701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66.exe
Size

128KB
MD5

cede491531cfc32b7d38a155fe9255b6
SHA1

77384aa01d8bea93940cc52e04470fbbfa72fef4
SHA256

701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66
SHA512

5e48785edda38728b8bfd246c3dc4f7aa5a3f74b2fce6c64eacd066911eda8d0b46fb387ea4d8ece84dcbf7a93a507ef13ec8f000f678cbc4572b217254c981f
SSDEEP

3072:gWVSStdzzo89MAAw8asCHNhMXi6Y0HYSx9m9jqLsFmp:gWV/t9zo8eAA2xUS6UJjws6

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmannhhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojllan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdhhdlid.exe

Executes dropped EXE 64 IoCs

pid	Process
4848	Ojjolnaq.exe
3940	Opdghh32.exe
4784	Ognpebpj.exe
860	Ojllan32.exe
4976	Onhhamgg.exe
4480	Oqfdnhfk.exe
4008	Ocdqjceo.exe
4968	Ofcmfodb.exe
3000	Olmeci32.exe
4660	Ocgmpccl.exe
1476	Ogbipa32.exe
1896	Ojaelm32.exe
2916	Pmoahijl.exe
3868	Pdfjifjo.exe
1060	Pgefeajb.exe
4828	Pfhfan32.exe
3644	Pnonbk32.exe
1440	Pmannhhj.exe
2456	Pdifoehl.exe
4596	Pfjcgn32.exe
4232	Pnakhkol.exe
2564	Pqpgdfnp.exe
4084	Pcncpbmd.exe
3400	Pflplnlg.exe
5072	Pncgmkmj.exe
4312	Pdmpje32.exe
4984	Pgllfp32.exe
4768	Pmidog32.exe
4540	Pcbmka32.exe
5036	Qnhahj32.exe
1744	Qmkadgpo.exe
4548	Qceiaa32.exe
4840	Qjoankoi.exe
2848	Qqijje32.exe
1976	Qcgffqei.exe
1972	Qgcbgo32.exe
4032	Anmjcieo.exe
3788	Aqkgpedc.exe
4376	Acjclpcf.exe
1804	Afhohlbj.exe
5040	Anogiicl.exe
4780	Ambgef32.exe
3660	Aqncedbp.exe
624	Aclpap32.exe
4180	Agglboim.exe
3576	Ajfhnjhq.exe
4680	Anadoi32.exe
2724	Aeklkchg.exe
4228	Acnlgp32.exe
640	Afmhck32.exe
4424	Andqdh32.exe
4816	Amgapeea.exe
2404	Aeniabfd.exe
3172	Aglemn32.exe
2240	Aminee32.exe
816	Aadifclh.exe
1468	Agoabn32.exe
3824	Bjmnoi32.exe
1208	Bmkjkd32.exe
4148	Bebblb32.exe
3568	Bganhm32.exe
4908	Bfdodjhm.exe
4852	Bnkgeg32.exe
2492	Bmngqdpj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Qmkadgpo.exe	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Aeklkchg.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Bmkjkd32.exe	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Bganhm32.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Ceehho32.exe
File created	C:\Windows\SysWOW64\Ocdqjceo.exe	Oqfdnhfk.exe
File created	C:\Windows\SysWOW64\Ogbipa32.exe	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Jekpanpa.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Igjnojdk.dll	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Mjpabk32.dll	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Jdbnaa32.dll	Qqijje32.exe
File opened for modification	C:\Windows\SysWOW64\Qgcbgo32.exe	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	Aadifclh.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Ojjolnaq.exe	701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66.exe
File opened for modification	C:\Windows\SysWOW64\Opdghh32.exe	Ojjolnaq.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Agoabn32.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bffkij32.exe
File created	C:\Windows\SysWOW64\Elkadb32.dll	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Jocbigff.dll	Pnakhkol.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Opdghh32.exe	Ojjolnaq.exe
File created	C:\Windows\SysWOW64\Pnonbk32.exe	Pfhfan32.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Aeniabfd.exe	Amgapeea.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Aqkgpedc.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Aminee32.exe	Aglemn32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Dmgabj32.dll	Oqfdnhfk.exe
File opened for modification	C:\Windows\SysWOW64\Pnonbk32.exe	Pfhfan32.exe
File created	C:\Windows\SysWOW64\Gfnphnen.dll	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Anadoi32.exe
File created	C:\Windows\SysWOW64\Maghgl32.dll	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Bebblb32.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Onhhamgg.exe	Ojllan32.exe
File opened for modification	C:\Windows\SysWOW64\Qceiaa32.exe	Qmkadgpo.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Chempj32.dll	Qceiaa32.exe
File opened for modification	C:\Windows\SysWOW64\Aadifclh.exe	Aminee32.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Ejfenk32.dll	Pdfjifjo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5796	5584	WerFault.exe	208

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ickfifmb.dll"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kboeke32.dll"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opdghh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmgmnjcj.dll"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjdgn32.dll"	701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oomibind.dll"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfnphnen.dll"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqckln32.dll"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldamee32.dll"	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igjnojdk.dll"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfenk32.dll"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djnkap32.dll"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojllan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onhhamgg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4848	3952	701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66.exe	87
PID 3952 wrote to memory of 4848	3952	701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66.exe	87
PID 3952 wrote to memory of 4848	3952	701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66.exe	87
PID 4848 wrote to memory of 3940	4848	Ojjolnaq.exe	88
PID 4848 wrote to memory of 3940	4848	Ojjolnaq.exe	88
PID 4848 wrote to memory of 3940	4848	Ojjolnaq.exe	88
PID 3940 wrote to memory of 4784	3940	Opdghh32.exe	89
PID 3940 wrote to memory of 4784	3940	Opdghh32.exe	89
PID 3940 wrote to memory of 4784	3940	Opdghh32.exe	89
PID 4784 wrote to memory of 860	4784	Ognpebpj.exe	90
PID 4784 wrote to memory of 860	4784	Ognpebpj.exe	90
PID 4784 wrote to memory of 860	4784	Ognpebpj.exe	90
PID 860 wrote to memory of 4976	860	Ojllan32.exe	91
PID 860 wrote to memory of 4976	860	Ojllan32.exe	91
PID 860 wrote to memory of 4976	860	Ojllan32.exe	91
PID 4976 wrote to memory of 4480	4976	Onhhamgg.exe	92
PID 4976 wrote to memory of 4480	4976	Onhhamgg.exe	92
PID 4976 wrote to memory of 4480	4976	Onhhamgg.exe	92
PID 4480 wrote to memory of 4008	4480	Oqfdnhfk.exe	93
PID 4480 wrote to memory of 4008	4480	Oqfdnhfk.exe	93
PID 4480 wrote to memory of 4008	4480	Oqfdnhfk.exe	93
PID 4008 wrote to memory of 4968	4008	Ocdqjceo.exe	94
PID 4008 wrote to memory of 4968	4008	Ocdqjceo.exe	94
PID 4008 wrote to memory of 4968	4008	Ocdqjceo.exe	94
PID 4968 wrote to memory of 3000	4968	Ofcmfodb.exe	95
PID 4968 wrote to memory of 3000	4968	Ofcmfodb.exe	95
PID 4968 wrote to memory of 3000	4968	Ofcmfodb.exe	95
PID 3000 wrote to memory of 4660	3000	Olmeci32.exe	96
PID 3000 wrote to memory of 4660	3000	Olmeci32.exe	96
PID 3000 wrote to memory of 4660	3000	Olmeci32.exe	96
PID 4660 wrote to memory of 1476	4660	Ocgmpccl.exe	97
PID 4660 wrote to memory of 1476	4660	Ocgmpccl.exe	97
PID 4660 wrote to memory of 1476	4660	Ocgmpccl.exe	97
PID 1476 wrote to memory of 1896	1476	Ogbipa32.exe	99
PID 1476 wrote to memory of 1896	1476	Ogbipa32.exe	99
PID 1476 wrote to memory of 1896	1476	Ogbipa32.exe	99
PID 1896 wrote to memory of 2916	1896	Ojaelm32.exe	100
PID 1896 wrote to memory of 2916	1896	Ojaelm32.exe	100
PID 1896 wrote to memory of 2916	1896	Ojaelm32.exe	100
PID 2916 wrote to memory of 3868	2916	Pmoahijl.exe	101
PID 2916 wrote to memory of 3868	2916	Pmoahijl.exe	101
PID 2916 wrote to memory of 3868	2916	Pmoahijl.exe	101
PID 3868 wrote to memory of 1060	3868	Pdfjifjo.exe	102
PID 3868 wrote to memory of 1060	3868	Pdfjifjo.exe	102
PID 3868 wrote to memory of 1060	3868	Pdfjifjo.exe	102
PID 1060 wrote to memory of 4828	1060	Pgefeajb.exe	103
PID 1060 wrote to memory of 4828	1060	Pgefeajb.exe	103
PID 1060 wrote to memory of 4828	1060	Pgefeajb.exe	103
PID 4828 wrote to memory of 3644	4828	Pfhfan32.exe	104
PID 4828 wrote to memory of 3644	4828	Pfhfan32.exe	104
PID 4828 wrote to memory of 3644	4828	Pfhfan32.exe	104
PID 3644 wrote to memory of 1440	3644	Pnonbk32.exe	105
PID 3644 wrote to memory of 1440	3644	Pnonbk32.exe	105
PID 3644 wrote to memory of 1440	3644	Pnonbk32.exe	105
PID 1440 wrote to memory of 2456	1440	Pmannhhj.exe	106
PID 1440 wrote to memory of 2456	1440	Pmannhhj.exe	106
PID 1440 wrote to memory of 2456	1440	Pmannhhj.exe	106
PID 2456 wrote to memory of 4596	2456	Pdifoehl.exe	107
PID 2456 wrote to memory of 4596	2456	Pdifoehl.exe	107
PID 2456 wrote to memory of 4596	2456	Pdifoehl.exe	107
PID 4596 wrote to memory of 4232	4596	Pfjcgn32.exe	109
PID 4596 wrote to memory of 4232	4596	Pfjcgn32.exe	109
PID 4596 wrote to memory of 4232	4596	Pfjcgn32.exe	109
PID 4232 wrote to memory of 2564	4232	Pnakhkol.exe	110

C:\Users\Admin\AppData\Local\Temp\701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66.exe
"C:\Users\Admin\AppData\Local\Temp\701a79c4927520a799e27fb8851964b30db1fa26fddb4419a4b6fca97bc55e66.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\Ojjolnaq.exe
  C:\Windows\system32\Ojjolnaq.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\Opdghh32.exe
    C:\Windows\system32\Opdghh32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\SysWOW64\Ognpebpj.exe
      C:\Windows\system32\Ognpebpj.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:860
      - C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        24⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3400
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        27⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        29⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        30⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5036
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2848
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1972
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4032
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3788
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        41⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3660
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4180
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3576
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4680
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4228
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4816
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2404
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3172
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2240
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:816
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1468
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3824
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1208
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4148
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3568
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4852
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        66⤵
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3628
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        68⤵
        Drops file in System32 directory
        
        PID:4512
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        69⤵
        Drops file in System32 directory
        
        PID:2600
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1152
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3848
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        73⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1648
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        75⤵
        Modifies registry class
        
        PID:612
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2820
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4328
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        78⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        79⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        81⤵
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        82⤵
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5356
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        85⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        89⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5684
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        92⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        94⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        97⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        98⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        99⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        101⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        103⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        106⤵
        Drops file in System32 directory
        
        PID:5448
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        107⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5568
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        110⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        111⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        113⤵
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6024
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        118⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        120⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 404
        121⤵
        Program crash
        
        PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5584 -ip 5584
1⤵
PID:5760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
128KB

MD5
108a646dd839916a00c4d9861521705d

SHA1
ae918bcc212d99fc25978c3b8cd141f965323ef5

SHA256
3695300890b7a05350c23680ed4cb9e9b737542bd7e2270925bddd59ead06818

SHA512
139c804400607b25ccbac09bc5306b13839d90ec430a7578301299b506cc9484c1c9338853ee79bb09a66594c8522abcd652b2766d231cd8a9c7042a5d6c3a50

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
128KB

MD5
bbea871559af42e76d098cc32753451c

SHA1
779f3b4191363493a99541efd056e7adc900e337

SHA256
83642ddb92fe2d4d6aa341e4ef4159a55100e6a3b1b4f2b0749d0af54082f51f

SHA512
b3bfbaa2fb74c6eb1fa834790daa7bec3963127b8685a64f7879bbc8d358fc2d45d2e14657d43248e400257451d1eb13dcff50f87639f02fcd532a32712a0c5b

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
128KB

MD5
bb2c8998b17b774ad31cb0001d468d7a

SHA1
3d3e123c39dbd9d7e8192f3bd83de6d5c5f7fdb9

SHA256
e323f420b7c13a08f2b189edbb3fd8b85bf99e9f891671ebcd9189d5725d9d35

SHA512
a2d8e0679414e5ff50db5afff9218369ca819f148a55a23db6d5cd5da9a2e2d305cce207c22b5b91bb250ee42480e5a73fee43121f8d37dc0d3a1e7b611a8bff

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
128KB

MD5
3a89ebc7354d4058028a446d27097478

SHA1
23886cafd17f52e019d139d85c6751a38760130f

SHA256
9fd581d0f54fab97a6892068c10136865fd14ef714c6f1a4fe6703cbf155cb05

SHA512
68ee6bcf11d53be6ebb25d699cd53cf8597871bc581da556cb03bcb8f38b794fa2ef492591648d51c4c7798a4022a947a5fc89421fa53b995330c93d17b2177b

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
128KB

MD5
583c06e8865e51bfaee05d3426fbdfc2

SHA1
2221f636eecfc6e0715bbf2be27778933b98c504

SHA256
2699fe1064d7337862005fc5301e8844e3dc3de6770659e17361b095a4cdd70d

SHA512
14bdad7795b39c725a4af9af051d8f0f34c2539b792a637cc06e1a041d98ada1f63cff2271af19647e4a4145b356c69991d4ed141ee38e0ff02ac084c5ca5744

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
128KB

MD5
ff94d282376bcda53f989faedd2fc6e2

SHA1
75d1ed5749652ebdb8e064ccfb550ebb1b3dc439

SHA256
55f25e167c37f64db19b286f29435360c9d8b685131e989c32570154bf9a6d65

SHA512
6d2c734a4c636d489b505266f29dff6eb44219981eac79b00b9e0829db745cc3afcbcfad91ee8c393f9fc87b82e72aede1734af519d36f958ee634ad8535e01f

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
128KB

MD5
5f4dfb4dd61bd388f55bc464c69cd254

SHA1
1dc08a8237e8c456435f8b294e9dc3acdee97455

SHA256
29535312835b17bfbf0b9dbe0f0c3f1a87f109517b81042cd7794de80c31db2f

SHA512
a3ddfd6088218ee274b79f2ceeae293acf36c08967989d5b6bef6201730ca28ae8d4881c1feb91ca4efe54286e4c79c3f43b4c9350381db13e876facfb458d50

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
128KB

MD5
2c9024b59b8854588c18394ef1bc3de6

SHA1
c33cf18b8f936ae1826380b06032d80c9bf84989

SHA256
6721af32239c5fc586df927ce59fabbcc16e00d68b4989a8bfab157270b6f87e

SHA512
d798d22415e7ab232b088402c06cac50af22c330b7f5b1815a2ab2feab098ef8a8f3af545349c034d6f161d6f1344bc7ffd62d3bc99287a30f963922ab6dd74e

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
128KB

MD5
84bcb7307c2e972f9fd2cdf853b23b62

SHA1
199a0b65ecb2004d045d7e1cb1fc2425e8d7aba4

SHA256
4329ac16ab6a8f075156e4a4939e5ade5b18d04b55c193f5a6042942e4d9977c

SHA512
59461f0fcfb435dabfdc6271669de8378a2cbc052d1766b0fb3a0321c9eabdac7e3cb8e18cd49bdce351b143776cc9d05011aa05f915656ce0423f74b38f1fa3

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
128KB

MD5
64d577ec50844051121aae596a01ad16

SHA1
bec00f4d0e626b976870d36764c35d08947d0642

SHA256
c75df2040423a5d01c42b750192cae0b862155fbec916dfe7954e7315ab53c59

SHA512
771b4d671b1b5369ff460d054fa29818f400b1607e40da45603192e3dc5747fcf0619bb26b6fee92588183aa13696619d51aef39ddbdb54d2f935868c1754312

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
128KB

MD5
1c53d8b581c1492ef9a5da3b825b7a4d

SHA1
51f7130abd49b56d085b9b57bcfe160c10dfc4c6

SHA256
20b85adc8db3ab29bda56f7201d545c5c0e2b3b5994d41aadb75430d51e553f2

SHA512
19db34b990c8219e20cdcc64b82bbecd252132289512291dab011dfe270a8e2817ab7e7969d160ba1b49a4a99912eccd6925cce1a15400fc6fd301a13a795e9e

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
128KB

MD5
6d1e402e6df857be72a97b9be648e9dd

SHA1
184ef52b77fb3de14ed2d7a2d7600d800f45af1e

SHA256
bbda8c8ffaa53ffe1b49cab44b23a0e327a03ea7d99cbfb29077a5225dbbb65f

SHA512
7416818c34a24b22e0100cb6743362dd85c88197b68f7c0f201747816229e96347b02df620cbc209208b4c16394ded6bbc27cb1c60f864caddd42549270a6668

Download Submit
C:\Windows\SysWOW64\Ojjolnaq.exe

Filesize
128KB

MD5
550c049829f36d9d5050123003d08e24

SHA1
03598e497d14e47c4e0fef8d3851ec7f18650e8b

SHA256
7fadb178389b3ea94cba1fbfbfe890d32a5701f1b9227bd94adb8c41eb90d3bc

SHA512
cab0bd74ee6a2b973cc3d1372b60f6f1f184ee6f4b65aa82d73f4bc06aedfe9470f16f88a619920922d6c092ab19d9e75414126e33b61a8d07571c687d5c5fd7

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
128KB

MD5
6aca9c0083e2f1c215d2ba317e68aa68

SHA1
2abee4c91573b71f517d6a7d07e9269e19ea2d17

SHA256
edced9da0fedc3d69f870258242be69ebfec3201cd37061fc5b7aba7d49a3bf8

SHA512
555bb0b1450a3ea4e30b5b2edf7650562d9fde36c655bee995467a701e181e24f4fd3f352fbf236faaacb33ec36e1c2c387f7badb4d3b8a5a6187db120852cb7

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
128KB

MD5
1ae3b04ece487c703cd5ddd7a7f362f9

SHA1
73b798dbe90e12e5ae5f30fa15325c6ecd18028c

SHA256
87cc2fb3e3c502046e30e600de2055c3e49788108b5f2af3eac8ba4a7af9da4f

SHA512
bd721c27f083c6c5ffa2276211cca0f40b5229fdcded5338af865d24979c2a5c3a08ee8b4baafe69fddd101a7afeb8ef4f96c4d93adcf2d139cde019a16848b0

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
128KB

MD5
727f355e9b82fde454a3daf11d302c31

SHA1
51da64c28707ab2e5232f716a6b8df3fe7a822b4

SHA256
4efd5f0fe28d94f23926002d911a9deb1326559c6c767df431d9540b012dd8b5

SHA512
d3952e06b718d2cd21b3693d06ce95bc65788d8e0b235530661169adccb7fef75d866a8b4f9d062d56dba6f9d710b063737d5d3b39cca5d02a49b54a8e2874a3

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
128KB

MD5
c479897f135373e22f965b2a2e31bee2

SHA1
9aeca9fab9babc5a321e2622e4e70691ab1bf53d

SHA256
636f203934a0dcb1ceb3d9a832a3915daf5f9e9e74c00bbdbfb7d546d1cd6b5b

SHA512
d22c7766554bf1d3407c201a69c92e2ddf5053831517072a52559584157b7e74c6de8c9e677d8588c4b6690cfd7afeb74288d89b7ba7df263599cf2d381bbf80

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
128KB

MD5
f18b09a988cb64fc7dd50647f3c6ba8b

SHA1
e04fd676bbc41dae455a7adb153f22cb71385605

SHA256
291b91dc8f90516a4e9dc94c27e65b61a06423df94fdf451eadaaf967049b944

SHA512
5a1ee2085024b7affad5863a3a2582368a71fcebc01e92660c939b28b66050355b45940e17303ee8e77a6a060cf470009d2ffd41436c6c3ebe2f44449626cd1e

Download Submit
C:\Windows\SysWOW64\Pcbmka32.exe

Filesize
128KB

MD5
0ecc487df1a2a11fe4274fd777ad3c08

SHA1
7eaacc32474e2c60d4d37a47bcc7d39d28238577

SHA256
c5263b69ba3b2de0394d8a8a8a230b51577e68e87a8638eff58c4107ba6d3caf

SHA512
58033ba831985ad2b3a7e0bfdfe74c802b249262aa685c57284ff1500909de0b1dcaea1bafe4ac49464dbab73b17c1220264750623d9979bb167abd188d384c3

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
128KB

MD5
5d92dfdb385a1d2503b45481d2ca0459

SHA1
48bde50a51bbe0fe91d21a9e997411c1eded97c2

SHA256
215fe86ee46a459ea753c37ae01947d154938e11cd20f5d78cf0ca7557413f72

SHA512
6abc7ddd254816f258a052e8f3032e117dfae3a2acdeaa4dfe13cf1f6e1f5422be577f59deb9b1317e8109a13fa04bf3a6ee7d29fc60bd430ea1003d973f73b8

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
128KB

MD5
bf620fa75ffef12605959dc8372db02c

SHA1
c93573d515faa3311b85a2bf023a92bd30543553

SHA256
6bd2f84211638c826b1de59ea29a146b063fa2238ea2ee1eef1ea08916322674

SHA512
9738f7a3794778436d175850831157a6c9b4b14c976071dead1a237319a8c7d673e58a8b4e6565cdb5c92007a31bbb8b6863992edd94542b188adc9c6802cae7

Download Submit
C:\Windows\SysWOW64\Pdifoehl.exe

Filesize
128KB

MD5
c4e9ee47760b9f7f4c3553aef87eb05b

SHA1
45e751b894523526b786d6847eefc5cd9b1e1f32

SHA256
62255909a9b8a469d741207aea597d22d2935b220112014fb41146ca39bb6317

SHA512
e94107ab889c6104046cd539891c6e0a91ecb94c00271bd9b1622d4076478ff135b3d50d94169953e366844540c54ccc85ac6fab617835e09027c7d664258ecf

Download Submit
C:\Windows\SysWOW64\Pdmpje32.exe

Filesize
128KB

MD5
579aee9d0bef7291cea60c2e5015117e

SHA1
151b23ee71d907599de032eda78eb3a041fbd761

SHA256
8c500067fff8da5f9bb730aaa47cde55c00170d727c81a462df3b765cf60ba93

SHA512
c75f1feffe3fec164ded65d54ee31226a6c47e2a1e5a682f262d721b7402a421d82fcb7ab35ed73b7d6c537f1231932a526637afd6eafd0641315aba04a032de

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
128KB

MD5
083923bea0437d9860f747b2145cf125

SHA1
ba4fd7e7d40bfbd86876bde5e39873670a561591

SHA256
6e87c72959cc0d0e8f315b40002718bb0088f5bcfdafd4bc8c1eca5c1bed8f54

SHA512
15588aa21d15f86ae7ab925d1bbc9714150a377e2050a89f9c807da397b19e55c67e04428a1774746d4f992683b3647be0f013ed9238f9e55eb6da68f441283b

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
128KB

MD5
a6eebe13b07154393d31b31c588d6ba4

SHA1
ec4eedce2d2942053e19b11790a394e39ccff478

SHA256
5b189037df21a0fe75b97bad1325446565ad968470851bd1c45f8beabbcd8da7

SHA512
34d39504ed494e1ee94e98a5faa3dc63fde93efb2f1db37805add5d3feb3edf7d9ed0ff9ff5c0ed519f9343370a911455bb036fff9d914aa719f637409743d95

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
128KB

MD5
a8b7939ac092735eb87b43c94566d266

SHA1
37e5395ab724d4a402a41f5cfa1d577068e3b4cb

SHA256
fef2e75a265a698036b264cdd188d8e542e5a7095834e42485f1335b9041a6fd

SHA512
9a38e18c4601c486308a1862105bda19417738c573d8e00b74f27b1fb5dce47af03921ba37b0b56c04c198ba1b2e07823f93e38f737f7bc9e12b4b035aa667cd

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
128KB

MD5
8cb5ceafe9b48841169d80d05d9ead92

SHA1
390a729d88e0ba353796d5de9918324e14afd845

SHA256
1eb299665a8ff1b03601be53830371f081612add2d0dc73cd1dfd114303b829e

SHA512
f12a359887c48d7a3cc64385f2eedfa8ae9b51c39e8957610ce2dc5a8cb36a72799d8b00efd0a2a6146db5d536317dbb865257d1c01b520bbc695c6749f8aee9

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
128KB

MD5
f276eb816572ebcd3f287256b24b7079

SHA1
7adc84fa8b9cba5648be68df7599182867221739

SHA256
6cccd8d7a6ef31905d9dd2682d9d1cde29faf8f39f3f58552b920838cac1d960

SHA512
d4f9a39291158fd0d7362cc9c4ba70b79caefe5e1ac213db8874bc3375cc98f6df8430b6986fc38e75917d56acc317c4f07f54f7bdb693879e10e433162162c2

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
128KB

MD5
1fedb641c887d1ce135459186c7ca9e8

SHA1
35274b9961b54130f090042381c3eabad3fcee76

SHA256
a56661f50bc6b3238126bbb3a49031c4ddbfdaec53bb9299e630ee27a9395a10

SHA512
3c24bbff3f8d05be78b3497a2927a0d49eed56cf9e44c9fa9283dc5e6ce6a1cce304433f1c8933d98cd8f9348e79994dc2f480633dc2aa47a13800ef4597ee8d

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
128KB

MD5
be877a7e5ada810db5921c5ff6765002

SHA1
6422bd11cda24cb70736532426910887257c5ead

SHA256
f467cbe324f3950a4e6b1b1b9e1bc0dd577ddcf994ddc634766418f37f200574

SHA512
39728ce10df670b9b3a9e965e10cbbd039c0e156246adf2d59912adb1cb4596740534c357ca8440e993d966da742a9181c8a149f125c53b2e26ac02e51694391

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
128KB

MD5
c705363607e2d8698b5ee7d7c6d96d1c

SHA1
938970714d675ee460cda35bf328d9e27837436d

SHA256
93acf98d7bcf04668df2834912131cdf4865c39d5ffd33882f8cd965e9830b3e

SHA512
4e645e611ba4ba9eeb74ec36db6a0cdac7f1aedafc03984642f60b595e99c95e4eedf45673485a73adcbb32ed6d2cca5aa48089cef4da8f244ae1ab6dc19ec36

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
128KB

MD5
d783f5e22fa8c064564675525abbd13f

SHA1
b7d6db745cb6cf6213ebc6d26630ae1fea6d55af

SHA256
4ac840ec66ed7e75bdc8351a5eff87f4b67af2e3a7643c01ccceadd7c6789c27

SHA512
0f5c1fabd04a38a870fc7e3aafb4798f85da0fe3d07b017ca186c5375b16229946a322774a594e939e3b0a040289b860817ec8efe0cc3d37102e2e20502c40f9

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
128KB

MD5
e046360ce52989350195156c1d190fd9

SHA1
e0039a3aaa1a617944c2db015082341edd1366e6

SHA256
b52f79d760a32f8452653ae40b55c503f649dec3f766e28551782f5a840d0198

SHA512
fd7633adbac12f5e8f115c13248c46995be7f3e13654073a7c805e99f5e0e674ca6094cad83514d0db292244cf738afaf23c79e3b3f3cb07c068db5ca863ef0c

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
128KB

MD5
6379fe244c75092fef402d8d6fe5b3ce

SHA1
72cbad0a2fdc3c527945ba93abecb02f8820cadd

SHA256
ae5b68da4096b2160bf2ac0631ac4be3824323c8c80d65c412ee0108642fada2

SHA512
f8f46c39cb0ac99d3bc10e4f3296bab04e5c87aab0df0b59d5f02483b361313c4fc5d7ec71c0506391affadc741a15754ceb54f0b1ae92dc697aa11e4ac0c472

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
128KB

MD5
7028e37e408d7169c9ade3a6f43aef7e

SHA1
4a826d9986a23c73924958b61bfafaad5ffeefd6

SHA256
2c0528cd600daeaa13e9907bb1607e55c1c0a157e6fa28d9e9d13d4cfcfb2e9f

SHA512
36ce47a8f8022f2e86e8e711ff66c34cd8e233cec6f9c768d22d83f820bedf1cfa3870d4fd405f10c581758a05287ec137c64a4852d9f3c2a666c1b7857b4d4d

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
128KB

MD5
138e5a1b99a364c5a17c59059bc862cd

SHA1
a6655ae01fd642a3d4b1dcb76bf7013e33b3c474

SHA256
5cfc652d5a0f27b4f847833d617b0727c926c49a2296682e912b1b44f4271c86

SHA512
b4c00586a41278e1e48aca39aeea16e54db7f0fa67f119e221314b492e3536ebad3a6242e86cde2a17fb7bbd8c80d026b1f2294079f937ad16e8cddcf36f7e23

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
128KB

MD5
9f1d09f7569176a094452e80ff1b2181

SHA1
2ae93ce1ed391392da762d2f9427185460f750b8

SHA256
48a02571d60e05835899b4731925da125f1d5bb6f7e19178a9f0f2135828ada4

SHA512
26c81b4e0ddecf4cfee933333e54d78a9494a07df178ec19194694166e4b7040e118358703c9d318ec2681466bad64903f5b12790a268085452f53418ceae3ff

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
128KB

MD5
829a6483d91e80a387495b7a9353024d

SHA1
c4d004c02c9c1449b8d078007c112473000a3f72

SHA256
e0cacb92afc3926ea6bbd7b32319ef30e297ea40fdb1e8e6d27a266ed057f4ab

SHA512
dffda8531115cc6962b6a065d0faf43810c3d2b59ceb879dbbc01e144cea9485c60dbc519407889dcb63e6905bc025a48dec29e80df562b0a4848946c2a0f11a

Download Submit
memory/624-335-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/640-366-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/816-406-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/860-33-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1060-122-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1208-420-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1440-146-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1468-408-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1476-90-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1744-250-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1804-306-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1896-98-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1972-282-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1976-280-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2240-400-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2404-389-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2456-154-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2564-178-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2724-358-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2848-275-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2916-106-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3000-72-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3172-394-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3400-194-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3568-437-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3576-347-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3644-142-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3660-324-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3788-298-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3824-418-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3868-114-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3940-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3952-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3952-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3952-81-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4008-57-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4032-288-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4084-186-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4148-426-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4180-336-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4228-360-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4232-170-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4312-210-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4376-302-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4424-376-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4480-49-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4540-234-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4548-262-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4596-166-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4660-86-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4680-348-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4768-226-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4780-318-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4784-25-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4816-383-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4828-130-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4840-264-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4848-9-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4968-65-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4976-41-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4984-218-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5036-246-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5040-317-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5072-202-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads