29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c

Analysis

max time kernel
115s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c.exe
Size

109KB
MD5

1a810fa9c6962174ba77dd3cf502df69
SHA1

9ef06307f030290183a6aa579cb920a3ee115044
SHA256

29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c
SHA512

d840f41e1ca5e774c492eabcd743e0e6d962c6942689954bfeb677d8d191c75c25e6d9b5b4d74b772ae8850a4a5aa2fa2712ceb49a7746e04ea449cc897012b4
SSDEEP

3072:5r1RjGdkw8ndHDSP5NvFJ93LCqwzBu1DjHLMVDqqkSpR:FGf8n2pJ9Lwtu1DjrFqhz

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilghlc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimekgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpoefk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nngokoej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npjebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcppfaka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oncofm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nphhmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndhmhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilghlc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jifhaenk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibpda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhhnpjmh.exe

Executes dropped EXE 64 IoCs

pid	Process
3572	Ifgbnlmj.exe
2328	Ifjodl32.exe
4864	Ilghlc32.exe
4812	Ifllil32.exe
2696	Ilidbbgl.exe
3796	Jfoiokfb.exe
1884	Jimekgff.exe
2080	Jedeph32.exe
1552	Jcefno32.exe
3884	Jplfcpin.exe
2264	Jmpgldhg.exe
2216	Jifhaenk.exe
3744	Kboljk32.exe
3140	Kdnidn32.exe
1836	Klimip32.exe
400	Kfoafi32.exe
4580	Klljnp32.exe
3780	Kedoge32.exe
4412	Klngdpdd.exe
3688	Kfckahdj.exe
3240	Kmncnb32.exe
828	Lffhfh32.exe
1580	Llcpoo32.exe
3664	Ldjhpl32.exe
3648	Ligqhc32.exe
3220	Lpqiemge.exe
4228	Ldoaklml.exe
1612	Lepncd32.exe
1620	Lgokmgjm.exe
4292	Mdckfk32.exe
4704	Mipcob32.exe
4692	Mibpda32.exe
432	Mckemg32.exe
4072	Mpoefk32.exe
3428	Mgimcebb.exe
5020	Mlefklpj.exe
4548	Mcpnhfhf.exe
4708	Mnebeogl.exe
2504	Ncbknfed.exe
684	Nngokoej.exe
648	Ngpccdlj.exe
1816	Nphhmj32.exe
1532	Neeqea32.exe
4540	Npjebj32.exe
4440	Ncianepl.exe
2072	Nnneknob.exe
3632	Ndhmhh32.exe
4044	Odkjng32.exe
2368	Oflgep32.exe
4224	Oncofm32.exe
4428	Odmgcgbi.exe
4416	Odapnf32.exe
4340	Ofcmfodb.exe
3236	Oqhacgdh.exe
4092	Pnlaml32.exe
1280	Pdfjifjo.exe
4460	Pfhfan32.exe
3176	Pmannhhj.exe
2928	Pnakhkol.exe
3216	Pmfhig32.exe
1384	Pcppfaka.exe
1116	Pdpmpdbd.exe
5156	Qnhahj32.exe
5216	Qdbiedpa.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Glgmkm32.dll	Ndhmhh32.exe
File opened for modification	C:\Windows\SysWOW64\Qqijje32.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Djkahqga.dll	Kdnidn32.exe
File opened for modification	C:\Windows\SysWOW64\Kfckahdj.exe	Klngdpdd.exe
File created	C:\Windows\SysWOW64\Mpoefk32.exe	Mckemg32.exe
File created	C:\Windows\SysWOW64\Pcppfaka.exe	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Jpcmfk32.dll	Pcppfaka.exe
File opened for modification	C:\Windows\SysWOW64\Acqimo32.exe	Amgapeea.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Jifhaenk.exe	Jmpgldhg.exe
File created	C:\Windows\SysWOW64\Mnebeogl.exe	Mcpnhfhf.exe
File created	C:\Windows\SysWOW64\Hlfofiig.dll	Nphhmj32.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Acqimo32.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Pkmlea32.dll	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Klimip32.exe	Kdnidn32.exe
File created	C:\Windows\SysWOW64\Lpqiemge.exe	Ligqhc32.exe
File created	C:\Windows\SysWOW64\Ldoaklml.exe	Lpqiemge.exe
File created	C:\Windows\SysWOW64\Ikkokgea.dll	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Mibpda32.exe	Mipcob32.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qnhahj32.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Jfenmm32.dll	Mckemg32.exe
File created	C:\Windows\SysWOW64\Neeqea32.exe	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Ilidbbgl.exe	Ifllil32.exe
File created	C:\Windows\SysWOW64\Fojhkmkj.dll	Ligqhc32.exe
File created	C:\Windows\SysWOW64\Odmgcgbi.exe	Oncofm32.exe
File created	C:\Windows\SysWOW64\Oqhacgdh.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Hdoemjgn.dll	Pfhfan32.exe
File created	C:\Windows\SysWOW64\Hmphmhjc.dll	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Ligqhc32.exe	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Pemfincl.dll	Ngpccdlj.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Odmgcgbi.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Aadifclh.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Lepncd32.exe	Ldoaklml.exe
File created	C:\Windows\SysWOW64\Mgimcebb.exe	Mpoefk32.exe
File opened for modification	C:\Windows\SysWOW64\Nnneknob.exe	Ncianepl.exe
File opened for modification	C:\Windows\SysWOW64\Qgcbgo32.exe	Qqijje32.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Anadoi32.exe	Agglboim.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Kmncnb32.exe	Kfckahdj.exe
File created	C:\Windows\SysWOW64\Madnnmem.dll	Lffhfh32.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Kfckahdj.exe	Klngdpdd.exe
File created	C:\Windows\SysWOW64\Eohipl32.dll	Neeqea32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6600	6508	WerFault.exe	216

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inpocg32.dll"	Kedoge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndqgbjkm.dll"	Jmpgldhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdckfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oicmfmok.dll"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Madnnmem.dll"	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkmlea32.dll"	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mipcob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edgbbfnk.dll"	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnlaml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jimekgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdjlic32.dll"	Odkjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ambgef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cenahpha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benlnbhb.dll"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiopcppf.dll"	Jimekgff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmannhhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjegoh32.dll"	Nnneknob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oncofm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 3572	3928	29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c.exe	94
PID 3928 wrote to memory of 3572	3928	29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c.exe	94
PID 3928 wrote to memory of 3572	3928	29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c.exe	94
PID 3572 wrote to memory of 2328	3572	Ifgbnlmj.exe	95
PID 3572 wrote to memory of 2328	3572	Ifgbnlmj.exe	95
PID 3572 wrote to memory of 2328	3572	Ifgbnlmj.exe	95
PID 2328 wrote to memory of 4864	2328	Ifjodl32.exe	97
PID 2328 wrote to memory of 4864	2328	Ifjodl32.exe	97
PID 2328 wrote to memory of 4864	2328	Ifjodl32.exe	97
PID 4864 wrote to memory of 4812	4864	Ilghlc32.exe	98
PID 4864 wrote to memory of 4812	4864	Ilghlc32.exe	98
PID 4864 wrote to memory of 4812	4864	Ilghlc32.exe	98
PID 4812 wrote to memory of 2696	4812	Ifllil32.exe	99
PID 4812 wrote to memory of 2696	4812	Ifllil32.exe	99
PID 4812 wrote to memory of 2696	4812	Ifllil32.exe	99
PID 2696 wrote to memory of 3796	2696	Ilidbbgl.exe	100
PID 2696 wrote to memory of 3796	2696	Ilidbbgl.exe	100
PID 2696 wrote to memory of 3796	2696	Ilidbbgl.exe	100
PID 3796 wrote to memory of 1884	3796	Jfoiokfb.exe	101
PID 3796 wrote to memory of 1884	3796	Jfoiokfb.exe	101
PID 3796 wrote to memory of 1884	3796	Jfoiokfb.exe	101
PID 1884 wrote to memory of 2080	1884	Jimekgff.exe	102
PID 1884 wrote to memory of 2080	1884	Jimekgff.exe	102
PID 1884 wrote to memory of 2080	1884	Jimekgff.exe	102
PID 2080 wrote to memory of 1552	2080	Jedeph32.exe	103
PID 2080 wrote to memory of 1552	2080	Jedeph32.exe	103
PID 2080 wrote to memory of 1552	2080	Jedeph32.exe	103
PID 1552 wrote to memory of 3884	1552	Jcefno32.exe	104
PID 1552 wrote to memory of 3884	1552	Jcefno32.exe	104
PID 1552 wrote to memory of 3884	1552	Jcefno32.exe	104
PID 3884 wrote to memory of 2264	3884	Jplfcpin.exe	105
PID 3884 wrote to memory of 2264	3884	Jplfcpin.exe	105
PID 3884 wrote to memory of 2264	3884	Jplfcpin.exe	105
PID 2264 wrote to memory of 2216	2264	Jmpgldhg.exe	106
PID 2264 wrote to memory of 2216	2264	Jmpgldhg.exe	106
PID 2264 wrote to memory of 2216	2264	Jmpgldhg.exe	106
PID 2216 wrote to memory of 3744	2216	Jifhaenk.exe	107
PID 2216 wrote to memory of 3744	2216	Jifhaenk.exe	107
PID 2216 wrote to memory of 3744	2216	Jifhaenk.exe	107
PID 3744 wrote to memory of 3140	3744	Kboljk32.exe	108
PID 3744 wrote to memory of 3140	3744	Kboljk32.exe	108
PID 3744 wrote to memory of 3140	3744	Kboljk32.exe	108
PID 3140 wrote to memory of 1836	3140	Kdnidn32.exe	109
PID 3140 wrote to memory of 1836	3140	Kdnidn32.exe	109
PID 3140 wrote to memory of 1836	3140	Kdnidn32.exe	109
PID 1836 wrote to memory of 400	1836	Klimip32.exe	110
PID 1836 wrote to memory of 400	1836	Klimip32.exe	110
PID 1836 wrote to memory of 400	1836	Klimip32.exe	110
PID 400 wrote to memory of 4580	400	Kfoafi32.exe	111
PID 400 wrote to memory of 4580	400	Kfoafi32.exe	111
PID 400 wrote to memory of 4580	400	Kfoafi32.exe	111
PID 4580 wrote to memory of 3780	4580	Klljnp32.exe	112
PID 4580 wrote to memory of 3780	4580	Klljnp32.exe	112
PID 4580 wrote to memory of 3780	4580	Klljnp32.exe	112
PID 3780 wrote to memory of 4412	3780	Kedoge32.exe	113
PID 3780 wrote to memory of 4412	3780	Kedoge32.exe	113
PID 3780 wrote to memory of 4412	3780	Kedoge32.exe	113
PID 4412 wrote to memory of 3688	4412	Klngdpdd.exe	114
PID 4412 wrote to memory of 3688	4412	Klngdpdd.exe	114
PID 4412 wrote to memory of 3688	4412	Klngdpdd.exe	114
PID 3688 wrote to memory of 3240	3688	Kfckahdj.exe	115
PID 3688 wrote to memory of 3240	3688	Kfckahdj.exe	115
PID 3688 wrote to memory of 3240	3688	Kfckahdj.exe	115
PID 3240 wrote to memory of 828	3240	Kmncnb32.exe	116

C:\Users\Admin\AppData\Local\Temp\29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c.exe
"C:\Users\Admin\AppData\Local\Temp\29d427c342d5514a4c9ecd932df4773133b7586353c41e04ea9e715c3a6ae00c.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\Ifgbnlmj.exe
  C:\Windows\system32\Ifgbnlmj.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\SysWOW64\Ifjodl32.exe
    C:\Windows\system32\Ifjodl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\SysWOW64\Ilghlc32.exe
      C:\Windows\system32\Ilghlc32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4812
      - C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:828
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        24⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3220
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4228
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        29⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1620
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:432
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4072
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        37⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        39⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2504
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:684
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:648
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1816
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4440
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2072
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3632
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4044
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        50⤵
        Executes dropped EXE
        
        PID:2368
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4224
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        53⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4340
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4092
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1280
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        60⤵
        Executes dropped EXE
        
        PID:2928
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3216
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1384
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1116
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        66⤵
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        68⤵
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        70⤵
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        71⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        78⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        79⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        81⤵
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        82⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        85⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        87⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5584
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        92⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        94⤵
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5920
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        99⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        100⤵
        Drops file in System32 directory
        
        PID:5656
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        101⤵
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        103⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        107⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6096
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        112⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        114⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        116⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        117⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        119⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 416
        120⤵
        Program crash
        
        PID:6600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6508 -ip 6508
1⤵
PID:6572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5108 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:6340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dndgjk32.dll

Filesize
7KB

MD5
d413bf11aab4b0c918367480bf3bbbfe

SHA1
ed025dee7241892b0076a7de70894a6beaa12406

SHA256
3337ee26a81bc1524cb82a02755980b88c87ba740e3a2cb7b995d9a8b00d44ac

SHA512
6da21e1f19693ef672e62e22a5522d7b139c561cdb1d71b1b58c5c87ba861fc7e5212e66e939779dc39258e468c957546e59ca336a3a7a988301100116284f03

Download Submit
C:\Windows\SysWOW64\Ifgbnlmj.exe

Filesize
109KB

MD5
070f31052f8a1970603251aa6f05ae6b

SHA1
5d8185a94cc311bfe817d4fb3def6547dffed732

SHA256
652ab61eb81cf4c528d149813fb418842b015321a508c7f6d47721522fc37399

SHA512
d388da4aee822db55c381cce3be8c8608f645dbfdeed5edb85697a5bf21426ab20d72e3cf8c229926f3120de98614f2365a276c3169f6e84d7d410861a4236d0

Download Submit
C:\Windows\SysWOW64\Ifjodl32.exe

Filesize
109KB

MD5
702391212246a71c15fef223c7a0326f

SHA1
89d6022bed8846eb7ac3bab612e8a4fe4d56d101

SHA256
377ab5ad587ef823ff17b6325634523b8c458eb369eac808e4ac051dd48288ea

SHA512
66af32cf4f8988e9f5717cb141f212429f9277a181768558cf22fd7a9663138c881f5e49f690e1108d3cb26393962771742a3dc384e1458ca39eb5b4c1308353

Download Submit
C:\Windows\SysWOW64\Ifllil32.exe

Filesize
109KB

MD5
09d14e8cbbb9b192f62cc38517b9817c

SHA1
c3bb6972695c02b5cc32c6e6062e073e39f16829

SHA256
8ab0b57fe9494d5a221de556df5d9a933475d3d5a8ae812cfd054ab2a162b545

SHA512
bf598595667cd88ff8de6d78ef218f3a0b35a0e0a3ca5b9f74e9b6a69ba18295698772160bb47ab02b60dff593711f494de7e514b4a142f012f0f324f9bc4883

Download Submit
C:\Windows\SysWOW64\Ilghlc32.exe

Filesize
109KB

MD5
cefa6fcffd29a8d067175bbd6127dc41

SHA1
87b4abe6b1a409c3820f4d793c2cd333ce7f143d

SHA256
3fc0a478b05b1ece5e0f330f6fced1d1a613948b4bb623bc4c7631b850b46038

SHA512
24eced4045dce4dae9388e150ed3a04b49788b2434820e0df26bf629511835507d2026570047d748bbfd4eb3875aa10c02abe36862f0447710d90c3fee28574a

Download Submit
C:\Windows\SysWOW64\Ilidbbgl.exe

Filesize
109KB

MD5
537b31732f72d73ffd0fc52ad29e3306

SHA1
8e468ed76aeb933fae6399696c847442caad997c

SHA256
5bea2029cc1f34d7d1ac57f592f1657341dc6a698b54fa7d2cfb7a6f664724b5

SHA512
14b7a8a35dd23e4af3bbb490e57efb6699ea41e43b80aa5dbdf32f4a070bdff128e42e654f6e25d04f7f1c64c48377687d1dcfe704b13631fcce0e76e996df3f

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
109KB

MD5
067626b844706376452015efddd89d70

SHA1
13383c5c2f0db575a96e71f1907bc0dfd2647338

SHA256
75546422bfa40c79c88b6d9db6accbe04e69c256b3434ae464bdd4d7433bd76a

SHA512
750e164c0c2a19d233ae2dcbba539e1ef47ecb2aac2f0f6fb73f2a6c1f9c0f3e8ba74917c4f00c37f39093521472b41f4a339808521665bfa36493296a33e32a

Download Submit
C:\Windows\SysWOW64\Jedeph32.exe

Filesize
109KB

MD5
aa84204a98434db42c3aba0cdfa738a0

SHA1
d8e08d3a5cdebd167a3ad18e1121ff3d6d260b7a

SHA256
650c40de04d7a8a70f4ef1f60772b9a7f57c38403570060692e41fbfe6194092

SHA512
66e5df7e22f32b3f62f34667b2172b506a72b287ea8a5af353ff1d36ad4ef88f118291c1fb2e335b6cbba4e1ab697861cd2cbaf7a2d2eacfd16605ae9594e397

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
109KB

MD5
331b6e6d5ebd7513acab713fb2a9ca32

SHA1
051691361881d99aa6ec22e42c5201d39b318a2e

SHA256
bc0be0536e6c86d452772ef286a576ac45a0d216d5b85edff3da1403f65d8aed

SHA512
305883cf0fbcbdbfb99b78cf7b811f46a48fb13ad7274af12f87b88358334b147402be3972a58242532c630dd3f5c7337ea479bc65311ccf42396e51bb32c447

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
109KB

MD5
adef1169fa9d43e0dd4bb2263cbef60a

SHA1
cff69f41505778a6f3d794eaaff97f507b86a5da

SHA256
d7e847cc75359285c979bd6ac4d3d1767c31541b0c3a22e4c57b07faa8f17233

SHA512
6c7854d37dc0cd299fcc7bb0b39f67d934e71fde8af0168110c6048086605cfbf714a395371da77f74a10d1ed5c257c2167d1c6e1155e627f82a95425302e96b

Download Submit
C:\Windows\SysWOW64\Jimekgff.exe

Filesize
109KB

MD5
ccf2a1d66fe782ac7e2dd4e3dba9291f

SHA1
1eb753d5b9ab234a4bba650c221cdc12bcccef35

SHA256
b38815eecce1c76d4547c5e58be2e7e9fb4a117753c338868b365a07ed337752

SHA512
bdb98f0b00ed449a4b5f42b953dc1735798af038ccbc79a32d716ebef3a1768a718910231db66b6326ca064d2125519a516178c240d4c45103f1c35c52454d3f

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
109KB

MD5
db31f0df1f33a9d5a84d385bb0d9ea28

SHA1
639cee4b52b483a61913096caba43f4550bf416e

SHA256
739271dbda2b1c7bd378e2284a3a21209810049071aecf13deefd874de1119a6

SHA512
9dc4b0dc0d155d1984e64088895bb9a490d548797e3fcbb364f0a2439ed206763a972775de490a44e03f82be999c7e33d6b36fcbbc3302bf2e05680974d374ac

Download Submit
C:\Windows\SysWOW64\Jplfcpin.exe

Filesize
109KB

MD5
21097d287db856e65287d71e8b1431d6

SHA1
d01baf9128d9d21344062bfec9f21c72582eae9d

SHA256
d23c88b47224c8339f5262e047804b60cbc71aac577e2ff6861857fd3030a9ba

SHA512
c692705305a6482b0b568a16f2202be06c858d6e10b1b23e1202808daa1c6a21282e785ce2639c470ce5b8b3c3f1a926425beef39ec0b0e0ddb0810dc64d73d9

Download Submit
C:\Windows\SysWOW64\Kboljk32.exe

Filesize
109KB

MD5
14e75eb4581ea682897086c8addf2344

SHA1
f6ec15dd7a18f9bf396effae3980ffe06c1a1458

SHA256
fa9fd71414ebaeccebe9b172dad808149ac327232cd4e7bae0097963f3a421a7

SHA512
74e661eeb2759f75f34a53ab7a0113eb4f72d95a83dd0c0f805ddef4981c9d41a4df9c537f0b872a395346e87537669e5693042f0771d5aa5d78a055e7c74fa2

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
109KB

MD5
a5220f329e26db8c2b31ecf3a73d10bc

SHA1
e0d50793cf87db4102b56273484b98ea23a3d758

SHA256
994cd7afe935f79576664248e9138fbefdde926e6aabb29ddeca12a49f7df702

SHA512
516aa8671bf3e092ec35e59c59c7b8b60f458cceaeeaf131057231d8877fd81b763ae99fe49094ee0663f2af6bc5455a72ebd784d97d35c8c5342bd09cc02310

Download Submit
C:\Windows\SysWOW64\Kedoge32.exe

Filesize
109KB

MD5
3d7023ac8a9a310445d4e07f1c102749

SHA1
d9af78bbdba0d8ceebfb8deed1b764af303e75ef

SHA256
be687272d2233fc7b4299a130f03ee11877da2a5bde61ffaddc38dbc8c32d0a6

SHA512
d0b342079e39f288bf3e3cbae01deb4165629a4c6484b32291810578e26bd7d23d00c16cf2019ea12a27d6f2161375d1ffe6a2c1ac0b7b7bf7658f9ac6372b83

Download Submit
C:\Windows\SysWOW64\Kfckahdj.exe

Filesize
109KB

MD5
bb66f16663e6547ac9331135a2d899bc

SHA1
57228bab81c51c53548ef5795faea77b02a5787c

SHA256
d4bd0208ca9e1e56f5576d5feb6ed34fa6d78dbd6e2a97e5476eb3e32f9197ff

SHA512
4665109c689e4b0a8e1a2aa6f028e3b827505e6dc67fffc332f66667938edf7358502b4ac0607b5643b436dcc95820d3ffdf64b91987faa541dd45e36c007dbb

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
109KB

MD5
400acaa5761b4dc36e45bb72d3f190de

SHA1
cc135f0b062698b4fde058b6a5c4df3d28b0f49a

SHA256
a0240dac05897edf613bd72ea908dde14e351e053839732df4f4f347c2800b2c

SHA512
0423a09c57b80ee6086f8a2f07c8058bc7ea1f0461c69ce398351e5215f24d2d4b7bb4d886f887291a4dc127b7595334a40998cbaad5f6ac0a8de0618996687f

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
109KB

MD5
938402987eca4f337fb8d25949c89561

SHA1
f7341e689894162ce4c73690d140392c1c1af8b6

SHA256
bd4ea6f1dad710e3b0d2b45b03aebf8469a3bd9ef6b2bc4a7cf312f2ec317afc

SHA512
0e138f7c1c0cc10e42bc582850a15d24fbc9145b199adf996129a99d2f8f553972b6c1777ad6876137d20b1c5274a74aa3c267034210b0fe5b7529d357f89d02

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
109KB

MD5
ea6024ebaf564dd22a73f9cbbbe46631

SHA1
1cc1de1ef9e02c0d46e7640f5b5008c8fc237ee1

SHA256
c85ed136195b8c13269b2c6f24f3f51c507b8d90a34965fcef67aca8d5cb5bdd

SHA512
41801e8dae04d5bcc7aa9a994d2cc167a15d8ea314c136016095f061610272bad714e2b9f836d68c0e16b27b04cfe8f3e9e7897e88d1d8b9c91878e5142b6640

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
109KB

MD5
7cb2a3233f5357c4a73f3b8c2817e390

SHA1
c4481e8e4a917d99f02ad6940197f10ee50a579c

SHA256
4ba0a26a266ab4d323e4d77db9878a557eb3e8252d9dd5147488fb6818278fd2

SHA512
1f748f2137520731fba710b27740950d9d312cd7ac9547153d6adb3073e2511d4df44d6ae62e1dff44b371b1e3ccc55cde30bbbafb55fca480ffcb80d4161220

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
109KB

MD5
3a7cd4aecb8854467c60332cb2ae316f

SHA1
7051ab384ac274cf98ea4ec4b7bb9e60da844ba7

SHA256
70dee5c29c1c84c8a5d272c94cf5f257295aa8105c7c49fb40dcb0f2b61c53f5

SHA512
dc12a0b07a82a78ae8be3cb26dd2a6054729ea914628a0d5536baa782fe027c82a96bb2ddd31892093c87b9171502e92ecfc639acdb77ac25593f6e5ff482bc6

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
109KB

MD5
d5ae07c04ff00dbeb6fe37fa085e0ebd

SHA1
df1a333028ea685fd74a52b8facb727a3fc57778

SHA256
8364860a0d08787d18d0238f65a471ef7d2609497e7b18bdad2897f95c799137

SHA512
1ff286b4ab19bdc061975e83497bc8980aa388f156961daba700dc8f6ffc2c55c19ecd24acf04ab420e1c327889e9a8f7b078540ec05f1c26e72ea6b217c7ad4

Download Submit
C:\Windows\SysWOW64\Ldoaklml.exe

Filesize
109KB

MD5
045e434ef074fd836fffe22c195edc59

SHA1
457ed508c5817bd57562e574c40e06ed1b627a65

SHA256
226f1985d211cda3a80cdd88dd4267bcad9b3e527fccb44cc909deb9ddc10303

SHA512
c29c68f68faf7a5624f671b10ee422311f16215912e8efe06b278890f4a84926c49f4f2d85dec1a59c99c68c7cf9891e6963954b51c836bc2250e550a364e424

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
109KB

MD5
9a6a762899d2aa57c24bdd4cc2c49581

SHA1
d01f7bda309508bd86882e17968482fc58c62272

SHA256
20555b5ad96ae1a936befd299eeeaf80185e60b0baa61036a1cb5d6e401de5a7

SHA512
c58e491eef16fab435a1c5a360b400b169be0376c6fd640d3368433795b8cbfe8fef9e62983d3c300bc52b2f52c354bd4fa3a090b47be2d51e3b712f26faaf0e

Download Submit
C:\Windows\SysWOW64\Lffhfh32.exe

Filesize
109KB

MD5
506f78fb9ddcf5f44cec216169e4eb72

SHA1
95ca249f5c04f52114a8489348754af753ba7fb6

SHA256
d8f1e3616e53f10ed7d2ad3ba7eb0b19718950b5e09b47f6ab344fa608410c24

SHA512
3506b68d677441a3710f7395bb3ed368e8ab5c6397bde4c51f9d20dc228276c8d4327fedeccd4fa5fb86518d5a7abf0b1e705847901e251f27452751cb6f0e79

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
109KB

MD5
f00e278e5380a4b79aeb1b6cfde495ee

SHA1
8c1f72521f0dca1b737a5dcae06c4a5bd024cd37

SHA256
6a3e1e09f543aa31bc55c39cb215fcaa0a0469468218916691547b32aa3c7af7

SHA512
09695021f92ef52d71cc73dd0d4b583d932b8da27ae68d4b7700abc80a01c0092db257d1a1f6bf889d19eb0d4ac8cd1e24350b4d005bfda022e4ebe19fcbfc6c

Download Submit
C:\Windows\SysWOW64\Ligqhc32.exe

Filesize
109KB

MD5
18f402d9b62a320b921aaf843e40ca6a

SHA1
1572bb1224a2b298d1e99b8b9d60f272e1f084af

SHA256
5853d2a4717f8717827d25cd1e7635a157ec94c9f10be2601388a57f0e185d69

SHA512
bd695ece5ddf7fa1cec6c38bdbe267f4de0ae4cf47848445ffeb81c2c1f6d65e430bae0b3f27f8777a684f2c0e3fed687a7b6ae70030cdc6d22e8e3b7396ea92

Download Submit
C:\Windows\SysWOW64\Llcpoo32.exe

Filesize
109KB

MD5
4975729fcad2c5311cae97a9102e07ab

SHA1
8f507ab7dcfd7a080950dd5b3e9eb505b30b2106

SHA256
7bf23ac7446602ba3acfa4be497a2eee4ee9fc6fb9b9b0acd32b1908398e7627

SHA512
55407bf71b075d7ce01e3701258ff2401d39f986ce107dd7a3aa4441f287b531ab80509c9d255424272f33792fa223403d53d4a096fd09b5f968be09a79b9b75

Download Submit
C:\Windows\SysWOW64\Lpqiemge.exe

Filesize
109KB

MD5
2478094f26955aea8096b987476caf50

SHA1
82508f5b52aac9dc91667fdf3d00e08cc5163545

SHA256
f289da83b61da9fd66a8d28f754077156233031434062c6483d47647e10d725f

SHA512
217893c15897f2d7cde5726ca686e731e42ee071bb4a89a826a562b209a03237a803d110615d75427dd504b1a92dd5a6a9c7d312481fa5ef1cadb5b6e09f9f4b

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
109KB

MD5
b25ef976e9c71551a0c4fe9e884a79d8

SHA1
6f1d3f34ae9223c7cc2036a5dcf66e9886ad0765

SHA256
86f3f5f8f3c2acd757a51add050f222d3279aee72557dbe2d9b9931640474b69

SHA512
6f43787fd3c1c60fc635d9f7d1cea748c3dc61a610a67088061fd0e602541742470d74497a0ee9da491cfa9c71bb7c63a58651dfed975428c9d35dda98c54df0

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
109KB

MD5
b0692f1a18da802d9e2856e562447ae8

SHA1
055e488b61fcb60c172fced605077cb1bf44563c

SHA256
f7afff9a2e2216abc5be03f96cc8318ffd6aae41dadf37277df2c8a32018c944

SHA512
d42376e1634fd58122bce28e7849e727b1648f41a91b0608608eba986c5a6239ec198e1cc433006cae82ba69fec21b739cf6c68f03d19a07942e1535f87230c4

Download Submit
C:\Windows\SysWOW64\Mipcob32.exe

Filesize
109KB

MD5
3393b79bbfb46e0e0c0e9a62eb7769b5

SHA1
33d3f6c4a5913d8372ca7e4427324dae3fa70808

SHA256
9a225cbb57f9144f088c37cef8841cf118ca56e592a8dc5cc1410dc14f76e118

SHA512
192b727ed5a1210309c35191d0804f6d26333f35ab1a23b8c94507502b6c8e04595d65d802d9d826086998e460d79ed179a23428b0908c9a9b8f5068da1fdd52

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
109KB

MD5
93bc12335022cd60edb2e56640721f02

SHA1
5a7402349cf056491fbd0105154760aa08e94f8e

SHA256
9027b743fcf60f269c916b2c9ec563f00a26d3012d13f9c71ac22a135e67f700

SHA512
7e087bdccbc9ecb9e81f910ef372579c0544b376060c2295875d00b5a1ce2da7816984e6ba7d61188c393cfabe1d2d1b9c920563b080f90fc720b0336a5d0eb7

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
109KB

MD5
80cf8fd23db4dcd9c364c5cea91a369f

SHA1
9a1d502da6414263cdb7ad84eb9897d6042b5f4d

SHA256
7d97875a2fddc49e32a3418201d79f6b3b9fd3aeb10c6497517b1d4a5e43e319

SHA512
6250f6776b626fc7900ea7729320573f549ff8cc511efc374d1f4b90cd6fd37c32d740e87ec142967f151f1d022dba0572a7bd12226df56e3fda4aeba76fefd6

Download Submit
memory/400-128-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/432-262-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/648-310-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/684-304-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/828-183-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1116-436-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1280-404-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1384-430-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1532-322-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1552-71-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1580-188-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1612-228-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1620-231-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1816-316-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1836-119-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1884-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2072-340-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2080-64-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2216-96-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2264-87-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2328-16-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2368-362-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2504-298-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2696-39-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2928-418-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3140-111-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3176-412-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3216-424-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3220-208-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3236-388-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3240-168-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3428-274-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3572-8-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3632-346-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3648-200-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3664-197-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3688-160-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3744-103-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3780-144-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3796-52-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3884-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3928-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4044-352-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4072-272-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4092-394-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4224-364-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4228-220-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4292-245-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4340-382-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4412-152-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4416-376-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4428-370-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4440-336-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4460-410-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4540-332-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4548-290-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4580-135-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4692-256-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4704-247-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4708-296-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4812-32-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4864-28-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5020-280-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5156-446-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads