a66474d51ffaafdafc9b127952885b1459999b04a561b61bdd15650d6b90dc02

Analysis

max time kernel
156s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a66474d51ffaafdafc9b127952885b1459999b04a561b61bdd15650d6b90dc02.exe
Size

78KB
MD5

95370da09ac76f63775e214660dfb9fa
SHA1

4090e89212caaf7a8a6878b18c6ebc214aaed9ad
SHA256

a66474d51ffaafdafc9b127952885b1459999b04a561b61bdd15650d6b90dc02
SHA512

dc3a07208ba0731a54798d593aedec9cdd9b32b27b73a053d467e9e84c028de056c8b9f8391c6c3ddbd4c5986de59cdeb03923cc956d652278701193a2775562
SSDEEP

1536:bvMmNNfju+5ubj6COAkiVLN+zL20gJi1ie:bbzfj3oJODiVLgzL20WKt

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdamgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhndljll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkabjbih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhilfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oehlkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgninn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpbfii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfcqpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcbnpnme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdmein32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlfelogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbkqfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjjahe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bciehh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oklkdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pamiaboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Domdjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gijekg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjchaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbfheo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oemefcap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcbnpnme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cqpbglno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejflhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnpofnhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcepkfld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbbnpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjlgdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jibmgi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkcqn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neafjdkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmkbfeab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckhecmcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likcilhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgflqkdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghhhcomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkkjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhkgoiqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhdjehhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bogcgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Injcmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckhecmcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpbfii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emlenj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqdoem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nchjdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqhcpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqdoem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhpqaiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgdhgmep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kflnfcgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfjgaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mffjcopi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pomgjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhmeapmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaopfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnnkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngomin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aijnep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgndoeag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nklbmllg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pedlgbkh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lblaabdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhicpg32.exe

Executes dropped EXE 64 IoCs

pid	Process
2620	Jecofa32.exe
4148	Joiccj32.exe
4360	Jgdhgmep.exe
3156	Jnnpdg32.exe
2732	Jnpmjf32.exe
3220	Kfjapcii.exe
4180	Kpbfii32.exe
4544	Kflnfcgg.exe
4836	Klifnj32.exe
4356	Kfnkkb32.exe
2536	Kimghn32.exe
972	Khbdikip.exe
2572	Kbghfc32.exe
3312	Lnnikdnj.exe
2084	Lhfmdj32.exe
2024	Lblaabdp.exe
2056	Locbfd32.exe
2180	Lhkgoiqe.exe
1104	Likcilhh.exe
4024	Lfodbqfa.exe
1416	Mojhgbdl.exe
928	Mpieqeko.exe
4448	Mhdjehhj.exe
4560	Mffjcopi.exe
3428	Mlbbkfoq.exe
3640	Mhicpg32.exe
2312	Mfjcnold.exe
3772	Niipjj32.exe
4864	Ngmpcn32.exe
2600	Ngomin32.exe
3232	Nlleaeff.exe
3844	Ngaionfl.exe
3384	Nchjdo32.exe
1148	Nibbqicm.exe
1564	Ncjginjn.exe
4992	Ohgoaehe.exe
464	Ogmijllo.exe
4528	Oljaccjf.exe
4852	Ocdjpmac.exe
1236	Ojnblg32.exe
1300	Pgbbek32.exe
4428	Pjpobg32.exe
4672	Pomgjn32.exe
4888	Pfgogh32.exe
216	Phelcc32.exe
4352	Pgflqkdd.exe
5084	Phhhhc32.exe
1628	Pcmlfl32.exe
1796	Pjgebf32.exe
440	Pcpikkge.exe
3248	Pjjahe32.exe
1996	Pofjpl32.exe
2804	Qjlnnemp.exe
1112	Qoifflkg.exe
1092	Qfbobf32.exe
5068	Qqhcpo32.exe
3172	Agbkmijg.exe
3768	Ajqgidij.exe
4932	Aqkpeopg.exe
2648	Afghneoo.exe
2332	Ahfdjanb.exe
3604	Ackigjmh.exe
744	Afjeceml.exe
4780	Amcmpodi.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pgbbek32.exe	Ojnblg32.exe
File opened for modification	C:\Windows\SysWOW64\Bppfmigl.exe	Bifmqo32.exe
File opened for modification	C:\Windows\SysWOW64\Hjchaf32.exe	Gdfoio32.exe
File opened for modification	C:\Windows\SysWOW64\Injcmc32.exe	Igqkqiai.exe
File created	C:\Windows\SysWOW64\Fndchiip.dll	Malgcg32.exe
File opened for modification	C:\Windows\SysWOW64\Okchnk32.exe	Nbgcih32.exe
File opened for modification	C:\Windows\SysWOW64\Fcneeo32.exe	Ejccgi32.exe
File created	C:\Windows\SysWOW64\Fjqjajoe.dll	Majjng32.exe
File created	C:\Windows\SysWOW64\Mncilb32.dll	Oeheqm32.exe
File created	C:\Windows\SysWOW64\Pdpjda32.dll	Kqbkfkal.exe
File created	C:\Windows\SysWOW64\Nbqmiinl.exe	Nlfelogp.exe
File opened for modification	C:\Windows\SysWOW64\Qfbobf32.exe	Qoifflkg.exe
File created	C:\Windows\SysWOW64\Pjglocmi.dll	Ljilqnlm.exe
File opened for modification	C:\Windows\SysWOW64\Aodfajaj.exe	Aijnep32.exe
File opened for modification	C:\Windows\SysWOW64\Nlfelogp.exe	Naaqofgj.exe
File created	C:\Windows\SysWOW64\Kdpmbc32.exe	Pamiaboj.exe
File opened for modification	C:\Windows\SysWOW64\Cbbnpg32.exe	Cnfaohbj.exe
File created	C:\Windows\SysWOW64\Fnkhbo32.dll	Ngmpcn32.exe
File created	C:\Windows\SysWOW64\Dleglm32.dll	Pgbbek32.exe
File created	C:\Windows\SysWOW64\Impjjbmh.dll	Aimkjp32.exe
File created	C:\Windows\SysWOW64\Egcjff32.dll	Dfmcfp32.exe
File created	C:\Windows\SysWOW64\Jkomneim.exe	Jhpqaiji.exe
File created	C:\Windows\SysWOW64\Nbgcih32.exe	Nlkngo32.exe
File opened for modification	C:\Windows\SysWOW64\Ngaionfl.exe	Nlleaeff.exe
File created	C:\Windows\SysWOW64\Kamqij32.dll	Dmdonkgc.exe
File created	C:\Windows\SysWOW64\Jaddoaap.dll	Fibojhim.exe
File created	C:\Windows\SysWOW64\Naaqofgj.exe	Mhilfa32.exe
File created	C:\Windows\SysWOW64\Ingcceof.dll	Oehlkc32.exe
File created	C:\Windows\SysWOW64\Kplqhmfl.dll	Ephbhd32.exe
File created	C:\Windows\SysWOW64\Lepein32.dll	Nbgcih32.exe
File created	C:\Windows\SysWOW64\Klgmcn32.dll	a66474d51ffaafdafc9b127952885b1459999b04a561b61bdd15650d6b90dc02.exe
File opened for modification	C:\Windows\SysWOW64\Phhhhc32.exe	Pgflqkdd.exe
File opened for modification	C:\Windows\SysWOW64\Ddadpdmn.exe	Dmglcj32.exe
File created	C:\Windows\SysWOW64\Kjjbjd32.exe	Jlgepanl.exe
File created	C:\Windows\SysWOW64\Ffpcchkn.dll	Bmkcqn32.exe
File created	C:\Windows\SysWOW64\Oeheqm32.exe	Kmkbfeab.exe
File created	C:\Windows\SysWOW64\Qiginoqd.dll	Ahfdjanb.exe
File created	C:\Windows\SysWOW64\Fdkpma32.exe	Fmqgpgoc.exe
File created	C:\Windows\SysWOW64\Pcepkfld.exe	Pkogiikb.exe
File opened for modification	C:\Windows\SysWOW64\Poomegpf.exe	Pefhlaie.exe
File created	C:\Windows\SysWOW64\Bqcmhb32.dll	Gaamlecg.exe
File created	C:\Windows\SysWOW64\Oflpld32.dll	Oaompd32.exe
File opened for modification	C:\Windows\SysWOW64\Fqfojblo.exe	Fcbnpnme.exe
File created	C:\Windows\SysWOW64\Pjjahe32.exe	Pcpikkge.exe
File created	C:\Windows\SysWOW64\Inomhbeq.exe	Ihbdplfi.exe
File created	C:\Windows\SysWOW64\Kbddfmgl.exe	Kgopidgf.exe
File created	C:\Windows\SysWOW64\Lneajdhc.dll	Jecofa32.exe
File opened for modification	C:\Windows\SysWOW64\Cpihcgoa.exe	Cjmpkqqj.exe
File created	C:\Windows\SysWOW64\Ackigjmh.exe	Ahfdjanb.exe
File opened for modification	C:\Windows\SysWOW64\Cjmpkqqj.exe	Cgndoeag.exe
File opened for modification	C:\Windows\SysWOW64\Djdflp32.exe	Dcjnoece.exe
File created	C:\Windows\SysWOW64\Hkbdki32.exe	Hjchaf32.exe
File created	C:\Windows\SysWOW64\Keqdmihc.exe	Kqbkfkal.exe
File created	C:\Windows\SysWOW64\Lblaabdp.exe	Lhfmdj32.exe
File created	C:\Windows\SysWOW64\Fcdomhkp.dll	Afnnnd32.exe
File created	C:\Windows\SysWOW64\Jqdoem32.exe	Inomhbeq.exe
File opened for modification	C:\Windows\SysWOW64\Lbinam32.exe	Lgcjdd32.exe
File created	C:\Windows\SysWOW64\Fqokaeco.dll	Mojhgbdl.exe
File created	C:\Windows\SysWOW64\Mfjcnold.exe	Mhicpg32.exe
File opened for modification	C:\Windows\SysWOW64\Nbqmiinl.exe	Nlfelogp.exe
File opened for modification	C:\Windows\SysWOW64\Gijekg32.exe	Ghhhcomg.exe
File created	C:\Windows\SysWOW64\Lbmoin32.dll	Hjchaf32.exe
File opened for modification	C:\Windows\SysWOW64\Chlflabp.exe	Cbbnpg32.exe
File created	C:\Windows\SysWOW64\Ojnblg32.exe	Ocdjpmac.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5152	4428	WerFault.exe	357

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdpmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnnikdnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngaionfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efdjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkonq32.dll"	Fmlneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kplqhmfl.dll"	Ephbhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Likcilhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iejpiq32.dll"	Acnemi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgnboabc.dll"	Fgbfhmll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmdjce32.dll"	Jnpmjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oeheqm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckmonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjpobg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnfmjbo.dll"	Bciehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pinnnm32.dll"	Llhikacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpecpgjp.dll"	Nklbmllg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knhcpa32.dll"	Oldamm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Becnaq32.dll"	Hjlkge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jqdoem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Naaqofgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmbbhkjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkabjbih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckkpjkai.dll"	Kjjbjd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghhhcomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljilqnlm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lankbigo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Milidebi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oldamm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddhnoefl.dll"	Oimkbaed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhjlnlii.dll"	Pcepkfld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhpqaiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmkcqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odnknc32.dll"	Ccgajfeh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghkeio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hnfjbdmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gijekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emmoafdl.dll"	Injcmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpbfpack.dll"	Jqdoem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lankbigo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkfgena.dll"	Kflnfcgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbjlkd32.dll"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihqiqn32.dll"	Keqdmihc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llhikacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcaihm32.dll"	Mlmbfqoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgndoeag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bifmqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdmein32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idhmabfb.dll"	Jhpqaiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhmeapmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alncgf32.dll"	Likcilhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcbnpnme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfljoa32.dll"	Ajqgidij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjbalpnl.dll"	Ddadpdmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amcmpodi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpckjfgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkdhjknm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Henjapmn.dll"	Ghkeio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbfheo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngmpcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhdohp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lklcfhik.dll"	Jjdjoane.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkhpjc32.dll"	Cnfaohbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjjbjd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2620	1444	a66474d51ffaafdafc9b127952885b1459999b04a561b61bdd15650d6b90dc02.exe	90
PID 1444 wrote to memory of 2620	1444	a66474d51ffaafdafc9b127952885b1459999b04a561b61bdd15650d6b90dc02.exe	90
PID 1444 wrote to memory of 2620	1444	a66474d51ffaafdafc9b127952885b1459999b04a561b61bdd15650d6b90dc02.exe	90
PID 2620 wrote to memory of 4148	2620	Jecofa32.exe	91
PID 2620 wrote to memory of 4148	2620	Jecofa32.exe	91
PID 2620 wrote to memory of 4148	2620	Jecofa32.exe	91
PID 4148 wrote to memory of 4360	4148	Joiccj32.exe	92
PID 4148 wrote to memory of 4360	4148	Joiccj32.exe	92
PID 4148 wrote to memory of 4360	4148	Joiccj32.exe	92
PID 4360 wrote to memory of 3156	4360	Jgdhgmep.exe	93
PID 4360 wrote to memory of 3156	4360	Jgdhgmep.exe	93
PID 4360 wrote to memory of 3156	4360	Jgdhgmep.exe	93
PID 3156 wrote to memory of 2732	3156	Jnnpdg32.exe	94
PID 3156 wrote to memory of 2732	3156	Jnnpdg32.exe	94
PID 3156 wrote to memory of 2732	3156	Jnnpdg32.exe	94
PID 2732 wrote to memory of 3220	2732	Jnpmjf32.exe	95
PID 2732 wrote to memory of 3220	2732	Jnpmjf32.exe	95
PID 2732 wrote to memory of 3220	2732	Jnpmjf32.exe	95
PID 3220 wrote to memory of 4180	3220	Kfjapcii.exe	96
PID 3220 wrote to memory of 4180	3220	Kfjapcii.exe	96
PID 3220 wrote to memory of 4180	3220	Kfjapcii.exe	96
PID 4180 wrote to memory of 4544	4180	Kpbfii32.exe	98
PID 4180 wrote to memory of 4544	4180	Kpbfii32.exe	98
PID 4180 wrote to memory of 4544	4180	Kpbfii32.exe	98
PID 4544 wrote to memory of 4836	4544	Kflnfcgg.exe	99
PID 4544 wrote to memory of 4836	4544	Kflnfcgg.exe	99
PID 4544 wrote to memory of 4836	4544	Kflnfcgg.exe	99
PID 4836 wrote to memory of 4356	4836	Klifnj32.exe	100
PID 4836 wrote to memory of 4356	4836	Klifnj32.exe	100
PID 4836 wrote to memory of 4356	4836	Klifnj32.exe	100
PID 4356 wrote to memory of 2536	4356	Kfnkkb32.exe	101
PID 4356 wrote to memory of 2536	4356	Kfnkkb32.exe	101
PID 4356 wrote to memory of 2536	4356	Kfnkkb32.exe	101
PID 2536 wrote to memory of 972	2536	Kimghn32.exe	102
PID 2536 wrote to memory of 972	2536	Kimghn32.exe	102
PID 2536 wrote to memory of 972	2536	Kimghn32.exe	102
PID 972 wrote to memory of 2572	972	Khbdikip.exe	103
PID 972 wrote to memory of 2572	972	Khbdikip.exe	103
PID 972 wrote to memory of 2572	972	Khbdikip.exe	103
PID 2572 wrote to memory of 3312	2572	Kbghfc32.exe	104
PID 2572 wrote to memory of 3312	2572	Kbghfc32.exe	104
PID 2572 wrote to memory of 3312	2572	Kbghfc32.exe	104
PID 3312 wrote to memory of 2084	3312	Lnnikdnj.exe	105
PID 3312 wrote to memory of 2084	3312	Lnnikdnj.exe	105
PID 3312 wrote to memory of 2084	3312	Lnnikdnj.exe	105
PID 2084 wrote to memory of 2024	2084	Lhfmdj32.exe	106
PID 2084 wrote to memory of 2024	2084	Lhfmdj32.exe	106
PID 2084 wrote to memory of 2024	2084	Lhfmdj32.exe	106
PID 2024 wrote to memory of 2056	2024	Lblaabdp.exe	107
PID 2024 wrote to memory of 2056	2024	Lblaabdp.exe	107
PID 2024 wrote to memory of 2056	2024	Lblaabdp.exe	107
PID 2056 wrote to memory of 2180	2056	Locbfd32.exe	108
PID 2056 wrote to memory of 2180	2056	Locbfd32.exe	108
PID 2056 wrote to memory of 2180	2056	Locbfd32.exe	108
PID 2180 wrote to memory of 1104	2180	Lhkgoiqe.exe	109
PID 2180 wrote to memory of 1104	2180	Lhkgoiqe.exe	109
PID 2180 wrote to memory of 1104	2180	Lhkgoiqe.exe	109
PID 1104 wrote to memory of 4024	1104	Likcilhh.exe	110
PID 1104 wrote to memory of 4024	1104	Likcilhh.exe	110
PID 1104 wrote to memory of 4024	1104	Likcilhh.exe	110
PID 4024 wrote to memory of 1416	4024	Lfodbqfa.exe	111
PID 4024 wrote to memory of 1416	4024	Lfodbqfa.exe	111
PID 4024 wrote to memory of 1416	4024	Lfodbqfa.exe	111
PID 1416 wrote to memory of 928	1416	Mojhgbdl.exe	112

C:\Users\Admin\AppData\Local\Temp\a66474d51ffaafdafc9b127952885b1459999b04a561b61bdd15650d6b90dc02.exe
"C:\Users\Admin\AppData\Local\Temp\a66474d51ffaafdafc9b127952885b1459999b04a561b61bdd15650d6b90dc02.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\Jecofa32.exe
  C:\Windows\system32\Jecofa32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\Joiccj32.exe
    C:\Windows\system32\Joiccj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\SysWOW64\Jgdhgmep.exe
      C:\Windows\system32\Jgdhgmep.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4360
    - - C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3156
      - C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\SysWOW64\Kpbfii32.exe
        
        C:\Windows\system32\Kpbfii32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        23⤵
        Executes dropped EXE
        
        PID:928
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        26⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3640
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        28⤵
        Executes dropped EXE
        
        PID:2312
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        29⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2600
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3232
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3844
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        35⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        36⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        37⤵
        Executes dropped EXE
        
        PID:4992
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        38⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        39⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4852
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1236
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1300
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        45⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        46⤵
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4352
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        48⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        49⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        50⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:440
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        53⤵
        Executes dropped EXE
        
        PID:1996
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        54⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1112
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        56⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        58⤵
        Executes dropped EXE
        
        PID:3172
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3768
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        60⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        61⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2332
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        63⤵
        Executes dropped EXE
        
        PID:3604
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        64⤵
        Executes dropped EXE
        
        PID:744
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        66⤵
        Modifies registry class
        
        PID:4224
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4068
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        68⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        69⤵
        Drops file in System32 directory
        
        PID:1128
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        70⤵
        Drops file in System32 directory
        
        PID:4012
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:232
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1504
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        74⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        75⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        76⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        77⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        80⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        82⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        84⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        85⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        87⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        88⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        89⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        90⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        91⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        92⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        93⤵
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        95⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        96⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        97⤵
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        98⤵
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        99⤵
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        100⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        101⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3404
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        103⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        104⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        105⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        106⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5580
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        108⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        109⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        110⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        111⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6008
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        113⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        114⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        115⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        116⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        117⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        118⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        119⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        120⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        121⤵
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        122⤵
        Drops file in System32 directory
        
        PID:5876
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        123⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        124⤵
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        128⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        129⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        130⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        131⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        132⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        133⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        134⤵
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        136⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        137⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        138⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        139⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6680
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        141⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        142⤵
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        143⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        144⤵
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        146⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        147⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        148⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        149⤵
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        151⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        152⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        154⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        157⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        158⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6736
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        160⤵
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        161⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        162⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        163⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        164⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        165⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        167⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        168⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2644
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        171⤵
        Modifies registry class
        
        PID:548
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        172⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        173⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        174⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6920
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        175⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        176⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        177⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        178⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        179⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        180⤵
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        183⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        184⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1308
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        186⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        188⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2564
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6688
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        194⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        196⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7312
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        198⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        199⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        201⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        202⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        203⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7696
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        205⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        206⤵
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        207⤵
        Drops file in System32 directory
        
        PID:7860
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7948
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        210⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        211⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        212⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        214⤵
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7208
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        217⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        219⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        221⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        222⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        223⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        224⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        225⤵
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8144
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        227⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        228⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        229⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        230⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7624
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7844
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        233⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        234⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        235⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        236⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        237⤵
        
        PID:332
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        238⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        239⤵
        Drops file in System32 directory
        
        PID:7652
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        240⤵
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        241⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        242⤵
        Modifies registry class
        
        PID:1556
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        243⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        244⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        245⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        246⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        247⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        248⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        249⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        250⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        251⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Ejccgi32.exe
        
        C:\Windows\system32\Ejccgi32.exe
        252⤵
        Drops file in System32 directory
        
        PID:4864
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        253⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        254⤵
        Modifies registry class
        
        PID:7972
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        256⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        257⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        258⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        259⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 408
        260⤵
        Program crash
        
        PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4428 -ip 4428
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ccnncgmc.exe

Filesize
78KB

MD5
bbf81558eefcde28878d44162dd8d9a5

SHA1
b0739add9559a57cb2041fd40b8061a3b68f1293

SHA256
948d724473a4d74eca38603b26ef30c8493417a4ab0c4823f199bd912b363fa6

SHA512
d42134966a477a5876c8b102785ca290d49954c1b9603f42900921066925db62da12331674d56741d324e2c0ae6909fb40366e489db7561e3104b9d910c508de

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
78KB

MD5
0162bea7ff9efe52c55796366e2c87cb

SHA1
ac4f604465f00ceb8065e79c97a24324b7aa33df

SHA256
58f6ddb89af243e6296d59c701bc690b89e7e110a805b4de60f0ab4e461ddee1

SHA512
ef97acd561302793c6edfeda1bd4b792d07754700b0be93da41a6b483869a83e84ede2c159a23715898f018210955ed6157bc73cc610beaa4441b2532c3503d6

Download Submit
C:\Windows\SysWOW64\Ejccgi32.exe

Filesize
78KB

MD5
93441afbdc750fac1e98f9a91326d053

SHA1
46cdd8fa9547dbfc55f97a948cc44b8794380237

SHA256
3ee016161b7e43f3e0b83e63b0edae63f969320899db28e0b5e4f6ebffcccb0b

SHA512
f841c2a0bb484b769e6b0df8bf60fe0729276aea66cb45c8735706702b0d56d5122627ce171c2bfad03fc0e7959a6122c79686a8fd8a4458a4bef02b673fb80f

Download Submit
C:\Windows\SysWOW64\Gaopfe32.exe

Filesize
78KB

MD5
524e42b4037626ebd0d940e9118f1098

SHA1
c74bb5dd13f4ac53aa9dd1182475d30d7b21b391

SHA256
0cf89f864164171193bb9c14cb34d67b931fe4e0edf793a7216b61923c86f278

SHA512
6b42fca86f0edc7099bfb332db6e41fa1a103de5fe84af40e6a156a5fbca0be564963e643a30cacd6e8b8b13e48fbf1afe7d038e21e3024cc741dc5dbd3c841c

Download Submit
C:\Windows\SysWOW64\Hjhalefe.exe

Filesize
78KB

MD5
54926b2ba1123af62bd430387223087d

SHA1
0661089bea569c1d922d5d287397d217597632cb

SHA256
83389600f630109a6c632b130be665b047f5aacad024eb13342a3504e325ae0e

SHA512
6735f6da74095878a8a0fed627c3efeefefbcd7c1ae80a91eeef6418f2c7ff7e56581d1d285c4d95eee83cd9439777e00351e29d7ff1d3fd9939e17bb86b9619

Download Submit
C:\Windows\SysWOW64\Hnfjbdmk.exe

Filesize
78KB

MD5
cc20318729b2f7d726a489ce24134a12

SHA1
fc49784c2c002e1e7470538ea2a83d23b50e1716

SHA256
cfd5af34fe12fd35c64bde3477ea4769902ffdc7230d5328e915faa298cfef2e

SHA512
4f37149e41138c3a2e7cdaa99dbec1d168fbdd1977f00b07488b782ea5bdca966d6ff07a325442972430510e17a2948ffe12279e01aa6d5ca800861e3a5a3a3e

Download Submit
C:\Windows\SysWOW64\Jecofa32.exe

Filesize
78KB

MD5
5e1c7230c4a40aea5bf6f6aa8e3097de

SHA1
fe983c5adf9b9850726f0a6042d183ddec4e3fd1

SHA256
d4ea61fd40f9b763d428178c33486af7dc1463ccf896f68c68cd111067615bc4

SHA512
ee0fc77b9a09011757df15d5403a4a1ad8a4d8f969dc67eaa398c70ada7206ba7d330ebe82b0da8b4370b6be439e5dc9ff19c06f867b77c7a7bcaf86496ca8d3

Download Submit
C:\Windows\SysWOW64\Jgdhgmep.exe

Filesize
78KB

MD5
bd1ddc5ae3f92b9596050c3bb1f95df0

SHA1
aea0daa677df63391ff0b071c528a15d52f1cc66

SHA256
d492987ef85a8b7ff8d119471c8be3f7b5513f1e2e41da989d00a329db178879

SHA512
2d583759dbb4493a71b35e33192297b7037456f9581ec9c911afd31edbaa09d34723a5a1c6027a43d4505cbcf34c22d30642501fdc9f0736c6714126eda3d4b3

Download Submit
C:\Windows\SysWOW64\Jibmgi32.exe

Filesize
78KB

MD5
b902912d80c94794e8788df7523ebe74

SHA1
6c84aa2a84394379397c5c80f94d2b4546c0ef22

SHA256
91221e734c64d842845c23020a6cfe5ae6e37a989aecfdbde8d1a2073bff7435

SHA512
ae069ea053426d9acc7cd7ea799bf4c6f4aff323a01f0d6c036519a48ab0116f56b6ca08462573c95bdaf80d374ff2b82b03929eb34fd57b4285106584a580e4

Download Submit
C:\Windows\SysWOW64\Jnnpdg32.exe

Filesize
78KB

MD5
89d906534a90f131d39c558d43b5b3b4

SHA1
ca19b34bfca01d6e13c25739b65e02d12b3cfc0d

SHA256
c9130a3b05afe9c4110420800c1ac200f9d5d0230cea6f9898059312d2750a38

SHA512
13a62d19fecd2dc474d0ce7a2bd9d07c0bfb12b0c230064b1ecc3177be00b5a933fed77752ee31cc2cbd67f20c65fe0632d90162859a216f31426c916db89469

Download Submit
C:\Windows\SysWOW64\Jnpmjf32.exe

Filesize
78KB

MD5
093711af8b6fe6c109fc89f63f931e86

SHA1
e850c36b99085bf3c6273c88bf004d38cd3dda0e

SHA256
296a4955585cbbd9e79f80b821d076a8c6d0e80eaa5b75de8eb7e580b281a1fb

SHA512
5d64a8af266adf500b1d5ab77b941430ec98fea0f840d1d7c4831c4c290a177585d0e32ab51394d92f4b130395abbc75ea4c237ddd404048f002b1b5e77043fa

Download Submit
C:\Windows\SysWOW64\Joiccj32.exe

Filesize
78KB

MD5
20921237fc4ace1e19c495b2c69f3e55

SHA1
9917a2f18403d29ad02893c90c1ad4c2ae3128b3

SHA256
d30e86b4821728dcce340c11e1cfc1051969f5b71c047eb30e35c40e6f2d414e

SHA512
41fc60b49cf3cc25c2c1d0aa8b764ac339067dafa504084b8a3fed1968a0cc3a849593f6127689bd78314eab0e7a727bc91f65f913dd70f81363357eea6680ae

Download Submit
C:\Windows\SysWOW64\Kbghfc32.exe

Filesize
78KB

MD5
10e543204f9a57baad6077d677a12d51

SHA1
65f37e194b949656fe3b6c3e01107b492ca2cf96

SHA256
3242cc3fcdebf7e35b19dec30a9ff296ba75c6df34c037fb93029d15abe9963e

SHA512
f499c9e204afd6977c05ef4610db3b2d28dd26a1df2d0ba978f310434adc2a1707a6f12d12479cc67aa0edc9878caf1d9958af57f79ff073f848a86aca567e92

Download Submit
C:\Windows\SysWOW64\Kfjapcii.exe

Filesize
78KB

MD5
35a49bc9907f3047147cddf666e51594

SHA1
ef02552ead197b4d67a6ea34f90ebe3850ff8fc3

SHA256
403d60c2ad1d1697ce84596a194b0ef192697afc37e9f99ec412d0407042164c

SHA512
ace12a0eb87775343654cdc1cebbb60f4511e1728f3e7d6d579ac1a64d3872c56cb19002a3ba461dce33063c7c41a5a646a067fe8994c03b062726a18ed6371e

Download Submit
C:\Windows\SysWOW64\Kflnfcgg.exe

Filesize
78KB

MD5
a0e7e1e17ee7253fe37a3e147fe78e72

SHA1
eeae344595efb1f50d3fc613f264493d4206306f

SHA256
1fe378c35f155e556959cda0a60a9eac4600b57867dd6462ae86414696b9aec9

SHA512
d62c1bfdad823200917118bf1282bebbf9eff42c26dba1bfe451c3986d35104d624367cf123e3270514b1c20ceb19cb9be10159728840df0a4df5498ca2caa33

Download Submit
C:\Windows\SysWOW64\Kfnkkb32.exe

Filesize
78KB

MD5
74c36c45ece9b1fadd2b4b38280593d6

SHA1
8084242da0d047ebc291b8e3e0fda8d087beac3d

SHA256
b8f9cae484e7f8bebb211268515bd5345f9dc5929ed32bf8064e8c2b85b51402

SHA512
0ef24f927960dad3f9f334188575bf7b853c8bd95ab46a61c552ca34c8c6755c235124237e200b225d76ec8f283c22ad5f88aa77b92d97d81a1c10f8718064b7

Download Submit
C:\Windows\SysWOW64\Khbdikip.exe

Filesize
78KB

MD5
c1576448e8e220c657bfdea3500191f6

SHA1
13ee0505473c2b4e4ee02b20e7295f3f6d1cf4ed

SHA256
f37af74712e185a5f9b28e7aac1a7b6fc4d8173e74395b66fb399468c572258d

SHA512
484df657b63197faa4b5e8ff129fa7a6cd9e9d9b1b25859a27b2c7647472784dcd6c56b0db0f70135841a11ebab117ad2050df0d235eda68382cd3f0133ba1cb

Download Submit
C:\Windows\SysWOW64\Kimghn32.exe

Filesize
78KB

MD5
5590fbc2c1502acdd7d201155d9c7387

SHA1
20f150e8c9e3b8b5459b44620f8c560cb6439827

SHA256
b7e83149d5f45ea5bbfff303606557202c344c9ad42f0d179baac6a60417c158

SHA512
b30153c54e80198a6d14d4577fc4d5599fa303a8a72a727261bd3ba41a41e79ade26f23d79b0414792c35b44e623cd694ef4ae06a9f3ff69371396dff17ec6fd

Download Submit
C:\Windows\SysWOW64\Kjjbjd32.exe

Filesize
78KB

MD5
f1be15e428d54e4d97151fe3545c6e17

SHA1
c6cbb23f16f74e8d5ba97809fc1d9bcdcf98ffc1

SHA256
0001ed9463cdadf31b33b8dcd4cfa85658ee5074aa3b38ee5b87a2c8dff4276d

SHA512
51f5a759663d916d401a00bbef52fb56b86778fc25df4a90c8701fc800eaf20b814b06f09b4d2be63a1d23b3b3920d5639ae6022c7abddb9cea78a3de0751f26

Download Submit
C:\Windows\SysWOW64\Kkcfid32.exe

Filesize
78KB

MD5
f13786fa51902b5758833545def2a473

SHA1
aa3f583e33326867ed78f454504b9deb37972530

SHA256
76cfe31f8cb6bb3051da916a84655ae6a76f37daa6088bd9d3cf28e3bcb5a484

SHA512
31d806830337ef8d40a5c87ee3c49e6ca83a4931b57cc3cb9780b7a554ac9879c3fbf0bad04c5fff4030bbd5c90cd167fb23a271a3906bda42e77cd3baf8c4cc

Download Submit
C:\Windows\SysWOW64\Klifnj32.exe

Filesize
78KB

MD5
8a078e8eebfe2a320bbaa546a64759c8

SHA1
e74e80855b3ebefd4bc45c43de7c4c6783cb6f32

SHA256
181af798e0b80d7957a7186cd701b5a4c51d7ce431fb50bd61dd00468df5e566

SHA512
8a7d309244a06d1cba2ffa7285cdd33bed1dd115064921ead82f4f49d75a99340e9f79bb03d99a774311b861a6a4e78cc0f68bbc029e33f81da2b517865d5a74

Download Submit
C:\Windows\SysWOW64\Kpbfii32.exe

Filesize
78KB

MD5
073f79534724a5504bc0e15795921fb4

SHA1
d45b64046a07e32f690534186ef4eaa3664eeebd

SHA256
805973a001d2eddc06b8dc86d2118898f337e1b91cf53d7663afca7bf378cd83

SHA512
da99756ae2d9abb2a0f9e2c6a785e11fb4d1f6c62f402adca3d2c874ec66ed282bbe71d6bf7567389181b4714f4b3de37f20e92fe92207cf2de092a353ad2eaf

Download Submit
C:\Windows\SysWOW64\Lblaabdp.exe

Filesize
78KB

MD5
6c1a93e72eb3b1a8f2cd46d8b5dae9b2

SHA1
b2421355e72234bbae1d211a2177a5266e89eb60

SHA256
119c27891ea79507f4da9ce08ec3b52b7ec00e45dd885935f736d487e2f1d6f8

SHA512
d66bad463ae9ec297d614fee66bb6a4889415df7bd91ac1cb33668418ce7facc12db8eb1f428b878061a16586233400ea404fe3c27ba2adbeb3d967ce14843d1

Download Submit
C:\Windows\SysWOW64\Lfodbqfa.exe

Filesize
78KB

MD5
cef10d974f67f524aa28e1c3c7ec0ab3

SHA1
6f7e16078d39e95a5476b04070320a48ca299989

SHA256
6d7c27d29907d76e050b853bf097a31cf41f3f669d2531661f944de6b1219fc1

SHA512
6539120ec3a5d62178544fc88e8d93d903aec098cf63dd36816b3cc1404a92ccd874ec3aa6b2fd75f408526c53e814aaf1df86d2ef302197a0699f8304d80b3c

Download Submit
C:\Windows\SysWOW64\Lhfmdj32.exe

Filesize
78KB

MD5
eac13d9e803f21c0b93a124ca6931a3b

SHA1
43512a4492e7fc7bfa5461cfdd5c583585ff5f76

SHA256
4f6dad3f612fbbd5c4feb78f2130db48eba4af6acf883e55a3987470e1eef81e

SHA512
443ba3b83c73882bc465f0ecef296238a0ab1502b20032e02be4f6a0dd4d1ddaae63ed16bad625209042cb492d1606c7735414c354709c32db16fca4481ad247

Download Submit
C:\Windows\SysWOW64\Lhkgoiqe.exe

Filesize
78KB

MD5
5531b182fb8b05a0609d8ddd233efbab

SHA1
3764d8f6b14e3810e4496031972dd60192d49fc0

SHA256
dc73a2b55b0fc0f878e9635e5262d9880ce0ffb975bbbb7664389e7b5b6e37d8

SHA512
a2464ea7586ee7e48a9b334135d83cab122b2287def98b438031b859b0223424759fa0d2b13e51c9614cdc2c8e91535f8e9e245708eaa53c0278b3f0c49d2f18

Download Submit
C:\Windows\SysWOW64\Likcilhh.exe

Filesize
78KB

MD5
9b197398f2d415eb9b497e677993c4bd

SHA1
2f2154b0b5797ce5854dcce5d9e7beaabc0f9dd0

SHA256
5b02ae20da1882872e9f409f76fe8f0bfaa66438c691fe9f8144d4e23b6fb27d

SHA512
259b48fac5475b6a1a5359ae9b413a875b310e5d5ef2c8adbb445e1d6c7b45dda921670507826ee4b7f9a2b0271aaf55d34cad0b5a6914c5b030d43cc516a840

Download Submit
C:\Windows\SysWOW64\Lnnikdnj.exe

Filesize
78KB

MD5
75e5f07ff35e5641698a2febc425e993

SHA1
ab96d7c34eb8061833c1e8fc926fcfe78c984e4d

SHA256
bd256ba4bc9548b6e70b76938d86d36aea6aa6fdd9961c3b3ca4a071492e1e23

SHA512
8df7bfb1acda726a02c86055eab3ec53b577ec8cf6a4fae1813af6933b44fc34de4c0e317434701232772e52cfb1faa63df64edce7462069aacf7cc59c5fac65

Download Submit
C:\Windows\SysWOW64\Locbfd32.exe

Filesize
78KB

MD5
e7cdc819546c2847b186a86271ccbef1

SHA1
aa5cd0d18d60c1e26a851a95dd0ba3def0efa031

SHA256
64c9b52e616fc2b5d376bd70437e06ccd1d48801dda4d9891bb44510ced77830

SHA512
c6351bb1c797b30649df5c7d3ec80eeb07c7a80f5c44325cab0e2d0a2b4549d83f2d722ab8b312f617dee50cbc6f2a453e438ea6c793ecb318ef72dc0d663867

Download Submit
C:\Windows\SysWOW64\Malgcg32.exe

Filesize
78KB

MD5
2d623479cf835e63fdeca1221e38119d

SHA1
1806d46bdcbbcbf6508a02505e09941a477047cf

SHA256
65f4219be7e6a05711a15505745bb2864e7cdf2b4b2ad0c30e1711c5addd325a

SHA512
e94454df4dd014822f1c9c68ce34e18ed245af352535aed24465312c92d51282e38eeec35a4027953fa08066da5d3c08832b62d7027fb99d91afb0ab1dd79046

Download Submit
C:\Windows\SysWOW64\Mffjcopi.exe

Filesize
78KB

MD5
1487aab268fc2a0644b0ffb8ba0ad63c

SHA1
c56266fd82537775796b69c39b7f8585739b44c6

SHA256
06b881e2f8152f4080067f52c02c6b856fbab518c02349ed32df2402ea86d1a0

SHA512
d0b9d628dc642bac8b7a9ce8a70474799a2b3191a0fc8d2e7addbde0511fe7784b14f296c713b8c40b1f362db3264408854f726a925b9fb89e2661e44e184426

Download Submit
C:\Windows\SysWOW64\Mfjcnold.exe

Filesize
78KB

MD5
5208da2a84736ca6c1b7681b26035217

SHA1
5d1750f45500398af8231d57ca27c4a9970c65eb

SHA256
b4858760a2e8fa110076aa9bd7461dfe2027d5e22acee51362f780c6e3a95066

SHA512
2920bae5f0b545500c334ccf09cc5087afa5cf6313c786e328a607232509cdc0fedb0031163be2d2df9dc03f0abf89dbdfa28c83a97b5909b8654606e9dc512b

Download Submit
C:\Windows\SysWOW64\Mhdjehhj.exe

Filesize
78KB

MD5
d16dfda6c8f3bb1eaf4b419d2fbd0b9a

SHA1
0199cbbd417a9590f4535889b3f788ff0ef56b6c

SHA256
378dda9a383cd91c4e96bbbbe0993a1daab50fb21921189ebf670522213b1060

SHA512
a6e1fda3b1aaf22b85ee756a9e016fcc25f7138db1e08025149aeeb92e88f63c3ac54df28dd9a192a1f48b75058b2d87819bbdb5aa1ca9a773650f73720b0535

Download Submit
C:\Windows\SysWOW64\Mhicpg32.exe

Filesize
78KB

MD5
9b751ae5916c51afa6e09457885d0762

SHA1
c7b597df2eeaac7052f697f06ae32639d089cb4b

SHA256
6d662746a8b5ac1f40fff15b4e9835e52c43400d49016655280c7e653ffe248d

SHA512
79b49773d9caf50a297b0daa966bb50f48b7bb0fe48f80a207992c83e213fe1755ece8284f9116951733e7471b48173fec51f7cc9a476f8102229c40278cf5aa

Download Submit
C:\Windows\SysWOW64\Mlbbkfoq.exe

Filesize
78KB

MD5
2a7ef66e4b1fdedda84e4ee8ee0c7c01

SHA1
9621b9960f1f3bf2f84b20aaf5aee85dab024b3f

SHA256
588579a7aad4f152448e2db89abcd7bd1beede6e88f00b597998c3180d19f949

SHA512
4e72024a73545cacd6db7073e23ee863131827f2188e76e713a818edacd456aec8818fc3e69c1ba8e29a2bd100346c797212ed44144e705427ef640253244c89

Download Submit
C:\Windows\SysWOW64\Mojhgbdl.exe

Filesize
78KB

MD5
f2f2f3bd8326538e059aedc06c9da46f

SHA1
c6f5868ec9cb7e6358c215eb07e4885a6b5fcd71

SHA256
7a73ab867d309677d554d52734ecaa26968413bfa52f0e8a08dc7a2fbd40dcf9

SHA512
e19d11fad5e492fafa5cf7ca977b9aafa315af33d5c6f9bddcd99d0523c43f72a16b55e969dc5964b1bae0329e7828455ab831c9f8ae505670a5c729673707e8

Download Submit
C:\Windows\SysWOW64\Mpieqeko.exe

Filesize
78KB

MD5
f4ada225bb95dc83300f0dd7d1017358

SHA1
b3c44a60f0017c690551740acf06340a0a42845c

SHA256
86afab71d341695e8a18e9bbea563400e90053d74b188786dccc86987205e069

SHA512
05f1e068e7c6fa62eb6c74fd781c48c67d1658bc23696f4acb0c393f8e8b9839b78531df20bb1a146afc9e4b6362ef3cd0b74dd74141f57c30afe6fefbfe194d

Download Submit
C:\Windows\SysWOW64\Nbgcih32.exe

Filesize
78KB

MD5
3168d00c3f5d672a7d7eaddc4c2c314d

SHA1
7ccc4779e9fb073cf99aa56bc32dca345e0d9192

SHA256
e6dbebb1f5dafeaecb96cffcf298ad0a9598b8f3220d68defce246150d200fa3

SHA512
0fcbdf072450cd4733ed09cae322be72b6f682b9b898c776368a82f5299328fa353fa1ee13aa5932e701d4cd9e13aa037cc9dfe58829df7feaeb687644210923

Download Submit
C:\Windows\SysWOW64\Ngaionfl.exe

Filesize
78KB

MD5
ea132620964e0cf1dde42ec7a869a3bd

SHA1
4ed2a6bd442e836494a543945d69381bdc311a54

SHA256
106bbe24022e0582b958ba77a310d1af38a4a36e631a3333cdeef75984f99c8a

SHA512
29980552474621c4018302211b716d1eb353a9f49a90e6c4c45ba464dc9278bc0b6fd05fc368e43c3a5759d7b776e867a17f83da604acc531ba5cc7ed690d99f

Download Submit
C:\Windows\SysWOW64\Ngmpcn32.exe

Filesize
78KB

MD5
1b0a42da8a46851fe744e90a026844c6

SHA1
03e2e182287a002fedd3d8368046649a8e0382af

SHA256
15add29d5fe3a5131eca52d94e7346a1308ed8e1a1e1eba8fef9f0c29d1d18d5

SHA512
6e85cd1e9f35ae6861ddd284d10fdccd5a4362d1a31faca5188516ed55ae5ba8616955ab43a6ef80637a1c116e6ef52f20aaf475ddeb0097998000501594a85d

Download Submit
C:\Windows\SysWOW64\Ngomin32.exe

Filesize
78KB

MD5
d909f69f156452cec5080adf53208514

SHA1
256996f9fbaffc624fe83bb8f1b9f9c37e37ad03

SHA256
a86fb79d6009e823817d21dcf596e687d418f8315a478a4858f3a344307fc2ed

SHA512
b38b53c4fc48300cf3c8a9515318e6d1a3eedf27f2d075d18100e2920ccbf08d071b41a2ffd7381918da8d232a657efa518ed3a84235208aad2f5a4474c7d690

Download Submit
C:\Windows\SysWOW64\Nhmeapmd.exe

Filesize
78KB

MD5
9a2a43e801ad98e66df838e5f1cd2841

SHA1
7dd58d60d5715313850eac67c8698ad219ffe29f

SHA256
00850813a1dd9cf61090bc46368796dad499b093164874ed99387036d33d8e77

SHA512
eac2fca460426d81e3d6e014edd90e99f26bb8261f1e927fa1debf0cdf38b316d837f867e80d822edd823ba44cb3ae6f7bdb8153b94a26888421b7a3d0bd12db

Download Submit
C:\Windows\SysWOW64\Nibbqicm.exe

Filesize
78KB

MD5
5e0d8ecd5e3784085d36f73dbeefe05c

SHA1
43a1e4e13de274e6354b35d921e0979b4ad85003

SHA256
7aa8f1578ee88e56953d01a412f825dbe386c29991529d12063453f60f56cf27

SHA512
c7dbf6f453fdd29aa55f9fbaff64a2d191058f5fe0aa2d1dcb786c49257849064e95627201f7381bbd35c39cf3528570297bb37c10000a0aac6f75343a541212

Download Submit
C:\Windows\SysWOW64\Niipjj32.exe

Filesize
78KB

MD5
cf085c22a4e1c3d931ad166348f00b7e

SHA1
f12f5778d71b3c4d4405dcbd79f02634064ed091

SHA256
8a78c1698d20481112c366bedf1a877df7a5407dda6f47a1149b9dd380744eeb

SHA512
ac8e50a6c40e94fb1f26618fb8d5f538353459c455ce25bde711caed789ff3ef5caa067518d60daed44ba8a50da5bcedee1547bb42b49178250a8fb0eefdcc1d

Download Submit
C:\Windows\SysWOW64\Nlleaeff.exe

Filesize
78KB

MD5
e2350da7f90034b406015933109b6a27

SHA1
69593d45a2a7c496c4ae07247935e5c4f4ecb1c0

SHA256
d401ad1c0c0bafb291e27e2436dce54f2fa49ffaa939cea2fad2aaac012c257f

SHA512
18fea27ab1cda2bc1f6602d5f93337fe19100be828d2b244bb6ca13c9145f482b851b560369ef6ed2869e0a7b582d41217f47cc3f3005e93bfe086ac29768b70

Download Submit
C:\Windows\SysWOW64\Oaompd32.exe

Filesize
78KB

MD5
2f38eb18ffb480b60a2aee898563b117

SHA1
868852211f5bf0302dac2f2988a055f70ad7804d

SHA256
a434f4842a061cb01ff6786c83dba21615a64a72ca3b6ab6b3922d340a6309fe

SHA512
8f81fc6fc58ad4ec9663e7c85312eb41123a04b03f2d872bf7e3af73416ed45bcbd9e76896518a2eedb38ae4514babfc7e7264fd79629489c3a08995441302e1

Download Submit
C:\Windows\SysWOW64\Pgbbek32.exe

Filesize
78KB

MD5
654035abff42ad1fcfdef297377bd7d3

SHA1
23d7f07740deb9201411df00aa3eac609f95c2fb

SHA256
93f16cb344d31f1a79ad3d75bd5e7d12496c1f6823cc51a6e6be4970482ccf56

SHA512
ee5a3331e470df0af67884bb5489e095417e9f0715475be7b228636ce47677558ad208135ed241885d5c79b1765735448b6e6037b32c89b6d4ab81b08528ea66

Download Submit
C:\Windows\SysWOW64\Qjlnnemp.exe

Filesize
78KB

MD5
b8673baaaa76c3d7c8d7087cf00eaf20

SHA1
80d0e20a27e0cb44aa94adc59433cb572f2c54e2

SHA256
df7011dcb60d5baac898d89a84d1bb4d02e686fc861f85699e10231e03401830

SHA512
f97993a6aacd2f72ee9e3b8b24bb9402cb7fc1e19d1b17c01b1c23dc6e3c2822237ddd9812daddd8b92a176447509ceb9d6b4f80b19689954240d912e3c1bb1e

Download Submit
memory/464-309-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/928-276-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/928-189-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/972-100-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/972-187-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1104-163-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1104-250-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1148-294-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1416-267-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1416-179-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1444-1-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1444-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1444-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1564-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2024-140-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2056-150-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-214-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2084-130-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2180-155-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2180-245-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2312-236-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-91-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2536-178-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2572-109-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2572-197-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2600-263-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2620-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2620-12-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2732-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2732-41-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3156-117-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3156-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3220-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3220-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3232-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3312-118-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3312-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3384-283-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3428-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3428-289-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3640-302-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3640-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3772-247-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3844-281-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4024-258-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4024-170-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4148-99-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4148-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4180-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4180-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4356-86-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4360-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4360-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4448-202-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4528-315-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4544-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4544-153-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4560-211-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4836-74-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4836-154-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4852-326-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4864-249-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4864-325-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4992-303-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads