94212211a23ac3152dda6c4854f71032531cf7dc759770137b471dc3d42bdb5e

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94212211a23ac3152dda6c4854f71032531cf7dc759770137b471dc3d42bdb5e.exe
Size

367KB
MD5

dce7f7c2aba41df244438e8d23aa29c8
SHA1

662c4ecf52394d12465461ffb54c8d3909241c3a
SHA256

94212211a23ac3152dda6c4854f71032531cf7dc759770137b471dc3d42bdb5e
SHA512

7496110d362d139b3493659bc816c0e102abeeeb3aaf177bb8393d54eae468517c6d9b72f7dfb189d65c47c33fc3e6eaad8e661794400b69d03c82d14e0d67a3
SSDEEP

6144:L0DmVQwBs7ntnJfKXqPTX7D7FM6234lKm3mo8Yvi4KsLTFM6234lKm3cM9:L0DftJCXqP77D7FB24lwR45FB24lqM

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anclbkbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dokgdkeh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojdgnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnfiplog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnkbkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfiddm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ekajec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlimed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljeafb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohlqcagj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilphdlqh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jbepme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hidgai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipoheakj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kofkbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ilfennic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddcebe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	94212211a23ac3152dda6c4854f71032531cf7dc759770137b471dc3d42bdb5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cklhcfle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ganldgib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kofkbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Abcgjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iijfhbhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbepme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aidehpea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boeebnhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gnblnlhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kabcopmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iolhkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jeapcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojqcnhkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehndnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Filapfbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcikejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fpbflg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhikci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ookoaokf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccmcgcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pdhbmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdbfab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoobdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Adgmoigj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bbdpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gfhndpol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiopca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeocna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lojmcdgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnfihkqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljklo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgmdec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dndgfpbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Geoapenf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loofnccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpapnfhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koaagkcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcgpni32.exe

Executes dropped EXE 64 IoCs

pid	Process
2132	Ojigdcll.exe
1544	Paelfmaf.exe
2888	Poimpapp.exe
4772	Pkpmdbfd.exe
4524	Pdhbmh32.exe
3012	Pehngkcg.exe
1308	Qmepam32.exe
392	Qoelkp32.exe
1000	Qlimed32.exe
4916	Ahpmjejp.exe
2424	Anmfbl32.exe
4508	Alpbecod.exe
4720	Adkgje32.exe
4376	Anclbkbp.exe
1360	Bnfihkqm.exe
2496	Boeebnhp.exe
3464	Blielbfi.exe
4808	Bddjpd32.exe
3184	Bnmoijje.exe
3716	Blqllqqa.exe
1376	Clgbmp32.exe
3312	Cdbfab32.exe
4636	Cohkokgj.exe
3296	Dokgdkeh.exe
4432	Dheibpje.exe
3480	Ddligq32.exe
3196	Dndnpf32.exe
3044	Dngjff32.exe
3524	Eiokinbk.exe
2144	Eiahnnph.exe
4724	Emoadlfo.exe
1188	Fpbflg32.exe
4160	Fijkdmhn.exe
3440	Ffnknafg.exe
4628	Ffqhcq32.exe
3980	Flpmagqi.exe
2076	Gehbjm32.exe
4132	Gfhndpol.exe
3244	Gldglf32.exe
2900	Gemkelcd.exe
5132	Gpbpbecj.exe
5172	Gikdkj32.exe
5212	Glkmmefl.exe
5260	Hedafk32.exe
5300	Hbhboolf.exe
5340	Hoobdp32.exe
5380	Hidgai32.exe
5420	Hblkjo32.exe
5460	Hpqldc32.exe
5504	Hemdlj32.exe
5544	Ibaeen32.exe
5588	Iebngial.exe
5624	Ibfnqmpf.exe
5668	Imkbnf32.exe
5708	Igdgglfl.exe
5748	Igfclkdj.exe
5788	Ipoheakj.exe
5828	Jiglnf32.exe
5868	Jocefm32.exe
5912	Jlgepanl.exe
5956	Jilfifme.exe
5996	Johnamkm.exe
6048	Jinboekc.exe
6088	Kpjgaoqm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Neiqnh32.dll	Blielbfi.exe
File created	C:\Windows\SysWOW64\Dckahb32.dll	Kpjgaoqm.exe
File created	C:\Windows\SysWOW64\Ohlqcagj.exe	Oabhfg32.exe
File created	C:\Windows\SysWOW64\Hahqkaaa.dll	Boeebnhp.exe
File opened for modification	C:\Windows\SysWOW64\Qdaniq32.exe	Qmgelf32.exe
File created	C:\Windows\SysWOW64\Iojkeh32.exe	Ihpcinld.exe
File created	C:\Windows\SysWOW64\Inmdohhp.dll	Keifdpif.exe
File opened for modification	C:\Windows\SysWOW64\Oqklkbbi.exe	Ojqcnhkl.exe
File created	C:\Windows\SysWOW64\Hemdlj32.exe	Hpqldc32.exe
File opened for modification	C:\Windows\SysWOW64\Hlblcn32.exe	Halhfe32.exe
File opened for modification	C:\Windows\SysWOW64\Jhgiim32.exe	Ilphdlqh.exe
File created	C:\Windows\SysWOW64\Bboffejp.exe	Bpqjjjjl.exe
File opened for modification	C:\Windows\SysWOW64\Ddcebe32.exe	Cpfmlghd.exe
File created	C:\Windows\SysWOW64\Ibaeen32.exe	Hemdlj32.exe
File created	C:\Windows\SysWOW64\Hioflcbj.exe	Hbenoi32.exe
File created	C:\Windows\SysWOW64\Nbdfqocb.dll	Hoobdp32.exe
File opened for modification	C:\Windows\SysWOW64\Halhfe32.exe	Hlppno32.exe
File opened for modification	C:\Windows\SysWOW64\Ilfennic.exe	Hldiinke.exe
File created	C:\Windows\SysWOW64\Iheocj32.dll	Oikjkc32.exe
File created	C:\Windows\SysWOW64\Pbegml32.dll	Hblkjo32.exe
File created	C:\Windows\SysWOW64\Dckajh32.dll	Mjjkaabc.exe
File opened for modification	C:\Windows\SysWOW64\Pnmopk32.exe	Pnkbkk32.exe
File created	C:\Windows\SysWOW64\Jjofoqdn.dll	Hpqldc32.exe
File created	C:\Windows\SysWOW64\Iebngial.exe	Ibaeen32.exe
File created	C:\Windows\SysWOW64\Flmlag32.dll	Jhgiim32.exe
File created	C:\Windows\SysWOW64\Pgdhilkd.dll	Jeocna32.exe
File created	C:\Windows\SysWOW64\Lcgpni32.exe	Ljnlecmp.exe
File created	C:\Windows\SysWOW64\Qhjgbbnj.dll	Abfdpfaj.exe
File opened for modification	C:\Windows\SysWOW64\Mcaipa32.exe	Mhldbh32.exe
File created	C:\Windows\SysWOW64\Ocjoadei.exe	Nceefd32.exe
File created	C:\Windows\SysWOW64\Mpaqbf32.dll	Hlppno32.exe
File created	C:\Windows\SysWOW64\Eiahnnph.exe	Eiokinbk.exe
File opened for modification	C:\Windows\SysWOW64\Qobhkjdi.exe	Ppahmb32.exe
File created	C:\Windows\SysWOW64\Chjjqebm.dll	Pafkgphl.exe
File opened for modification	C:\Windows\SysWOW64\Pcgdhkem.exe	Pfccogfc.exe
File opened for modification	C:\Windows\SysWOW64\Cpfmlghd.exe	Cgmhcaac.exe
File created	C:\Windows\SysWOW64\Qlimed32.exe	Qoelkp32.exe
File created	C:\Windows\SysWOW64\Benibond.dll	Jeapcq32.exe
File created	C:\Windows\SysWOW64\Mjlalkmd.exe	Mcaipa32.exe
File created	C:\Windows\SysWOW64\Bcjfln32.dll	Mogcihaj.exe
File created	C:\Windows\SysWOW64\Bahdob32.exe	Bddcenpi.exe
File opened for modification	C:\Windows\SysWOW64\Mapppn32.exe	Ljdkll32.exe
File opened for modification	C:\Windows\SysWOW64\Bnmoijje.exe	Bddjpd32.exe
File created	C:\Windows\SysWOW64\Hokomfqg.dll	Iijfhbhl.exe
File opened for modification	C:\Windows\SysWOW64\Diqnjl32.exe	Ddcebe32.exe
File created	C:\Windows\SysWOW64\Glkmmefl.exe	Gikdkj32.exe
File created	C:\Windows\SysWOW64\Kiodpebj.dll	Igdgglfl.exe
File opened for modification	C:\Windows\SysWOW64\Pfandnla.exe	Pnfiplog.exe
File created	C:\Windows\SysWOW64\Fohfbpgi.exe	Fecadghc.exe
File opened for modification	C:\Windows\SysWOW64\Abfdpfaj.exe	Aimogakj.exe
File created	C:\Windows\SysWOW64\Paenokbf.dll	Amnebo32.exe
File opened for modification	C:\Windows\SysWOW64\Khbiello.exe	Jbepme32.exe
File opened for modification	C:\Windows\SysWOW64\Kncaec32.exe	Koaagkcb.exe
File created	C:\Windows\SysWOW64\Aphnnafb.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Kjamidgd.dll	Aphnnafb.exe
File created	C:\Windows\SysWOW64\Lbfecjhc.dll	Gndick32.exe
File opened for modification	C:\Windows\SysWOW64\Pakdbp32.exe	Pcgdhkem.exe
File created	C:\Windows\SysWOW64\Hoobdp32.exe	Hbhboolf.exe
File created	C:\Windows\SysWOW64\Hpioin32.exe	Hioflcbj.exe
File opened for modification	C:\Windows\SysWOW64\Oikjkc32.exe	Oihmedma.exe
File opened for modification	C:\Windows\SysWOW64\Pfiddm32.exe	Pnmopk32.exe
File created	C:\Windows\SysWOW64\Mklbeh32.dll	Bnmoijje.exe
File created	C:\Windows\SysWOW64\Cfiedd32.dll	Kcpjnjii.exe
File created	C:\Windows\SysWOW64\Gemdebha.dll	Kofkbk32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9088	8792	WerFault.exe	371

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okjpkd32.dll"	Fecadghc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nndbpeal.dll"	Geldkfpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eiokinbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dccfkp32.dll"	Aidehpea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqichhmn.dll"	Pkpmdbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafmjm32.dll"	Iebngial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Domdocba.dll"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mleggmck.dll"	Lpepbgbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Abfdpfaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdoljdi.dll"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heeeiopa.dll"	Blqllqqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mbgeqmjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bbdpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfnlgh32.dll"	Caqpkjcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cgmhcaac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhbek32.dll"	Cammjakm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iiopca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qiiflaoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Caqpkjcl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcgpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pnmopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Blqllqqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Anmfbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjjkaabc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhcbhh32.dll"	Qpbnhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kadpdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnfgko32.dll"	Kadpdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Adgmoigj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkjefc32.dll"	Qlimed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oidalg32.dll"	Ddligq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dndnpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ebkbbmqj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ehndnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hbenoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncpeaoih.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qclmck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hblkjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lckiihok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nciopppp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aimogakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gahamgib.dll"	Dheibpje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pagbaglh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biafno32.dll"	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfebfnqn.dll"	Glkmmefl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhikci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nciopppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgqin32.dll"	Mqimikfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nfohgqlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iojkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfccogfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cohkokgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfmmaj32.dll"	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpghll32.dll"	Nceefd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ebkbbmqj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ibcjqgnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enalem32.dll"	Iolhkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olieecnn.dll"	Johnamkm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjjkaabc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffeifdjo.dll"	Fohfbpgi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2132	1128	94212211a23ac3152dda6c4854f71032531cf7dc759770137b471dc3d42bdb5e.exe	97
PID 1128 wrote to memory of 2132	1128	94212211a23ac3152dda6c4854f71032531cf7dc759770137b471dc3d42bdb5e.exe	97
PID 1128 wrote to memory of 2132	1128	94212211a23ac3152dda6c4854f71032531cf7dc759770137b471dc3d42bdb5e.exe	97
PID 2132 wrote to memory of 1544	2132	Ojigdcll.exe	98
PID 2132 wrote to memory of 1544	2132	Ojigdcll.exe	98
PID 2132 wrote to memory of 1544	2132	Ojigdcll.exe	98
PID 1544 wrote to memory of 2888	1544	Paelfmaf.exe	99
PID 1544 wrote to memory of 2888	1544	Paelfmaf.exe	99
PID 1544 wrote to memory of 2888	1544	Paelfmaf.exe	99
PID 2888 wrote to memory of 4772	2888	Poimpapp.exe	101
PID 2888 wrote to memory of 4772	2888	Poimpapp.exe	101
PID 2888 wrote to memory of 4772	2888	Poimpapp.exe	101
PID 4772 wrote to memory of 4524	4772	Pkpmdbfd.exe	102
PID 4772 wrote to memory of 4524	4772	Pkpmdbfd.exe	102
PID 4772 wrote to memory of 4524	4772	Pkpmdbfd.exe	102
PID 4524 wrote to memory of 3012	4524	Pdhbmh32.exe	103
PID 4524 wrote to memory of 3012	4524	Pdhbmh32.exe	103
PID 4524 wrote to memory of 3012	4524	Pdhbmh32.exe	103
PID 3012 wrote to memory of 1308	3012	Pehngkcg.exe	104
PID 3012 wrote to memory of 1308	3012	Pehngkcg.exe	104
PID 3012 wrote to memory of 1308	3012	Pehngkcg.exe	104
PID 1308 wrote to memory of 392	1308	Qmepam32.exe	105
PID 1308 wrote to memory of 392	1308	Qmepam32.exe	105
PID 1308 wrote to memory of 392	1308	Qmepam32.exe	105
PID 392 wrote to memory of 1000	392	Qoelkp32.exe	106
PID 392 wrote to memory of 1000	392	Qoelkp32.exe	106
PID 392 wrote to memory of 1000	392	Qoelkp32.exe	106
PID 1000 wrote to memory of 4916	1000	Qlimed32.exe	107
PID 1000 wrote to memory of 4916	1000	Qlimed32.exe	107
PID 1000 wrote to memory of 4916	1000	Qlimed32.exe	107
PID 4916 wrote to memory of 2424	4916	Ahpmjejp.exe	108
PID 4916 wrote to memory of 2424	4916	Ahpmjejp.exe	108
PID 4916 wrote to memory of 2424	4916	Ahpmjejp.exe	108
PID 2424 wrote to memory of 4508	2424	Anmfbl32.exe	109
PID 2424 wrote to memory of 4508	2424	Anmfbl32.exe	109
PID 2424 wrote to memory of 4508	2424	Anmfbl32.exe	109
PID 4508 wrote to memory of 4720	4508	Alpbecod.exe	110
PID 4508 wrote to memory of 4720	4508	Alpbecod.exe	110
PID 4508 wrote to memory of 4720	4508	Alpbecod.exe	110
PID 4720 wrote to memory of 4376	4720	Adkgje32.exe	111
PID 4720 wrote to memory of 4376	4720	Adkgje32.exe	111
PID 4720 wrote to memory of 4376	4720	Adkgje32.exe	111
PID 4376 wrote to memory of 1360	4376	Anclbkbp.exe	112
PID 4376 wrote to memory of 1360	4376	Anclbkbp.exe	112
PID 4376 wrote to memory of 1360	4376	Anclbkbp.exe	112
PID 1360 wrote to memory of 2496	1360	Bnfihkqm.exe	113
PID 1360 wrote to memory of 2496	1360	Bnfihkqm.exe	113
PID 1360 wrote to memory of 2496	1360	Bnfihkqm.exe	113
PID 2496 wrote to memory of 3464	2496	Boeebnhp.exe	114
PID 2496 wrote to memory of 3464	2496	Boeebnhp.exe	114
PID 2496 wrote to memory of 3464	2496	Boeebnhp.exe	114
PID 3464 wrote to memory of 4808	3464	Blielbfi.exe	115
PID 3464 wrote to memory of 4808	3464	Blielbfi.exe	115
PID 3464 wrote to memory of 4808	3464	Blielbfi.exe	115
PID 4808 wrote to memory of 3184	4808	Bddjpd32.exe	116
PID 4808 wrote to memory of 3184	4808	Bddjpd32.exe	116
PID 4808 wrote to memory of 3184	4808	Bddjpd32.exe	116
PID 3184 wrote to memory of 3716	3184	Bnmoijje.exe	117
PID 3184 wrote to memory of 3716	3184	Bnmoijje.exe	117
PID 3184 wrote to memory of 3716	3184	Bnmoijje.exe	117
PID 3716 wrote to memory of 1376	3716	Blqllqqa.exe	118
PID 3716 wrote to memory of 1376	3716	Blqllqqa.exe	118
PID 3716 wrote to memory of 1376	3716	Blqllqqa.exe	118
PID 1376 wrote to memory of 3312	1376	Clgbmp32.exe	119

C:\Users\Admin\AppData\Local\Temp\94212211a23ac3152dda6c4854f71032531cf7dc759770137b471dc3d42bdb5e.exe
"C:\Users\Admin\AppData\Local\Temp\94212211a23ac3152dda6c4854f71032531cf7dc759770137b471dc3d42bdb5e.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\Ojigdcll.exe
  C:\Windows\system32\Ojigdcll.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\Paelfmaf.exe
    C:\Windows\system32\Paelfmaf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\SysWOW64\Poimpapp.exe
      C:\Windows\system32\Poimpapp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4772
      - C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3296
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        29⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        31⤵
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        32⤵
        Executes dropped EXE
        
        PID:4724
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1188
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        34⤵
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        35⤵
        Executes dropped EXE
        
        PID:3440
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        36⤵
        Executes dropped EXE
        
        PID:4628
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        37⤵
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        38⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4132
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        40⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        41⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        42⤵
        Executes dropped EXE
        
        PID:5132
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        45⤵
        Executes dropped EXE
        
        PID:5260
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5380
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5588
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        54⤵
        Executes dropped EXE
        
        PID:5624
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5668
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        57⤵
        Executes dropped EXE
        
        PID:5748
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5788
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        59⤵
        Executes dropped EXE
        
        PID:5828
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        60⤵
        Executes dropped EXE
        
        PID:5868
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        61⤵
        Executes dropped EXE
        
        PID:5912
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        62⤵
        Executes dropped EXE
        
        PID:5956
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        64⤵
        Executes dropped EXE
        
        PID:6048
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        66⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5000
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        68⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        69⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        72⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        74⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        75⤵
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        77⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        78⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        79⤵
        Drops file in System32 directory
        
        PID:6004
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        80⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        81⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        82⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        83⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        84⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        85⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        86⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        87⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        88⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        89⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5160
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        91⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        92⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3408
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6084
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        96⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        97⤵
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        98⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        102⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        103⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6204
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        105⤵
        Drops file in System32 directory
        
        PID:6248
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        106⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        107⤵
        Drops file in System32 directory
        
        PID:6340
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        108⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        109⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        110⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6552
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        112⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        113⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        114⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        115⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        116⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        117⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        118⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        119⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        120⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        121⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        122⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        123⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        125⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        126⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        127⤵
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6560
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        130⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        131⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        132⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        133⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7068
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        136⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        137⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        140⤵
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        141⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        142⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        143⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6260
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        145⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        147⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        148⤵
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        149⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        150⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        152⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6684
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        154⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        155⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7244
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        157⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        158⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        159⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        160⤵
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        161⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        162⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        163⤵
        Drops file in System32 directory
        
        PID:7552
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        164⤵
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        165⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        166⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        167⤵
        Drops file in System32 directory
        
        PID:7724
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        169⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        171⤵
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        172⤵
        Drops file in System32 directory
        
        PID:7936
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        173⤵
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8020
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8064
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        176⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8148
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        178⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        179⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        180⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        181⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7400
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        185⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        186⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        187⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        188⤵
        Drops file in System32 directory
        
        PID:7868
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        189⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8052
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        191⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        192⤵
        Modifies registry class
        
        PID:7200
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        193⤵
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        194⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7736
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        198⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8140
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        200⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        201⤵
        Drops file in System32 directory
        
        PID:7532
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7664
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        203⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        204⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        205⤵
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        206⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        207⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        208⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        209⤵
        Modifies registry class
        
        PID:7240
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        210⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        211⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        212⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        213⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        214⤵
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        215⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        216⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        217⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8504
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        220⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        221⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        222⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        223⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        224⤵
        Drops file in System32 directory
        
        PID:8760
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        225⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        226⤵
        Drops file in System32 directory
        
        PID:8840
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        227⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8880
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        228⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        229⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9012
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        231⤵
        Modifies registry class
        
        PID:9052
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        232⤵
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        233⤵
        Modifies registry class
        
        PID:9136
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        234⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        235⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8240
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        237⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8312
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        238⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        239⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        240⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        241⤵
        Drops file in System32 directory
        
        PID:8580
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        244⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        245⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        246⤵
        Drops file in System32 directory
        
        PID:8900
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        247⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        248⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        249⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7628
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        251⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        252⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        253⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        254⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        255⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        256⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        257⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        258⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8952
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        260⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        261⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        262⤵
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        263⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8376
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        264⤵
        Drops file in System32 directory
        
        PID:8492
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8680
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        266⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8792 -s 428
        267⤵
        Program crash
        
        PID:9088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8792 -ip 8792
1⤵
PID:8364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:8688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adkgje32.exe

Filesize
367KB

MD5
031df4627322e3880b318cd9877290a6

SHA1
1d49a72e0f6f5e676e8e1b03f39a1cb3068bf3b5

SHA256
a20e4f5dc082ab2dd3a0d57aa7323bc199fac2f63c127daed8d30a0c9c946bdf

SHA512
2da8a057b45c6b1e45131d322b5e1adc9c2f36c51901b950433d874a4aec6c475c12dc95f10380c6cbe52a8fe5ae9d1baf39e82bbcd4d347f6a044487055b370

Download Submit
C:\Windows\SysWOW64\Ahpmjejp.exe

Filesize
367KB

MD5
62584cb6418b71f9cee70d72bd40cb09

SHA1
ec30de090f63bfa480bb3041ab8481ffa0c63230

SHA256
5baa26cdcda3547f90db930769fef38e7516843c027b5c4a875ad9ae1333171c

SHA512
ba1d426b335762a4eaeb3292114ad4036262d5851f6912f4c592a5a02e12e63635c2661059e876fbcf29425b40ae1bc1b3b889fdfb18aa892c954defa859bbaf

Download Submit
C:\Windows\SysWOW64\Alpbecod.exe

Filesize
367KB

MD5
3ee4d7e5e36e6974db7e972c12e6ccff

SHA1
39e4cddc0454fc6bdafe58ad85cc43bc3fa3bca8

SHA256
35857b7abb6bbe38a7b99efcd38164d9ee958152e6aafae226d6b5a922e38b1d

SHA512
fcaf85b7d564475e331916d65ba9a763ff2f096f7ed996910f80b6111cfffb08341d75285b59a321ef4c9cbd4ce58a126f233d0d194ebc998f3c60d91b374ede

Download Submit
C:\Windows\SysWOW64\Anclbkbp.exe

Filesize
367KB

MD5
ff948b568be8066f2d36c5d4ced276d0

SHA1
5bb726657c971c23eb2817caff01649b3faf4c2a

SHA256
03fb36d7aa7c33460aaa6a1820d8d65addcee02b01a24b3c50f02fe987def357

SHA512
0b942cd16a7767bbb56407ecb3c1fce84e7c505e6fed4fce9a5f1c30e0ca60ee775e9cd683d8b0a6a1e2e436038ad090e7f83afa5b4d6414cbc7acf1cf3f5c38

Download Submit
C:\Windows\SysWOW64\Anmfbl32.exe

Filesize
367KB

MD5
26f3c763d5797c529895eff2319a3993

SHA1
2a7af187e94472da9456805341ed5fd695df459c

SHA256
e9a0c7b1a3828da7767a32d8a8a2ab2bf3193812679e8af1e2d72dc3bf394a4b

SHA512
77492f89b321f102b88bba88a25297f9d55ceac56b8cf75981f049e1daf9f3769fb048a04cb27c9d32d8f48dfc75d6f4ea96ac26111bd9f7ed3a9d574ed77c70

Download Submit
C:\Windows\SysWOW64\Bddjpd32.exe

Filesize
367KB

MD5
126196c3d303815c47e0ac889a30dc11

SHA1
73c4fd60225968842b741f09adc2f5a2a553d1c9

SHA256
15c5c295fe7e9d844bd830c669a38f306aeffa962dd0291eb4dfe2fb4a999bb8

SHA512
b3022d5186de42d4bdb3a60a97672dedb1b9bffe226a31c910ff90add5353f5f37b8f77aa558ca9b5f40edde0e542bb63254c07c3ac14107ba2b491c778eea7c

Download Submit
C:\Windows\SysWOW64\Blielbfi.exe

Filesize
367KB

MD5
52316bd21d3a811d4591d3f242526a86

SHA1
975fe93b39d88b6b1d8f246c361d46767e08607a

SHA256
7bafc4d8376e911a15c5d3c4847f6630e7732d7343e0f0d8f4afb1e69b8abfd1

SHA512
c30e8cdb35c16878e28cabc9d1fed6492b78d76de7a81e82a658842b673304935af80834dad1c7bc9f8074de552e025a1a8428a1263671fd8ee76d33713b4341

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
367KB

MD5
1fa9342260c5d97a5a43d514a089fe99

SHA1
7c05e673d0e6edda2e497ceb78acb2cb283149f5

SHA256
7c389ab4cd891fd8ddb3d77002d4f12192b17b5d03568ca8bdd4271179e8efb5

SHA512
abeea1384ae44b51c8ee7f906c7d0ed50cd9aafea816e45295e572a2b9fab616f8df856b3fc19c98028fc91b78c19b591f039ecd3a72ab1f15d6a10503d7567d

Download Submit
C:\Windows\SysWOW64\Bnfihkqm.exe

Filesize
367KB

MD5
dbb0bebb74a647c91b89040883f7f837

SHA1
d2617682596f8ebefd211a793a58ef38df5f9493

SHA256
20bcbbd562331289affea21d2eda2bfd39dd18e91a8b15e1d0b4521fe91ee5b2

SHA512
0f0d70791be9eccdf0557f7f850d4c211c4df17777ff31975b5b731e6079d7c174e0d629651ed7e6bb0a11b58ecccf6bfef950854832137dab38f74280049f44

Download Submit
C:\Windows\SysWOW64\Bnmoijje.exe

Filesize
367KB

MD5
71e84b7550ab433229c714f019dd5a51

SHA1
541313001656f1a581859396c6aa9b68d842372a

SHA256
074ccc16fe1a351e2558de730a6e309e5504b328d20e1475d05ea4c84295b8ec

SHA512
9e1b1f752be98c8031aa96b0b3a0c38f851193f7b0290833cd146d7bea0af14022b021116d38307207304e80c2088464c4ac26bd5a5cd1a8b7b9409b2338e16b

Download Submit
C:\Windows\SysWOW64\Boeebnhp.exe

Filesize
367KB

MD5
4db743edc6d07a27f29b0df04448f1df

SHA1
d7171402f670cfb7274e072ebc369e7976cba498

SHA256
3b01b9c730a4c64f5d68119e304c3b384f654f5b669fcde47e27117d79122a4a

SHA512
1ba5c9bc9c87ff2f274b9eaec1dab10e8e912c48832012141d8e5ef53595f83c51dbcb68d1a86b5fe7088f9c6d9642208a683765a9a4177c70e972e057178fd1

Download Submit
C:\Windows\SysWOW64\Cdbfab32.exe

Filesize
367KB

MD5
3d3a3fb617fa1f787cf5c71ea69fb86d

SHA1
d23a88d882144e36d4f2b338e8238bc354085815

SHA256
f70ad3cdd14065f3d077d3fe1265bd381cba4102109ab58cb966ed8864dd3745

SHA512
ef76a7f6d1a39ede7e4a60047c81f9f686965a2459fa0d41199973be7f1d45e9b548c70d39e813936990e0ac78d954dfc9bc14de94a32b8c933a6da6fbcae41d

Download Submit
C:\Windows\SysWOW64\Clgbmp32.exe

Filesize
367KB

MD5
098c9caeb54ede8b482095d7f0ba1190

SHA1
bd5183eaff9d34419e1eec91159ed86ea6c735a3

SHA256
6b76376b417daf51aa3096d9edab7e6c2cdaef1d79b0b1ebf728ad677f9664de

SHA512
bce38e2d59f46b0c511d12e92f823a54a71364f9092145c59c5eb71f5f278f8c22c0d69f028ef316ad03369464be3cb52653ea1157f0b9572a8e96ff2b0a90be

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
367KB

MD5
8fa7943a45465f674d65bf9c554b86c8

SHA1
9cb7bb334e0d0d221385f31bd3de1ba049cb3a2b

SHA256
899d542633e0181e2c97dbdd0c62971e65a2a3ea1957ee6e17c758996937ae5a

SHA512
2c8a4d75f5ec64214c738c8543b03ba02c96fbf175ce5f8bebe2a76fe444db6de1c0021d75422bc82c884ef47ef3ba4b62f6f6ee85da95ee89231c0dc5659e3b

Download Submit
C:\Windows\SysWOW64\Cqichhmn.dll

Filesize
7KB

MD5
2d670378d8262073051edb5706db49f5

SHA1
d587e9eddbf1fa5e22c3e76d67db38d0e0eb7ea6

SHA256
f238994dfba32b0f884b12cd45368ad8fa9015cf4a6ee6c71ad84678ed0f5bab

SHA512
50eb8499a86237a5e1df5bf112ec6669737d6ad45a47c63ac0754fed85e6b717972d1863dced8d2299e87373c453c2e3535d23328fa9be4a7028bd3d7ba9beaf

Download Submit
C:\Windows\SysWOW64\Ddligq32.exe

Filesize
367KB

MD5
2feace173a558210765f38b8f150b9ac

SHA1
c46937d65ef4a17de7165e42d3a2a484c1d1d602

SHA256
44d0d684eb505b1b6b1d569f3a9983eeafc663cc078d754ce34d2693f6292deb

SHA512
942bd1018e45ef2af8af2d073ce79c4c04602b8d13a64bbcae59346523caf8a0285c234e3515594dc7935e926d338708f65e8e100353feef483548aa410a22de

Download Submit
C:\Windows\SysWOW64\Dheibpje.exe

Filesize
128KB

MD5
d994edfa53b5a058ff2e31e7113a15f3

SHA1
c2fd9bbf65bc2bf5077b9d52f113a929488066e0

SHA256
9764f7ff4a13fa0c0b5c22fea8dcba1b468883c2f9b5f8deeeb21dddb2045c9d

SHA512
d9ea25cc38468d9464650959f83a4ee742334fbfc6e42910672d9fa0cddece3d929651962670e375550a8f491964ebe481bf19aef35781129c349ca5cc5a2ace

Download Submit
C:\Windows\SysWOW64\Dheibpje.exe

Filesize
367KB

MD5
7031a87e627fab14ace01ce37ff81319

SHA1
ee2c2f52797f10eee4e00054d9036eedc7635651

SHA256
15c4425b07b193a1a62965e4c2c0a154c65fd7434c94d23be9cf44830e140734

SHA512
60a4c0457807be5ab6652d7133e2e6732564801df7eceeb279e7c075a62c8d68a1aa9f049ff71ef33e23a90f3ec5ff808b964028a0f4cfee91a917ba3428d602

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
367KB

MD5
f490010b63d73626a902cbc74faead65

SHA1
8b8a4e9e3d873df3f58e7101bbd7d916278490ee

SHA256
289959f7a3be7a09623a7b72e1b538f6a7b5a5ee17263a16a700c1d3175f5a46

SHA512
8dfc90b78699ae119b03d1fde2c50cb458fe91143b5b1f73c9e8fa70b040c34b282dfc2fadae79017ace267acf82751d678b6dfbe6d94c3466e549181d1bc325

Download Submit
C:\Windows\SysWOW64\Dngjff32.exe

Filesize
367KB

MD5
b56123f727df63ed78c660b10343d15f

SHA1
d80453a388eb5a9d93b6572a9397546000e4f64f

SHA256
de8a798d9c7730418ea498154699ef363de565f3f4215761f819800c8bfd3193

SHA512
d8dcd0638df1d062253fb22e90384c17135902f070da32f3554b7ef6abbd04237f8ad3d4df8bbd1e0abe66804ca6c7b5c38d7e1acc35599a8e245c2c39911497

Download Submit
C:\Windows\SysWOW64\Dokgdkeh.exe

Filesize
367KB

MD5
55813790037175840fd3f99cc7922d59

SHA1
3e08e0d978158675b153f569e5e1f4ef084b68bf

SHA256
1836ee21c71457f0272016e244759a0c7b86adaf8c6fe2c4f3b9680e831ca677

SHA512
4ab45ab7cc4de143863ea47a8c1b1b722a0546689fc00221057b98208587f580c4e8b75231a7654b509bc631143d99a4916f6955257d72b63413f636359e262e

Download Submit
C:\Windows\SysWOW64\Eiahnnph.exe

Filesize
367KB

MD5
c513690bf6a125374875264145c6ca97

SHA1
9af66fee8f37ce51f02704a768f5716f56e5c816

SHA256
83cc10f49e497f12c078ba9104000b6f1abb5217b6ad103490a75bd6e711f13b

SHA512
c687ea10c508bbd5a248e83b3c1239d2d94677fd0ac608c62aec77bc4b7e28aaf7f87e409cf96007dd2f797784278f7df5866efd83d54f413e62248ec86139d4

Download Submit
C:\Windows\SysWOW64\Eiokinbk.exe

Filesize
367KB

MD5
619c814838ad5edac3659bbe03c81790

SHA1
1704c021a09778c0798d3429524985d6b12ccb18

SHA256
9dd32ea4c24611ed74629e903c97587e22c0f303b5f35db9ed4a5a5eb86177a2

SHA512
4a0b66f6199f9a8bce852977043249b661995b303ef8ff7a6b2d5c7daa59c88eae22603c37d50f899496003fd7c7dc156ae966c5905337833132579340bc4141

Download Submit
C:\Windows\SysWOW64\Emoadlfo.exe

Filesize
367KB

MD5
e948f4e9ebdb8c8b8b9a8c23b80d612d

SHA1
db9f3208e3acd307108c7aa124c3e66ed5a2166e

SHA256
cb5dc2a5aca4de38263c2a6c11410fb2f22c4e517d9c7679f1a95fc1ec8aafa0

SHA512
9c9507dfb71a2e74e68db3392ceb677b125dddb1b9c89c29bd5f2d0abf8f978baf9b6825c989493d9d3f2b77c057968b04f5b1448b268ccdc7b3488ea17833c9

Download Submit
C:\Windows\SysWOW64\Fpbflg32.exe

Filesize
367KB

MD5
df9565267da702ea1ef42330264b0474

SHA1
b0d2820c2a618a78be5d2cd8aeb417c547cb09a2

SHA256
05258003074d8d2d667b0f81bd5459c822243d96b264e5f84e96fd7e1c57293b

SHA512
ba75e8fcb131ec107a5424d64eb084e7463ba412e353ccd460f12ff6ea67d3d35cfafbcaa64a4af9554ab862fb24f3fe8aa5a41ac2feca5de03f9ec8948f4bbe

Download Submit
C:\Windows\SysWOW64\Halhfe32.exe

Filesize
367KB

MD5
88cd6eac1e48c7fd7b4a87477ac3ee78

SHA1
7435a200c6139987d1d061942e16ba2aa577d526

SHA256
d9c82343080e895d05fb6d9273e1d98ce0e7dc01becc3228851d7d2c1a95137f

SHA512
622ec23d319b8f651fb372312106ff9a2a21a01edf2b218be0381c5aff622d69e85f35b696469e7223c9d2e0a022160bd3728652667a755f2e0128b405ca6c02

Download Submit
C:\Windows\SysWOW64\Iebngial.exe

Filesize
192KB

MD5
a2954c987eb68eb370202326bc61d216

SHA1
06cb42ffdb8394a3325ac543ee262f5800d69bc3

SHA256
aeb0f664f687143c70bc2a21861d57b73b3061c96329c93fa7a29cca8e67d2c9

SHA512
4064296eae49d1e29a367fbcde1641df447ded99ef397dc87e360f8ea8f9e82fa3750ff5cbdd922982c7c6946d78e33a74bda39f5082c7d6eb830397125ff9a3

Download Submit
C:\Windows\SysWOW64\Kofkbk32.exe

Filesize
367KB

MD5
4838b8cc9d64f60ab4f8a11d3f128fa0

SHA1
15d6b5f87697d929c83ae0a9654deed73eda8737

SHA256
ecff5fc4758b8adb278917ca50b7530c429e502114af85f4339fc804973be0bb

SHA512
f0c245b3a6567cc5571d86858d169f05cbbc018741cea8b4a1446588c22b8178b92ae1fe7084577d24f7c1719ca56cc58aad02387396289e77a644c6a1109c37

Download Submit
C:\Windows\SysWOW64\Lfgipd32.exe

Filesize
367KB

MD5
683ce6b745e6373be64fdd13733559d7

SHA1
d906f704c35c21a541ef3d7a3e31e0dceb6f2e6d

SHA256
9b5965ce21bc01301e0443b9dce7e0e6d8a9715dc59e177fa20c44f6f39f778f

SHA512
503407337dad7d965a95d93fb585d6e7e69a04a4a734b1ec1dec55f5a3b25fda98b460993a66c2daad58d17a6aa17e4a9397925722f703c7f63f8c58ac74187c

Download Submit
C:\Windows\SysWOW64\Ljdkll32.exe

Filesize
367KB

MD5
f33b3f1800dd91bdce42a2d12293d7fa

SHA1
22d4fa45c8d7cac89782162226636d3dc03a1549

SHA256
52000416283c0075ddf52f4e3106b028b336f10d792943a02eeff12f9ac2965c

SHA512
9c0fc3ca1ed20cbc3fc4d16d2c58f7df39cbc3219920bf9de5cbdf68801268963aa2e496350d2541dadb5dcc2fece4234b789fa60796dcf2e4ae9d37bdf2f56d

Download Submit
C:\Windows\SysWOW64\Ljeafb32.exe

Filesize
367KB

MD5
d7e7f444670e7ed458426f14789a69df

SHA1
62e9291901ef492a103a133e99910208a2599289

SHA256
c3c9df5e800e4ef5e883e308c2b21cfedcdac61e908b4f93e6f30426dfae8781

SHA512
acc988a8b98d8a18d7022cd2ddd5dca345575cc2550c4cf63bb7be18c3b88df7acecf0ecae8fd945abff5a638861ee9b47f50e9c040045858c85bed1e31ac048

Download Submit
C:\Windows\SysWOW64\Lljklo32.exe

Filesize
367KB

MD5
ef308f81cb757e6b1d439895159b301d

SHA1
5ae84d661b15fc5c3fc43e36e1dcb88ff6fedf21

SHA256
37d11e1b90fbb9a39b26971d6b111c2453ecf2118e881ad01e5d0e6b81c70374

SHA512
5ec16fc7334510a3f041683cdb1f2ced95b9227efa9ff7fff9a276ab684bda62fa01a883f09799236c0301bf80078d97dca621568f35464f4444e8abe4a2f883

Download Submit
C:\Windows\SysWOW64\Mjjkaabc.exe

Filesize
367KB

MD5
1ffd12fadeea7fec058cc90b3ab1c54f

SHA1
7789775d331312a86c1728b1e93f1c184e01c1fc

SHA256
f73b37c4c7554e4e9cc040e7355970c4cac4f82a94e75397a40bbfbab56ef31f

SHA512
ecd5634af51197c49ab525fedab677dc8bd2a616e19873d879327c82dce66d8e3a1906b83ec36f9b7b3b6d56814a45f6eeab3875a71337a8f0f587c432f5435a

Download Submit
C:\Windows\SysWOW64\Noblkqca.exe

Filesize
367KB

MD5
521551d429c6be175a412e251f08fe2c

SHA1
10fe224e9da02d1a8187e65f664c2fe7b4a12953

SHA256
05122d4d5c26e2136b3d6ddcb32c4b9caedb066a3cb6771551e7766ad41dcd7b

SHA512
4eb961e1f8b02367f79d539b1a6661cc0bf6976083ee26ec567751f408c0b9fd8c1b45daa028cdbe7299a0f326712f212072909029a41caec5332e55b45cd59a

Download Submit
C:\Windows\SysWOW64\Oikjkc32.exe

Filesize
367KB

MD5
779cbfb64301740085c48d1502e0f140

SHA1
c684ffe80ba5a97e1ba7b2e82509c961bda852e4

SHA256
a28c395bdf0a36e549c296507e7602d65adf8c7e33e33892af011f27a8e2474a

SHA512
93a4b900df2cf8ca97477eb89c83a551fc943fa8cdcf4c9c11f26b3aa16aba29df48b2089f3a1adea1076f178d5041f5ff388b2e5f98e25b8515c963266625fb

Download Submit
C:\Windows\SysWOW64\Ojigdcll.exe

Filesize
367KB

MD5
9d75217380b36dfed7dac344312ae27a

SHA1
443ad053836f75b6da1e8ddb00ade9498375e678

SHA256
563ebdde0a2bbb524dfaca619ccad5eecd001661cd8c31e96fe63852493c97ec

SHA512
d20a5fd7959589284876aac89c65440ed4d0756d7d1a6699aa005f1707a78626fcb1e00668a41415c7233d78d6964a7477735f827ff3059497a2f8902fd058d8

Download Submit
C:\Windows\SysWOW64\Paelfmaf.exe

Filesize
367KB

MD5
f5ff72658fff0b450bb1904bb43768ad

SHA1
c9d5a4e4992e617416932a0d580394fd149e19ec

SHA256
614a7bb71cecd4f7a19694f5469378e1f203a73b799150db16d74de6d35c1eb7

SHA512
c5ecf3dce319d0801f57431a600b43799cd71f6c2499c64e3c5663fd2504de48b0aab4f708b602bcd057acf1a17aa99d581b94f0bc27bbe80f53c3c7253a20bf

Download Submit
C:\Windows\SysWOW64\Pdhbmh32.exe

Filesize
367KB

MD5
1cfa1cc9705bf4ad80e73fbfb1abf995

SHA1
c332f930ec4c16773c911eeb9458b8cc58701d85

SHA256
e22fd8dc85e3d4afae21f9b6fb9af45a451c7f5b8a3b5ee9a763533b078803e7

SHA512
576eed9d392b206cb8c1f041cf08774a52b6886be393f608eecfd045fd537a68bf91cae810d1cc348edb47eb7200eddf6831e74bdd1382b135dae3bb2a7c99fd

Download Submit
C:\Windows\SysWOW64\Pehngkcg.exe

Filesize
367KB

MD5
9049e1c1f3db4cf3c398a3500fde83cc

SHA1
5b5f7fb0871959bd496585e420805cf15325956a

SHA256
1573eba0dd0fbbf33bef75ecd23766fc5c14bee030716a40841f3571a0ddd6c0

SHA512
86e0229ab6b230998716c6151ad6691cb391c7dc119fcbb9b59b56ddbbf2106221e31b415ed6d2dc510fcd00e2d2e6cc8d46f655ca09a74973276b62457eb582

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
367KB

MD5
23143ad438dbaeabed75de0f71846e5c

SHA1
e5067820baa5720230d167154dd73278ca56372d

SHA256
8d6d9f9b5f0a1d7597bc12a70352629035bd9ad13bb8fef10ff0730ebf14ddb4

SHA512
876dc83e4ee157935fda93ca5114bf41819c7cfb0f32d8c0072bdd1b877667735c03efce707aec690b10d91eef7fc60f634577fb287178bf19e6245727b929f6

Download Submit
C:\Windows\SysWOW64\Pjcikejg.exe

Filesize
367KB

MD5
19fce690d660e1ab82af3d8f704b88ef

SHA1
a74e551aee75e8fd31a21be33183c27db70c949c

SHA256
355d135acf34d80b39061d07a4b43644d742c3805cd1bdb177b895cd45d7a3aa

SHA512
854bf86c68c498da0219709733080dd52e0ef01007c2c869bce321b69cb37480d61825e01e1f421d0e624a61e3c504b585fa0eae94e188b98f56a7d2cfe7b70e

Download Submit
C:\Windows\SysWOW64\Pkpmdbfd.exe

Filesize
367KB

MD5
34990061c24bbd0537311685c1df7fd9

SHA1
e0b55171043ec0a0b41127b38faac2719eb984c7

SHA256
6a57c2e347f5c448c7b93edfcb2f6df8cb0d71f3d876fdb01641a4e0124fbac0

SHA512
91abf98072743ef2a18284b39a76edf9aa66baf95fcdee962017921102399b69327230e0143d10b1701c4644548fb792b22b7cae0b95f51e59ba7e9e12a5ac74

Download Submit
C:\Windows\SysWOW64\Poimpapp.exe

Filesize
367KB

MD5
c9dd6dcdae18d2e5c939fa4bd3ffa108

SHA1
c3b8bad044c94b417cc1c519cfe6abc213917c52

SHA256
f36aff0e3de4bb418785efb8aac758a499d71b54d95e452dfa4d21467a9b6977

SHA512
81d1629c7dad3fd16506d7f32db79940888bcbc84615d8506691e8d5c0b38ea2154ff53ea519632ccba4de4b0184151f1dba8463ba1fac292e5e2a1d8d210422

Download Submit
C:\Windows\SysWOW64\Qlimed32.exe

Filesize
367KB

MD5
392434ea793255855eab0c2ec19d3fa6

SHA1
50b0a89ae02bc10a8a165505891c00365cccf42b

SHA256
007b43ec5681811fcbcab164d652bbc125e46b0e25b2933e92a78cbdd194908e

SHA512
e37402976e30a9f1e20c9b170f2d9bf2e94e9a95bb0c619407aaa2cfbb93f406726a844a9cc02744288e122b81ba217ce581f5461de78bdc223fdb936c429378

Download Submit
C:\Windows\SysWOW64\Qmepam32.exe

Filesize
367KB

MD5
99fa406e1c9e6334dd2788756712ca85

SHA1
030cb1e2f0495a729430ff4d7d2e857a88e274e0

SHA256
49d9d3b7fbdbd2176ca78570b2d0e0788fbf8360b2e5281b878e58f30d518b51

SHA512
47ca74610ae87348c3647bdc1bbc9112d99cf52717b6961c3614a02c7503ae82fea64c5f9cd8b32bd361bb058d09bd21a24cc7e25a61ad0a17ba7ee2606f155d

Download Submit
C:\Windows\SysWOW64\Qoelkp32.exe

Filesize
367KB

MD5
546b69e06ebe738524e6d0579db87dfd

SHA1
fa7a9b31b48ff3a5a49162651d542d4802fad396

SHA256
b910d5a99f0b66a3edaea8f449c8dfb925d27b0c11f53c0083109a33df77835c

SHA512
7ae37cf21b5838117fe598709fc7bc2a0103de5ffb4563fc35468a1f175258e044cfb4b6fdcc67651ecfad061086318dfb167efc27e4856209aebd96113c5df5

Download Submit
C:\Windows\SysWOW64\Qoelkp32.exe

Filesize
278KB

MD5
2ce9d736e1575749790528da7d86b447

SHA1
98c15724e79a1db95f5b77ba21a9d4a5cc5950ed

SHA256
bfeee71a8064cca5451ddd1d34236c4b78cd26bab7033444951edd6c5b6de091

SHA512
7513022c794bac399aefd908a4cb1270ceefe8d8812e86c7727e448232af97a342f12308c174bd102fef7872508bc48e51822a0928bd3ea1f93bd8a74fb56afd

Download Submit
memory/392-63-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1000-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1128-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1188-256-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1308-55-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1360-119-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1376-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1544-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2076-286-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2132-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2144-239-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2424-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2496-127-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2888-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2900-304-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3012-47-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3044-224-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3184-152-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3196-216-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3244-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3296-192-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3312-176-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3440-268-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3464-140-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3480-208-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3524-232-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3716-160-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3980-280-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4132-292-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4160-262-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4376-112-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4432-200-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4508-98-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4524-41-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4628-274-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4636-184-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4720-104-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4724-247-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4772-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4808-144-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4916-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5132-310-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5172-320-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5212-322-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5260-328-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5300-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5340-340-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5380-346-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5420-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5460-358-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5504-364-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5544-370-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5588-380-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5624-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5668-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5708-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5748-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5788-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5828-412-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5868-418-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5912-424-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5956-430-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5996-436-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/6048-442-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads