9e52b0de77209fd47be06a62ad7957e7fddcc1b1499c7e87c015304beb08bd4b

Analysis

max time kernel
159s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e52b0de77209fd47be06a62ad7957e7fddcc1b1499c7e87c015304beb08bd4b.exe
Size

52KB
MD5

928f8375d3086613b562db0a9272dcd9
SHA1

a89ed74df22c5f8286983defd000978bd32b8d95
SHA256

9e52b0de77209fd47be06a62ad7957e7fddcc1b1499c7e87c015304beb08bd4b
SHA512

5e1e7cd12a8c6b5c02683de5fae71b4f98857fd049c3246a4f5a5cf2fe2170ffce3105f9047aa28a1d797b8a0ddf6392fdaabc9407d33a06628d653ad1233c5e
SSDEEP

768:KAAr76zCuEjVEKH2i9N4pE/SVHIUG8TRLCgUHMvdgTMH8/1H57:yXjBEG2imwSaUG8UHMv9H+

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikbphn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hameic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndjldo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpmfklbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alcfpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecccmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dccjfaog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkeedk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqhbgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacikbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjdcfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clgkmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmaooihb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecoiapdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecccmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggjgofkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncgkma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbjade32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmhlijpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jakkplbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngaabfio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhmnhcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnccmnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkepgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacikbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpjfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aiclodaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbjmih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icedkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqomdppm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjdcfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebplhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcbehbim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjnnmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqfmlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgqehgco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahkffqdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnccmnak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohmepbki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amibqhed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbhkjicf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcikfcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olnmdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accnco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maohdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgphggpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnmoglij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpeejfjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caimachg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accnco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcdkdpih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onaieifh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eakdje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odidld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kallod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohmepbki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omdnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdjeklfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eakdje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcbehbim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mihikgod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdhkefnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhmdeink.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpeejfjm.exe

Executes dropped EXE 64 IoCs

pid	Process
676	Fdmjdkda.exe
1044	Kaioidkh.exe
3800	Kallod32.exe
648	Kfkamk32.exe
3292	Logbigbg.exe
3324	Lmnlpcel.exe
1656	Ndinck32.exe
3156	Odkcpi32.exe
3332	Poagma32.exe
2768	Pkjegb32.exe
2776	Pdeffgff.exe
3560	Qoocnpag.exe
3900	Akogio32.exe
4000	Chddpn32.exe
4836	Dbjade32.exe
3496	Ehkcgkdj.exe
2248	Eflceb32.exe
2480	Epehnhbj.exe
1728	Flekihpc.exe
436	Iobmmoed.exe
3372	Jokpcmmj.exe
1424	Mhefhf32.exe
4156	Mdcmnfop.exe
484	Nhafcd32.exe
1744	Nmpkakak.exe
3856	Ohmepbki.exe
3376	Pkedbmab.exe
2128	Iadljc32.exe
4472	Jchaoe32.exe
3356	Jjgcgo32.exe
1540	Kmhlijpm.exe
1052	Kcikfcab.exe
4456	Kmaooihb.exe
2744	Ljephmgl.exe
220	Lpgalc32.exe
2492	Mihikgod.exe
544	Mminfech.exe
1332	Nfabok32.exe
1624	Njokei32.exe
5084	Ndjldo32.exe
2232	Omdnbd32.exe
456	Ojmgggdo.exe
1512	Opjponbf.exe
2320	Pdjeklfj.exe
4240	Pcaoahio.exe
2312	Pgphggpe.exe
2072	Qpmfklbq.exe
3012	Alcfpm32.exe
4148	Ajjcoqdl.exe
4568	Almifk32.exe
5132	Bdpqcg32.exe
5180	Cnmoglij.exe
5220	Dnfanjqp.exe
5260	Dccjfaog.exe
5304	Dgqblp32.exe
5344	Eakdje32.exe
5388	Ekcemmgo.exe
5436	Ecoiapdj.exe
5480	Ecccmo32.exe
5520	Feella32.exe
5564	Fnmqegle.exe
5612	Glhgojef.exe
5652	Hdmojkjg.exe
5704	Hhmdeink.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lpgalc32.exe	Ljephmgl.exe
File created	C:\Windows\SysWOW64\Almifk32.exe	Ajjcoqdl.exe
File created	C:\Windows\SysWOW64\Ojmgggdo.exe	Omdnbd32.exe
File opened for modification	C:\Windows\SysWOW64\Poagma32.exe	Odkcpi32.exe
File created	C:\Windows\SysWOW64\Acaicdko.dll	Ipohpdbb.exe
File created	C:\Windows\SysWOW64\Dbjade32.exe	Chddpn32.exe
File created	C:\Windows\SysWOW64\Enehjd32.dll	Jokpcmmj.exe
File created	C:\Windows\SysWOW64\Nhafcd32.exe	Mdcmnfop.exe
File opened for modification	C:\Windows\SysWOW64\Ohmepbki.exe	Nmpkakak.exe
File created	C:\Windows\SysWOW64\Ogokeh32.dll	Pcaoahio.exe
File opened for modification	C:\Windows\SysWOW64\Hjdcfp32.exe	Gplbcgbg.exe
File opened for modification	C:\Windows\SysWOW64\Palkgi32.exe	Onkbenbi.exe
File created	C:\Windows\SysWOW64\Elcpkeef.dll	Mjnnmn32.exe
File created	C:\Windows\SysWOW64\Omdnbd32.exe	Ndjldo32.exe
File opened for modification	C:\Windows\SysWOW64\Gcdkdpih.exe	Giofggia.exe
File created	C:\Windows\SysWOW64\Hgbaigln.dll	Mkepgp32.exe
File created	C:\Windows\SysWOW64\Accnco32.exe	Apnkfelb.exe
File created	C:\Windows\SysWOW64\Giacmggo.exe	Gcdkdpih.exe
File opened for modification	C:\Windows\SysWOW64\Pkjegb32.exe	Poagma32.exe
File opened for modification	C:\Windows\SysWOW64\Gmclgghc.exe	Foplnb32.exe
File created	C:\Windows\SysWOW64\Jokpcmmj.exe	Iobmmoed.exe
File opened for modification	C:\Windows\SysWOW64\Aiclodaj.exe	Qlkbka32.exe
File created	C:\Windows\SysWOW64\Jjjqhl32.dll	Foplnb32.exe
File opened for modification	C:\Windows\SysWOW64\Iiibdc32.exe	Ibojgikg.exe
File opened for modification	C:\Windows\SysWOW64\Mjednmla.exe	Mdhkefnj.exe
File opened for modification	C:\Windows\SysWOW64\Nmpkakak.exe	Nhafcd32.exe
File opened for modification	C:\Windows\SysWOW64\Ngaabfio.exe	Mnjqhcno.exe
File created	C:\Windows\SysWOW64\Gmclgghc.exe	Foplnb32.exe
File created	C:\Windows\SysWOW64\Hfmpchij.dll	Bajqpe32.exe
File opened for modification	C:\Windows\SysWOW64\Caagpdop.exe	Blbabnbk.exe
File opened for modification	C:\Windows\SysWOW64\Foplnb32.exe	Fqhbgf32.exe
File created	C:\Windows\SysWOW64\Kcikfcab.exe	Kmhlijpm.exe
File created	C:\Windows\SysWOW64\Dmjgdq32.exe	Dqomdppm.exe
File created	C:\Windows\SysWOW64\Emabga32.dll	Kaioidkh.exe
File opened for modification	C:\Windows\SysWOW64\Dqomdppm.exe	Cnealfkf.exe
File created	C:\Windows\SysWOW64\Ikbphn32.exe	Hpeejfjm.exe
File created	C:\Windows\SysWOW64\Nojfic32.exe	Nqifkl32.exe
File created	C:\Windows\SysWOW64\Ebplhp32.exe	Ecfeldcj.exe
File created	C:\Windows\SysWOW64\Dogcjkih.dll	Kmbkfp32.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkma32.exe	Maohdj32.exe
File created	C:\Windows\SysWOW64\Onaieifh.exe	Odidld32.exe
File created	C:\Windows\SysWOW64\Alcfpm32.exe	Qpmfklbq.exe
File created	C:\Windows\SysWOW64\Moajmk32.exe	Jakkplbc.exe
File created	C:\Windows\SysWOW64\Ncgkma32.exe	Maohdj32.exe
File created	C:\Windows\SysWOW64\Bliioqol.dll	Pimmil32.exe
File opened for modification	C:\Windows\SysWOW64\Maohdj32.exe	Mkepgp32.exe
File opened for modification	C:\Windows\SysWOW64\Moajmk32.exe	Jakkplbc.exe
File created	C:\Windows\SysWOW64\Debalegc.dll	Fdmjdkda.exe
File created	C:\Windows\SysWOW64\Ecnbgian.exe	Ejcaidlp.exe
File created	C:\Windows\SysWOW64\Ehkcgkdj.exe	Dbjade32.exe
File created	C:\Windows\SysWOW64\Mnjqhcno.exe	Loqjlg32.exe
File created	C:\Windows\SysWOW64\Amagqp32.dll	Dnfanjqp.exe
File created	C:\Windows\SysWOW64\Ecccmo32.exe	Ecoiapdj.exe
File opened for modification	C:\Windows\SysWOW64\Hecadm32.exe	Hhmdeink.exe
File created	C:\Windows\SysWOW64\Caagpdop.exe	Blbabnbk.exe
File created	C:\Windows\SysWOW64\Pnjnnclb.dll	Jbhmnhcm.exe
File created	C:\Windows\SysWOW64\Jfpfabjm.dll	Ncgkma32.exe
File opened for modification	C:\Windows\SysWOW64\Logbigbg.exe	Kfkamk32.exe
File created	C:\Windows\SysWOW64\Bcecgb32.dll	Qoocnpag.exe
File created	C:\Windows\SysWOW64\Pjmmohcf.dll	Moajmk32.exe
File opened for modification	C:\Windows\SysWOW64\Njokei32.exe	Nfabok32.exe
File created	C:\Windows\SysWOW64\Anlkidnm.dll	Ejcaidlp.exe
File opened for modification	C:\Windows\SysWOW64\Mnjqhcno.exe	Loqjlg32.exe
File created	C:\Windows\SysWOW64\Fgkbhpei.dll	Mdhkefnj.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5324	4468	WerFault.exe	254
5984	4468	WerFault.exe	254

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmaooihb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljephmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnmbaadg.dll"	Mjednmla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hakhcd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onhoehpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpgalc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgakgc32.dll"	Ahkffqdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Coojpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbhndb32.dll"	Dofpqfof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iadljc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjdcfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnjqhcno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnkdbl32.dll"	Nmpkakak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jakkplbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjlmdmqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Logbigbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljephmgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbjmih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkedbmab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qlkbka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjqhl32.dll"	Foplnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhefhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekcemmgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fghoohma.dll"	Palkgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjednmla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgphggpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onkbenbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igjhce32.dll"	Iobmmoed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohmepbki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mminfech.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogokeh32.dll"	Pcaoahio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dogcjkih.dll"	Kmbkfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Almifk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Feella32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hecadm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hecadm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gplbcgbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipohpdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aajeigke.dll"	Coojpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdhkefnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifkppk32.dll"	Hameic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfoflj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnnkplho.dll"	Opjponbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipohpdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhdilold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcdkdpih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbcildbi.dll"	Njacikbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odidld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daaioh32.dll"	Eflceb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofgbflng.dll"	Mihikgod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dccjfaog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bckddn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Molpkleo.dll"	Cnmoglij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbibeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejcaidlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anlkidnm.dll"	Ejcaidlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqklahgj.dll"	Caimachg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgcqil32.dll"	Icedkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bindmcbj.dll"	Hakhcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkjegb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejbonb32.dll"	Alcfpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemfgkid.dll"	Blbabnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogegkehh.dll"	Gcdkdpih.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Coojpg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 676	2432	9e52b0de77209fd47be06a62ad7957e7fddcc1b1499c7e87c015304beb08bd4b.exe	99
PID 2432 wrote to memory of 676	2432	9e52b0de77209fd47be06a62ad7957e7fddcc1b1499c7e87c015304beb08bd4b.exe	99
PID 2432 wrote to memory of 676	2432	9e52b0de77209fd47be06a62ad7957e7fddcc1b1499c7e87c015304beb08bd4b.exe	99
PID 676 wrote to memory of 1044	676	Fdmjdkda.exe	100
PID 676 wrote to memory of 1044	676	Fdmjdkda.exe	100
PID 676 wrote to memory of 1044	676	Fdmjdkda.exe	100
PID 1044 wrote to memory of 3800	1044	Kaioidkh.exe	101
PID 1044 wrote to memory of 3800	1044	Kaioidkh.exe	101
PID 1044 wrote to memory of 3800	1044	Kaioidkh.exe	101
PID 3800 wrote to memory of 648	3800	Kallod32.exe	102
PID 3800 wrote to memory of 648	3800	Kallod32.exe	102
PID 3800 wrote to memory of 648	3800	Kallod32.exe	102
PID 648 wrote to memory of 3292	648	Kfkamk32.exe	103
PID 648 wrote to memory of 3292	648	Kfkamk32.exe	103
PID 648 wrote to memory of 3292	648	Kfkamk32.exe	103
PID 3292 wrote to memory of 3324	3292	Logbigbg.exe	104
PID 3292 wrote to memory of 3324	3292	Logbigbg.exe	104
PID 3292 wrote to memory of 3324	3292	Logbigbg.exe	104
PID 3324 wrote to memory of 1656	3324	Lmnlpcel.exe	106
PID 3324 wrote to memory of 1656	3324	Lmnlpcel.exe	106
PID 3324 wrote to memory of 1656	3324	Lmnlpcel.exe	106
PID 1656 wrote to memory of 3156	1656	Ndinck32.exe	107
PID 1656 wrote to memory of 3156	1656	Ndinck32.exe	107
PID 1656 wrote to memory of 3156	1656	Ndinck32.exe	107
PID 3156 wrote to memory of 3332	3156	Odkcpi32.exe	108
PID 3156 wrote to memory of 3332	3156	Odkcpi32.exe	108
PID 3156 wrote to memory of 3332	3156	Odkcpi32.exe	108
PID 3332 wrote to memory of 2768	3332	Poagma32.exe	109
PID 3332 wrote to memory of 2768	3332	Poagma32.exe	109
PID 3332 wrote to memory of 2768	3332	Poagma32.exe	109
PID 2768 wrote to memory of 2776	2768	Pkjegb32.exe	110
PID 2768 wrote to memory of 2776	2768	Pkjegb32.exe	110
PID 2768 wrote to memory of 2776	2768	Pkjegb32.exe	110
PID 2776 wrote to memory of 3560	2776	Pdeffgff.exe	112
PID 2776 wrote to memory of 3560	2776	Pdeffgff.exe	112
PID 2776 wrote to memory of 3560	2776	Pdeffgff.exe	112
PID 3560 wrote to memory of 3900	3560	Qoocnpag.exe	113
PID 3560 wrote to memory of 3900	3560	Qoocnpag.exe	113
PID 3560 wrote to memory of 3900	3560	Qoocnpag.exe	113
PID 3900 wrote to memory of 4000	3900	Akogio32.exe	115
PID 3900 wrote to memory of 4000	3900	Akogio32.exe	115
PID 3900 wrote to memory of 4000	3900	Akogio32.exe	115
PID 4000 wrote to memory of 4836	4000	Chddpn32.exe	116
PID 4000 wrote to memory of 4836	4000	Chddpn32.exe	116
PID 4000 wrote to memory of 4836	4000	Chddpn32.exe	116
PID 4836 wrote to memory of 3496	4836	Dbjade32.exe	117
PID 4836 wrote to memory of 3496	4836	Dbjade32.exe	117
PID 4836 wrote to memory of 3496	4836	Dbjade32.exe	117
PID 3496 wrote to memory of 2248	3496	Ehkcgkdj.exe	118
PID 3496 wrote to memory of 2248	3496	Ehkcgkdj.exe	118
PID 3496 wrote to memory of 2248	3496	Ehkcgkdj.exe	118
PID 2248 wrote to memory of 2480	2248	Eflceb32.exe	119
PID 2248 wrote to memory of 2480	2248	Eflceb32.exe	119
PID 2248 wrote to memory of 2480	2248	Eflceb32.exe	119
PID 2480 wrote to memory of 1728	2480	Epehnhbj.exe	120
PID 2480 wrote to memory of 1728	2480	Epehnhbj.exe	120
PID 2480 wrote to memory of 1728	2480	Epehnhbj.exe	120
PID 1728 wrote to memory of 436	1728	Flekihpc.exe	122
PID 1728 wrote to memory of 436	1728	Flekihpc.exe	122
PID 1728 wrote to memory of 436	1728	Flekihpc.exe	122
PID 436 wrote to memory of 3372	436	Iobmmoed.exe	123
PID 436 wrote to memory of 3372	436	Iobmmoed.exe	123
PID 436 wrote to memory of 3372	436	Iobmmoed.exe	123
PID 3372 wrote to memory of 1424	3372	Jokpcmmj.exe	124

C:\Users\Admin\AppData\Local\Temp\9e52b0de77209fd47be06a62ad7957e7fddcc1b1499c7e87c015304beb08bd4b.exe
"C:\Users\Admin\AppData\Local\Temp\9e52b0de77209fd47be06a62ad7957e7fddcc1b1499c7e87c015304beb08bd4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\Fdmjdkda.exe
  C:\Windows\system32\Fdmjdkda.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\SysWOW64\Kaioidkh.exe
    C:\Windows\system32\Kaioidkh.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\SysWOW64\Kallod32.exe
      C:\Windows\system32\Kallod32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3800
    - - C:\Windows\SysWOW64\Kfkamk32.exe
        
        C:\Windows\system32\Kfkamk32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:648
      - C:\Windows\SysWOW64\Logbigbg.exe
        
        C:\Windows\system32\Logbigbg.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\Lmnlpcel.exe
        
        C:\Windows\system32\Lmnlpcel.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\Ndinck32.exe
        
        C:\Windows\system32\Ndinck32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Odkcpi32.exe
        
        C:\Windows\system32\Odkcpi32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\Poagma32.exe
        
        C:\Windows\system32\Poagma32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Pkjegb32.exe
        
        C:\Windows\system32\Pkjegb32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\SysWOW64\Pdeffgff.exe
        
        C:\Windows\system32\Pdeffgff.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Qoocnpag.exe
        
        C:\Windows\system32\Qoocnpag.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\Akogio32.exe
        
        C:\Windows\system32\Akogio32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\Chddpn32.exe
        
        C:\Windows\system32\Chddpn32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Dbjade32.exe
        
        C:\Windows\system32\Dbjade32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Ehkcgkdj.exe
        
        C:\Windows\system32\Ehkcgkdj.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Eflceb32.exe
        
        C:\Windows\system32\Eflceb32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Flekihpc.exe
        
        C:\Windows\system32\Flekihpc.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\Iobmmoed.exe
        
        C:\Windows\system32\Iobmmoed.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Jokpcmmj.exe
        
        C:\Windows\system32\Jokpcmmj.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\SysWOW64\Mhefhf32.exe
        
        C:\Windows\system32\Mhefhf32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1424
        
        C:\Windows\SysWOW64\Mdcmnfop.exe
        
        C:\Windows\system32\Mdcmnfop.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4156
        
        C:\Windows\SysWOW64\Nhafcd32.exe
        
        C:\Windows\system32\Nhafcd32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:484
        
        C:\Windows\SysWOW64\Nmpkakak.exe
        
        C:\Windows\system32\Nmpkakak.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Ohmepbki.exe
        
        C:\Windows\system32\Ohmepbki.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3856
        
        C:\Windows\SysWOW64\Pkedbmab.exe
        
        C:\Windows\system32\Pkedbmab.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Iadljc32.exe
        
        C:\Windows\system32\Iadljc32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        30⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Jjgcgo32.exe
        
        C:\Windows\system32\Jjgcgo32.exe
        31⤵
        Executes dropped EXE
        
        PID:3356
        
        C:\Windows\SysWOW64\Kmhlijpm.exe
        
        C:\Windows\system32\Kmhlijpm.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1540
        
        C:\Windows\SysWOW64\Kcikfcab.exe
        
        C:\Windows\system32\Kcikfcab.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1052
        
        C:\Windows\SysWOW64\Kmaooihb.exe
        
        C:\Windows\system32\Kmaooihb.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Ljephmgl.exe
        
        C:\Windows\system32\Ljephmgl.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2744
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Mihikgod.exe
        
        C:\Windows\system32\Mihikgod.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2492
        
        C:\Windows\SysWOW64\Mminfech.exe
        
        C:\Windows\system32\Mminfech.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:544
        
        C:\Windows\SysWOW64\Nfabok32.exe
        
        C:\Windows\system32\Nfabok32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1332
        
        C:\Windows\SysWOW64\Njokei32.exe
        
        C:\Windows\system32\Njokei32.exe
        40⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\Ndjldo32.exe
        
        C:\Windows\system32\Ndjldo32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5084
        
        C:\Windows\SysWOW64\Omdnbd32.exe
        
        C:\Windows\system32\Omdnbd32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\Ojmgggdo.exe
        
        C:\Windows\system32\Ojmgggdo.exe
        43⤵
        Executes dropped EXE
        
        PID:456
        
        C:\Windows\SysWOW64\Opjponbf.exe
        
        C:\Windows\system32\Opjponbf.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1512
        
        C:\Windows\SysWOW64\Pdjeklfj.exe
        
        C:\Windows\system32\Pdjeklfj.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Pcaoahio.exe
        
        C:\Windows\system32\Pcaoahio.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Pgphggpe.exe
        
        C:\Windows\system32\Pgphggpe.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2312
        
        C:\Windows\SysWOW64\Qpmfklbq.exe
        
        C:\Windows\system32\Qpmfklbq.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2072
        
        C:\Windows\SysWOW64\Alcfpm32.exe
        
        C:\Windows\system32\Alcfpm32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3012
        
        C:\Windows\SysWOW64\Ajjcoqdl.exe
        
        C:\Windows\system32\Ajjcoqdl.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4148
        
        C:\Windows\SysWOW64\Almifk32.exe
        
        C:\Windows\system32\Almifk32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\Bdpqcg32.exe
        
        C:\Windows\system32\Bdpqcg32.exe
        52⤵
        Executes dropped EXE
        
        PID:5132
        
        C:\Windows\SysWOW64\Cnmoglij.exe
        
        C:\Windows\system32\Cnmoglij.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Dnfanjqp.exe
        
        C:\Windows\system32\Dnfanjqp.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Dccjfaog.exe
        
        C:\Windows\system32\Dccjfaog.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Dgqblp32.exe
        
        C:\Windows\system32\Dgqblp32.exe
        56⤵
        Executes dropped EXE
        
        PID:5304
        
        C:\Windows\SysWOW64\Eakdje32.exe
        
        C:\Windows\system32\Eakdje32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5344
        
        C:\Windows\SysWOW64\Ekcemmgo.exe
        
        C:\Windows\system32\Ekcemmgo.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Ecoiapdj.exe
        
        C:\Windows\system32\Ecoiapdj.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Ecccmo32.exe
        
        C:\Windows\system32\Ecccmo32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5480
        
        C:\Windows\SysWOW64\Feella32.exe
        
        C:\Windows\system32\Feella32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Fnmqegle.exe
        
        C:\Windows\system32\Fnmqegle.exe
        62⤵
        Executes dropped EXE
        
        PID:5564
        
        C:\Windows\SysWOW64\Glhgojef.exe
        
        C:\Windows\system32\Glhgojef.exe
        63⤵
        Executes dropped EXE
        
        PID:5612
        
        C:\Windows\SysWOW64\Hdmojkjg.exe
        
        C:\Windows\system32\Hdmojkjg.exe
        64⤵
        Executes dropped EXE
        
        PID:5652
        
        C:\Windows\SysWOW64\Hhmdeink.exe
        
        C:\Windows\system32\Hhmdeink.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Hecadm32.exe
        
        C:\Windows\system32\Hecadm32.exe
        66⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Jakkplbc.exe
        
        C:\Windows\system32\Jakkplbc.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Moajmk32.exe
        
        C:\Windows\system32\Moajmk32.exe
        68⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Ofjokc32.exe
        
        C:\Windows\system32\Ofjokc32.exe
        69⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Olnmdi32.exe
        
        C:\Windows\system32\Olnmdi32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5972
        
        C:\Windows\SysWOW64\Pimmil32.exe
        
        C:\Windows\system32\Pimmil32.exe
        71⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Aeigilml.exe
        
        C:\Windows\system32\Aeigilml.exe
        72⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Apnkfelb.exe
        
        C:\Windows\system32\Apnkfelb.exe
        73⤵
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Accnco32.exe
        
        C:\Windows\system32\Accnco32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Amibqhed.exe
        
        C:\Windows\system32\Amibqhed.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Bckddn32.exe
        
        C:\Windows\system32\Bckddn32.exe
        76⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Cnealfkf.exe
        
        C:\Windows\system32\Cnealfkf.exe
        77⤵
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Dqomdppm.exe
        
        C:\Windows\system32\Dqomdppm.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Dmjgdq32.exe
        
        C:\Windows\system32\Dmjgdq32.exe
        79⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Ejcaidlp.exe
        
        C:\Windows\system32\Ejcaidlp.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Ecnbgian.exe
        
        C:\Windows\system32\Ecnbgian.exe
        81⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Fqfmlm32.exe
        
        C:\Windows\system32\Fqfmlm32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Fgqehgco.exe
        
        C:\Windows\system32\Fgqehgco.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3044
        
        C:\Windows\SysWOW64\Fnmjkahi.exe
        
        C:\Windows\system32\Fnmjkahi.exe
        84⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ggjgofkd.exe
        
        C:\Windows\system32\Ggjgofkd.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4352
        
        C:\Windows\SysWOW64\Gadimkpb.exe
        
        C:\Windows\system32\Gadimkpb.exe
        86⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Gpjfng32.exe
        
        C:\Windows\system32\Gpjfng32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Gnkflo32.exe
        
        C:\Windows\system32\Gnkflo32.exe
        88⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Gplbcgbg.exe
        
        C:\Windows\system32\Gplbcgbg.exe
        89⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Hjdcfp32.exe
        
        C:\Windows\system32\Hjdcfp32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Hjimaole.exe
        
        C:\Windows\system32\Hjimaole.exe
        91⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Hpeejfjm.exe
        
        C:\Windows\system32\Hpeejfjm.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Ikbphn32.exe
        
        C:\Windows\system32\Ikbphn32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2768
        
        C:\Windows\SysWOW64\Ipohpdbb.exe
        
        C:\Windows\system32\Ipohpdbb.exe
        94⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Idonlbff.exe
        
        C:\Windows\system32\Idonlbff.exe
        95⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Jolhjj32.exe
        
        C:\Windows\system32\Jolhjj32.exe
        96⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Jdkmgali.exe
        
        C:\Windows\system32\Jdkmgali.exe
        97⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Jkeedk32.exe
        
        C:\Windows\system32\Jkeedk32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Loqjlg32.exe
        
        C:\Windows\system32\Loqjlg32.exe
        99⤵
        Drops file in System32 directory
        
        PID:4160
        
        C:\Windows\SysWOW64\Mnjqhcno.exe
        
        C:\Windows\system32\Mnjqhcno.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3564
        
        C:\Windows\SysWOW64\Ngaabfio.exe
        
        C:\Windows\system32\Ngaabfio.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3052
        
        C:\Windows\SysWOW64\Nqifkl32.exe
        
        C:\Windows\system32\Nqifkl32.exe
        102⤵
        Drops file in System32 directory
        
        PID:3496
        
        C:\Windows\SysWOW64\Nojfic32.exe
        
        C:\Windows\system32\Nojfic32.exe
        103⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\Nbibeo32.exe
        
        C:\Windows\system32\Nbibeo32.exe
        104⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Onkbenbi.exe
        
        C:\Windows\system32\Onkbenbi.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Palkgi32.exe
        
        C:\Windows\system32\Palkgi32.exe
        106⤵
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Pnbifmla.exe
        
        C:\Windows\system32\Pnbifmla.exe
        107⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Qlkbka32.exe
        
        C:\Windows\system32\Qlkbka32.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Aiclodaj.exe
        
        C:\Windows\system32\Aiclodaj.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5464
        
        C:\Windows\SysWOW64\Ahkffqdo.exe
        
        C:\Windows\system32\Ahkffqdo.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Bajqpe32.exe
        
        C:\Windows\system32\Bajqpe32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Bhdilold.exe
        
        C:\Windows\system32\Bhdilold.exe
        112⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Bbjmih32.exe
        
        C:\Windows\system32\Bbjmih32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Blbabnbk.exe
        
        C:\Windows\system32\Blbabnbk.exe
        114⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3944
        
        C:\Windows\SysWOW64\Caagpdop.exe
        
        C:\Windows\system32\Caagpdop.exe
        115⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Clgkmm32.exe
        
        C:\Windows\system32\Clgkmm32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1992
        
        C:\Windows\SysWOW64\Cadcfd32.exe
        
        C:\Windows\system32\Cadcfd32.exe
        117⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Caimachg.exe
        
        C:\Windows\system32\Caimachg.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Coojpg32.exe
        
        C:\Windows\system32\Coojpg32.exe
        119⤵
        Modifies registry class
        
        PID:2044
        
        C:\Windows\SysWOW64\Dofpqfof.exe
        
        C:\Windows\system32\Dofpqfof.exe
        120⤵
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Ecfeldcj.exe
        
        C:\Windows\system32\Ecfeldcj.exe
        121⤵
        Drops file in System32 directory
        
        PID:4288
        
        C:\Windows\SysWOW64\Ebplhp32.exe
        
        C:\Windows\system32\Ebplhp32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5280
        
        C:\Windows\SysWOW64\Fcbehbim.exe
        
        C:\Windows\system32\Fcbehbim.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:804
        
        C:\Windows\SysWOW64\Fjlmdmqj.exe
        
        C:\Windows\system32\Fjlmdmqj.exe
        124⤵
        Modifies registry class
        
        PID:2900
        
        C:\Windows\SysWOW64\Fqhbgf32.exe
        
        C:\Windows\system32\Fqhbgf32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4420
        
        C:\Windows\SysWOW64\Foplnb32.exe
        
        C:\Windows\system32\Foplnb32.exe
        126⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Gmclgghc.exe
        
        C:\Windows\system32\Gmclgghc.exe
        127⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Giofggia.exe
        
        C:\Windows\system32\Giofggia.exe
        128⤵
        Drops file in System32 directory
        
        PID:2592
        
        C:\Windows\SysWOW64\Gcdkdpih.exe
        
        C:\Windows\system32\Gcdkdpih.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3840
        
        C:\Windows\SysWOW64\Giacmggo.exe
        
        C:\Windows\system32\Giacmggo.exe
        130⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Hakhcd32.exe
        
        C:\Windows\system32\Hakhcd32.exe
        131⤵
        Modifies registry class
        
        PID:3832
        
        C:\Windows\SysWOW64\Hameic32.exe
        
        C:\Windows\system32\Hameic32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Hfoflj32.exe
        
        C:\Windows\system32\Hfoflj32.exe
        133⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Icedkn32.exe
        
        C:\Windows\system32\Icedkn32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4260
        
        C:\Windows\SysWOW64\Ibojgikg.exe
        
        C:\Windows\system32\Ibojgikg.exe
        135⤵
        Drops file in System32 directory
        
        PID:4836
        
        C:\Windows\SysWOW64\Iiibdc32.exe
        
        C:\Windows\system32\Iiibdc32.exe
        136⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Jmgkja32.exe
        
        C:\Windows\system32\Jmgkja32.exe
        137⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Jbhmnhcm.exe
        
        C:\Windows\system32\Jbhmnhcm.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Kmbkfp32.exe
        
        C:\Windows\system32\Kmbkfp32.exe
        139⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3292
        
        C:\Windows\SysWOW64\Lnccmnak.exe
        
        C:\Windows\system32\Lnccmnak.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Mjnnmn32.exe
        
        C:\Windows\system32\Mjnnmn32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\Mdhkefnj.exe
        
        C:\Windows\system32\Mdhkefnj.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Mjednmla.exe
        
        C:\Windows\system32\Mjednmla.exe
        143⤵
        Modifies registry class
        
        PID:4548
        
        C:\Windows\SysWOW64\Mkepgp32.exe
        
        C:\Windows\system32\Mkepgp32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Maohdj32.exe
        
        C:\Windows\system32\Maohdj32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Ncgkma32.exe
        
        C:\Windows\system32\Ncgkma32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1424
        
        C:\Windows\SysWOW64\Njacikbd.exe
        
        C:\Windows\system32\Njacikbd.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2876
        
        C:\Windows\SysWOW64\Nbhkjicf.exe
        
        C:\Windows\system32\Nbhkjicf.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2324
        
        C:\Windows\SysWOW64\Odidld32.exe
        
        C:\Windows\system32\Odidld32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4280
        
        C:\Windows\SysWOW64\Onaieifh.exe
        
        C:\Windows\system32\Onaieifh.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Onhoehpp.exe
        
        C:\Windows\system32\Onhoehpp.exe
        151⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Pqkdmc32.exe
        
        C:\Windows\system32\Pqkdmc32.exe
        152⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 400
        153⤵
        Program crash
        
        PID:5324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 400
        153⤵
        Program crash
        
        PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3872 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4468 -ip 4468
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Akogio32.exe

Filesize
52KB

MD5
e3eaa812d142cd5cf7b308fcbf7f6837

SHA1
ba89143ec0d940606966c8312584e3da8629aba3

SHA256
a530428ffacd6e49dc31873e58091ca82a4c03f69b0774e1cc978e31f44677d9

SHA512
873ab4b9f4960c5e8b01a10b1ee276624f4ddc741d0998379b3403e185b6661248c1444b09154b5165c26de60f61f20f3f550e5b7a93e8f02becffebfa9dbdb2

Download Submit
C:\Windows\SysWOW64\Chddpn32.exe

Filesize
52KB

MD5
c4ff071614203775db431935d56e5ad8

SHA1
1cef8ab4895f748418ba4db489bae24d857a4d4a

SHA256
05a58de5f68a42aff742c3b645236b5ca5ce047ea10becbed294fdb13fd78755

SHA512
57bbbd89461d1fa64501823295a96645f3d48ec27668585dcc242df3f840ab7d93b7e50999f4a02b8f23972e419ac2daee15ae396e356dbcf1cc0d051b7617e2

Download Submit
C:\Windows\SysWOW64\Dbjade32.exe

Filesize
52KB

MD5
0e67b51b35d8c7fcee7979cb777a85c3

SHA1
2534db6793007478c012cba9790827b4b227f906

SHA256
c175ff0a532a55918ea96e9326113e6e86fa9e244effd7396ab1361bd0376dd1

SHA512
f82e352b189b61b70c7324e4a2ff803fe1105fd4099ec1ba19678c59b6e8cea216680d640f510a361526f0b9a9c969cc027857c785c03a486d3f94503e3b9a47

Download Submit
C:\Windows\SysWOW64\Dgqblp32.exe

Filesize
52KB

MD5
d5661826a751d5143a58e4c4af727cf7

SHA1
2d67ecc6eba03a44c707f1975e87f1905fb3e8cf

SHA256
b141be500c343e70fdba5c982250ee37395a4c6f1d73e9695c39a913f80e18f2

SHA512
6961a1012cc64807ef93e451e8b78d25264a2b44d4ca9e5f504f1a2c34481a3c75897aacda14dbc2c804b86f02d7c404e72c1f8a590791ec0530632be1bbf32a

Download Submit
C:\Windows\SysWOW64\Ebplhp32.exe

Filesize
52KB

MD5
d3e0dfce45dea58818dfeedd3574b219

SHA1
d4795b4642ae519ea8d0c54feddb81328f023b12

SHA256
85abfa6d7f6eb78d73d7206d11996d01078ebe854c8eaf4cc7ba38e840a749a7

SHA512
66b9e3e0fed44453ed98e7c54c8e007496228aad627f1fe936a39b95a06b7d00f72d586f9bd810459eee4fa83b37d40a8df307296949bf2343613f2a993b5fb8

Download Submit
C:\Windows\SysWOW64\Eflceb32.exe

Filesize
52KB

MD5
c5456d91e0e15303f068ada2a2e48a06

SHA1
57e473ee0acbb6ce65794506882e59cdcfa299f4

SHA256
3f8947b5b5b074893c62374f0a583199cc0b2b20d76eae240c7ffa9bdcafde4f

SHA512
9ba6481c6561a362f1240e17c1040d982124f3dcf475be337b693a5a7832287b5dc4555257ecae0c6fccb26854c9d12522a0bb4a22369dbb91ca1dfd1f71bd59

Download Submit
C:\Windows\SysWOW64\Ehkcgkdj.exe

Filesize
52KB

MD5
e52f80ed6723ec02ef165607d855d0a6

SHA1
3e761b91660cafcbe0098421d07f21085d411cf9

SHA256
b4ddf837fcb6c420f01b9e298ed55338f9fa0b950d2820b638335815e7cb114a

SHA512
834330a0b3e15e7a21b0f0ae9d0005d12135e8bf4f703ed465ad4ddf0c7e918ecddd345e7c3046439aeb087162ff0d3ded8ca4f12c3184a5591ba677168d0848

Download Submit
C:\Windows\SysWOW64\Epehnhbj.exe

Filesize
52KB

MD5
40fdcb9853b2503e82e0d824a6f97235

SHA1
f5e61818ac9701208740596f79549427bf27f684

SHA256
977f62d26e3859c4ed7c4bd8a6d0ca920c212bf6e7b9e0b462ba0b4025ddc080

SHA512
5b71be8facb0d1a71d1d4308cb49b24ac43a54016ed2096ad747da7c4c4fca2d47be395cacf5f51de7836ceeac396d58c9eb97a23b8f78fb7324e9d78a410048

Download Submit
C:\Windows\SysWOW64\Fdmjdkda.exe

Filesize
52KB

MD5
298714f76253d0ced308636e0ea828a8

SHA1
564e77b765f865b18041974e956904f33a1cb014

SHA256
b962707f5e2671df754c2a8bbdc4e91afeb054aea4c6a9006d1b7c6a1b73cf81

SHA512
c6624f7c505b144abd033dbcf805f1ab5d143f1458e442ce1b23e59a187d7b1efc562a59373881463007493938b37aaf22ebaec5d1a9b3acdab4cecf50049a62

Download Submit
C:\Windows\SysWOW64\Flekihpc.exe

Filesize
52KB

MD5
e3f7db56fd4ddb2f585fe32181dd9912

SHA1
d156bddd089a7c077d7ae92ec94ece42cdb7670b

SHA256
9f1781595f77565af1b37de3490a584984925bbf010a66dcf222de6fc42a880e

SHA512
325e0f4bae6cbc648be8e3c65c143a2f3901ce26ec64253413c454d61f1d5fc928064cb72f7f3d7f12621680620f7f6d27bd05423ef2ed91ab58157db24657b8

Download Submit
C:\Windows\SysWOW64\Gpjfng32.exe

Filesize
52KB

MD5
f09ea262aacae501c74b4477eee7ef09

SHA1
f26b0fefdb0d988509546382caf91cbb641a9a0f

SHA256
0e48933394791741c3cd9d796f1f85fa953618a63df80947010631830ba36655

SHA512
ed51ba180535e291da13c48f660d31c0f89fef46d2369125a16f08e58a419b2a34c6710bf03af5c45cbc97e589a639095d420dc8d9cb36d6f92302eed55a16f3

Download Submit
C:\Windows\SysWOW64\Hakhcd32.exe

Filesize
52KB

MD5
ef710a80e42faa58538c67e88e17a20d

SHA1
d219cf99a5a53e50139394da4f55d3ff86b1cea0

SHA256
020932ebcb08c5525996ec99f16264d900de2fb1a1340d87f7fdc372b2dc484e

SHA512
88fcc7b2ae7732e0b4f4f3b85d6afa0fb18006df9178e662bbdca136a5a20bfce60fc6daa35005950c204fd645467026bd989c6b6d097c5b407f2095a7d7f7f3

Download Submit
C:\Windows\SysWOW64\Hdmojkjg.exe

Filesize
52KB

MD5
9f5e756a9e6a1b7b811164ea2e788c38

SHA1
491fd2e329a9f150a6d959192845b5298340eab2

SHA256
c6523cd2e9bd80f2f789fee1855783c00532ddddb62adbda7b3058caffe0a577

SHA512
d41766b0bb9c5a87cb873794fe2fbf2ef783d55b6d02f34e375d36ee38adf7e6f745d879d8cf8ba9af24c286c780b35db4e514209756bb24b2b6e583040ee263

Download Submit
C:\Windows\SysWOW64\Iadljc32.exe

Filesize
52KB

MD5
5189ff795e95ccc8bed76d4a58851e9f

SHA1
25997cb2e57d3e4a02e56bd7f161e29587035e50

SHA256
93a33205a3ded8797a950e9acbcce44805f464accf8e56bc4c7916f0a1e64cc3

SHA512
3a4c83a895472759e746295b675dae24d97d373b3eb157f8e91d88e4489a62b0709dcc9a03a2e013c57d801621171e97a324ab6df53703052cf58e44929ff1b1

Download Submit
C:\Windows\SysWOW64\Iobmmoed.exe

Filesize
52KB

MD5
5e0419f5ae2f6a584fc9413ee0cb570a

SHA1
3faf10139828c53d43b29fd64556025ed68de706

SHA256
a8d0c73cd727d672a70e4b53342a3dbff1129b1d2b68829450fc451d1e147908

SHA512
e0370994d0e726effcdddd03a7a2141597db97d99c7fa90857f83e14f6c95539204ec3dbc7090578ddcb99797b00765f45f78fbf92fcca21f3c89723521dabe0

Download Submit
C:\Windows\SysWOW64\Jchaoe32.exe

Filesize
52KB

MD5
6f1f88eee602c5f75952711f5ac7e5c2

SHA1
45ae670ee2473f9c0282fb7d0a13e8cd418046c5

SHA256
153db607f5f74d1388f023a6403bba0ae22460eba5b1c3c13bf3aa74fadf58dc

SHA512
41248218bb92dae323e701e0dcc22615eb02c4a82c3ad60b1786fb5bb41eafd2f1dcba837c64336da67ac41def2a8bcd9f5d2ade731955b9c5b477bcfac48389

Download Submit
C:\Windows\SysWOW64\Jjgcgo32.exe

Filesize
52KB

MD5
01000da21de584150fa0cbfca4e094f1

SHA1
c77e2237b0f697e936153e87e4fc9495105c7021

SHA256
57d0762fbe027a4a217ac1c87e192222d38cf7b2870c29bef7bf7a7a7770502e

SHA512
f0d685f4790719fdee95856b207113c2d283997579c76c1c59aaecc556ce7e23197a4f6566081599c66dd4d3f0d57f1c6feade2d8e047cdc9090379bc8840ddb

Download Submit
C:\Windows\SysWOW64\Jokpcmmj.exe

Filesize
52KB

MD5
2831f33e56f719518370176d4c72313c

SHA1
21878f28d0c0c2959f0109c2d6ec3e0ca4324541

SHA256
6f6f531138e0d606f8e5d44631bdd6de1c26b593acbf10c73f4aef9a3c1b7839

SHA512
0393f558b7ee2de5cdbe2e74d6d9063c5da82c68c5322d8e0561fd75a2b530f857c32890423a7db1c14ce021cee4e579da21542b61aace9f363885d3348766fe

Download Submit
C:\Windows\SysWOW64\Kaioidkh.exe

Filesize
52KB

MD5
04642b782d6c4abe3295b9d594045198

SHA1
22331c0fb728df5ced28371fabf10ffbecd7c3a4

SHA256
f0b091b4d9b9ef2ef2a911ac8a54cbb7fec71221f863d7336424be435463185f

SHA512
7646d3432ec143f7f47872114a3110141d04b14e5ae2ade5ac5b0dd9eee155a8125f26aa5dff1f67ee6cbdaf16927952960c1850159f03fb97a7572e15fd323f

Download Submit
C:\Windows\SysWOW64\Kallod32.exe

Filesize
52KB

MD5
97b8ddb2c5aadba9cde461c91924581d

SHA1
7e8d28ddf3b7d43e1834dd0e5bb793e0630f87cf

SHA256
ed5e5d0e0e63487b6651b9036474c02bce7db53adc762d5aff2206936c9b0a5a

SHA512
1d4701241898d6ad965cfb05bc12a7a79c50b767028a984b152476d12abad7be59929b91d1c620e16d909b24cc89ad61fbabe0a6134085c892d8514b81d5cbd7

Download Submit
C:\Windows\SysWOW64\Kcikfcab.exe

Filesize
52KB

MD5
6e1fbfb8e61907002cb120a5a1737d4c

SHA1
54cc9bfe9979b15f90737c663c0ad6a4824cfaee

SHA256
52201b0081315b5ba66dfa96c58fc46e8842d7f9320da06adaf76a4cf9c1dff4

SHA512
2b3c55d23f7f9ebb8ad7035a42f46b5235735aaaae7635ddcaa536177100e58596e6754d76b6b65b14676c1431d836d108e12ed1703fb1ad9dc23ff5270b4c5b

Download Submit
C:\Windows\SysWOW64\Kfkamk32.exe

Filesize
52KB

MD5
1972d91f809e85a77cf882d6cc0d991e

SHA1
eb8e317ed0ec34d0d88ce754b2fa06af240506aa

SHA256
c1f9cb32c90e401ae69c99f309d4202a94a5db934f15ec67c55c15b03a499300

SHA512
5c570d86ebab27ee07f12538c536377c52f350e636ce24e3483f197e98ddd16017cfb482b6db55f2d669b6c560a86a161136497b6897118963d8f4df273c67c3

Download Submit
C:\Windows\SysWOW64\Kmbkfp32.exe

Filesize
52KB

MD5
891a3cb3d1cde22e322fe103afc52caa

SHA1
a1b138cd63cd460aef0bdc67ee3b5949d3633552

SHA256
a98e2c7abda7a425765424987704add096561e67bcf8f0cd550efa17cdbbd7f3

SHA512
36a84dcff82429158c7a7b8e364b352aefd2e4574aebbf95a626079df27b47b059ee06b617df286e497ca25cf69a87347e696f637a6c3893670fd2f92452ea91

Download Submit
C:\Windows\SysWOW64\Kmhlijpm.exe

Filesize
52KB

MD5
05729af51a740769cc3b37336a1b42cc

SHA1
8f4d4759ea2d4275d343b2ff8ff6d98a52eafc00

SHA256
2d24d9010d6c3b8e74f13ce2709c66daa5c3a1acfa8a50cf0fc58f78ae6e89d5

SHA512
8ff02286c678c715870f95ce53f28101763c8549dace3cdcac41d11ed49c0029e5d1e6a0ca2f80aae752e33622defd66990dce7f693089c62f01031e01fb93b7

Download Submit
C:\Windows\SysWOW64\Lmnlpcel.exe

Filesize
52KB

MD5
4809af2db90f585ab3167c0f86d724ea

SHA1
3132dff428876b35d5ec924baedbed268e8c68ee

SHA256
5f2983f43513f19ad1ee217fb399911c87eede4d40537bcb4b97527c21ea2f01

SHA512
484298eb7b78c09ebf4b67e6f574c49986fb9c9c3cadf35e841db39969acd737949643d44abdb62da2039b2e365a8b13b2c10854e5c5144a252493d6610db6ef

Download Submit
C:\Windows\SysWOW64\Logbigbg.exe

Filesize
52KB

MD5
d9689ed397486b6b60f812bf55f77d90

SHA1
bf985d667eb44fb86df0b89e1d5f7bc3ab9ad8e9

SHA256
652bdd7ce6e8a6ce8589ec4f0173153fd74fc20d7b6a2176eafcc0f8390b2d46

SHA512
f30c9f54e938a6e82b33415f22d266e78f632783b6eec3d111fee276eaf5adc3a5101d11092fa7fdb341b83ae9c4feaf912e17d071426c28311d37e07a6ebdcc

Download Submit
C:\Windows\SysWOW64\Loqjlg32.exe

Filesize
52KB

MD5
2feec9850c1007aa1516332c686dc3d2

SHA1
d5dc9275f7f0b38f02c00b7c8fb4eb2a1cd40d9a

SHA256
2fc9084f7921a3be73c9dbdd8a209253b5d49904b862e3313aed1d2658bc0d4b

SHA512
cc1ec5d9e35c7bad199a4d36de9282c38e436121ad18bda31e289c80a49aa013702c929364a90af383e9feb05bbe38a95eb1112a92da347a41de8f7ff4f679c0

Download Submit
C:\Windows\SysWOW64\Mdcmnfop.exe

Filesize
52KB

MD5
b2eceea07fc28631ebe8b65f1a9a57b6

SHA1
330ebf2a99c60dddf8015d25e2ec7b59129868f2

SHA256
28a424df79f859d4fc3935069e63e18fc9e70e7dc1d102f79609887d41032a59

SHA512
e0e78022d8b57bbcfaa138a3abfd9c64962253af4697feb42a75f8d1336d25d6b0137e03b0ecb0031fc27b5cadecfcb657a0f48ace1d3a70404f5daf00c0adf5

Download Submit
C:\Windows\SysWOW64\Mhefhf32.exe

Filesize
52KB

MD5
60df8f8d8c36b04bcd9085a322526f26

SHA1
1b596d113ebf617aaca67b924d2847717ae37d5b

SHA256
2b12a331108294374fea905cff667cb357458dd48a3c9442537566a710d1788d

SHA512
0269e9474e2d7bc4cfcf4fb5dbbece9f0e6c3b39e01c5e16da121e88d24c6fe6f6ffd1b4904378d1ae9b8e2f70ec2b2930946f111096ef5c71298a3599205967

Download Submit
C:\Windows\SysWOW64\Mjnnmn32.exe

Filesize
52KB

MD5
f9dd88dc03f286810b2abce6e7cb5dce

SHA1
6e4728ab26c48f0bc6f117195d985d9762b766cd

SHA256
fba744e4e573a0db286ab25b10446c6fdb98c5277b505337e4cf1e2784921ee9

SHA512
daaceca2fc5152aba25c258dfb6dff8b5c99562b09e9457849ab1e101f91f45e88440566a7076b06ea14f65d3d65bce6497da417e41f18b7b623c7e60676eb01

Download Submit
C:\Windows\SysWOW64\Ndinck32.exe

Filesize
52KB

MD5
caea9ff57861cdc7803e52fa06bfb07e

SHA1
cf0fa9427d63b3a71cbe335ad12eca7debb5bfdf

SHA256
007b0120e092d100c78bc2385e20510ba4cb4f1378c018baf8aab0d1a984c3eb

SHA512
eb05a14b168ecd1a6202f48f7d636259dd0926a104f05a47e0cd78ecc2e9b1f16bf0194d4b436f61f385ff865e08d074c83b386432c911ba9e1ff5ba97f2d958

Download Submit
C:\Windows\SysWOW64\Nhafcd32.exe

Filesize
52KB

MD5
07bb6bb33445b8876d13319af7918ef1

SHA1
b8abc033a9149aa2bd40c45123aed4ad5f5815ec

SHA256
4bde92d44e9e4cd08d2adc35577962d670e719627a8c25aae38b8b4be0aabd51

SHA512
eba6511917e1dc48437eeca4f507bf535cd9f9a843023aaabc03b48f29f2f2443b569aac6c2ffd28780ad9231c22e7d36f16d7c193d52fd853aa4bf421b0cb65

Download Submit
C:\Windows\SysWOW64\Nmpkakak.exe

Filesize
52KB

MD5
fb47f051baf28ccc1921fea1ce6d5c8e

SHA1
45f9c05dab6f84b29acb3297797a179dc1913289

SHA256
96b2f12e147a44d50b547def61d3f69a300fdfebe9bcd3485e177a032fb75f5e

SHA512
68a3a16a90648743ddfb09387278c0880688f32a4c5a0cadc2a01f01ef095e9ec6f7e671bf4e8aec11a32e7fed9799cf2e109a3bcba7311f1ba95ca2a5c340fe

Download Submit
C:\Windows\SysWOW64\Odkcpi32.exe

Filesize
52KB

MD5
ef40b03c57990eecd49616c98485aa53

SHA1
765776fdff3cd71911a47430e8e7176957ccd17e

SHA256
984a906b0fba43be6b21afdd7840a64d4a8438cb2eb9fd3dfb490b7f0639a102

SHA512
97af06c4a832d48308d7889d014feda2f4dcb7f807e8b9f5433d150dda914b77ebec1bb4057e1a3da897f1fe70c1f00e2aa3b4e8517b78b2f77a643fbd8fcfd3

Download Submit
C:\Windows\SysWOW64\Ohmepbki.exe

Filesize
52KB

MD5
70df8f90dc2875a98a14b7533bf6d802

SHA1
2bbfd197faca1603c8ee2df0704690e656cf1793

SHA256
536aca30d3cf44d66f72c084e788862e372718a110a6c9df57632198fbfae7a3

SHA512
1ffa3f94df4300f0f739aa7c85be2caace32979e617d1a0dad4227ab32b47cf8f2540dc0f22955b758e060e45436093668847365104e4dd2223ed8f33b752c72

Download Submit
C:\Windows\SysWOW64\Ojmgggdo.exe

Filesize
52KB

MD5
464dd6c1be3fca19953660ac6f5f87d9

SHA1
3f8b85b5b337996eaa45c0184eb2ddde2d203751

SHA256
588de5196d6725212972dbceb6533c268bc9d0a6e23740ce3cb1eb89da65e0c2

SHA512
dcf238ec3fabc36faf01f01784361ebf990298b15ebea4bee1e235db5f29e25c9aa33feefec963c255c7bec0c62d747b7a285db1e117362f0c8cb4622b92dac3

Download Submit
C:\Windows\SysWOW64\Pdeffgff.exe

Filesize
52KB

MD5
4826432cfe6a7ec0f3f68e05c73c6af9

SHA1
9ea86fcf8addafc8092f4ae4fc02b3cbef3cccff

SHA256
721198b6cb57309c721614e731755401e958b0ae312470fea2bfc23760c578b5

SHA512
64689d52b9f70ac3df2406b347137e05816a0fc6e9206645922bbc0275ddf323eaf88eca3d418b243a27762b33c050eec2f40983fffad9cd2410cf902f69f948

Download Submit
C:\Windows\SysWOW64\Pkedbmab.exe

Filesize
52KB

MD5
6319cd2a853da97a32946c06f41ca04d

SHA1
32db83fc5509dbd5f6f4f0754c8c318be7f70a26

SHA256
66c20beef37bc80f3cbea8862ce0ee104ce0910d7169827c4a31f1239435b758

SHA512
9f8387f5177ddbd164064de8b4361bc115913fb4766e94f4ff85b48ff4d937842c7d9381720e1cdaddf5f424bf8c307676c049953240650425f41ef944eacf9e

Download Submit
C:\Windows\SysWOW64\Pkjegb32.exe

Filesize
52KB

MD5
ceae1e10c802012e38e10eeda6d6be3c

SHA1
108380b0a85641b1de77bdaa186e1dd208d71aaf

SHA256
fd5cdb550492f1dd0fe50c35578c7b854de5a2b96f47bc92eefa6d90b880b30b

SHA512
bb758a75385648076ba35cb073b552e6c83549bb2c51924d03d3acdd96c28128487649c55ffe66bb14d16b6e9d986ac9b46a3597cb2d5c10fdb22db2914af3d8

Download Submit
C:\Windows\SysWOW64\Poagma32.exe

Filesize
52KB

MD5
1cae25e7590991e5b18fb436165b3e7e

SHA1
f3b577d3055cdf4999cb9e3b8d79bba6b1fc7801

SHA256
692433d91df053aa68999848d6d5af2deb4057e6998b7581ed46538bc2af50ee

SHA512
d9271587fafa6603edbd5eb2b6c49ee30efb5f81492c61f15ee84faecef3eb06b5f6f85c92344fda9bcc65b1c7534257126ca0cc85c60396a140aa1fcc21c447

Download Submit
C:\Windows\SysWOW64\Qoocnpag.exe

Filesize
52KB

MD5
83690ae4fa1532b9219e004f5c5bfe2d

SHA1
4d8c548324b512bd86a1fef1938c6a5c01eff653

SHA256
344f7096b0044090e6ecffb97280464b449bab515c2e90965b668c4c389339e8

SHA512
1b598a774d6325cdc794e53f5001119633c0d7c566303ff1c371dad47858ebd2d47e0676279d73882e630c8c56c648548e2cef1fb1ba8ce2a3bd189417901d85

Download Submit
memory/220-308-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/436-167-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/456-351-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/484-200-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/484-331-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/544-323-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/648-178-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/648-34-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/676-9-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/676-170-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1044-172-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1044-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1052-283-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1332-325-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1424-183-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1424-310-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1512-366-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1540-280-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1624-336-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1656-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1656-216-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1728-154-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1728-237-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1744-344-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1744-208-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2072-388-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2128-252-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2232-345-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2248-233-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2248-138-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2312-387-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2320-368-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2432-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2432-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2432-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-146-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-234-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2492-312-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2744-301-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2768-226-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2768-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2776-90-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2776-227-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3012-394-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3156-222-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3156-66-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3292-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3292-179-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3324-199-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3324-49-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3332-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3332-225-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3356-265-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3372-180-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3376-509-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3376-239-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3496-130-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3496-232-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3560-228-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3560-98-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3800-177-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3800-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3856-223-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3900-106-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3900-229-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4000-114-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4000-230-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4148-401-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4156-311-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4156-191-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4240-375-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4456-289-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4472-257-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4568-407-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4836-123-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4836-231-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5084-338-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5132-418-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5180-420-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5220-426-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5260-433-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5304-439-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5344-452-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5388-454-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5436-460-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5480-466-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5520-477-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5564-479-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5612-485-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5652-491-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads