868b2c722

SHA256
e1cf6fee9c1592f315c7a18884e3d3ab97231327189f6edb956eba788ed3ae4a

SHA512
79f44b6bceba6e82d5fbb8ea8ba40809393f550bbc19895a6ad3471afa079147d7e3c64b8ef5b84d85ca480a75b9334fe39fc4352c8b7865289a7a8230f6970d

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
64KB

MD5
7a1a62b14e7301462b0a6c6a14a8fecd

SHA1
fd9e99ce27345a517b448289ff1b1ca63a1bd194

SHA256
e57bb87fc0dfdac63d8baddd75afefb237f56d2e93ccae99d9abb08ba0cacc25

SHA512
2f537198bf684b8761a396d9939361de9b6c6d229b5ffbee6dc46700476583f5e0d5864076f3808685e9372d136aee8bd7390f4f10dc65f32384a4a9db858d47

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
64KB

MD5
769b1a8d3a356add46db39f0f0788619

SHA1
e94eabed4f111dc12a086ffa64387d288dcc897a

SHA256
97c266af7fb4651f3e693e296c6493d4395d3961377c5dd1de67df80540c35c4

SHA512
e7fa2ca8089f0f81219e476d2f9d176787ffe37239d5dba9c9e1f023b50fbf01ac6be55aca3b8a88bad7d4f5573cd853a87916842514c56f792ef12f690424e3

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
64KB

MD5
78e47c8a79a962231a8cd22db4cfc9da

SHA1
a3ba50519fa67e3002f1f65d8f68ce7fd766865a

SHA256
f773f9b4279af02f16d6e949238bc005c6e710a40832be1cf2746d8a49ea6e0d

SHA512
967033d7af7d7a799959cf823a0a7776b24e25b75e192ba689ff48762831b6326ff2f2f7f5f8b0121d05747dc72889647e410aebe0e64b0717df007df349c901

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
64KB

MD5
387f687436e5f3159bad8d8896369139

SHA1
81f2436d9bde984b273e56b53df64be8d8eda432

SHA256
521c8e3f92d027925bf29152402b739568e6e53e9f834e025d1c683dd57832c6

SHA512
c573da918cbc7ea0559fb7f74d019047c108ae1ff8283ed0ab171341623076febf005de5b132942f031332ef68e5e7bfa47af523101da82f3283390138537bda

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
64KB

MD5
3c78dbfcb0d12acfb5cbfcbdf392bdf2

SHA1
4aef70f2afbf8a3bbc9e4addc9bc37c1d83d05f0

SHA256
b651d34c3ba12b9f4b46a837f7f37be12f2e14d8ef05781014f66a2bc055e55c

SHA512
e15a6861fdcc6c687e27457467fa87150f860ac0d2584d88fe5545563009ebc88fcd6102f163da2f2d1e9c21f9dae4a8695ddb0a62a7fcd2cab731400b986cb5

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
64KB

MD5
2a15dddeadfc0bb96d3bb635213c6424

SHA1
13bf959bc15cd737997ed28990d6f8177150fc78

SHA256
d9bda2ce6aa0d19cadbc3c6fd5260a6998c6fd342df07227d98744b8606e5ebd

SHA512
40950ba5254868c2a388031a11e9e161fd376dcddd48ede7b4ea98d71b64098a5a10461fdfa60e4be95a19d33d3ede64442ccee15e5e8bc409423084204ba33d

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
64KB

MD5
347910aa48ee9b97ac52eebf12c99732

SHA1
8747fdbd05f1e062fbd1b9e29ede41ac8ba2f660

SHA256
18268b7855a19a2a405a1ba3227d3471e432341b2be96df3e10413cdbbd3d481

SHA512
4290575153116928435c5487d884bc6223113e967f2f8bc1102823b3199011a50adc5babcbfb08673f008b11a384a3185c4bfb97534005bc0e658f0c47c41761

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
64KB

MD5
c287e42c39b99960899d199fcb9740e9

SHA1
b5354b8c9bb71a7c150b0f62a55adc961a496787

SHA256
52f592779be06abe30476efb073bef45fa012f36242aabdd711f3c486b1d332b

SHA512
15d3d9724212678cd023e7d615e6a93f97499f04cb0e0c724288c6a3b5b144a35bc827a0026cc7b7d1bbd77ed9456f20749ce8008245148e0df06577209bd072

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
64KB

MD5
9940d50c4c3d97b2d175f6716c8b4f5d

SHA1
8800da0df0821d6a421c3f2116175b8ea8943b79

SHA256
6453c4f577c754c86ccfa990398c9a1654ae1a5181cd657282ea2b85ee3d0a60

SHA512
9475442f1d23aff3e74b625db2150e7ad49854ddd06f4241b8e73bb1ebea03799057d38146012ffd1333c546246d359707b056d64f534c344df31007656413b3

Download Submit
C:\Windows\SysWOW64\Pdmpje32.exe

Filesize
64KB

MD5
2e2b6ef2dff7380f62d3efd3f18d06d7

SHA1
9d9703c06f04f13ad47236401fc921bab37c4a43

SHA256
fd19ca0e4f5b4fd0e076e91b5601bf8b1d3589e904a82c2d8ed4f7c1e2fcfbe1

SHA512
ed1633028389051a2b9222cb5213a903f10bb27a88dd7bffa3c18c1a3ee62a6fda1f5228c6996fc3fc665c7f2713b1d1dadf57cc012850b640b45ea9e078c34b

Download Submit
C:\Windows\SysWOW64\Pfaigm32.exe

Filesize
64KB

MD5
c5ee74ea734b5d5f329d97f0c39edbd3

SHA1
e801506440b1eefc53040bb2f7df46982b2fa7b4

SHA256
f30e84bdd2cff30e2b2f390c6da25ee27d2c4495ca915736e1a7dfb917bb3130

SHA512
a5f819baa21105db234b2227ce346a3fa3dad8231921a4162911cce48d0e1840902819569d0cbd1a7ff09bffd3a4f16ee13f2d866b95ece8adb16762e476e2dc

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
64KB

MD5
9c8321205f40bf34612693fbef8fdfae

SHA1
f8255def309d198578cd8de58f71e7918c370c5d

SHA256
1473f97c3139a3591571e421eaa3fe6e40c0f151967ea0f0498d7a914c522ed3

SHA512
57d209102f4fef8ece45958e3b63a550a0388b4cf4f29894e8207c7e26c14f22367013d3c8f50eac4983962649e8bca378cb2bf832e2fc28a48e5a0cb58ff4c2

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
64KB

MD5
538162820161db88ba6f055818c639fc

SHA1
7d2f175e98e84797e9962c7bda90cca8f0185525

SHA256
c76ba4fd7185bbf23736b380135ff8d101ee9b2a59151ebcdc39c7ece876951a

SHA512
1f6f964e9d68d21dfd20819b9982ab59fede8dfc0bcb732d12f8389d020ba0873552d7d1c2c7978231d017a709ccfb5243475452e6237cb5bb5ffc5bd7c1e788

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
64KB

MD5
afe7e627f57e51fa6d74fc2b906db076

SHA1
0f94f9462fddd34ea19d3047bb6f14d6a94fa139

SHA256
0a711831125004f8d0680e92eef15e41d2a6653329869d70a3b224d6c4faf88c

SHA512
71957e67778ce72470e451a24c76886e5cc2997cb962ee007e7e11e1650db4ad9f811b1014c6bbe8c63eec0ffcc68a6618cfeb0274fe33d27337693c81135b67

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
64KB

MD5
4da1766cb0d7f73f779a89f21bd27db9

SHA1
9a272e7c08f8122e5d21493de0a1f24d0474620d

SHA256
fea553bd1241763748dfe27068c1baa793e9924acda39d7a931b9b70d8eee163

SHA512
af5a35e2608878b46c53f29bb187f5bccdaf28104b1315e69e9f767443d158f98414752d249547f78d5c4b80e45cd22460a4100ca5737a1771690921d65b7545

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
64KB

MD5
bac9b1fa75af43f35877e2b17e54f91b

SHA1
905b2002aba16397781053ba67bb5834f25ba43a

SHA256
5138f7bd58c32433b9c880bf7b5c36862e95a0379c5b4ec06d48b5b3fe44664e

SHA512
7fbc592c01814160e2439f330a43630ba55979bc7de8398666fa45a5e97ca4026e422e4af61da23c211b70ce6217d449c4d371cd7f405dd98f70ab965aa940da

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
64KB

MD5
321c669d6b369775cc01a22b523bdeab

SHA1
a9badc91bb5d62b1db6d696eb744f9264a937d07

SHA256
945b43ae605d94e64a9c57801f6d095ce4239680c190a6b3e8ff641f3a960c9d

SHA512
d13078df61ea3b33cf194b58d5c7b96569b9d31dee7e0a2bbb80c5fe2b31720867462e33c37a5afa858c04771d28f5473c796d4d8ff95cf7a36e5921011a7b75

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
64KB

MD5
61442c45d66c921897beaf12a58b9aaf

SHA1
765addfd3acecafba9721dc07861b135b9fcc4ad

SHA256
2923b860ee7c7af610bfa8439630a6c6409981dd898a2723cabebb6fba15b672

SHA512
d22bf620e96f76be9681c35cb18173b0ca5935aa016d1a8adbfcf862c01a48df8356a7308a5a2709f5d81356c37ba87c70fad3ee48d7a3ec74288af531152f7f

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
64KB

MD5
f643fe9ead375a04bae16a8fb5f712f5

SHA1
7de3d6f692fc9710df1cd145b55f97f0ad3af7fc

SHA256
677262e326ea8036e7c95b131a3452cd5360c2dd4f830616cba68c950402a2d6

SHA512
36d75bb1f69e0a8f1f7e4568ed7eaddc1f7205294becf91ee20958538ebaffe7e7617f8e6da9b5a000b31b8b1dca3a28bbeebfc72e3be0ae7c27c7eeddfd532b

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
64KB

MD5
7d111b753013653fbd752cfa1c0d698e

SHA1
c6a94aa7cd5103f8b0660ca833873489dc3352d2

SHA256
cbf64ba1ca989f6090d63de6bb5d9addda540aee1cd83f69ee9796a753469a35

SHA512
dff4a0bf85f56e4fdfa95f1f33306c0d367d91fdb6b0a5af19ebbbe21505c93083ca02bffce3e03c623817cc93301dabef1547ac8e5863a6967f9ff1f4477c18

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
64KB

MD5
785a1cd912ed5175d9128f9544bdccde

SHA1
6e356a8fb09d950f02fb98b0dbc73d05a1678ecf

SHA256
14b7a1e170833b1dc047efef21348c22c650c443be742ea8edf7b2df3b954fc0

SHA512
77c78d695f0937953eb6a074f6f10c038f02975d70b78f82615deecdc46e66844c0d340deab38603358dd261645c43a7db891c8cc5afcb35d58b06bb8409a6ee

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
64KB

MD5
3376d513c7e493450ab409be45d1a484

SHA1
02c79a7f6ad0513bc81e494b39dcf525ceb0b063

SHA256
4b48ad3bc461158d3ffba47a5ed5662708257c87ec61d5985d9d8f4653594738

SHA512
d9681a7a8f593f74d87a155cff2508bad6262278faf878cd07592b572cf6914bd679a93d38cf369ea558ae96ad2934be09fdc84d27b4cc2703a95010c9a5f400

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
64KB

MD5
53f603a9ff180a848035fd978887e553

SHA1
291279b5dae4de34159c60e36ba7b35619741343

SHA256
5c112ca4ca97d0732b34498e3c66f5fc307bc4ef26898d54f406159441d89df9

SHA512
8c128ced997577de8c476e31f5c8a000afc8363381d14267abe07c4756a13b981df5ce0cf0b475508f6178d53b65bd0b5af18f7770f25249b4ca893802e35a58

Download Submit
memory/664-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/692-483-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/936-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1036-477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1108-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1136-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1216-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-471-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1484-453-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-465-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1664-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1896-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1928-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1928-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2100-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2220-179-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2220-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2356-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-143-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2528-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2528-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2556-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2556-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2600-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2640-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2672-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-223-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2768-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2768-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-116-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3196-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3196-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3204-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3268-283-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3268-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3316-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3400-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3400-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3412-447-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-124-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-115-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3740-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3740-260-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3804-435-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3908-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3908-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3952-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3952-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3960-207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3960-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-151-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4040-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4040-108-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4092-290-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4240-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4300-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-99-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-187-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4720-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4736-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4736-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4764-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4764-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4788-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-338-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4956-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4956-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5032-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5032-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5056-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5056-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5056-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/5112-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads