aa2df06fa9ef123b79754ba537b439c89460309ceab35e2435b0f00c0cdc30e3

Analysis

max time kernel
106s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c15836f0cda5db2255f16c9d420ebef0N.exe
Size

324KB
MD5

c15836f0cda5db2255f16c9d420ebef0
SHA1

d34db7ceca412ba6678587a4eb471d7a400085c6
SHA256

aa2df06fa9ef123b79754ba537b439c89460309ceab35e2435b0f00c0cdc30e3
SHA512

5486e4279ddcb414ac839b170e86920c23cb3d324fd658871e1c657613f52be59468afa84df588e5c8ed977c43a2cb286ee3479bdf83ea2380cf554650971fcc
SSDEEP

6144:nkUfzKM93zzpDLzpogzd5IF6rfBBcVPINRFYpfZvT6zAWq6JMf3us8ws:kUfOip7Lp5IFy5BcVPINRFYpfZvTmAW9

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	c15836f0cda5db2255f16c9d420ebef0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c15836f0cda5db2255f16c9d420ebef0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe

Executes dropped EXE 34 IoCs

pid	Process
4616	Pqmjog32.exe
2108	Pqpgdfnp.exe
2260	Pdkcde32.exe
460	Pgioqq32.exe
4188	Pnfdcjkg.exe
3700	Pdpmpdbd.exe
1060	Pjmehkqk.exe
1704	Qmkadgpo.exe
348	Qddfkd32.exe
5104	Ampkof32.exe
4980	Acjclpcf.exe
3964	Aeiofcji.exe
3412	Aclpap32.exe
4848	Afmhck32.exe
2028	Aglemn32.exe
4624	Aepefb32.exe
1188	Bagflcje.exe
2496	Bmngqdpj.exe
1932	Bffkij32.exe
1740	Beglgani.exe
4288	Bfhhoi32.exe
904	Bjfaeh32.exe
1684	Cndikf32.exe
3024	Ceqnmpfo.exe
3984	Chagok32.exe
2324	Cffdpghg.exe
4368	Cmqmma32.exe
452	Dmcibama.exe
3560	Dobfld32.exe
4212	Dkifae32.exe
1976	Daconoae.exe
3384	Dhmgki32.exe
2232	Dhocqigp.exe
1084	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bffkij32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Pgioqq32.exe	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Hgaoidec.dll	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Hmcjlfqa.dll	Ampkof32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Ampkof32.exe	Qddfkd32.exe
File opened for modification	C:\Windows\SysWOW64\Afmhck32.exe	Aclpap32.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cndikf32.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Aeiofcji.exe	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Aepefb32.exe
File created	C:\Windows\SysWOW64\Cndikf32.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	c15836f0cda5db2255f16c9d420ebef0N.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Kmfiloih.dll	Aglemn32.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pnfdcjkg.exe
File opened for modification	C:\Windows\SysWOW64\Qddfkd32.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Pjmehkqk.exe	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Fqjamcpe.dll	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Ghngib32.dll	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cndikf32.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Eiojlkkj.dll	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Acjclpcf.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Aclpap32.exe	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Dmcibama.exe
File created	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Ehmdjdgk.dll	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	c15836f0cda5db2255f16c9d420ebef0N.exe
File opened for modification	C:\Windows\SysWOW64\Pnfdcjkg.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Fpnnia32.dll	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Qmkadgpo.exe	Pjmehkqk.exe
File opened for modification	C:\Windows\SysWOW64\Ampkof32.exe	Qddfkd32.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Aglemn32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Jocbigff.dll	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Jpcmfk32.dll	Pnfdcjkg.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Bfhhoi32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Pgioqq32.exe	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Afmhck32.exe
File opened for modification	C:\Windows\SysWOW64\Bffkij32.exe	Bmngqdpj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3800	1084	WerFault.exe	120

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c15836f0cda5db2255f16c9d420ebef0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcmfk32.dll"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feibedlp.dll"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjgghdi.dll"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	c15836f0cda5db2255f16c9d420ebef0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c15836f0cda5db2255f16c9d420ebef0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhkdnkh.dll"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehaaclak.dll"	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oncmnnje.dll"	c15836f0cda5db2255f16c9d420ebef0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	c15836f0cda5db2255f16c9d420ebef0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoddikd.dll"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qmkadgpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cffdpghg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4616	4032	c15836f0cda5db2255f16c9d420ebef0N.exe	84
PID 4032 wrote to memory of 4616	4032	c15836f0cda5db2255f16c9d420ebef0N.exe	84
PID 4032 wrote to memory of 4616	4032	c15836f0cda5db2255f16c9d420ebef0N.exe	84
PID 4616 wrote to memory of 2108	4616	Pqmjog32.exe	85
PID 4616 wrote to memory of 2108	4616	Pqmjog32.exe	85
PID 4616 wrote to memory of 2108	4616	Pqmjog32.exe	85
PID 2108 wrote to memory of 2260	2108	Pqpgdfnp.exe	86
PID 2108 wrote to memory of 2260	2108	Pqpgdfnp.exe	86
PID 2108 wrote to memory of 2260	2108	Pqpgdfnp.exe	86
PID 2260 wrote to memory of 460	2260	Pdkcde32.exe	88
PID 2260 wrote to memory of 460	2260	Pdkcde32.exe	88
PID 2260 wrote to memory of 460	2260	Pdkcde32.exe	88
PID 460 wrote to memory of 4188	460	Pgioqq32.exe	89
PID 460 wrote to memory of 4188	460	Pgioqq32.exe	89
PID 460 wrote to memory of 4188	460	Pgioqq32.exe	89
PID 4188 wrote to memory of 3700	4188	Pnfdcjkg.exe	90
PID 4188 wrote to memory of 3700	4188	Pnfdcjkg.exe	90
PID 4188 wrote to memory of 3700	4188	Pnfdcjkg.exe	90
PID 3700 wrote to memory of 1060	3700	Pdpmpdbd.exe	92
PID 3700 wrote to memory of 1060	3700	Pdpmpdbd.exe	92
PID 3700 wrote to memory of 1060	3700	Pdpmpdbd.exe	92
PID 1060 wrote to memory of 1704	1060	Pjmehkqk.exe	93
PID 1060 wrote to memory of 1704	1060	Pjmehkqk.exe	93
PID 1060 wrote to memory of 1704	1060	Pjmehkqk.exe	93
PID 1704 wrote to memory of 348	1704	Qmkadgpo.exe	94
PID 1704 wrote to memory of 348	1704	Qmkadgpo.exe	94
PID 1704 wrote to memory of 348	1704	Qmkadgpo.exe	94
PID 348 wrote to memory of 5104	348	Qddfkd32.exe	96
PID 348 wrote to memory of 5104	348	Qddfkd32.exe	96
PID 348 wrote to memory of 5104	348	Qddfkd32.exe	96
PID 5104 wrote to memory of 4980	5104	Ampkof32.exe	97
PID 5104 wrote to memory of 4980	5104	Ampkof32.exe	97
PID 5104 wrote to memory of 4980	5104	Ampkof32.exe	97
PID 4980 wrote to memory of 3964	4980	Acjclpcf.exe	98
PID 4980 wrote to memory of 3964	4980	Acjclpcf.exe	98
PID 4980 wrote to memory of 3964	4980	Acjclpcf.exe	98
PID 3964 wrote to memory of 3412	3964	Aeiofcji.exe	99
PID 3964 wrote to memory of 3412	3964	Aeiofcji.exe	99
PID 3964 wrote to memory of 3412	3964	Aeiofcji.exe	99
PID 3412 wrote to memory of 4848	3412	Aclpap32.exe	100
PID 3412 wrote to memory of 4848	3412	Aclpap32.exe	100
PID 3412 wrote to memory of 4848	3412	Aclpap32.exe	100
PID 4848 wrote to memory of 2028	4848	Afmhck32.exe	101
PID 4848 wrote to memory of 2028	4848	Afmhck32.exe	101
PID 4848 wrote to memory of 2028	4848	Afmhck32.exe	101
PID 2028 wrote to memory of 4624	2028	Aglemn32.exe	102
PID 2028 wrote to memory of 4624	2028	Aglemn32.exe	102
PID 2028 wrote to memory of 4624	2028	Aglemn32.exe	102
PID 4624 wrote to memory of 1188	4624	Aepefb32.exe	103
PID 4624 wrote to memory of 1188	4624	Aepefb32.exe	103
PID 4624 wrote to memory of 1188	4624	Aepefb32.exe	103
PID 1188 wrote to memory of 2496	1188	Bagflcje.exe	104
PID 1188 wrote to memory of 2496	1188	Bagflcje.exe	104
PID 1188 wrote to memory of 2496	1188	Bagflcje.exe	104
PID 2496 wrote to memory of 1932	2496	Bmngqdpj.exe	105
PID 2496 wrote to memory of 1932	2496	Bmngqdpj.exe	105
PID 2496 wrote to memory of 1932	2496	Bmngqdpj.exe	105
PID 1932 wrote to memory of 1740	1932	Bffkij32.exe	106
PID 1932 wrote to memory of 1740	1932	Bffkij32.exe	106
PID 1932 wrote to memory of 1740	1932	Bffkij32.exe	106
PID 1740 wrote to memory of 4288	1740	Beglgani.exe	107
PID 1740 wrote to memory of 4288	1740	Beglgani.exe	107
PID 1740 wrote to memory of 4288	1740	Beglgani.exe	107
PID 4288 wrote to memory of 904	4288	Bfhhoi32.exe	108

C:\Users\Admin\AppData\Local\Temp\c15836f0cda5db2255f16c9d420ebef0N.exe
"C:\Users\Admin\AppData\Local\Temp\c15836f0cda5db2255f16c9d420ebef0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\Pqmjog32.exe
  C:\Windows\system32\Pqmjog32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\Pqpgdfnp.exe
    C:\Windows\system32\Pqpgdfnp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\SysWOW64\Pdkcde32.exe
      C:\Windows\system32\Pdkcde32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2260
    - - C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:460
      - C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:904
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3024
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3984
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:452
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3560
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4212
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3384
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        35⤵
        Executes dropped EXE
        
        PID:1084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 408
        36⤵
        Program crash
        
        PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1084 -ip 1084
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
324KB

MD5
9d5a5c0fdd2c3b93cc5193676794c7d5

SHA1
73be64420d2ef42673fba87907e57395c952ccb5

SHA256
2ae696baeb1acd6b4ca15e6eec3e285c32d3fb7c10f448b7f1e241db901c159e

SHA512
7fa4f17738587c1efe61280fc9f878cd0d3bd7ba62cdb0adf4cbbe86d5ba33c00a3328564eb362c1cb691c69426d3c173b13d24674c735277600d69351b746aa

Download Submit
C:\Windows\SysWOW64\Aclpap32.exe

Filesize
324KB

MD5
d1ff238342d6c2406a156aabac8483c6

SHA1
01c7061771ad58aa2950435d121aedfe78fbc38d

SHA256
b442a2af71dddc6368601a6fb4c74338ff5fd0adad2cbf090e537053d616fb66

SHA512
55283e4351e34e791dd38df652f30e1a0c6bc19c5214ba9ae03723a1d0d99d188fe1fc61ba56d27ec699f0850cb5679a5364c9633a819263f9fa1171fcf05b40

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
324KB

MD5
46e88e5dbe87b5c5e53657a45ce80b36

SHA1
1aa4e74d641cb3ea9f06ed51c8be3728e0ee4b6c

SHA256
4ad4d404dbbad691519798c7fa92288937ed2e0a9d7ae9ec8f5acece4edaff26

SHA512
c3597aaf5f92e48d333bdff47485bb05d882aa2365514f66d0155788bb4142d7d73c31be740506f621d6c071a74adeaa21558832eca55a0da5402cdca5fb0863

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
324KB

MD5
04f41fc85a42bfd487b14e777e2b8340

SHA1
4dbb61382a4f4aac910fcd1a0d7a7b49c112d94f

SHA256
7a40c60012539d1a598449d90bbbf5a705c88a260d29090bf79b706f53730f31

SHA512
34c75afcf5297e9eab330c06477dd7a91b29d77f972f9d8f1fee0761f00471e645f4dd5665500ee89b68bbfcc3a2e21e63a3da7de128854db2c4962d63a05063

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
324KB

MD5
3c3dc15be96a5c0d811209a95797c75f

SHA1
3fb5e215ddd1f3e12ea853dd5c27386ab54991d6

SHA256
8c2488b75e6f316703f5136403266782c48f9c1f0a70c4b08486c5b11b0cbee6

SHA512
f7da31f6e043e1d881e917e057aac7f1cf734964dab85d4d2b0b01a0bf126006d06766bcb9800bfa1f1499a50208436e1eb33cbfaa225a9c3accc3de9b33e853

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
324KB

MD5
45c48dfe0024ba41cea162eb13ee79ec

SHA1
68f4b24065b3697f0aadcdacd8cd59a74396c3b9

SHA256
759aa0d42c56043eb9422da8e23b565c12970aaa32cdcc7a2ae7ec92f32341a9

SHA512
580730b9c6f0e4460e3fdd07f2eeffc4cce7858634e93a8f66b533b63b48aa80fd03ee26e6d720325c66e499d10b5716f94255726a7505bca09f642615c0c2ef

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
324KB

MD5
9e9c5fbac8fb762b8c419dc8af4cdb4e

SHA1
bc7722dda763f431a197a059d55c38095e2287af

SHA256
763084a9bcd117c698bd38ba2edef7a50c2536c4b45abe67cae056b147467a48

SHA512
f572a2e9f30c72f23ca62574f30025e4824ffcf6f091363af045c2b0a7e6e21018e21e49d15d150475c99bf8f1c3061cdc999bfb369661845ce9ef077a5356d8

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
324KB

MD5
659e9f5e5129fb9d3821db2887f00014

SHA1
3417cd8583fa2ed1966cd5bad66a3e580e22ea00

SHA256
1a6d9fd025a5be628b6b255d061e57bf33667dc59fca5ea7b77bf77e3f9b02f0

SHA512
04e8b1104f2cbd458dd210b09bb241fc10dc1015142fda12990db39b2347a42f8793657a82043e8e384b8720a2f53b01fd0b60c542310f3716f11a5e43368c7c

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
324KB

MD5
97d22b829610edb7c722dac755b66e5e

SHA1
ad087b7b22393c4ab0ab12ec3c67e6885c8caa3c

SHA256
60cf919b7e139e39359510d8a23af76066e067667f0342949458bb98911b228a

SHA512
0bc94e0027f7c00097ce6f206364cbd187cdd057c51c732ae804bbc737ca54085ebed867ae5567b5a065c340d29d7285087c0701e8a13877aa823c5abe8bf775

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
324KB

MD5
f968616a80976a25d3a1b70a77ded17c

SHA1
e4c52a5008c115e951e9870e0f2b886ceaf5c519

SHA256
5d5669eb3c73c73c9699b5afca9f86bcdc2a6e24f67e2d297e49309ee1967ba2

SHA512
e49bcc4a023a23db031ee1fda3dd817eb4af50cd9323583bc2076ebc25d40bce35e9778d6d39aa53edd3d7acd04664478b53e4b0a0d21ad49c1da9bf2d09911f

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
324KB

MD5
54e8ad7495f31245fa70cb720e8dd812

SHA1
b1cc403bdea124fc82e55c2022feaa823d2ddca7

SHA256
2f4743950e4adbddb9cdc94e1e920b19a923f8391060ba92ff9193ac058f25bf

SHA512
103a507eded3c3d2672edb6d97594da0b0eccce8446beb99b7fa28a713c2b6acb16542772ed0a7ff099c9de1fcbe04fbf047ac81ef7e2932061be97c2ec99baa

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
324KB

MD5
e8f5131402bbf69e379dad0ffb96fbdc

SHA1
31f5ff7d3f81b5ad223cd5af4a71edd5546b9553

SHA256
60e8ba69c1508ecdba8ed0c1d54f8954214528334c762f2471539e81974d437f

SHA512
c7c90438c9d13ca7dec1ee29d10d76da2b1a277e95fbf377742c132f162813c597804d50fcaeeea686ac572d278cab89fc15ff504f33e9e7d4f14e20ff332082

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
324KB

MD5
c37c6a839b827d97ec5c079fe5445d83

SHA1
1065997b654b3ffad7d7997db88e1ee2e583232b

SHA256
57e665042b4311a7ae4b9dd2965be8962e47e7ed4ddc3e5d082c9c2d4b5a2a73

SHA512
99fbaf5ceaddf041a31d8734177d33a266f3d235244f1114abd4c4d23951313c5bae86c9919259a35cd56136d3aeed2bd8aad27b124a77ac4912fa04a459aa6c

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
320KB

MD5
fb397e26e31e19cd633454544e4660f8

SHA1
7e7c8a3b739cccb05e57a1ded948325c7a5cb60a

SHA256
f91ab865152931a62bb0c10d66c9ad4cf7c394c787f71c9624c6556c6e3ed311

SHA512
2ff2dc0aab66cbd1562ed1119080a4fdada7aaf72ab793f38235940246c9b5f2bafc81d89c4d60fa29dfe1a09419046d3c99d9fd95a727a0f426fc93fb43c696

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
324KB

MD5
bdbe0032278865d5eec12b84bd26ec97

SHA1
8d5f93e49fa81334d73651630af47f45e9aa33fd

SHA256
b700469565fc43709a36015823b7efad870ff635699ce6bccd00163be75186d1

SHA512
f102203a4f22f5595f159a40dfb1b31820b6db81b66e5bc41c397ac2cc8f6d7be91554e393f190ec352eac43b5f91fd81842cb321ad0e57f0e087d1cb001a547

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
324KB

MD5
df515ff23625377f968b88de8b5cfd65

SHA1
a5c8d4c420c9fe6ae2239e0279a1d418e39fa4be

SHA256
3c7b4813db6f0e0f8ddd92b4294f155e93986e766fe9d64f12d1475aa982217e

SHA512
b8b18a3c110e81f03c5d304966cf1913879e49fd3ea185ad543dbbd88b40c6de18178e44968b06b72848e82090802cc85949eab8d6e6b1420355558cc1b5e925

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
324KB

MD5
6fcbf5497e998fdf8a3680801997c754

SHA1
5f0ad7d66aa7e462f7e346659bab700aeddae4e3

SHA256
43692c7f976d8aeb7cee84357ec24b08e08a308b1b055d7fe7b6cd11278d2364

SHA512
b4609f91c3418be50e8583c7ab5a4e2afd1a5d3986ef091b420ff433ebdd429bae2750b505a66a8b83aec98c1e8eedd712171da68a2068abac4a3e5c9f9781a8

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
324KB

MD5
3ce764920029a8d78b99ef4d8200d473

SHA1
3e9fa3a2664c1fbdf93df9426c7d54ce6d8c6e05

SHA256
d3f0a75cd911bb507c955b7a6c7b2e54ce6720acaf7a9895e590272b16a59feb

SHA512
824692c8d6f13177f62261b755cb6f262c3b595dfa81d48e136e57f6ef71e95276c3a1cd3f6c34b767e5f5cdef715bbaeed62dd79c2a32a2db3d8e99f9490c01

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
324KB

MD5
bd6bb189b612e25486e82b4628957e00

SHA1
a79ff08609c85f329db9fe91f57ca80f501edd0f

SHA256
dac8d68c49106102aef4a7c47b8d26fce35df93e9abb56463eb2ca94c9a70cf7

SHA512
f16342862d25d12967bcc1f4e141680d55653345fdb2dea03b649944c78f9df2e49ab6a0fcf60ba3b5479f71fb040a3685c22c0f224e17b0567927b180b7457f

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
324KB

MD5
c297fb3450056f0590adf45674ea4c47

SHA1
ff10c6214fc0cbd1cd73bd81dcb8f9860ec8dc30

SHA256
ef4bbec918b301c42e43fb870e1876cc8c38d6e80540d0ef65e3d85c2a0a13fc

SHA512
75d703109a234f030119ab93e177635b56fb1c749e61595b0f011f545c6bd8ace08318daaafabbb68be23aa47117edb98140a4cda13aa0cfc340d7d5432eb507

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
324KB

MD5
8a0ae671f76e0f6e6881524b05bada2d

SHA1
b40e7679c718a7f7f7f748dc7b48eae580d53781

SHA256
cbe5861d7460c16b8a04ee98a1814120be239fe627e8f737b9ffaefa7a591e81

SHA512
5d5dabc9b7dbac0c907049cb8d48434c88039883d881624db6e39695037bbf00194a4cddbabdd288313f08211f537ed44259cca275fcab69515e81a234baa751

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
324KB

MD5
326888acb3d6c673d76034fabb54bbd2

SHA1
a1ea02623bb857893bfa47c3fb904478ddf4a6bb

SHA256
1c0c03e8cde1d02bfda6c818ad5bee2c0155a80a3d43cac20dcc8bfe718ec108

SHA512
4cfd8ee6d5756cde733c4bc82318e1898ab0bf3042ffd24d360552ea53a4ba3057d396f8e96388929fafcbc5178abdb369e0bc3b488c3f247d3c82b32effbc91

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
324KB

MD5
550bfb6330db50827df5bbbc9af60300

SHA1
755617e119eb26afc25921f388e9772f88b8fb5f

SHA256
7d38fa3982fb63fe5240e341b9318889a551c884ddf2be9df91534a89113ec72

SHA512
9bb9d8f7bc0ebbad5fa0f924bbaa711b0f8e0e0862b45db8cc2d9edc3a6e41b14e97e5cacbbac0182ca251a13af17061952f80ff34de67c93d9d685d7a5fea82

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
324KB

MD5
7829ba94eaccf7f8bc18cad4c231d063

SHA1
936c7534e5b73a1b95467cd3f8679983d99f3cfa

SHA256
f4fed4726b59a76f74327a88f46c2271d1eed77e506660064b1d029cd42d2c50

SHA512
619ab98c65224e079d64a667a9923da4b312371c14d3bebeddd81ce6d52185519f2a2d1ea92e13ecc68890e064b8093384672dddfb633fc2fd9b914c17700118

Download Submit
C:\Windows\SysWOW64\Lnlden32.dll

Filesize
7KB

MD5
6f68b71cf761db481f8ca7f3a818fe83

SHA1
037b5fee2930153ed722023946d3d2bbbeca287e

SHA256
649f5609234f34fb129ce2e921d949f92ae61bb3c705de76363252cbc1a2c8b8

SHA512
7bc1d1e5ba4b0aae102ef510d487b8a10a018e11118a795bc69f3dc74abd948ff9acf9bf3a44ee53617078abb6efe548f31e184bdbf264f7c55838732b8d8416

Download Submit
C:\Windows\SysWOW64\Pdkcde32.exe

Filesize
324KB

MD5
0c45649aa46278a949727fec6126daf3

SHA1
ad176e8dfb811c219b1afe1212ea4e54f1e7cd35

SHA256
c13aafff60575f20dd8c82e03a5ca2f7818e8a0677d778287bc8e37da94d1fcf

SHA512
4a0f4e40c9b4a7fe8804f1eec16c70ce150ec578e5d6acbc53bc7df869ff9e73e59957d2bafda2a73dbe660209f3f9038f0b564d39ff9e2f1a1e3334ad457dad

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
324KB

MD5
3413b2be4edc4c0a2b2f5fa4d44f9653

SHA1
c60b187692939381d7bfd73a9c9ac0f65ff87704

SHA256
65ccc5f83c36d534d3cdc6eb7938a8b059336b46f344d2d44d12e69229860f8e

SHA512
ed74a3f78e9eda8b1b6f5b755afdf60d185114d9cacd2fa5ad9d7fcc28d028e45c89b03ad4a987929675ca3767796f3c3bbed934f629c5156e0b786790efcbfd

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
324KB

MD5
6aae678de2740b72723c472b30c29456

SHA1
14d44327fda7fd7bb62873d776fec2a2e8f58166

SHA256
1a0dc7b0ebf4b156cc5cd252a48e623e3b75ddb8382e1cf062365a7fafb951fa

SHA512
36ac304438f60404334d0a62ffe7c42ca0e90e01324ede7807b106bf4fcd3b520f501ee9cd51d693a28fd33f6560d1b7dd396feb387a50a24f35f501dd72f493

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
324KB

MD5
ac5b2c9d467369112b2f20e238363675

SHA1
ca6f1513d71ed5f3387e1ebce19ca7d2d8c697cd

SHA256
09ef03ae4766fe056719ec3c9681360d70a0e5393c0baf87ffab5239be0c3ab4

SHA512
89ab809a98d7ecd1c1869174e50466f9dd9906b95006067bfa9e658bc8959028ba300a3466ca79af920889e5ccfa0fb77967ad7abefa6cbfe885726679fea1fe

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
324KB

MD5
ec8189a20fe52d261aaf399917bc2530

SHA1
16c3e839b271624f7c7aad9e33c8f7d8efda663d

SHA256
edff6b553f8687c62c4968ab1496c0cee1a9049b6ea55b99944dcfc3a7e3c8c7

SHA512
08ee84a6311273ccc05a64e81baf49a7a6755b98b408e1ebcc2c6b1c794637aebb6413da32a1d8f0a4b67c105b363de1a98b20d255df34f1320a3c5574a85b5d

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
324KB

MD5
c4ec7ebfdeba83ebf8b2ecdb1a243903

SHA1
5b574dd7d8bde17698b8647cd25220157b87a66e

SHA256
31b24048a93b8507064c0d3015564f6640f7b6031629755c21bdc0eb6e801155

SHA512
86e64bdcc053a4e5ced599b23114b365563629383386fd84b3d05ac1691b0f4e796ce8824db903efd13dba77544b36b99c2fa0063e634cc30ced8eb0228b36f4

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
324KB

MD5
970ee4983329f30f0238acd929b22018

SHA1
8f69ac80753141e2943b43318b7057b260c5d125

SHA256
4d2c23ef2cac054fef075a64b3b29323480cae74a0b4fde918a765d4a22ff07f

SHA512
b1e9a51825b370579a6364ca9be66d7766cb3735f49e27c5f7ac8e8f612ef14edfb6a2f6c99fa41a326d24dc6305387ac02c485fb93a069504c4abcea451d18e

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
324KB

MD5
f5d065cfd6712848e9bcc68abc96e7ad

SHA1
b811ab148d9b4a417cd44b542364919665ea5871

SHA256
0a576632f5e72358248dadcf93c1d9b44b302a610a29074e6bfbe91e06529833

SHA512
53b2e4ae4a8d7ff4d442e937a9a5f1b3d8952ae2fba92246dac8fdc9036d5f5353e070bf96723c2dc0b071e13449e04bb24f5222eda1d202d212d75827bacc46

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
324KB

MD5
ad540d505cdd1fde8e37b683b23a0bad

SHA1
ee32a571a33f4b9344cb2eef3292f725cdc4b9b4

SHA256
aee7983e017619e5ca163aa49e893069cdf418487c762dc67cbb31c592769e90

SHA512
c7cead229f6e96284efb9116d3b0a94355fda91b180112171748439a43847e198188a0e01362c8d3cb85ca335d2c968144ffd0442806a39f37d404d229373814

Download Submit
memory/348-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/348-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/452-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/452-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/460-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/460-326-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/904-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/904-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1060-321-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1060-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1084-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1084-271-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1188-301-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1188-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1684-289-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1684-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1704-319-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1704-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1740-295-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1740-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1932-297-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1932-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1976-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2028-305-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2028-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2108-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2108-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2232-267-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2260-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2260-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2324-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2496-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2496-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3024-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3024-287-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3384-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3384-273-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3412-309-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3412-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3560-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3560-278-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3700-52-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3964-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3964-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3984-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3984-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4032-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4032-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4188-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4188-324-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4212-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4212-243-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4288-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4288-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4368-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4368-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4616-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4616-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4624-303-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4624-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4848-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4848-307-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4980-313-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4980-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5104-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5104-315-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads