054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12.exe
Size

224KB
MD5

f9bbe094182fdeea7c12e1b971c0165e
SHA1

8c992b486fb18cd26a55a3cc0a9bc01727d985f5
SHA256

054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12
SHA512

cf1a83ee5725850b6105f55f7c85a4f20e9c6da984ec15793f3e96e7eff918ddea19623cf4084d7fdcff5ebfcbd911604a52a836304df78b5f446f6c37cb1851
SSDEEP

6144:B+Imhmes5vPlF34rQD85k/hQO+zrWnAdqjeOpKff:kIj5vPlarQg5W/+zrWAI5KH

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipknlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odkjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdeoemeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eemnjbaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icplcpgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkoiefmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbjcolha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlncan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gofkje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblngpbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngmgne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmnldp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqfdnhfk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhemmlhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcllonma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oflgep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe

Executes dropped EXE 64 IoCs

pid	Process
1380	Deoaid32.exe
640	Dohfbj32.exe
3952	Dhpjkojk.exe
3628	Dahode32.exe
2828	Dlncan32.exe
1004	Echknh32.exe
3768	Elppfmoo.exe
5012	Eoolbinc.exe
3084	Eekaebcm.exe
2508	Eemnjbaj.exe
2256	Edbklofb.exe
3928	Fcckif32.exe
4120	Fkopnh32.exe
3820	Ffddka32.exe
3208	Fhemmlhc.exe
2996	Fckajehi.exe
1704	Flceckoj.exe
4364	Gkhbdg32.exe
456	Gofkje32.exe
4104	Gdcdbl32.exe
2932	Gkoiefmj.exe
2292	Gblngpbd.exe
3564	Hkdbpe32.exe
2268	Hkfoeega.exe
2328	Hmhhehlb.exe
2140	Hecmijim.exe
2336	Ipknlb32.exe
2228	Ipnjab32.exe
2004	Ildkgc32.exe
3136	Ilghlc32.exe
4736	Icplcpgo.exe
3624	Jmhale32.exe
4472	Jlnnmb32.exe
1812	Jianff32.exe
2236	Jbjcolha.exe
1492	Jpnchp32.exe
3000	Jeklag32.exe
2212	Jcllonma.exe
1788	Kiidgeki.exe
3748	Kfmepi32.exe
4820	Klimip32.exe
2936	Kebbafoj.exe
4320	Kmijbcpl.exe
4664	Kbfbkj32.exe
2216	Kmkfhc32.exe
4744	Kdeoemeg.exe
2100	Kefkme32.exe
3652	Kplpjn32.exe
1212	Ldjhpl32.exe
4172	Ligqhc32.exe
1276	Lpqiemge.exe
2092	Lbabgh32.exe
4460	Likjcbkc.exe
2660	Lgokmgjm.exe
2308	Lphoelqn.exe
1996	Mgddhf32.exe
2960	Mmnldp32.exe
2656	Mplhql32.exe
3452	Mgfqmfde.exe
2420	Mlcifmbl.exe
1388	Mcmabg32.exe
4840	Mmbfpp32.exe
4340	Mgkjhe32.exe
1604	Npcoakfp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lgokmgjm.exe	Likjcbkc.exe
File created	C:\Windows\SysWOW64\Fdjlic32.dll	Odkjng32.exe
File created	C:\Windows\SysWOW64\Qjoankoi.exe	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Dlncan32.exe	Dahode32.exe
File created	C:\Windows\SysWOW64\Agocgbni.dll	Npcoakfp.exe
File opened for modification	C:\Windows\SysWOW64\Ngpccdlj.exe	Ndaggimg.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Hkdbpe32.exe	Gblngpbd.exe
File opened for modification	C:\Windows\SysWOW64\Kdeoemeg.exe	Kmkfhc32.exe
File created	C:\Windows\SysWOW64\Chempj32.dll	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Bqbodd32.dll	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Dahode32.exe	Dhpjkojk.exe
File created	C:\Windows\SysWOW64\Pqknig32.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Mnepdqjg.dll	Elppfmoo.exe
File opened for modification	C:\Windows\SysWOW64\Ilghlc32.exe	Ildkgc32.exe
File created	C:\Windows\SysWOW64\Npcoakfp.exe	Mgkjhe32.exe
File created	C:\Windows\SysWOW64\Gnbinq32.dll	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Glgmkm32.dll	Nnqbanmo.exe
File opened for modification	C:\Windows\SysWOW64\Dahode32.exe	Dhpjkojk.exe
File created	C:\Windows\SysWOW64\Likjcbkc.exe	Lbabgh32.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Eoolbinc.exe	Elppfmoo.exe
File created	C:\Windows\SysWOW64\Kefkme32.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Npmagine.exe
File created	C:\Windows\SysWOW64\Ajanck32.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Ajanck32.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Pkfhoiaf.dll	Oflgep32.exe
File created	C:\Windows\SysWOW64\Qeobam32.dll	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Kpmmhi32.dll	Dhpjkojk.exe
File created	C:\Windows\SysWOW64\Jianff32.exe	Jlnnmb32.exe
File created	C:\Windows\SysWOW64\Nenqea32.dll	Nilcjp32.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Ifjigbdo.dll	Hmhhehlb.exe
File created	C:\Windows\SysWOW64\Nnqbanmo.exe	Njefqo32.exe
File opened for modification	C:\Windows\SysWOW64\Olmeci32.exe	Oqfdnhfk.exe
File created	C:\Windows\SysWOW64\Deeiam32.dll	Pjhlml32.exe
File opened for modification	C:\Windows\SysWOW64\Mmbfpp32.exe	Mcmabg32.exe
File opened for modification	C:\Windows\SysWOW64\Pdifoehl.exe	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Pfolbmje.exe	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bganhm32.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Bmemac32.exe
File created	C:\Windows\SysWOW64\Ldjhpl32.exe	Kplpjn32.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bnkgeg32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Gkoiefmj.exe	Gdcdbl32.exe
File opened for modification	C:\Windows\SysWOW64\Ocpgod32.exe	Olfobjbg.exe
File created	C:\Windows\SysWOW64\Abkobg32.dll	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Ipnjab32.exe	Ipknlb32.exe
File created	C:\Windows\SysWOW64\Iedoeq32.dll	Gblngpbd.exe
File created	C:\Windows\SysWOW64\Cdbinofi.dll	Jbjcolha.exe
File created	C:\Windows\SysWOW64\Kplpjn32.exe	Kefkme32.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Deoaid32.exe	054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12.exe
File opened for modification	C:\Windows\SysWOW64\Gkhbdg32.exe	Flceckoj.exe
File created	C:\Windows\SysWOW64\Debdld32.dll	Olfobjbg.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Echknh32.exe	Dlncan32.exe
File created	C:\Windows\SysWOW64\Ilghlc32.exe	Ildkgc32.exe
File created	C:\Windows\SysWOW64\Ihlnnp32.dll	Jeklag32.exe
File opened for modification	C:\Windows\SysWOW64\Dohfbj32.exe	Deoaid32.exe
File created	C:\Windows\SysWOW64\Edbklofb.exe	Eemnjbaj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6684	6588	WerFault.exe	238

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbpfgbfp.dll"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfnbea32.dll"	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Flceckoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdkpdef.dll"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blfiei32.dll"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmgmnjcj.dll"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aipoal32.dll"	Dlncan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Elppfmoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feibedlp.dll"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjpmk32.dll"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpqiemge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chempj32.dll"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdcdbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpllc32.dll"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dahode32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbinofi.dll"	Jbjcolha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beihma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjgfjhqm.dll"	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eekaebcm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmijnn32.dll"	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chmhoe32.dll"	Ojjolnaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdfloja.dll"	Jcllonma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elocna32.dll"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Namdcd32.dll"	Kefkme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kplpjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odkjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehaaclak.dll"	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eonefj32.dll"	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaheeaan.dll"	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihlnnp32.dll"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njkdbljm.dll"	Eoolbinc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ipnjab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deeiam32.dll"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Aeiofcji.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 1380	232	054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12.exe	87
PID 232 wrote to memory of 1380	232	054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12.exe	87
PID 232 wrote to memory of 1380	232	054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12.exe	87
PID 1380 wrote to memory of 640	1380	Deoaid32.exe	88
PID 1380 wrote to memory of 640	1380	Deoaid32.exe	88
PID 1380 wrote to memory of 640	1380	Deoaid32.exe	88
PID 640 wrote to memory of 3952	640	Dohfbj32.exe	89
PID 640 wrote to memory of 3952	640	Dohfbj32.exe	89
PID 640 wrote to memory of 3952	640	Dohfbj32.exe	89
PID 3952 wrote to memory of 3628	3952	Dhpjkojk.exe	90
PID 3952 wrote to memory of 3628	3952	Dhpjkojk.exe	90
PID 3952 wrote to memory of 3628	3952	Dhpjkojk.exe	90
PID 3628 wrote to memory of 2828	3628	Dahode32.exe	92
PID 3628 wrote to memory of 2828	3628	Dahode32.exe	92
PID 3628 wrote to memory of 2828	3628	Dahode32.exe	92
PID 2828 wrote to memory of 1004	2828	Dlncan32.exe	93
PID 2828 wrote to memory of 1004	2828	Dlncan32.exe	93
PID 2828 wrote to memory of 1004	2828	Dlncan32.exe	93
PID 1004 wrote to memory of 3768	1004	Echknh32.exe	94
PID 1004 wrote to memory of 3768	1004	Echknh32.exe	94
PID 1004 wrote to memory of 3768	1004	Echknh32.exe	94
PID 3768 wrote to memory of 5012	3768	Elppfmoo.exe	95
PID 3768 wrote to memory of 5012	3768	Elppfmoo.exe	95
PID 3768 wrote to memory of 5012	3768	Elppfmoo.exe	95
PID 5012 wrote to memory of 3084	5012	Eoolbinc.exe	96
PID 5012 wrote to memory of 3084	5012	Eoolbinc.exe	96
PID 5012 wrote to memory of 3084	5012	Eoolbinc.exe	96
PID 3084 wrote to memory of 2508	3084	Eekaebcm.exe	98
PID 3084 wrote to memory of 2508	3084	Eekaebcm.exe	98
PID 3084 wrote to memory of 2508	3084	Eekaebcm.exe	98
PID 2508 wrote to memory of 2256	2508	Eemnjbaj.exe	99
PID 2508 wrote to memory of 2256	2508	Eemnjbaj.exe	99
PID 2508 wrote to memory of 2256	2508	Eemnjbaj.exe	99
PID 2256 wrote to memory of 3928	2256	Edbklofb.exe	100
PID 2256 wrote to memory of 3928	2256	Edbklofb.exe	100
PID 2256 wrote to memory of 3928	2256	Edbklofb.exe	100
PID 3928 wrote to memory of 4120	3928	Fcckif32.exe	101
PID 3928 wrote to memory of 4120	3928	Fcckif32.exe	101
PID 3928 wrote to memory of 4120	3928	Fcckif32.exe	101
PID 4120 wrote to memory of 3820	4120	Fkopnh32.exe	102
PID 4120 wrote to memory of 3820	4120	Fkopnh32.exe	102
PID 4120 wrote to memory of 3820	4120	Fkopnh32.exe	102
PID 3820 wrote to memory of 3208	3820	Ffddka32.exe	103
PID 3820 wrote to memory of 3208	3820	Ffddka32.exe	103
PID 3820 wrote to memory of 3208	3820	Ffddka32.exe	103
PID 3208 wrote to memory of 2996	3208	Fhemmlhc.exe	104
PID 3208 wrote to memory of 2996	3208	Fhemmlhc.exe	104
PID 3208 wrote to memory of 2996	3208	Fhemmlhc.exe	104
PID 2996 wrote to memory of 1704	2996	Fckajehi.exe	105
PID 2996 wrote to memory of 1704	2996	Fckajehi.exe	105
PID 2996 wrote to memory of 1704	2996	Fckajehi.exe	105
PID 1704 wrote to memory of 4364	1704	Flceckoj.exe	106
PID 1704 wrote to memory of 4364	1704	Flceckoj.exe	106
PID 1704 wrote to memory of 4364	1704	Flceckoj.exe	106
PID 4364 wrote to memory of 456	4364	Gkhbdg32.exe	108
PID 4364 wrote to memory of 456	4364	Gkhbdg32.exe	108
PID 4364 wrote to memory of 456	4364	Gkhbdg32.exe	108
PID 456 wrote to memory of 4104	456	Gofkje32.exe	109
PID 456 wrote to memory of 4104	456	Gofkje32.exe	109
PID 456 wrote to memory of 4104	456	Gofkje32.exe	109
PID 4104 wrote to memory of 2932	4104	Gdcdbl32.exe	110
PID 4104 wrote to memory of 2932	4104	Gdcdbl32.exe	110
PID 4104 wrote to memory of 2932	4104	Gdcdbl32.exe	110
PID 2932 wrote to memory of 2292	2932	Gkoiefmj.exe	111

C:\Users\Admin\AppData\Local\Temp\054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12.exe
"C:\Users\Admin\AppData\Local\Temp\054f5767bf7aba2e556cbd3aa72ca4b8501538179f29dec6567b2dd868b2ba12.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\Deoaid32.exe
  C:\Windows\system32\Deoaid32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\Dohfbj32.exe
    C:\Windows\system32\Dohfbj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\Windows\SysWOW64\Dhpjkojk.exe
      C:\Windows\system32\Dhpjkojk.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3628
      - C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        24⤵
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        25⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2328
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        27⤵
        Executes dropped EXE
        
        PID:2140
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2336
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2228
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        31⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3624
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4472
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        35⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2236
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3000
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1788
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3748
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        42⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4320
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        45⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4744
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3652
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        50⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        51⤵
        Executes dropped EXE
        
        PID:4172
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1276
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        55⤵
        Executes dropped EXE
        
        PID:2660
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        56⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2656
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2420
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1388
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        63⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4340
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1604
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4976
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:512
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4788
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        69⤵
        
        PID:908
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        70⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        71⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        72⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        73⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4304
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:796
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2332
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2132
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2632
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:992
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        80⤵
        Modifies registry class
        
        PID:4284
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        81⤵
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3596
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        83⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1056
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        85⤵
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        88⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        89⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        91⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        92⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        96⤵
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        97⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        98⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        99⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        100⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        102⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        103⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        104⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        106⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        107⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2000
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        110⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        111⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        115⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        116⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        117⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6000
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        120⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5184
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5288
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        123⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        124⤵
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        128⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        129⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        130⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        131⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        134⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        135⤵
        Drops file in System32 directory
        
        PID:6016
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        136⤵
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        137⤵
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        138⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        140⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        141⤵
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        142⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        143⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        144⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 408
        145⤵
        Program crash
        
        PID:6684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6588 -ip 6588
1⤵
PID:6636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bmemac32.exe

Filesize
224KB

MD5
d3b6e0e43149072f7f5441c174512a6d

SHA1
a0dacc6117cf3c1053d777f8bd10bb6b5413952e

SHA256
6e1880a726341f51d2ef0ad381277ef8e6058e5ed133ce9558bdb2ec72af4eb8

SHA512
8f83638627e3af839f2ea990e021f3d7390fc85f585c06b4c46e8afd0a6a23d9be5a0e795f738c0fe3b62ad13b19b63d88958b9f367c001e63d3d1229cb13599

Download Submit
C:\Windows\SysWOW64\Dahode32.exe

Filesize
224KB

MD5
93e93751e583351ce8e88c3d31f2404a

SHA1
8e771814427dac38827faaeafc1afda5cfb39854

SHA256
432c31bcd9c997cad49f74ef79425f304624de61d0321ecf89f7c43bd95a8c50

SHA512
6606ed61599ed79abb5b07b381a7520bc332a69e26459fb327f4a5aae54f83bc5cac80be793becf4ddf29c34786505315264a19310e8d580a3edb54ac701d536

Download Submit
C:\Windows\SysWOW64\Deoaid32.exe

Filesize
224KB

MD5
8a17792583823da839a76d006342ab0a

SHA1
b16f3453f8ebf0de06f9f9e97cd01d04c8469aee

SHA256
59c0b43cce508d5166265a21d93848a13deee58b2384f3e8529c46de276271d8

SHA512
1ec4bd27f512b390d2fef1bd3509eea0388de7b33dc3c72939d2dc777f8047a6c6b4b648061ea949bf43093e9cef70210d14e7890919e2dbb0237a84fd3db240

Download Submit
C:\Windows\SysWOW64\Dhpjkojk.exe

Filesize
224KB

MD5
05cf347bcbf271e3a69931cebec7aa8a

SHA1
ec5d92e3e4ab8e6e4b2eb19f4f0f879dfa2b0c90

SHA256
b4cbf649083dbc176317cbfab129b5de67065bd60b2b9e38af89da43cb6d4e4b

SHA512
91a5e18141eeb2d1fdd49b9ab7915eabb2dd57af1b2a2a203fccbb250307f2f185b17eb045db1c6c7adadb9cf6ff0f4d573d340e9cae8e60eb696208954c9b67

Download Submit
C:\Windows\SysWOW64\Dlncan32.exe

Filesize
224KB

MD5
8e80b088f7887494635e9ee095ab325f

SHA1
7bead9eaa27caa256413d3982194d1c74ad62d07

SHA256
09c9eee668d2261ca67782de701c6620ab1111e11e4cdccdc301279a363f7c31

SHA512
8d6308f012301d4af0e4c3d2d7b73daa251b3d18874fbc272f8dd30ccc9578ae2e266751175a08cc24dd90676716d2fdfce0d12338ab08467acba53164558aa4

Download Submit
C:\Windows\SysWOW64\Dohfbj32.exe

Filesize
224KB

MD5
31461a0e3791969ba9661e895b96a46b

SHA1
a2d4e7f69faa0ff9cfa2a8c38c81670748d0888b

SHA256
e1290d7f19544d3cfb062e2f93373d32b611c43cb4d089e8de0df4dbe3bc7d78

SHA512
ecfb69d83bdb87ad7e030920f87f6f08d7e7ade2f7031bbb8b83af5d4f69ccd7fd551daa62f6c4ef97ab568d4c30af9d7541b5db23866a3090ebf1aec950827b

Download Submit
C:\Windows\SysWOW64\Echknh32.exe

Filesize
224KB

MD5
04b61f6e6660a8f85bc3e1aeb68453ab

SHA1
0098369c5b3a4925ebb184195effaa480ef01321

SHA256
d72605440471b0f89d3b5c66d33d3fdaac690766489314f731e4428c71a50705

SHA512
1401665ee8f5d47d71b56a225541f1b9bd9625b643840466901b538638e35438d0a935cf60e9c83d3e81dff130101f428d7aa16e23b8f380d23b7b9adc9358fd

Download Submit
C:\Windows\SysWOW64\Edbklofb.exe

Filesize
224KB

MD5
e283dc78819a9ede4f7bc4940db0e6c5

SHA1
60bfb533ec3e98c5934447f64f9ee0cf8460cfe6

SHA256
26eeaefb2581cf6e056ad6086444a08de144a1488bb0f22a161eb7799d998a62

SHA512
8cb5074ddb303f52f5b47cabde181e66d143007599cb199bf34985428700efb16fd897eb0f8e81ee9f82e4e7bd1345fc81a8278568441166b229bbd057eae675

Download Submit
C:\Windows\SysWOW64\Eekaebcm.exe

Filesize
224KB

MD5
218150edf38945ed1c938d6cf5348328

SHA1
8e8e46a59a4c6ee2c370b46f042197c3401fafc5

SHA256
4093c8d6ebbddd72ae34b3bbf14e50e3716e4029a3d3086baf0e03c3e3308228

SHA512
e40dc79abd61659432c23eea181d8fa66dd93d3785ed8e8ce7c76aeb0b86321667029ecddf77c702840ea86093ef4acb90910e63b6798c52af9eb7bf8b557c17

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
224KB

MD5
068cb4bf18450ca46cdb63b7b768387a

SHA1
feec9ac1eabf1094c86f1a6eb663afca506b99c6

SHA256
45a3c8ed624503a4005e9573ac123063916d0c8db3319f60b8b151162025d2d8

SHA512
6fd01000e4cfbe6b848a9fa0b0b546ffc2b6f6bb8240dc81b5771de5f9eab640a74b7bb64f0d2fd83cc0c95422f15e9f668efffa4c74edd48e58bc7df97bd52a

Download Submit
C:\Windows\SysWOW64\Elppfmoo.exe

Filesize
224KB

MD5
5531c562ac1899cf18f34f463cf76b7b

SHA1
181f3a6e13b1f42fe4775e3aea158ab9f65afad8

SHA256
a3ca2e3813ffc710597c22eccd328f0b1a5f69608d9023b4d938011ff9eef2b1

SHA512
e5ffb57450908f0ae6b29246fe02b491cb0a37c80df332e2e9e714a0d3d643791d2c9b079d883487542f71570feb66590a6a112416e7f1a620ee4c82dbe714ea

Download Submit
C:\Windows\SysWOW64\Eoolbinc.exe

Filesize
224KB

MD5
b0d7865eba3cf4a7fd6f71429105f598

SHA1
526fc20c8674fece92a134839c60cf07bffae162

SHA256
7969fd700d96b74f9cdf794e65f12a13a4dfeb95a6e9c031b88a58d09f8f96ae

SHA512
70f9b9edad2c58d3824c6fe44d9fd953591158d0c117852b2fe79a58c951c22ba7da299a6ed599723a8a74c304d82160dc4729bf386be89c69256aad93e57a55

Download Submit
C:\Windows\SysWOW64\Fcckif32.exe

Filesize
224KB

MD5
c3c2cc768ee28b9108c0dad3a47cb178

SHA1
7db7ced4bdb1ebfd5b38bde4fba701fbf7cc03c4

SHA256
6d2885c0f661ec1810e02222dbd7bdd6933476ed5562dc7622e27e3e49989143

SHA512
794ab1780428df17ab79598478ebe73d7185e82fdd8ff85fdeca9242a940baa3154d37188471cba7a74e5ee5eec1d49f1837811cb73587f7a48eae0f16761a59

Download Submit
C:\Windows\SysWOW64\Fckajehi.exe

Filesize
224KB

MD5
447530feb7bf0d69546bf403d67cf553

SHA1
b41d914f0b9831c7df13b8f97f4f32aaf5af3cd6

SHA256
dd3462d496bfd873721f163f4068d645f8670adae06d94cc9ea5c8dfd85f402b

SHA512
29d753cf09c6b99ff0d5a2fd2caf0d311448af57df892a2e4291ff6876b3334cd547849c2ee9c09d4289013b58efd3b823e0f901f4fc9da691164d901f61602b

Download Submit
C:\Windows\SysWOW64\Ffddka32.exe

Filesize
224KB

MD5
b4c8258b083b36ee8ccb5bde88d64f35

SHA1
6a8a4dcaa87c7c3d42751a922e283e5eb38009db

SHA256
92158cb84f8f1c9567bf0cf956b55c1ae157f0385f398060fda5057fdff85811

SHA512
8410be3aef213ad76740c512ed152a9096d8ec5968ed605bc692e5cbd61f00c5db94cd62f3314a80b1da31623fb41936be386064d9005c544651e640e5d2cce1

Download Submit
C:\Windows\SysWOW64\Fhemmlhc.exe

Filesize
224KB

MD5
983ab50ff13f307deadc8bf023b38eb2

SHA1
f6fd937405d8d84e7db8f42f8c4c3e76e4b11484

SHA256
194c355e5d4668a238eedde08f56e608fcee738b704f92e1261130a57fa69ec1

SHA512
1e983df1213fd241852243b6dc768c1def32e1eb3269b066e2f7e7152aed57e5aab49882d69541094108a196fa29428da06bde5fc21e2cf9d7dc86afe5404f94

Download Submit
C:\Windows\SysWOW64\Fkopnh32.exe

Filesize
224KB

MD5
cb5633c5aa553fbd72e7a112be24b271

SHA1
0272de09cb50194933d6820b8958af379ef7c3c9

SHA256
e66a0196c64b6e25c772325b1baadf9631c024f870d4f47996650b7d662ab01c

SHA512
282b876ce7e082d353a0a1c221896af15db0d3a06a18a31fd441e80b4fddb60f4989dfcdc08d96a37c386af50efdf52875f4411ae9269927981e7fb613af35c2

Download Submit
C:\Windows\SysWOW64\Flceckoj.exe

Filesize
224KB

MD5
04567ce65e915cd9bec270fcc2fa10fe

SHA1
ae61921426487380eb192be7d49867ddce31269e

SHA256
cca59683bc637e44673ecef91da0a39e3679a14cf7bf1c42c1af14b4edf392ca

SHA512
2f0accb7e04a707b8e5449886e5f3312e7e3fc654af2a083939027ee39ec1ed9cd92fac6ae85f011858c85038a18ae11259a3a8a29ebcf12c7a83c46a0e8458c

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
224KB

MD5
78164bc413f0297c9f5550078444c910

SHA1
c7fbd3920c00214d68d32d0ac63e6d7c5182b429

SHA256
0e7c8123ca88430470a9d7e6e416305326054cb46c0c293762bc07590b605a72

SHA512
18617d5c200902f5b1a2283a89e9d31d01d1e9de786ebde7a5ad80ac552871c3af85d3f5ff7d6a6483265f81e2b1d2b4b82223277d1005616186923e5bab5911

Download Submit
C:\Windows\SysWOW64\Gdcdbl32.exe

Filesize
224KB

MD5
ba79c993e7ae04b54514d83bd3ec6ff5

SHA1
9f2d89e2f9951724bd5795da4c0818de1ef8fe10

SHA256
39b1e094317a5e917f95890fe2a1816abaf3af691456721189d3560b70bc307c

SHA512
533dd362d2a7af548a6b2f15f7b3a1a00105fb5d89ad4d1d2fc5cd7a49e5c76583c78151b5fdb8e9394adf720ba385cfac630454a145fd71df76d20ee1e5d7be

Download Submit
C:\Windows\SysWOW64\Gjihje32.dll

Filesize
7KB

MD5
d679b2313ef9c6bb952bf7a7f35a1575

SHA1
610ccf73c9eca4d93c8af70e40dc89a3de39b4a3

SHA256
a5af4f0272e473a8f10b3d3b82bf4d47bfeb744501e1863f8f7957b13b20b9d8

SHA512
8df8dc0fe9db9ca28e58e0891d520cfdef88a6d1fc879296be91c9af2c646808e576fc2e8eaa1ebcaa969d56aa4289eb9bb1144c3163adc2568e5ea51f3706f3

Download Submit
C:\Windows\SysWOW64\Gkhbdg32.exe

Filesize
224KB

MD5
c085e5249605f5bc4e203f712696d154

SHA1
2c9e72c7002f302d4c35439418494f22fa85ea65

SHA256
a6e9fafa7dbc374a0b231fc193b63d473bc2eb6eab72adb33be067c01e361e3b

SHA512
132738ab82cdf7ece5de25c3bad4c2e01ff921ba1f0c34873dde4b82ff558bab7a83fc20e3459254718db4d3cc869b9a2b7a7924fb88309cecfdb81b597433fd

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
224KB

MD5
179dd0787f3d24b33ce28caeb02e0f87

SHA1
99dae9d9ce5ceecb2f67742ab0b4d32df8d33b4e

SHA256
9f47deb66647fbb18e123b14ee30601cde2587f3d508ff87961c3cd2e8aa4abd

SHA512
6e73f2f80ece5f45fa3c6498b8c6aa6bf65ea56b6b8ee027cd2550ca9e97de81d0e1258b74b5a9090d5cc3fcc70094dd50ce1912f2f8a0621c75f13fffb1aad5

Download Submit
C:\Windows\SysWOW64\Gofkje32.exe

Filesize
224KB

MD5
31d294e15b26b1072be8f3a69cc94251

SHA1
7449baaa4809e402c6e9b649258bf488d213fdf3

SHA256
cf46b7e6f86041ba4ce09734929edaaa9b16f7e146cf897d39dc236bd779be80

SHA512
ee0dc1fc8f29711da13d2799aa3646601ae3fda1edaa64c74bab8eed95603e970abe93432a923484b0747f518a5c0f1adbd77238c909065548c222523b15b2c9

Download Submit
C:\Windows\SysWOW64\Hecmijim.exe

Filesize
224KB

MD5
5cc7c7f623bd5c7495e2f2551c1f45b7

SHA1
20db869c343c8d28008d7d829710d0a514fa66ca

SHA256
2265e9845fdbc19ce45e668cedba08b3376a6c26eb17dccf1cd4025bf30876e1

SHA512
da1586ab7e920a253aae8b887c02bb96aa33b193b12119bcaa74b18c5c1196e5ac7029fde8312504c07d850af0e654ee6ab5992d2050eae5b672a4a15e3bc365

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
224KB

MD5
73706e56fc0a1b4cb9bda818e347b79f

SHA1
8c671efa4f0b25da213206cc396f754a64ec0d05

SHA256
553557b75b4ff25c523ac7a14e47fc28fbb64a039c903c81ffa9df117d1b4196

SHA512
abc8f2db145be7492ee30a7ea0de9d7f63463601b3686a35e07f8de4bc43a13376664193403813e90743daad219ec7008528fe76e1d7980a986f78d1360194da

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
224KB

MD5
98a1c7cd79deafc5415ea871c8d0e22b

SHA1
6756cd9c8685a0b65c740ccd92f38581e3b38c29

SHA256
574217c7d5dd684de1101e96b2fc8944ab1ecd912c332954f838e447e5e9ff95

SHA512
4c3c43db59bb554dfb2efa40799e9f91eac1557e68170d6008a2915470395ccadeb123bea26c9920606028ae108ac2f13b530a206299d226cfd861c63eb69199

Download Submit
C:\Windows\SysWOW64\Hmhhehlb.exe

Filesize
224KB

MD5
87b8c454922f7f7080c4339e1c6b31c9

SHA1
61af7ca4cae979d5ad94c903090773aa4227e28e

SHA256
3d8a3d2b4dc161427291e94bdeb1c47fdd7236abf8be3da79e2f615e817857ea

SHA512
a13bfac4ddcdb7e8f350d1bc1e254dd572e364a534288a39ef7b685b29200483066e61feb47ea9c283a2d94396a616cc4a36e9b827c06bfb99ff8959fe687bda

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
224KB

MD5
e69aba18f1b91188d0bd69054cdfed7d

SHA1
7b8d3ab4b5d2ccd83e3b976510e6570282c4b7b1

SHA256
a85fba1af800d84a97201376c6622ec8bbf388997008fe6ddf23e1bbb8b5d43b

SHA512
ef95189c13f3e5aa8be594569d77544db0070f2787cc87ef50d586fbab0b43efd60ba84b9a449853946401ae70a2800878f7535695e665155b2d19d1e3b9ceb0

Download Submit
C:\Windows\SysWOW64\Ildkgc32.exe

Filesize
224KB

MD5
402a0af45bb479484429471c2b9396fe

SHA1
21e5445b61daaa17fc40d6594a2498c37c96e5db

SHA256
1015d17102a3bd3be73ccf2e02210928174245f75114a3c8973354f363f0f78a

SHA512
a8ecbe1f1eb38ef3f76476fa6314a522f7b6fd23d89048708c0e5d9075fb3fe0efd56a6f6552fcb3cc2adf5b556508de759fe6a9716c3e3b63707d6eb7feb8c8

Download Submit
C:\Windows\SysWOW64\Ilghlc32.exe

Filesize
224KB

MD5
23aa950dbde177df5fd43029444464d9

SHA1
05e204f2c6d14a6ac067bbdbf000a062e537ed0b

SHA256
df03745b179afb54e384d8545b1a7c40b763fb1fca0099a7f6ebf6399347f2fc

SHA512
66e3fae1cdc65a4c8596ef1e70316eac7fed38a6275a1d1de21622eb59921a4d2c0efdcbe7cb7f5aeb688271bf123ca34289d20d7a9354086e98b0b336646574

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
224KB

MD5
146db63cb74be8a07281d4e6b531fe39

SHA1
22fa154bd915d52dca6ee64616dec1e91e17c886

SHA256
47598f67916337299f7037a797116df0c313faba6eb146c71c70df9f481fde33

SHA512
4b723d2b3335c15e05fdbd2d56e7f465a675773eb64de45ce06bc27505ca8925cf25f4665786cdcd26fc69434b9daa467420667c1e78c782062686c1e89566d1

Download Submit
C:\Windows\SysWOW64\Ipnjab32.exe

Filesize
224KB

MD5
7f14c05e70b29fb2f9699c1995e53792

SHA1
fc6abf1f77afe84d3beec409ef0795b50900132b

SHA256
959d7f3886645fdad76a52929f5666981f9cc41b260d2bd281ea860b3bf1602c

SHA512
e586b977881da828dc338173a60454f428a9c99ee85d63b419a657947142799ba122b33a4ccb2fe57ba5403755a92a1a505f8b3a0d0ceabd51e5b0622b8045cd

Download Submit
C:\Windows\SysWOW64\Jmhale32.exe

Filesize
224KB

MD5
07acbd4e65a100466b6ee6f0a8fe5d0d

SHA1
f6eb28ceb12630889c30d18713b88743bd23c701

SHA256
508589f2d0785b65c6a887c964acf5d918e167890f63205fbac38e1fcd5ede5c

SHA512
e6c3d8264824c4892fe5a72e99a67726ddde42da806b0cd84caadafdb1457ea8d2466b8a3638673b40066e41ff1679db68620058200589eeffeaa1b2f761d0ec

Download Submit
C:\Windows\SysWOW64\Likjcbkc.exe

Filesize
224KB

MD5
8ce2c3be1cefe5463a37ba849c64657e

SHA1
11841f21ce98366c994567f2943097cb95d812a8

SHA256
2d4e00f9d5903efee2ac0a22a118051985f399729ca5e39b49c0ed7033e69f25

SHA512
4d00a2206fa1cd130a9e7df5c7ebda158790e56819bc52acd9aa043ae8bec2a3ff5fa4b55c74af86df6d9fdfd8a66167ea1d91da7f1946534df6b5ccf0c94f66

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
224KB

MD5
6d56097eed227fbf2ea37985b1d9120f

SHA1
dbd3f67e2144cdac0f906ecc5ee28e4f3821a91d

SHA256
269df3bba006372543f09dfa5e721916bec5d202a4683ef5a549527714cc2c0d

SHA512
ac919a8223358fabf164c5310dd29b72243e3aa8b201d17fa0c5b6277855e15c20da4c4ffb4149f6d121d8ec47c30cb01fcf81476f72ad9b8a9facdff643e534

Download Submit
C:\Windows\SysWOW64\Lpqiemge.exe

Filesize
224KB

MD5
5a1a95eecdc4896efb0cef5d7f9b9e3f

SHA1
07b476e720bd645866c8c9e122facff17777935e

SHA256
0446f348e4e0ae4d8db15fe07de43cb47aa8b5cf35e627399456df010b5ab917

SHA512
b890e65858b4752f4b1c3bbe0828b3e1ba1797c25f7526b767171c898d427053e993e7ef817be85f64892b2f5b83876fc6990d2a9826fd47f40f387e09223b82

Download Submit
C:\Windows\SysWOW64\Mcmabg32.exe

Filesize
224KB

MD5
d41e2d3eeeb252419438206b5dc8d120

SHA1
1a1a538934a20f2d0b4dce67222f80435effc7c8

SHA256
dd6c11778261c142fde15580ece70f2a265b9ef485b5a94aa7ce6e2f8b925c83

SHA512
55ab98f9058e8cd07f61b8cc5ae9b19d5840df4361e4e67ec682c8739bea6324a3faad0a3a02cefa6662b2bec7d28b769397ea85a786a05b5f0551ff5a91b75e

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
224KB

MD5
5afeda161f9088bac95964902151f15d

SHA1
e1d636743e3a6b7683c76864dcd7c7766bf6f044

SHA256
135a1df337ea0f6aebba900e8fc314caa6ff30b4c386006f6be19162459d6590

SHA512
55679148b77f3ac61335ebc7d6629f994dc4f3445371b7d0d098b32180e59299761a139568143313c32a763db790d2f59f4e5214d0608615defc8c991ce9b2ac

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
64KB

MD5
2698b596fc454aca243ecb9dc91d4f10

SHA1
57ad88100f82d1d9b43c29add848a7684f284027

SHA256
78c4e93be75d1b058d74aeaf47e08ba898fe1f7fb7a345249594315265af3f80

SHA512
f75e968eb6ebe448366bbd0d1281d4ba2039930c3714193ecec6cfbe4c5048c40b10e997b62928e11a157345d3dba94b94f0e9e636bb9e2e81569b0b1a001745

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
224KB

MD5
665b2c57b443f7ba38fe970049f66144

SHA1
e11c726090f01f33809a9e6978ee91db0c2bdac9

SHA256
8c7dda5b9bf5048f4fec430fd79130890ff648df9bbbf1ed55ffd868380f2686

SHA512
8affa7bdf585457e01c03caa89b43b3b1a0fd5b4a2710a97980905258f056d521e42642a97861e57f31e4c497c3436cfe0e27e8b167194e6c52aef22185fceac

Download Submit
memory/232-87-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/232-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/456-160-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/456-242-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/640-16-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/640-106-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1004-141-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1004-48-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1380-8-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1380-96-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1492-304-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1704-146-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1788-320-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1812-285-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2004-244-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2004-319-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2140-303-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2140-219-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2212-317-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2228-312-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2228-234-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2236-296-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2256-89-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2256-176-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2268-284-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2268-202-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2292-269-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2292-187-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2328-211-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2328-291-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2336-310-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2336-227-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2508-167-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2508-80-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2828-124-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2828-43-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2932-178-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2932-261-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2996-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3000-305-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3084-72-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3084-159-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3136-253-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3136-326-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3208-129-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3564-194-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3564-277-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3624-271-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3628-32-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3628-115-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3748-327-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3768-63-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3820-120-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3928-98-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3928-177-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3952-28-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4104-251-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4104-169-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4120-111-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4364-155-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4472-282-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4736-266-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5012-149-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5012-64-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads