3d0c144d6c2af7102c4b8db335a1a1e4f4c96face0b02cb550f2456b0ba90d08

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d0c144d6c2af7102c4b8db335a1a1e4f4c96face0b02cb550f2456b0ba90d08.exe
Size

121KB
MD5

04c494d24ae6bd7d758a78a59ad4dcca
SHA1

347e8b7bf74a515a87ae96323c49bfe4942782c6
SHA256

3d0c144d6c2af7102c4b8db335a1a1e4f4c96face0b02cb550f2456b0ba90d08
SHA512

454b33436c8ae6d4b132b70fa839d6dbb303d5f09ff71b40374d4a94a508e2918aae3d4405d9a3190da31014fe5c51b23865eb36c111ba4c8ca5104d8271d67d
SSDEEP

1536:0NSftxE0eRPYCuikl/r7WWmnB5niQIVX6x7Vhq28D24VdCCV19zQYOd5ijJnD5io:XnE3hSr7W37nJx8fVdnO7AJnD5tvv

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiefcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iemppiab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iicbehnq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mplhql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcimkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghopckpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbfbkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiaephpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcddpdpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kemhff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpebpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfcbjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbjcolha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemhff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe

Executes dropped EXE 64 IoCs

pid	Process
3028	Ghopckpi.exe
3584	Gcddpdpo.exe
4548	Gfbploob.exe
3424	Gmlhii32.exe
2228	Gfembo32.exe
4264	Gmoeoidl.exe
2600	Gcimkc32.exe
4108	Hiefcj32.exe
2872	Hkdbpe32.exe
4804	Hmfkoh32.exe
4100	Hcpclbfa.exe
4308	Himldi32.exe
1112	Hcbpab32.exe
1400	Hioiji32.exe
4808	Hcdmga32.exe
4192	Iiaephpc.exe
4656	Ipknlb32.exe
4280	Iicbehnq.exe
2080	Imakkfdg.exe
864	Iemppiab.exe
4872	Ilidbbgl.exe
1816	Jfoiokfb.exe
568	Jlkagbej.exe
1452	Jlnnmb32.exe
3052	Jfcbjk32.exe
4592	Jbjcolha.exe
3488	Jmpgldhg.exe
4436	Jblpek32.exe
4056	Jpppnp32.exe
3996	Kemhff32.exe
3240	Kdnidn32.exe
4988	Kbfbkj32.exe
232	Klngdpdd.exe
2820	Kbhoqj32.exe
980	Kibgmdcn.exe
3036	Kplpjn32.exe
4188	Leihbeib.exe
1312	Lbmhlihl.exe
640	Ligqhc32.exe
564	Lpebpm32.exe
1660	Lgokmgjm.exe
2064	Lmiciaaj.exe
4932	Mdckfk32.exe
1688	Medgncoe.exe
3720	Mlopkm32.exe
1968	Mgddhf32.exe
1708	Mibpda32.exe
3528	Mplhql32.exe
2760	Mpablkhc.exe
2584	Menjdbgj.exe
5076	Nilcjp32.exe
3900	Npfkgjdn.exe
1844	Neeqea32.exe
4672	Nfgmjqop.exe
3128	Nggjdc32.exe
2348	Oncofm32.exe
1320	Ogkcpbam.exe
572	Opdghh32.exe
5060	Ojllan32.exe
3840	Odapnf32.exe
3228	Ojoign32.exe
1860	Ocgmpccl.exe
2396	Ojaelm32.exe
2156	Pdfjifjo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kplpjn32.exe	Kibgmdcn.exe
File opened for modification	C:\Windows\SysWOW64\Accfbokl.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Fqjamcpe.dll	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Andqdh32.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Klngdpdd.exe	Kbfbkj32.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Caebma32.exe
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Ijfjal32.dll	Medgncoe.exe
File opened for modification	C:\Windows\SysWOW64\Nggjdc32.exe	Nfgmjqop.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Akmfnc32.dll	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Jfcbjk32.exe	Jlnnmb32.exe
File opened for modification	C:\Windows\SysWOW64\Menjdbgj.exe	Mpablkhc.exe
File created	C:\Windows\SysWOW64\Jhondp32.dll	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Hioiji32.exe	Hcbpab32.exe
File opened for modification	C:\Windows\SysWOW64\Lgokmgjm.exe	Lpebpm32.exe
File opened for modification	C:\Windows\SysWOW64\Ojoign32.exe	Odapnf32.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Kdnidn32.exe	Kemhff32.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Leihbeib.exe	Kplpjn32.exe
File created	C:\Windows\SysWOW64\Neeqea32.exe	Npfkgjdn.exe
File created	C:\Windows\SysWOW64\Pggbkagp.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Qegnoi32.dll	Hcdmga32.exe
File created	C:\Windows\SysWOW64\Gdkkfn32.dll	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Gjgfjhqm.dll	Pggbkagp.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Gmoeoidl.exe	Gfembo32.exe
File opened for modification	C:\Windows\SysWOW64\Ojaelm32.exe	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Pncgmkmj.exe	Pgioqq32.exe
File opened for modification	C:\Windows\SysWOW64\Aminee32.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aminee32.exe
File created	C:\Windows\SysWOW64\Kgdphnlp.dll	Himldi32.exe
File created	C:\Windows\SysWOW64\Knfoif32.dll	Nggjdc32.exe
File created	C:\Windows\SysWOW64\Hpoddikd.dll	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bfdodjhm.exe
File opened for modification	C:\Windows\SysWOW64\Iiaephpc.exe	Hcdmga32.exe
File opened for modification	C:\Windows\SysWOW64\Mgddhf32.exe	Mlopkm32.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Docjlc32.dll	Iiaephpc.exe
File created	C:\Windows\SysWOW64\Bncfnnbj.dll	Imakkfdg.exe
File created	C:\Windows\SysWOW64\Mdckfk32.exe	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Pncgmkmj.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Hjakkfbf.dll	Iicbehnq.exe
File created	C:\Windows\SysWOW64\Bjmjdbam.dll	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Bclhhnca.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Kdnidn32.exe	Kemhff32.exe
File created	C:\Windows\SysWOW64\Ikkokgea.dll	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Aqncedbp.exe	Pjmehkqk.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6304	6200	WerFault.exe	225

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlkagbej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oncofm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmafkkf.dll"	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odgdacjh.dll"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhgaocmg.dll"	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmoeoidl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdijfii.dll"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfoiokfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deeiam32.dll"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qegnoi32.dll"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ligqhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfnbea32.dll"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdkkfn32.dll"	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcnhho32.dll"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oomibind.dll"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomaga32.dll"	Ligqhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdjinlko.dll"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kbhoqj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echegpbb.dll"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chmndlge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iedoeq32.dll"	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gfbploob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Neeqea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddakjkqi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3028	3784	3d0c144d6c2af7102c4b8db335a1a1e4f4c96face0b02cb550f2456b0ba90d08.exe	88
PID 3784 wrote to memory of 3028	3784	3d0c144d6c2af7102c4b8db335a1a1e4f4c96face0b02cb550f2456b0ba90d08.exe	88
PID 3784 wrote to memory of 3028	3784	3d0c144d6c2af7102c4b8db335a1a1e4f4c96face0b02cb550f2456b0ba90d08.exe	88
PID 3028 wrote to memory of 3584	3028	Ghopckpi.exe	89
PID 3028 wrote to memory of 3584	3028	Ghopckpi.exe	89
PID 3028 wrote to memory of 3584	3028	Ghopckpi.exe	89
PID 3584 wrote to memory of 4548	3584	Gcddpdpo.exe	90
PID 3584 wrote to memory of 4548	3584	Gcddpdpo.exe	90
PID 3584 wrote to memory of 4548	3584	Gcddpdpo.exe	90
PID 4548 wrote to memory of 3424	4548	Gfbploob.exe	91
PID 4548 wrote to memory of 3424	4548	Gfbploob.exe	91
PID 4548 wrote to memory of 3424	4548	Gfbploob.exe	91
PID 3424 wrote to memory of 2228	3424	Gmlhii32.exe	92
PID 3424 wrote to memory of 2228	3424	Gmlhii32.exe	92
PID 3424 wrote to memory of 2228	3424	Gmlhii32.exe	92
PID 2228 wrote to memory of 4264	2228	Gfembo32.exe	93
PID 2228 wrote to memory of 4264	2228	Gfembo32.exe	93
PID 2228 wrote to memory of 4264	2228	Gfembo32.exe	93
PID 4264 wrote to memory of 2600	4264	Gmoeoidl.exe	94
PID 4264 wrote to memory of 2600	4264	Gmoeoidl.exe	94
PID 4264 wrote to memory of 2600	4264	Gmoeoidl.exe	94
PID 2600 wrote to memory of 4108	2600	Gcimkc32.exe	95
PID 2600 wrote to memory of 4108	2600	Gcimkc32.exe	95
PID 2600 wrote to memory of 4108	2600	Gcimkc32.exe	95
PID 4108 wrote to memory of 2872	4108	Hiefcj32.exe	96
PID 4108 wrote to memory of 2872	4108	Hiefcj32.exe	96
PID 4108 wrote to memory of 2872	4108	Hiefcj32.exe	96
PID 2872 wrote to memory of 4804	2872	Hkdbpe32.exe	97
PID 2872 wrote to memory of 4804	2872	Hkdbpe32.exe	97
PID 2872 wrote to memory of 4804	2872	Hkdbpe32.exe	97
PID 4804 wrote to memory of 4100	4804	Hmfkoh32.exe	98
PID 4804 wrote to memory of 4100	4804	Hmfkoh32.exe	98
PID 4804 wrote to memory of 4100	4804	Hmfkoh32.exe	98
PID 4100 wrote to memory of 4308	4100	Hcpclbfa.exe	99
PID 4100 wrote to memory of 4308	4100	Hcpclbfa.exe	99
PID 4100 wrote to memory of 4308	4100	Hcpclbfa.exe	99
PID 4308 wrote to memory of 1112	4308	Himldi32.exe	100
PID 4308 wrote to memory of 1112	4308	Himldi32.exe	100
PID 4308 wrote to memory of 1112	4308	Himldi32.exe	100
PID 1112 wrote to memory of 1400	1112	Hcbpab32.exe	101
PID 1112 wrote to memory of 1400	1112	Hcbpab32.exe	101
PID 1112 wrote to memory of 1400	1112	Hcbpab32.exe	101
PID 1400 wrote to memory of 4808	1400	Hioiji32.exe	103
PID 1400 wrote to memory of 4808	1400	Hioiji32.exe	103
PID 1400 wrote to memory of 4808	1400	Hioiji32.exe	103
PID 4808 wrote to memory of 4192	4808	Hcdmga32.exe	104
PID 4808 wrote to memory of 4192	4808	Hcdmga32.exe	104
PID 4808 wrote to memory of 4192	4808	Hcdmga32.exe	104
PID 4192 wrote to memory of 4656	4192	Iiaephpc.exe	105
PID 4192 wrote to memory of 4656	4192	Iiaephpc.exe	105
PID 4192 wrote to memory of 4656	4192	Iiaephpc.exe	105
PID 4656 wrote to memory of 4280	4656	Ipknlb32.exe	106
PID 4656 wrote to memory of 4280	4656	Ipknlb32.exe	106
PID 4656 wrote to memory of 4280	4656	Ipknlb32.exe	106
PID 4280 wrote to memory of 2080	4280	Iicbehnq.exe	107
PID 4280 wrote to memory of 2080	4280	Iicbehnq.exe	107
PID 4280 wrote to memory of 2080	4280	Iicbehnq.exe	107
PID 2080 wrote to memory of 864	2080	Imakkfdg.exe	108
PID 2080 wrote to memory of 864	2080	Imakkfdg.exe	108
PID 2080 wrote to memory of 864	2080	Imakkfdg.exe	108
PID 864 wrote to memory of 4872	864	Iemppiab.exe	109
PID 864 wrote to memory of 4872	864	Iemppiab.exe	109
PID 864 wrote to memory of 4872	864	Iemppiab.exe	109
PID 4872 wrote to memory of 1816	4872	Ilidbbgl.exe	111

C:\Users\Admin\AppData\Local\Temp\3d0c144d6c2af7102c4b8db335a1a1e4f4c96face0b02cb550f2456b0ba90d08.exe
"C:\Users\Admin\AppData\Local\Temp\3d0c144d6c2af7102c4b8db335a1a1e4f4c96face0b02cb550f2456b0ba90d08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\Ghopckpi.exe
  C:\Windows\system32\Ghopckpi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\Gcddpdpo.exe
    C:\Windows\system32\Gcddpdpo.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Windows\SysWOW64\Gfbploob.exe
      C:\Windows\system32\Gfbploob.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3424
      - C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4108
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1816
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:568
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        28⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        29⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        30⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3240
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4988
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        34⤵
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2820
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:980
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3036
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4188
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        39⤵
        Executes dropped EXE
        
        PID:1312
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:564
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1660
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2064
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        44⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1688
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3720
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        47⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1708
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3528
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2760
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2584
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4672
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        58⤵
        Executes dropped EXE
        
        PID:1320
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:572
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3840
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        62⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1860
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2396
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2156
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:532
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3728
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        68⤵
        Drops file in System32 directory
        
        PID:2952
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        70⤵
        Modifies registry class
        
        PID:2476
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        72⤵
        
        PID:680
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        73⤵
        Modifies registry class
        
        PID:868
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1264
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        75⤵
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        76⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        78⤵
        Drops file in System32 directory
        
        PID:336
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        87⤵
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        88⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        89⤵
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5748
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        94⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        95⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        96⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        97⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        100⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5292
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        104⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        106⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        107⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        109⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        110⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        112⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        113⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        114⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        115⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        117⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        119⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        121⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        122⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        126⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        127⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        128⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        129⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        131⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 420
        132⤵
        Program crash
        
        PID:6304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6200 -ip 6200
1⤵
PID:6276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
121KB

MD5
25ea32db16537233dfbca959e2ccf355

SHA1
83f594330c20c3fd340aa4c5dae7765907a818c5

SHA256
6c9417da2e98cf3574f09f020e15aabdd6f55a8e352e939627bf4301f6450b3f

SHA512
22b53a4cd8ee3bd4c929cdb01d3f5b29894ec14c377cf2c095720ffd451d4e5660cd55e3408bee3abf1d2129c5afb802f54180875dd028ae4a0e655d6ed01c67

Download Submit
C:\Windows\SysWOW64\Gcddpdpo.exe

Filesize
121KB

MD5
20d6d03a79297cf757a00bd1430cd6b3

SHA1
e3ddaf364e0e64095c7e45d0e97163657ffb3f82

SHA256
51d902e1a922d87b5c2124f9196a2d541edc2ec7cb0d2e039d49a91993264752

SHA512
2b3f1c57b88465a03b0cc0660757745b8eabdabb7a23393c2dcb22d8b6a0954a6452e97ddfee9ed9cbb2bd8140c723c739371d54cd480c0f1b6d038d2615bd1b

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
121KB

MD5
7e38d6e57452904f1fa096800502b83c

SHA1
477538235111a89e9120396400d99655f7deb06e

SHA256
0e839f59ecc5ccd42fc1c07f930f30d08a18dd1b2e8f84a525ddcd2c32f1418d

SHA512
c48c6952ecaf4b43256075b598311a20b37897fe2b58bfe2cef165a6d7e776f690d364e12ef0c04e31dcca790b791031acabb0f7f0573f888b6f5a5f2a74c668

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
121KB

MD5
3e6b41698a5c4e3b0b543a21b445466d

SHA1
25c1ee30bea48cbd51c27e8d79f787e5ef3fe12a

SHA256
28f4f7cba360a4457ef43ee8e7b8a631e7ccf875d11a2729fe0a83393664afda

SHA512
e9b1c1bd7def64d2db56e039b08893d5273ad516d0529856e82993f8869755b0cebe0c43493af25f95696b9e94abe09b1d85d13169768c860df56864572ab541

Download Submit
C:\Windows\SysWOW64\Gfembo32.exe

Filesize
121KB

MD5
d84c603bb9bbb08a3e1432e11f7177bd

SHA1
2240594075f94fee02dfd1e1b26fb7f01a8d556e

SHA256
46f00e29e8c8ddaa7ff30625725dc4611b58eca1f8bec9853d868c061a291932

SHA512
8554ffcdf1c2cb0c90c09bf176f7ab3824beb8b9a78b2b323c5ac2dd3178c17b860c91c78686ba63cc7fb54583aa9dcb08cea6082b98398c02652a60a18957be

Download Submit
C:\Windows\SysWOW64\Ghopckpi.exe

Filesize
121KB

MD5
2b282ae01d4eea9b53bfc96d1218c94a

SHA1
c4a49f47f672af0dea0e60fcf6affeb8f1fa2ea3

SHA256
1333788365bc3046b9b8ea1859daa2f33ccbc254b081c3e2e6a06895adb9469a

SHA512
0b914b8b5fe02754026721c5879af6a068f6f6fb64dd359ff203db4ffbea4b42898059921aa71a90e5fced9cc4260cac060517b6e557b9caa1f60f5b12b5a0f5

Download Submit
C:\Windows\SysWOW64\Gmlhii32.exe

Filesize
121KB

MD5
0ee64b830c633d5b02319d732da0cd71

SHA1
e18673d83b96cb062081a33791f09f941e7c25aa

SHA256
b96ff53683d452794ab4ece0f71256462966802e48accbb245de7193876ca75a

SHA512
730bfadcfc891bd6609c6607a06640dd15e4b8eebc1d821599963562c11ef1b2a411cfc6b8d61806b50c3730352991df95c4ab565e60ee0c9f16d7250f7b0a5d

Download Submit
C:\Windows\SysWOW64\Gmoeoidl.exe

Filesize
121KB

MD5
34d4d36f473cc3ea91f6512fa3f6be58

SHA1
314f4912e375cc3d25b879b0f5f539dcd473e244

SHA256
359cea6981daf97e862ea93ad91eea9036c6765f0e29e2d2f7716857d2f3ada7

SHA512
74d14857acb37e9b178ab87dc5d5709c3116cf090326b9ecdf77f11094aac0185b90539a370b8291c319c0ebc0cd7adb45e337970a97cf1d7ad9fdd7869aa64e

Download Submit
C:\Windows\SysWOW64\Hafgeo32.dll

Filesize
7KB

MD5
7946fdc791a4f28a360bc094d34896b1

SHA1
d608536984aad28c3b54716c2247505b1496048d

SHA256
32799e563b911e36c394c87a7636d6d3044e4b7bfb9545f8ea2b5abe9a68ee84

SHA512
97143520785bffbf966b2e82e9469183994534a9136bdc83b311df1b1f34b69073b527c4d4df96f7af7812d3fe8883de108b53c79d7faefa228f83207568d95a

Download Submit
C:\Windows\SysWOW64\Hcbpab32.exe

Filesize
121KB

MD5
c19bd9be278d80e9d4a5b1a95c7378b9

SHA1
10660029b86e360b5427d0c4ee55c82afc28cf12

SHA256
8dca00c3f62b0bd4d477beca270923faca3c7e7d6dc461e2724a45b83b72aac7

SHA512
d114015873d5241dbb4c3cd129bfdea648732d559223b3049a4a31a529c2f8a9a7c5af933259bdd9da9c5a380178402ee0186b56c34b3f2e2432a0ba898a6623

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
121KB

MD5
cd0e9b1329507a8248188952b6d02d44

SHA1
fd97ab3cf4c8d80836f460734e66bf5852a42779

SHA256
845421a9eef72a82406d8fec503b3f8d0ef64d7b8550dd49e108235cbdc72c05

SHA512
10bcae5f7afdfd598c34a0bb5be3d2801142aa6dd49575c796d62756d5062d3ec7c04cd21b88d52a5cc61e8f00f88c4d98cfc64d0aeb9e7d32966ceeed85a55f

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
121KB

MD5
607f47b6135e81ee8872e2950a382a53

SHA1
83e972ffdf2ee996496ff4a4850c648397a754fd

SHA256
6e203a04bea02e98a79e309dcd8aec0a2b413a11d6ac78011311a25227a941dd

SHA512
5a3ef28fd45cd4cc1e4f771e8dd405dae16ae712634cab3f1e56d6b6e22568c8090f7f84bb36567cfbad451d28f752e475c4a1d817eb5acbd739e001c557b9db

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
121KB

MD5
60605f81e8ebed1987fa6ac85b4f69f4

SHA1
37783a0f0032d3543c1c34d32daab72f6d30b631

SHA256
86dd2151b7fed5d10645c5f48e91e9cc2ec139e4c5eb7dddd10b8c1704533db9

SHA512
7c40d851f5f00aa1ec3cff4b84838e98c0825e6a93522f221afac5dc050b2c3fdaff929ca194f08c7bc3edea45200327dcd918a553ca8ba047d24a061aee9ef5

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
121KB

MD5
a671993f2d32b07fb996aed3dab8a82e

SHA1
3802731b5d5bae143496b996f8215b7958bfe4b8

SHA256
77b22c22332f4fa44966e8832b6f28beb61cda51d6d06b7ecab8eaa2a9ebcf58

SHA512
0560ea2e9737ee184b08b6fe931050ceb8f3db95f4b17ecbda8e2ea0d1966b16fb18c5da7f5709d3cc0e67b95a1d23b375f958faafafadef8f96bdf98a066dc2

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
121KB

MD5
31a9eeaf78d0d01cd4703aebf85c0f27

SHA1
0b27e0c41400bd0bc0de211d9f73af2e95e969be

SHA256
9aac8b997fa1a79269531dec44865abe6c6477d851c222ca1c0209b8973a7167

SHA512
a458dd5708df9860e9e6590ae798a7128a791bd5c0f0aacea16d7c67b6ef2e1d93ed97346bbbb2280693683de32ee21235ef1208dcfb1b2a21398f7884619659

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
121KB

MD5
07af4252d025ca17b2ecc4f314e4b47a

SHA1
2abd05ed32643c79eac005bee7dd871f0a705e4e

SHA256
ed3237a8a86ea305946c8bee35ff54846150843c125557cce247c20ad813ee85

SHA512
4eed52f344d3ca2ff84c4205b4253dd952ece3d40d26cab3be8b9e0bb8c775dd8c501acf9d91fec61154e0e2e1815576858fa8abaf49aa0e7ec649aa606f2757

Download Submit
C:\Windows\SysWOW64\Hmfkoh32.exe

Filesize
121KB

MD5
663b467c965185a9924f1f880eb6d82a

SHA1
e119cdfd84c6813430391d701b575a7c2839e91e

SHA256
50307582ce4493902f7c845ed67a81710e422eaad8bb69a03fc4fe9e9c8cefcd

SHA512
245d3528754978b4a99da55801b5d4681f094b3552c15334167bf958e844ba864926315cb1aafce45124abcb33096b9d0fe48cff8f853742958a1ebefaf4298c

Download Submit
C:\Windows\SysWOW64\Iemppiab.exe

Filesize
121KB

MD5
804ca80340450177673d05c56218cfe5

SHA1
421bfb6cbd74f8d05227937b091641ddaebf5651

SHA256
3803bc1cb9ddd7226cc931b526875e235bf3a870e11a3989f1e3e30f87311380

SHA512
8e8134c218f0b09e6a28332bd2f27080ad5ef5fb8bc14c1a468078cd6cf6c5364342b75a6216b11d16d90316b06d1437408f47e8e1b4e4f402a1189c46d62216

Download Submit
C:\Windows\SysWOW64\Iemppiab.exe

Filesize
121KB

MD5
b887597566e8bd027ee12ccb54ae7a94

SHA1
dd9d37df3c0a4b44f29b9e9b8dcc3ceff79b7b8e

SHA256
ce70f2f74eafa745c89c720f2cb6af551fe6988f30d509cc961a6704fbfe6a79

SHA512
0c30195d503c80d18733a9ac62a676fe07edfcc4bc15e53349904aa2835a9da1b9a0c25f9dbaa25e5f291713f5a36611e2e1fc1276413deb838a1a15671fa526

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
121KB

MD5
b5336e0299a2dea8cfe0152f2b68ef02

SHA1
7b177738db185cb226057264944d8144aaa7a355

SHA256
300ebee5091c6fdb42a95ed808b5cf741c5e0908bc9c1342b49444a834bd0cc2

SHA512
befbf13e992943ee232c3ef8e8951607be4f03badbe9624a09a865ec09c2fe05d36c84e0087397728af91edd84fd84414e11bc29e45ef802c55e13a8bc6ccc33

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
121KB

MD5
822677225f4f78530c95e2394e597d97

SHA1
46ee3065743bbdf46808d17fab7f3ca0bb9c992a

SHA256
6927df7eebf0f2d0ebd5c3cd64748e9d07024edb6e5fbc32e1b55f34b52b8c14

SHA512
19538abd049b1b90de617277dc1850b2793b4de0695e559042fc509790ccb42cc6317148fce34f041d173d04a52cdf22319e2c627d6d8961463373a783508cc8

Download Submit
C:\Windows\SysWOW64\Ilidbbgl.exe

Filesize
121KB

MD5
ff3a8d6cb68787247f5fae540b82eeea

SHA1
efbcb58fa23efb9ec504497f749b0cfca424e007

SHA256
115020fd64f8a7ffa6eab346563e36f4090c2189507191f32f1c10359cb70b8e

SHA512
4a2380b5db0f37089d7fb8c289258d81218d99db3a432b3aa7d46e03b5f921c1558c3d538ddb921d8a8ec819fd17ab1fd911f0bcbd7046e2b69c9f4b1b2cec45

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
121KB

MD5
25fa70ef76a06b47e2d71768115473c7

SHA1
467223f77807d1f6fa3884f7ac204bdc57bdee43

SHA256
8076e18a039f0dc8d8cb3c8c6c6df6adc411487a000ea62bdae0e376b5adb069

SHA512
55b3105fe5e40ece369b3bf333f4bed8bd0976c21159b78f55c0914bfad6bf3bf67d2e2e66a5d28207eff7421de2dd637639aaaa9ba42d303a5a550bf15d8c44

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
121KB

MD5
6aef950e008fac498793bff1139a0bd2

SHA1
5539e706e1e4e9cb5f666264dc1fa918de316d83

SHA256
dc4ba582d7a0a7b13b58382d7c25ca4c8fe3fcff8f20a8f734b361d8eb7b3cd9

SHA512
74fae2074c5d0604041260561f85a3a388ff1d2ce61fe3c0c68e1e648f7d8ecd44db2d2dda9fd1b6fe237ebc5d43b9bbeb30458925170445b7185ddbeff87b81

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
121KB

MD5
3fab274bb131791911fd43a0d6048baf

SHA1
51f08ac1ca2fcc5fb4c73191ce7c364c97f0eac3

SHA256
a71db2c98d33d2253cbc762d9ee3d33468fc83228377b3509dd7425d03bbed0e

SHA512
c6c0b990c56611970d4a06d4cc439a311c5c1b2f51ec93dce569e5a5eb214e75ace1c2dfd61ef84fef69c64ba3ee388b6a57da5e59c3f79104ca26b7f68f6943

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
121KB

MD5
6c893e210c9133817dc7f21eaad70efe

SHA1
83da1efee0a2258a9b2fca4207d4ba9398f30f8d

SHA256
5e49be149904d3e9e3d46914beadfa6cf501e1209209702ce3f2f6cb425c8860

SHA512
42e8ed8e1a3cf0247a67459798eecafb3e88f749e9ef487a99263ba0105902d3c24d3f3176e6f7bf7c301e708cf3e81837b13f137f429392a738ffa67d79417e

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
121KB

MD5
5019c05ec936123e87a482805955764c

SHA1
34b9ad61c68dfd7d3f3d849c3d36b31dc52418d6

SHA256
1241ef2e9160e96d0f6d36cba92955c124ba9e039a144ae4fcbcb07b295e9802

SHA512
45f0ac50460d69c7fe3530789d3d6af4fd79df47bd7079a6e375b2dce137b2b68e7c4162a359a7913f5b9444bb87492624716a3a154075bcd10dc9e003ebf4c1

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
121KB

MD5
f0fbe1bdc1012568977773b4edd4fa3f

SHA1
beecfa796c53b6abe71fb568b1a85ec1adf43149

SHA256
923e9b9a34766c3ab6f87bb404da8e158d85f916bd6ad77050aafb9735114d9d

SHA512
b709cf8edda3fd4c4403bf8026eb03593f4c3003649c75671085f01696c004129fc8722029b7ce0708ec2393217d78075bf33e53c9fb256b973598de5f0339ee

Download Submit
C:\Windows\SysWOW64\Jlkagbej.exe

Filesize
121KB

MD5
b5f781d6ee30d68aad536e8a0b7ddb94

SHA1
af0018f3bac4091d2a87fb5e3d811f94e4599fd7

SHA256
1c3765593a18a0acd2a75553b5de2b96f625b35e9f30125ca73de6ee2850ed4f

SHA512
a25786a4eb455703afee0f5baa4db0e8b572ab82f03f1e402a18e6b687ec2b22e6f400f2ece4141b4a97e979291178e0ab3bd41f144b64e9874a77f48bf1dea5

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
121KB

MD5
c48516fda99f7d0cfc523657015cf152

SHA1
999f7a596625365226f6ee047dc3d8670318fd42

SHA256
b611184710dbbb1acc74a6f19a01527a63dde3641ea5aa53af6a0012b836467e

SHA512
b78363f8212c644d8d96517ce3577efdd588b0c28ef185071f439901838297cf8b9a041de295db3183c9d46ff7d8b80b20325e5f9c6e3aa1e1401c7fdd132c97

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
121KB

MD5
5fae60d3c1d7b67e6f3676c8182e8f1d

SHA1
24237f70861004d32372941b07e9f20a53b725fe

SHA256
eb6c75ec98d10dc38c62634c0667e02437e1d2faed1fb59b908d62d34cc06c6d

SHA512
f0d35a8d84324deb28f697f6e1f9368cf8e7e78b80d9daa6fc89d09929765613687a3a8b6903adf76ae7312a3fe060ff4694a19e7d46a2dd46fad06f195bd21c

Download Submit
C:\Windows\SysWOW64\Jpppnp32.exe

Filesize
121KB

MD5
af93e7b2ac43213c9fffd9495a8e5bdb

SHA1
1d79c26cdc58b30bf3233398367f3c3b2a422fe4

SHA256
4dbe6e7061c7ce3bb76bc3e3c31e49641cb545370939b579078b6b42eedd51e9

SHA512
cbf43b761c7725821285433fd17f0586db3460fc11d13a6f3b7e37e7ddc5a88cd7e0b3f08642c5d5f6211f929db1a5a140e98672ef568b8b05688059db8c108c

Download Submit
C:\Windows\SysWOW64\Kbfbkj32.exe

Filesize
121KB

MD5
7a801c3ebd6c3b5ff4f4e14ae2a38ad2

SHA1
5f6ace96462c219875702d4665256c497adfce07

SHA256
475a7e8b20e95c78bfc5dc20c7ac7db0ebebe4914f164271c369bf5b3c1f8a2b

SHA512
b67e4feec80974f99573781155ab57a923b8fde200293fc6d858d3cab33a0e6971a07cfda6f22e0e0690694b595ddfe195a744d23057c03e4f4bb8bdeb0716a3

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
121KB

MD5
6f376d99dc06439c1dcd0de462a86370

SHA1
da326ed2130151462348d3c6bfb44e981ea2cef7

SHA256
f8e9dd02bfaf4ed95427afb42f56e689123c4149a3ffe63f6fe7d9d900064633

SHA512
6f979cdd2833827d71dbd032796b332a5a05eb856cd1413dc357601fabc88bec9b5aa2e4da7cf6a9696dce53d1bade5a7bde773f02b41560fe52699bbd0a140d

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
121KB

MD5
9b7837edf7b8637d27f8bf8e59ff5451

SHA1
793492868b7ef43d29406152f294fad3db8c6178

SHA256
3134012ce05ae7649545b8669893e068955a811ccbca416e4429deae1326962a

SHA512
ce6d919cf1856b70946f3de7925e7958c860822009cb11157d17e59b1c905fc8e414f1fb73e517e2d448a625e90fc22f7081e9bcc650178cc09b4fd9674950f6

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
121KB

MD5
9a7a4875a8a26472120277d6319c8daf

SHA1
7800d763555e75a19b595ebe2c250b0b08458c52

SHA256
bf51a17294d9a7c3bc3cfe5d166076629796f5ed24551a9027277483f9a76705

SHA512
042ff80f8ba9126442e4441358c0cdb8c9359047656c370f8c084c72b8afebd663d1a91f22f1b127a8509851d07c98a46af29700ad992fa5c3f9cdf64db79b1c

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
121KB

MD5
48df242bf9bdd4f22e22f576f50311da

SHA1
21af0879e51f1028bbc3f32f4b408728604d2410

SHA256
68403b4c6a5126cb2b35711807ee35bd06934a7a9d800c83888138b6400c249a

SHA512
5e9f573dc7315e59ac247e961710c28da30e625b8ff4038eda22b46e988ab52888fee0959af4480f782c5cd2f1c928d234d4df89bf74884def1023f9d3d8f91a

Download Submit
C:\Windows\SysWOW64\Nggjdc32.exe

Filesize
121KB

MD5
54d6309e83d339445213aff3b1549581

SHA1
191c12d7faf8dec08404697bb86d8dcc30bd77cb

SHA256
7536087530055f1483444609b0953ccc91754690381765d8f19161e622ce6bba

SHA512
7683df3078119a7ae0bca539d1c511a9bcb8269033e1cd140e59d885524d16f0728a919c0677e40cac0236e3fbc23299d451e7312302a686764d559ee9ed261a

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
121KB

MD5
2404e11552c698bf8328206726391ea8

SHA1
37119b57ce687f0bb7569a241432743c51397cb4

SHA256
fcfb09ce567c6f79c5e2adbff67e1419dc467fdb2ca6e102103898cbf3864029

SHA512
17024ca0d9fcf6cbe98d3838ae82f2bbd999a1ecccf2d29e7cff633bed396107a4ceab6d8e4853ff042db96416e6824ef0edaa0aaf90ba1618afeee7b08e84d0

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
121KB

MD5
9d1e6f6f150362a0f716f770f1ef74b2

SHA1
bd8e7c77fe4eb3213636707194f7fcf9722d055d

SHA256
2f232336e9329e9b83ef341c624e075e7410a545c298e70de0d7fd582fc394b8

SHA512
de97fe8e42cfc0286ebc002cb0f59b9d887009af2941bb2a428135ebff9897349a57ef4a0b84bdc6f1e3d606138f626c04d7c057da064d98b7d74b662b4fc2ac

Download Submit
memory/232-262-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/564-304-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/568-183-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/572-412-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/640-298-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/864-160-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/980-274-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1112-108-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1312-292-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1320-406-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1400-116-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1452-192-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1660-315-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1688-328-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1708-346-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1816-176-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1844-382-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1860-440-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1968-340-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2064-316-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2080-151-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2228-40-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2348-400-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2396-442-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2584-364-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2600-55-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2760-358-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2820-270-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2872-71-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3028-8-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3036-280-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3052-199-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3128-394-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3228-430-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3240-248-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3424-36-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3488-216-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3528-352-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3584-22-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3720-334-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3784-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3840-424-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3900-376-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3996-239-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4056-232-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4100-88-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4108-64-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4188-286-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4192-128-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4264-47-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4280-144-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4308-100-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4436-224-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4548-27-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4592-208-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4656-136-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4672-388-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4804-80-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4808-120-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4872-168-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4932-322-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4988-256-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5060-418-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5076-373-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads