59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe
Size

101KB
MD5

1a795a1cc51a020c1b78381358b1b01e
SHA1

c8bfd0804f70157f372902598443dbe4d09d3671
SHA256

59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e
SHA512

ba0cac8a1a35e69ffa5404abefd28244fc30c9a7ad2186c5bf100ad8c86d8eef64fbf2cfeed96ef480388faeac2bf2b1b8d71209af61662ace018d83260fe06b
SSDEEP

3072:J3v4O22wVg9a8TjPBzMIniVSWe3m3/zrB3g3k8p4qI4/HQCC:B4Bma8nBzhliPBZs/HNC

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe

Executes dropped EXE 34 IoCs

pid	Process
2172	Qgqeappe.exe
1304	Qnjnnj32.exe
456	Qddfkd32.exe
4984	Ampkof32.exe
4924	Acjclpcf.exe
4560	Aclpap32.exe
3356	Ajfhnjhq.exe
1252	Afmhck32.exe
1980	Aabmqd32.exe
4176	Aglemn32.exe
4436	Aadifclh.exe
2480	Bjmnoi32.exe
2524	Bagflcje.exe
3952	Bfdodjhm.exe
3004	Baicac32.exe
2804	Bmpcfdmg.exe
232	Bjfaeh32.exe
2908	Bcoenmao.exe
3452	Cmgjgcgo.exe
2232	Cfpnph32.exe
3312	Caebma32.exe
4852	Cjmgfgdf.exe
3852	Ceckcp32.exe
3332	Cmnpgb32.exe
1976	Chcddk32.exe
728	Cmqmma32.exe
3040	Dhfajjoj.exe
4492	Dopigd32.exe
3880	Ddmaok32.exe
4888	Dmefhako.exe
2476	Dkifae32.exe
4000	Daconoae.exe
384	Daekdooc.exe
1472	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Abkobg32.dll	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Aadifclh.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Bagflcje.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qnjnnj32.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Ajfhnjhq.exe	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Aadifclh.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Ehmdjdgk.dll	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Idnljnaa.dll	Afmhck32.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Qgqeappe.exe	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe
File created	C:\Windows\SysWOW64\Aclpap32.exe	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Hmcjlfqa.dll	Ampkof32.exe
File created	C:\Windows\SysWOW64\Afmhck32.exe	Ajfhnjhq.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Ooojbbid.dll	Aglemn32.exe
File opened for modification	C:\Windows\SysWOW64\Ceckcp32.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Ceckcp32.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Hpoddikd.dll	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Ajfhnjhq.exe	Aclpap32.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bfdodjhm.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Qddfkd32.exe	Qnjnnj32.exe
File opened for modification	C:\Windows\SysWOW64\Afmhck32.exe	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Caebma32.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Aadifclh.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Papbpdoi.dll	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Qgqeappe.exe	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe
File opened for modification	C:\Windows\SysWOW64\Qnjnnj32.exe	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cfpnph32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
880	1472	WerFault.exe	121

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qciaajej.dll"	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfgfh32.dll"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnljnaa.dll"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfhhm32.dll"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooojbbid.dll"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoddikd.dll"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjmgfgdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2172	4656	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe	86
PID 4656 wrote to memory of 2172	4656	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe	86
PID 4656 wrote to memory of 2172	4656	59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe	86
PID 2172 wrote to memory of 1304	2172	Qgqeappe.exe	87
PID 2172 wrote to memory of 1304	2172	Qgqeappe.exe	87
PID 2172 wrote to memory of 1304	2172	Qgqeappe.exe	87
PID 1304 wrote to memory of 456	1304	Qnjnnj32.exe	88
PID 1304 wrote to memory of 456	1304	Qnjnnj32.exe	88
PID 1304 wrote to memory of 456	1304	Qnjnnj32.exe	88
PID 456 wrote to memory of 4984	456	Qddfkd32.exe	90
PID 456 wrote to memory of 4984	456	Qddfkd32.exe	90
PID 456 wrote to memory of 4984	456	Qddfkd32.exe	90
PID 4984 wrote to memory of 4924	4984	Ampkof32.exe	91
PID 4984 wrote to memory of 4924	4984	Ampkof32.exe	91
PID 4984 wrote to memory of 4924	4984	Ampkof32.exe	91
PID 4924 wrote to memory of 4560	4924	Acjclpcf.exe	92
PID 4924 wrote to memory of 4560	4924	Acjclpcf.exe	92
PID 4924 wrote to memory of 4560	4924	Acjclpcf.exe	92
PID 4560 wrote to memory of 3356	4560	Aclpap32.exe	93
PID 4560 wrote to memory of 3356	4560	Aclpap32.exe	93
PID 4560 wrote to memory of 3356	4560	Aclpap32.exe	93
PID 3356 wrote to memory of 1252	3356	Ajfhnjhq.exe	94
PID 3356 wrote to memory of 1252	3356	Ajfhnjhq.exe	94
PID 3356 wrote to memory of 1252	3356	Ajfhnjhq.exe	94
PID 1252 wrote to memory of 1980	1252	Afmhck32.exe	95
PID 1252 wrote to memory of 1980	1252	Afmhck32.exe	95
PID 1252 wrote to memory of 1980	1252	Afmhck32.exe	95
PID 1980 wrote to memory of 4176	1980	Aabmqd32.exe	96
PID 1980 wrote to memory of 4176	1980	Aabmqd32.exe	96
PID 1980 wrote to memory of 4176	1980	Aabmqd32.exe	96
PID 4176 wrote to memory of 4436	4176	Aglemn32.exe	97
PID 4176 wrote to memory of 4436	4176	Aglemn32.exe	97
PID 4176 wrote to memory of 4436	4176	Aglemn32.exe	97
PID 4436 wrote to memory of 2480	4436	Aadifclh.exe	98
PID 4436 wrote to memory of 2480	4436	Aadifclh.exe	98
PID 4436 wrote to memory of 2480	4436	Aadifclh.exe	98
PID 2480 wrote to memory of 2524	2480	Bjmnoi32.exe	99
PID 2480 wrote to memory of 2524	2480	Bjmnoi32.exe	99
PID 2480 wrote to memory of 2524	2480	Bjmnoi32.exe	99
PID 2524 wrote to memory of 3952	2524	Bagflcje.exe	100
PID 2524 wrote to memory of 3952	2524	Bagflcje.exe	100
PID 2524 wrote to memory of 3952	2524	Bagflcje.exe	100
PID 3952 wrote to memory of 3004	3952	Bfdodjhm.exe	101
PID 3952 wrote to memory of 3004	3952	Bfdodjhm.exe	101
PID 3952 wrote to memory of 3004	3952	Bfdodjhm.exe	101
PID 3004 wrote to memory of 2804	3004	Baicac32.exe	102
PID 3004 wrote to memory of 2804	3004	Baicac32.exe	102
PID 3004 wrote to memory of 2804	3004	Baicac32.exe	102
PID 2804 wrote to memory of 232	2804	Bmpcfdmg.exe	103
PID 2804 wrote to memory of 232	2804	Bmpcfdmg.exe	103
PID 2804 wrote to memory of 232	2804	Bmpcfdmg.exe	103
PID 232 wrote to memory of 2908	232	Bjfaeh32.exe	104
PID 232 wrote to memory of 2908	232	Bjfaeh32.exe	104
PID 232 wrote to memory of 2908	232	Bjfaeh32.exe	104
PID 2908 wrote to memory of 3452	2908	Bcoenmao.exe	105
PID 2908 wrote to memory of 3452	2908	Bcoenmao.exe	105
PID 2908 wrote to memory of 3452	2908	Bcoenmao.exe	105
PID 3452 wrote to memory of 2232	3452	Cmgjgcgo.exe	106
PID 3452 wrote to memory of 2232	3452	Cmgjgcgo.exe	106
PID 3452 wrote to memory of 2232	3452	Cmgjgcgo.exe	106
PID 2232 wrote to memory of 3312	2232	Cfpnph32.exe	107
PID 2232 wrote to memory of 3312	2232	Cfpnph32.exe	107
PID 2232 wrote to memory of 3312	2232	Cfpnph32.exe	107
PID 3312 wrote to memory of 4852	3312	Caebma32.exe	108

C:\Users\Admin\AppData\Local\Temp\59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe
"C:\Users\Admin\AppData\Local\Temp\59460858fa0de2a355b1246b9b7806f7cb8d1ec6daf4f7e972178dfe1779ed6e.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\Qgqeappe.exe
  C:\Windows\system32\Qgqeappe.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\Qnjnnj32.exe
    C:\Windows\system32\Qnjnnj32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\SysWOW64\Qddfkd32.exe
      C:\Windows\system32\Qddfkd32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:456
    - - C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4984
      - C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3332
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:728
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3040
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3880
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2476
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4000
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:384
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        35⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 408
        36⤵
        Program crash
        
        PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1472 -ip 1472
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
101KB

MD5
07d33085ef7b7924472761d5d9806e07

SHA1
bb6cfbb276935a7d1b39bd2e5b192234e0a927a5

SHA256
57b972b6c6b4b5ad1a87825bf8aa003769d42bba6f4789e3bc0826471ae34eeb

SHA512
6e8354c58199e99205937fbfaefe126961baadd1ffb6242d296802f732a19a9f257c0c01d862fdbbbb5c7a229d5e3c7c125e27835223f9ed5c11abd68d431e66

Download Submit
C:\Windows\SysWOW64\Aadifclh.exe

Filesize
101KB

MD5
f5278156c2580af5ecbe7bb4400ba671

SHA1
b8489c504c6f4414bbb364f95b9dd3c778230e49

SHA256
a4876a90861b35b6c36865753cdb762908c8e21d5be31d7ff32d15dbe80fe093

SHA512
0499e819b4e1f287fba820c404e7d539b25fc2fef4cf80dbbbebbe35d5a9290c3b43892e041eaa512b18cd3180446d4636d9f27d20fef05f40d3f7c23683e3b6

Download Submit
C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
101KB

MD5
c838977af6144ba0e3210fe3914b4e14

SHA1
d45aab2468a6a725718eb595314996014182207d

SHA256
b9282b4440881e20be0160ec04d425cb32402639bc5709931c816a8162038a8d

SHA512
1d07548fba19aa66821d614814a26d393ad97ef25796669dd8616182f281cafb77f2c09dcd812a5fd20973758dde314791dbd8b1c4e2e6f955eb563a5067d53f

Download Submit
C:\Windows\SysWOW64\Aclpap32.exe

Filesize
101KB

MD5
af2cf9aa8ebb80dc4c32caaecc99f8d7

SHA1
0477bc6c83b49a6c10bd450a8b6d013e23ee3f4d

SHA256
e5bc809c14355af4f6e707abd422c9a5328cb45c1b15957547311cb2453b6703

SHA512
4744a827c634a4371a5e0c78ec20a9c70e10e22bc0534ecd6334cfae5c122dacdcb2d072432e92be4e3b18d1850f0e30dab7cc2a8cd003a76d0edab9a3251ce5

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
101KB

MD5
89c368e3c914001f728706f56835c1a5

SHA1
c4dadeb9af2bd36667a1f984516584c49fd4bcb7

SHA256
ce7733bbadf1ca5fe2396452ebfa25462baa3b6e720fc409bb39e28ed98938e9

SHA512
6b9f3921bf667644944d1b5539f1c31bae9e9f18a9027595935e298223ff7ebafd961951c475ba8acc552f8d50e7dd1a179b82cf991d1caffb17322802600a44

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
101KB

MD5
a6a520808639f5aad23478a8abaf7c37

SHA1
d120dacc13471890522fcb38082a3dc21c9e0adb

SHA256
1e6112dbeba291bee88685f832feffc24a0688b162ff482f70e6961ca29cca32

SHA512
54f56ef68bcfdd6fd51389e56b197aa8ccce3f4ad026c1a53cadcaed5a76df18e5864db294ddd762d429ad9971574cf64c0b837134b74fbd4e2f25b7187bb2c5

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
101KB

MD5
68aa20a3bde8fd115fe58be9dbe1ab6c

SHA1
1d5578cbf0ed597057fcd3c9fb30704f0fd62178

SHA256
967ef8ae14cc35395c431750eece7ba24b1e6761f14088d9066c1c78e7539cdb

SHA512
abe75d2728ed7991952fb7276002a2396ef5176af8a8e4bc6f81bea457efc86a67c589db6f21284ae87c67f34057239158674a09ec0c3ed28e60f799858b61e1

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
101KB

MD5
84d48de0112b7ec62349ff7ff1b5d0af

SHA1
69f3da1b1c1cc30cb8708afa657283abc331bc95

SHA256
d3aa74511fe763f25eef65f1dd435d3668c2381c0562bed1c56844ecc1be2098

SHA512
f7d8c41eb560fd4921b24330ca5d63942d703060d51a146b5be976b005efabbbea9b35d63b6c300d4f1b0aa0e2bed9b10367782b26201b50057e8fb45a572fbd

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
101KB

MD5
e4b84780c0e98c74e92d4cd97a5c087e

SHA1
6437beea2f754497f5fb8be3209fb5ff7b8b0a66

SHA256
c655c049e4ab3223a82760042f1d3999e685e23b2f5b49c2cac008081e189271

SHA512
9152bcfb8961574518f7c8898fc487de380a7f2d2a4761238e1a35f02589e4c02423392f6b8bf29055cd6d43dfef3f3ff5a82f9392f3c1cdc3e0d98a68525f22

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
101KB

MD5
c31d7ac034cf522836a362966038abcd

SHA1
d9790a13ac8b05fa6c028582bf9b70d7cc7df777

SHA256
0b02165b7c1a729652ced17d67e94fe9560bb6d1b08694519542803369fd0597

SHA512
c8ca8b623e0881ed143157e73f4405af5e8b9e51af6aeb0764e954f6b4f13959e7c2bbb1afa3d16f3c6a0c2991355589cf25132b7f75e24a4515fffae65ad27c

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
101KB

MD5
cd79f1c45d000560027138e7d0efb51c

SHA1
a521ed6b1b67b55b5f3fd5c2f015ef94b128fe2f

SHA256
9b27ca29067b9d92e51d6f8bc34f0fa7470c44c478dfee085201f6091013beb1

SHA512
6ebc5a643f5ae373c2bcfb934e3953461076baf7f5c90f168fe7ca545af2c3b3771a6c36a71f9809a7ed7559abe44f69ffc872ff8fc885db83a47ce3b6757fec

Download Submit
C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
101KB

MD5
d5b4b31db4808837b8840ad9cc08c4cb

SHA1
d9205283e15c66bef5d22c9a73b0deeae11f8ee7

SHA256
72cbf7f6f77a4ad0e19717d64bac81d343a9517127bcb4fd6f4d92b8fa00794e

SHA512
9909981844d4cfa9762da17bed3d1d8c2ab3f2c58f41092350643eaf2168a1bbac4bd3929ce893ede124a838e7a8b60c775518b7d1395761b39753239c961825

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
101KB

MD5
d6beeefa2b0dc34e2ec2b58437b8b955

SHA1
96f6f9d2fae519949ad73f8bf4a4d3bad44616da

SHA256
417ae43234c04eb56cf1fc1f6b07164ee2df1be90619c4478c5383fa6e235f7a

SHA512
5c0e4115b61e353fd9a1f41b8e7db090c60c5b4b3bc89402f36e0ce6069d03eb856706727c19258b1edabe177fcc83271265c4b3ef1d9acf216bd50470e9f82b

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
101KB

MD5
ef029393b291b76a66d6091df27398a0

SHA1
8e86cee42feeda7a07e65d21aaba1b5fcec75cae

SHA256
9acaa1bf3e905fb8c4dd5f3a77afc763b6da23f5e2a311ac6b36fc97d0ba7084

SHA512
71165824cf3b78f13ad6731e10b9c1fdabd7ec9c3881e754e7d9f1a9e29093486e1a01069922fd6bd370f68f29d435381c58caf144dce8989bc54dcc4642b681

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
101KB

MD5
3352802b75a6661d409e2d3fd16e0379

SHA1
6e00de2d5b9e7eb52479678471a1c6fc88c8212d

SHA256
ac99eb601f840710fbd40e97b9dbdee553a857bceedb1210421e5662fbed31da

SHA512
ab0d01602d5a10d80e2c75250a238fd23d235e9c1609beeebfe5089a2f9863f93505f81f42187bcb8152be8f50b4dbb4d67eed82744ebbf9c0db94fafbfba780

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
101KB

MD5
c8b8622d57fd0b43ae5ca44ad2ab86fd

SHA1
493b5cbc3cdd230f7e9e03141fdbae7966e2987a

SHA256
705ed5291cb0f1bfdbec395a6fb305d741e1e38e60c4f1345964e49e774141e4

SHA512
558c9969629b059bca30f97cc19960223ae1235eb04aace5c8ddc69fecb652c631a3f08ef96588944155f5d2d4ea1ede36baf06f725602008e5f494660200186

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
101KB

MD5
667a8963c6c6a405f0c52c339f4ddc8c

SHA1
a8fed0e30e15b0ce357e09ed4ce7eb24b67d256d

SHA256
7e876dca5c71c60f154c57189457fcc372e373963cf90934d6ceff59a1aa6fc8

SHA512
68ff8ae6554d224e3c22dbdbfeb155b41ce582e13b1da5e53e11f61231d080d7760c685f70a05101461cf35eb61a29a2dc0be236d95d93b8b85048fcb129fc15

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
101KB

MD5
25a87094af41ff39a672ba50d8a679c4

SHA1
7c54f59a3f33e2314f462f40f627a5c7bda414f2

SHA256
ca988d45f9332dbdf2763418c1ec1ac0a0fb40cd2070f8a367754d89ca8ba215

SHA512
cae3bd8437560b527180b8cb291f8ecd52a01de54ca05f461c0a99fdac062a8664bb0d5535244e3061ba1c63358346d2379d6f0f14c98944678e3c1d5c12a7ce

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
101KB

MD5
240495f6b58556bd2bac260cd2a4c7ad

SHA1
38e73a5461d819ce914676b400a7f5694a1a0c98

SHA256
f49d2fbffc4e4e93c4c26c2f0497bf3d5ec7387c38b4044a364526931d7325a9

SHA512
472edbf269aa4918d12f262871cee26618314e43012a1a01a8b7a6d913fda6ebb2496d5d495a3ede910937a6937c931507b23f77196addc903734f11b418a635

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
101KB

MD5
9d6c92633ab62a3615f29cf61ffbd31e

SHA1
f008542e24c49a48753da7d69ce86519d41fdf89

SHA256
96c65662664a41b89c289193b6c9edc1ad7a8ae2c1516b8a9d1f89cda818f035

SHA512
e3b3429d30d2811e81c952132ba5b8336fe22625577b15e847fc3846147e4752bb55627954818308c50d457031ee2edeb88a16674bbbe6b0471a18ee3c1b34e5

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
101KB

MD5
a5ee26954b175605875d43354b14aa1c

SHA1
f09891a350b782f047a9aad192fd9b7e969a7777

SHA256
a362599ed5f5946622b1e62f7d362fee2a709f2c388cd411089595d3206ff13d

SHA512
52429da9bc68e91bc81773a01ef086e09f6fce2bfb0e35ec221d41ce8564921c2467f95bfffbc2ba5b789d2ffaf464903be3b7e7178f40015af50428ca2803c6

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
101KB

MD5
ec2139525d77a334e0913b45a4d6ef71

SHA1
17b025ba8c35558978681790e6d387b0b709562b

SHA256
b3b537c9f162fc85e7c1771c267e7a85e86fe8f88942a4e145867e25ab9b262a

SHA512
fe995179da06a66d39ba66505afc1c6e4660e2d7eabf2ad63999dfc67e2348873126044b61665c8dd7bbe705cdf233d9658fa4c60cc0dcc0ff842e2aad7826c1

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
101KB

MD5
a040e3dde6ade643dd9241aead19f944

SHA1
0d4b328efd4f7910961568c417ac135de12028f5

SHA256
b2e5b724c1d6beec042421b527c28d1927c9eed984f68f6934f4642faef6712e

SHA512
74bf1567b6d28bbf02405105ea94ee88e7f540e96378c75cce2233c366f2b1193723eb923bccb8a8abae3b20c61b97e1a09123678da56b041a30d5ec23d784b8

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
101KB

MD5
7b460fe0b443f425ab37e2553ecbc404

SHA1
fb8b558cc177352f4c3a2f87d1cce3075af759aa

SHA256
db1e133654326b1967daa4f81d47d134265e814a590c779e71d111d7645dc7d2

SHA512
3eda8f29db760d22a63c9ce6582f4b19c6071f6e5dced992e40d6730ca54f7746b382e9a86a3496e599aaf2fab0b1d36f1f27121a4c8bf997b5201594ad11db4

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
101KB

MD5
de86e7e55337a4858728249014516ac9

SHA1
4fc59672eb91d579125c5a9d9bc26d0dcb29091b

SHA256
d4204236547c0f80f0db9ff63fd2ad1bb7f77bcc0bbe405a1879d926db8caf61

SHA512
5480ca661464a4244fb35552ebd24872ddcd5881ee679717a8a7771ae766211b171f92e87f273a0bf95d8b3e2d03e8a83be3814fcf3dc279042c80640d587b0a

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
101KB

MD5
f2ae4def125c8e572cf75a61819331c4

SHA1
209f99bdf904ac3f1192d12cc2de28d05cd61a71

SHA256
dcbd1fce54869279788a59fb405b8f15f33869af681da19f70abf4550f847416

SHA512
25f133e7715c327d9b418f3fd43c5585a1f59dab7c7cf84a3fc1867d855f7037700df5b7f1fbca443735083bb5a50d59cc2bdd6215a63ced439b5517003ed6fe

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
101KB

MD5
435b7b3491f0a82a22a873037fd37000

SHA1
df64a972cfcd3d7058b491d2e241068f611d8bec

SHA256
7459123390509ff81062d4ba423a2307bbbafca253c021bf67cc34f3916b2058

SHA512
87629509fe1587387773978d030d7dbcaa4812849ba53343856ab9aa85528f44095a2700c8483310bbcfc2e58a67d74908f2f6b00b44586bcbf0331f4502c274

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
101KB

MD5
17683354d752e6ee23a2a5af62a69a01

SHA1
277ba84ddc723e33aec4f1143dffb9eed1e2c470

SHA256
4189ae88e7608974475df4b57e51826de01ee031800cd2c3025da4b15c758c73

SHA512
7e2e49144817589bf3483d0e70116cb20de00b1090a7b9e61e1d2ae37705fc5a2ff7d6cf672db5ef11c5cb01872c168e3b8590b9f09be60b33a143448411b665

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
101KB

MD5
8f165b897df210dad8d0e75a3bd70c48

SHA1
412649883b144da06718f5f2035dec065b54c280

SHA256
0a14ac01e61886dd54247cf9f660484d5ca241127e1ab4c65772060e90410f35

SHA512
302f0e127df43ade123a7988218d4797c70ad66eebf63d403fc2add9d6d41c93ee62d800687c7dbf61488affa0315e33e1d3d67e875f7387a389e0974aa5405d

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
101KB

MD5
cc19b4ba96122943c27a75e04c1f50c1

SHA1
3acaa1f0c6f69fd10a4e5e12edccc05d8c12fc2c

SHA256
bff7843ed18b2ea23803cf44224ae95146fc13a264148451398e8e1b8f8e2c4f

SHA512
cd3a11eeb6f7a87fc30e7a8716e947f3ee86f66f2a314ea22389ea2bcb219dfd392e3122e4b4c98cff8a824c860d81156c632928b2954d8389eb5e1e74139eaa

Download Submit
C:\Windows\SysWOW64\Hmcjlfqa.dll

Filesize
7KB

MD5
82b19e0ff6b25bce3e8f56cdc6279f1a

SHA1
a53e4530e42630c6e956254861179d1d0cff0647

SHA256
2476e3bc0254c7604b34a6ca8a2bf7c82c72845137b46649fee3e5ddee9e9de0

SHA512
1d46e2a5cf451d545f85a67ab78e1c546240d6a232bf861bdb1c5876e265a742550b3c4998751168778e9fd52582dcc748f8014e4eded1267ec98823c58c3766

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
101KB

MD5
63c96dae065c61ccef987ea2f6ba1614

SHA1
45b4ce968ab1bbda277a77e4d3bb12e514cb7039

SHA256
38208b25712bf6a8740c9fb1e0e288be0a7139d19114e1dcbfb683696394c678

SHA512
8377d4acf85d4e0192ed7a32203b9bbdba9108309a3fd76630c74192777af6b0c80e3ba6a3288fa68c3e358e3a84785d060bf878cfcc6ebc48d20c44cc375c2f

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
101KB

MD5
388fbfa89158c9e748e7323ebab032ae

SHA1
4f447be0620d3657b63631fe3ea1fa99bb4d8377

SHA256
525b67a0375259043182fcf50f015cbf42777c313e16c79ff1ea4c81f668f6c6

SHA512
eaeafaaf488caaf7acf349de6c1917acc08bf2fe4a7357902bbee3169d8977f97072285084b0b658175da668a8d222df5f3d80f0df6d522fad952aacac82f75a

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
101KB

MD5
2b3c82eb6f0dc965f58a65b8895086e1

SHA1
7ffede63a40c2cc5d5549d522b7c959487fc3810

SHA256
e93dc8c177fe02407eead280829d683c44aec52db16d503db869876bc1f3b0b6

SHA512
4f2dd94ba46f4547af6290bb8b4088696920bf49f9b7c25f564895ff54eb444d33bfdb70719c3c743602ecd4d8bb776ca2c8aeea7c2d948ed2ea159e4b6355de

Download Submit
memory/232-285-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/232-135-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/384-262-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/384-270-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/456-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/728-276-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/728-207-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1252-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1252-294-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1304-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1472-268-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1472-269-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1976-277-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1976-200-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1980-293-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1980-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2172-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2232-282-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2232-159-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2476-272-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2476-252-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-290-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-96-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2524-104-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2524-289-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-128-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2908-143-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2908-284-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3004-119-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3004-287-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3040-275-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3040-219-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3312-281-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3312-168-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3332-192-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3332-278-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3356-295-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3356-56-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3452-152-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3452-283-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3852-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3852-280-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3880-236-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3952-112-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3952-288-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4000-271-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4000-255-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4176-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4176-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4436-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4436-291-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4492-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4492-224-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4560-52-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4560-296-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4656-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-176-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-279-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4888-273-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4888-240-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4924-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4924-297-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4984-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads