58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af.exe
Size

80KB
MD5

3fa8f331bcddee7a0ba8a5cf7185ee68
SHA1

ff2fa8ae5e4732658cbfd0db75b4f3a4b24ffbce
SHA256

58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af
SHA512

00af60d139196d7b973e519e293d3531e6ea364097105bbadb151379b4cc74412f26d22b9ba7dfd9fe84d864f13d80ce10c7238b729e5af124c96e1003cb6aa9
SSDEEP

1536:l8bqx+KSPLY/xSOzz2aDvAm2LsJ9VqDlzVxyh+CbxMa:mvVP0U3EvALsJ9IDlRxyhTb7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcikolnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imdnklfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjlfbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icljbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqkocpod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haidklda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffggkgmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hibljoco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eoocmoao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpnhekgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iinlemia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffbnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gidphq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcggpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpccnefa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqohnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Goiojk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fihqmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbanme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjlfbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmmocpjk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfaloa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jiphkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdemhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecbenm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfnnlffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifmcdblq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iiffen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjhmgeao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbanme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hihicplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebnoikqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbenqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kphmie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efneehef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kilhgk32.exe

Executes dropped EXE 64 IoCs

pid	Process
2032	Efgodj32.exe
4520	Ejbkehcg.exe
3868	Elagacbk.exe
1128	Eoocmoao.exe
1556	Ebnoikqb.exe
2268	Efikji32.exe
1280	Ehhgfdho.exe
440	Eoapbo32.exe
772	Ebploj32.exe
956	Ejgdpg32.exe
2644	Eleplc32.exe
3092	Ecphimfb.exe
4680	Efneehef.exe
4056	Ehlaaddj.exe
684	Eqciba32.exe
3496	Ecbenm32.exe
2464	Ejlmkgkl.exe
1888	Emjjgbjp.exe
3124	Eoifcnid.exe
2040	Ffbnph32.exe
1812	Fhajlc32.exe
4964	Fqhbmqqg.exe
2408	Fbioei32.exe
4644	Fjqgff32.exe
4160	Fqkocpod.exe
1524	Fcikolnh.exe
4856	Ffggkgmk.exe
396	Fmapha32.exe
2668	Fqohnp32.exe
1664	Fcnejk32.exe
2276	Fflaff32.exe
2240	Fjhmgeao.exe
4656	Fqaeco32.exe
3968	Gfnnlffc.exe
4484	Gmhfhp32.exe
4928	Gogbdl32.exe
3744	Gbenqg32.exe
4428	Gjlfbd32.exe
2132	Giofnacd.exe
1752	Goiojk32.exe
784	Gcekkjcj.exe
1672	Gfcgge32.exe
3472	Gjocgdkg.exe
4872	Gmmocpjk.exe
1372	Gcggpj32.exe
3984	Gbjhlfhb.exe
3040	Gidphq32.exe
4864	Gpnhekgl.exe
2576	Gcidfi32.exe
4220	Gjclbc32.exe
2324	Gmaioo32.exe
4876	Gppekj32.exe
4252	Hboagf32.exe
3432	Hihicplj.exe
4012	Hpbaqj32.exe
4524	Hbanme32.exe
1236	Hjhfnccl.exe
1784	Hmfbjnbp.exe
1380	Hpenfjad.exe
2884	Hbckbepg.exe
512	Himcoo32.exe
4504	Hpgkkioa.exe
4944	Hbeghene.exe
2412	Hjmoibog.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Hihicplj.exe	Hboagf32.exe
File created	C:\Windows\SysWOW64\Ppmeid32.dll	Hjmoibog.exe
File created	C:\Windows\SysWOW64\Fjkiobic.dll	Haidklda.exe
File opened for modification	C:\Windows\SysWOW64\Nddkgonp.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Hfdcbdnc.dll	Ebploj32.exe
File created	C:\Windows\SysWOW64\Fjqgff32.exe	Fbioei32.exe
File created	C:\Windows\SysWOW64\Fmapha32.exe	Ffggkgmk.exe
File created	C:\Windows\SysWOW64\Gcggpj32.exe	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Gbjhlfhb.exe	Gcggpj32.exe
File created	C:\Windows\SysWOW64\Kkdeek32.dll	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Pellipfm.dll	Lmccchkn.exe
File opened for modification	C:\Windows\SysWOW64\Mdfofakp.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Fqaeco32.exe	Fjhmgeao.exe
File created	C:\Windows\SysWOW64\Gfnnlffc.exe	Fqaeco32.exe
File created	C:\Windows\SysWOW64\Hfcpncdk.exe	Hcedaheh.exe
File opened for modification	C:\Windows\SysWOW64\Ijaida32.exe	Icgqggce.exe
File created	C:\Windows\SysWOW64\Idacmfkj.exe	Iabgaklg.exe
File opened for modification	C:\Windows\SysWOW64\Iinlemia.exe	Idacmfkj.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Efgodj32.exe	58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af.exe
File opened for modification	C:\Windows\SysWOW64\Gmhfhp32.exe	Gfnnlffc.exe
File created	C:\Windows\SysWOW64\Haggelfd.exe	Hmklen32.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Ehhgfdho.exe	Efikji32.exe
File opened for modification	C:\Windows\SysWOW64\Icljbg32.exe	Iannfk32.exe
File opened for modification	C:\Windows\SysWOW64\Iiffen32.exe	Iakaql32.exe
File opened for modification	C:\Windows\SysWOW64\Lalcng32.exe	Liekmj32.exe
File opened for modification	C:\Windows\SysWOW64\Ldmlpbbj.exe	Laopdgcg.exe
File created	C:\Windows\SysWOW64\Bdknoa32.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Ebnoikqb.exe	Eoocmoao.exe
File created	C:\Windows\SysWOW64\Lolncpam.dll	Gfcgge32.exe
File opened for modification	C:\Windows\SysWOW64\Hihicplj.exe	Hboagf32.exe
File created	C:\Windows\SysWOW64\Ppaaagol.dll	Kphmie32.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Ffbnph32.exe	Eoifcnid.exe
File opened for modification	C:\Windows\SysWOW64\Fqhbmqqg.exe	Fhajlc32.exe
File created	C:\Windows\SysWOW64\Ggdddife.dll	Gcggpj32.exe
File opened for modification	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Kkbkamnl.exe	Kckbqpnj.exe
File created	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Hbckbepg.exe	Hpenfjad.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Lilanioo.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Lnjjdgee.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Mamleegg.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Fihpfl32.dll	Eleplc32.exe
File opened for modification	C:\Windows\SysWOW64\Efneehef.exe	Ecphimfb.exe
File opened for modification	C:\Windows\SysWOW64\Eqciba32.exe	Ehlaaddj.exe
File opened for modification	C:\Windows\SysWOW64\Ljnnch32.exe	Lcdegnep.exe
File created	C:\Windows\SysWOW64\Gagaaq32.dll	Efikji32.exe
File created	C:\Windows\SysWOW64\Phogofep.dll	Ifjfnb32.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lcdegnep.exe
File created	C:\Windows\SysWOW64\Giofnacd.exe	Gjlfbd32.exe
File opened for modification	C:\Windows\SysWOW64\Gjclbc32.exe	Gcidfi32.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Hibljoco.exe	Hfcpncdk.exe
File created	C:\Windows\SysWOW64\Jdemhe32.exe	Jiphkm32.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	Lilanioo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7120	6880	WerFault.exe	266

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlgol32.dll"	Jpaghf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiidlll.dll"	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcidfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebnoikqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqciba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llebfo32.dll"	Fhajlc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipckgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbkmec32.dll"	Jmpngk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbnpm32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bofjdo32.dll"	Ffbnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbioei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcedaheh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejgdpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggipmfe.dll"	Fbioei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iiffen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmhfhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmpolji.dll"	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elagacbk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbioei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbckbepg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iikopmkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flfmin32.dll"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mepgghma.dll"	Gmhfhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Honcnp32.dll"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eagncfoj.dll"	Gppekj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inccjgbc.dll"	Hihicplj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphqml32.dll"	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imppcc32.dll"	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mglack32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eoocmoao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbeghene.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipckgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dadofijl.dll"	Giofnacd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibooqjdb.dll"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Himcoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eoifcnid.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 2032	3516	58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af.exe	91
PID 3516 wrote to memory of 2032	3516	58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af.exe	91
PID 3516 wrote to memory of 2032	3516	58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af.exe	91
PID 2032 wrote to memory of 4520	2032	Efgodj32.exe	92
PID 2032 wrote to memory of 4520	2032	Efgodj32.exe	92
PID 2032 wrote to memory of 4520	2032	Efgodj32.exe	92
PID 4520 wrote to memory of 3868	4520	Ejbkehcg.exe	93
PID 4520 wrote to memory of 3868	4520	Ejbkehcg.exe	93
PID 4520 wrote to memory of 3868	4520	Ejbkehcg.exe	93
PID 3868 wrote to memory of 1128	3868	Elagacbk.exe	94
PID 3868 wrote to memory of 1128	3868	Elagacbk.exe	94
PID 3868 wrote to memory of 1128	3868	Elagacbk.exe	94
PID 1128 wrote to memory of 1556	1128	Eoocmoao.exe	95
PID 1128 wrote to memory of 1556	1128	Eoocmoao.exe	95
PID 1128 wrote to memory of 1556	1128	Eoocmoao.exe	95
PID 1556 wrote to memory of 2268	1556	Ebnoikqb.exe	96
PID 1556 wrote to memory of 2268	1556	Ebnoikqb.exe	96
PID 1556 wrote to memory of 2268	1556	Ebnoikqb.exe	96
PID 2268 wrote to memory of 1280	2268	Efikji32.exe	97
PID 2268 wrote to memory of 1280	2268	Efikji32.exe	97
PID 2268 wrote to memory of 1280	2268	Efikji32.exe	97
PID 1280 wrote to memory of 440	1280	Ehhgfdho.exe	98
PID 1280 wrote to memory of 440	1280	Ehhgfdho.exe	98
PID 1280 wrote to memory of 440	1280	Ehhgfdho.exe	98
PID 440 wrote to memory of 772	440	Eoapbo32.exe	99
PID 440 wrote to memory of 772	440	Eoapbo32.exe	99
PID 440 wrote to memory of 772	440	Eoapbo32.exe	99
PID 772 wrote to memory of 956	772	Ebploj32.exe	100
PID 772 wrote to memory of 956	772	Ebploj32.exe	100
PID 772 wrote to memory of 956	772	Ebploj32.exe	100
PID 956 wrote to memory of 2644	956	Ejgdpg32.exe	101
PID 956 wrote to memory of 2644	956	Ejgdpg32.exe	101
PID 956 wrote to memory of 2644	956	Ejgdpg32.exe	101
PID 2644 wrote to memory of 3092	2644	Eleplc32.exe	102
PID 2644 wrote to memory of 3092	2644	Eleplc32.exe	102
PID 2644 wrote to memory of 3092	2644	Eleplc32.exe	102
PID 3092 wrote to memory of 4680	3092	Ecphimfb.exe	103
PID 3092 wrote to memory of 4680	3092	Ecphimfb.exe	103
PID 3092 wrote to memory of 4680	3092	Ecphimfb.exe	103
PID 4680 wrote to memory of 4056	4680	Efneehef.exe	104
PID 4680 wrote to memory of 4056	4680	Efneehef.exe	104
PID 4680 wrote to memory of 4056	4680	Efneehef.exe	104
PID 4056 wrote to memory of 684	4056	Ehlaaddj.exe	105
PID 4056 wrote to memory of 684	4056	Ehlaaddj.exe	105
PID 4056 wrote to memory of 684	4056	Ehlaaddj.exe	105
PID 684 wrote to memory of 3496	684	Eqciba32.exe	106
PID 684 wrote to memory of 3496	684	Eqciba32.exe	106
PID 684 wrote to memory of 3496	684	Eqciba32.exe	106
PID 3496 wrote to memory of 2464	3496	Ecbenm32.exe	107
PID 3496 wrote to memory of 2464	3496	Ecbenm32.exe	107
PID 3496 wrote to memory of 2464	3496	Ecbenm32.exe	107
PID 2464 wrote to memory of 1888	2464	Ejlmkgkl.exe	108
PID 2464 wrote to memory of 1888	2464	Ejlmkgkl.exe	108
PID 2464 wrote to memory of 1888	2464	Ejlmkgkl.exe	108
PID 1888 wrote to memory of 3124	1888	Emjjgbjp.exe	110
PID 1888 wrote to memory of 3124	1888	Emjjgbjp.exe	110
PID 1888 wrote to memory of 3124	1888	Emjjgbjp.exe	110
PID 3124 wrote to memory of 2040	3124	Eoifcnid.exe	111
PID 3124 wrote to memory of 2040	3124	Eoifcnid.exe	111
PID 3124 wrote to memory of 2040	3124	Eoifcnid.exe	111
PID 2040 wrote to memory of 1812	2040	Ffbnph32.exe	112
PID 2040 wrote to memory of 1812	2040	Ffbnph32.exe	112
PID 2040 wrote to memory of 1812	2040	Ffbnph32.exe	112
PID 1812 wrote to memory of 4964	1812	Fhajlc32.exe	113

C:\Users\Admin\AppData\Local\Temp\58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af.exe
"C:\Users\Admin\AppData\Local\Temp\58b5dee197ae429c4fb7a6f65ce29ba18941e7cfc81efb83e6814948fd7b20af.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\SysWOW64\Efgodj32.exe
  C:\Windows\system32\Efgodj32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\Ejbkehcg.exe
    C:\Windows\system32\Ejbkehcg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\SysWOW64\Elagacbk.exe
      C:\Windows\system32\Elagacbk.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Windows\SysWOW64\Eoocmoao.exe
        
        C:\Windows\system32\Eoocmoao.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1128
      - C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\Eoapbo32.exe
        
        C:\Windows\system32\Eoapbo32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\Ejgdpg32.exe
        
        C:\Windows\system32\Ejgdpg32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\Fqhbmqqg.exe
        
        C:\Windows\system32\Fqhbmqqg.exe
        23⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2408
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        25⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4856
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        29⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:372
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        32⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        33⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2240
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3968
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        38⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2132
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1752
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        43⤵
        Executes dropped EXE
        
        PID:784
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1672
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        45⤵
        Executes dropped EXE
        
        PID:3472
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4872
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1372
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        48⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3040
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2576
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        52⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        53⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4252
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3432
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        57⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        59⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        60⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1380
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2884
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:512
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        64⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2412
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        67⤵
        Drops file in System32 directory
        
        PID:740
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        68⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4528
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        70⤵
        Drops file in System32 directory
        
        PID:3592
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:968
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1232
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        73⤵
        Drops file in System32 directory
        
        PID:2044
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        74⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        75⤵
        Drops file in System32 directory
        
        PID:3276
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        77⤵
        Drops file in System32 directory
        
        PID:2308
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3992
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        79⤵
        Drops file in System32 directory
        
        PID:1004
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3064
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4828
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        82⤵
        Modifies registry class
        
        PID:4860
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:640
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        84⤵
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        85⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        86⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5288
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        88⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5420
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        93⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        94⤵
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        95⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        96⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        97⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        98⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        99⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        100⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        102⤵
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        104⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        106⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        108⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        110⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        112⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        113⤵
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        114⤵
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5716
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        116⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        117⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        118⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        120⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        121⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        122⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        123⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        125⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5812
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        127⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        128⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        129⤵
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        131⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        134⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        135⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5944
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        138⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        139⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        141⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        142⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        143⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6284
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6372
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        148⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        150⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        152⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        153⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        154⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        155⤵
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        156⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6836
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        158⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6952
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7016
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        162⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6164
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        165⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6352
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        167⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        168⤵
        Drops file in System32 directory
        
        PID:6568
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        171⤵
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        172⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 404
        173⤵
        Program crash
        
        PID:7120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6880 -ip 6880
1⤵
PID:7004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
80KB

MD5
374bdcb1636e3b7ffe6351c002f4f9f8

SHA1
3af3991fc67ee8bbfea6fbe89bd9b1dc6889e089

SHA256
6b3ee54b942abdb31ecef0e4469683071447e32e7f46dff84fa3403a211a30da

SHA512
82325651bfbe8c626b2cccd287f0521a6352136324605a1ff878aaff6608e7c1b607f75f0fab8e0f79416727a117e1804329b1e12242a0f19af80bf16bbc7826

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
80KB

MD5
39a51aff06d16056b01e63bebe987b8a

SHA1
ac979e4c86716ec96c469418344293d5b9d120c0

SHA256
7d5c6e99e9a59784e5200ea13c5c29b1b1bdc29b4af0a97501d600092206e54b

SHA512
237cd54f7121d3e8c9ecdefd6224cb73a53a3c44895bc17ed0c43858a109e0b7d6b16bc3db9f6e9a9342172095b969a571c9fe7e0836086b06f33e25f4886f40

Download Submit
C:\Windows\SysWOW64\Ecbenm32.exe

Filesize
80KB

MD5
039b58fd72c78309f7bd5d8e546861ed

SHA1
e5e0d13a1fdbcc98cd7f7af8953430e3b6075633

SHA256
1eb6f47c889fd4bbe5aa714225bda3622e6f55db66702de3d33a7240e9c51b85

SHA512
72fcb2192e3d2afb8e43ceddf0dfac18fd8b399332e147323835a6baa3fa20a90666ac8a087dd8a4d0eab88bc83492f4e41ebfd9ae36d51e633a9435f1554d44

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
80KB

MD5
8a871cc449a64120761abb3a069decff

SHA1
8991a9e2c8a2703186f3ae0a94d39b49458bff2c

SHA256
5e0bd40ebaed60f33a25ec393487f46a22759b4e147bb78e3e1a93a125adaa95

SHA512
6545ac2a937d3f7b6072bfcd74b7722f07fa5f94e724839217c189a67d2dee03d516916aca3ada3dcfe6f280f70bd168b443eb74e825efafda5d234863d6f69a

Download Submit
C:\Windows\SysWOW64\Efgodj32.exe

Filesize
80KB

MD5
312672f79dc32a5ce3d9ac438a819421

SHA1
324af82c17b0242540794cd6161b5de9f2fff5a1

SHA256
bf8f2c9f0c1190882c4eef16f370b8780e08ea62829f9b1d1735c57c1c50f182

SHA512
0951337f851412b7fbc47fd6381be819ee1634e74dc41345cce37a0b99c05749a8a1e47931950ba3f8b86ddf23926c203274af19a9f9aa0487683183a3f69f3d

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
80KB

MD5
b7af43a5e96ef8a3267a77081ff249fe

SHA1
26e0c37920996c36546163cb8bada0406894eaae

SHA256
5f1fabc5daf816c782d5e3f4f200458e0d809665008ffea9ffc7c3b20571494d

SHA512
73c3a0b5c7bac19f76c863d69e0c4bb3df9fb800ac3f3e31c120b6139a6759e74adefe95324aa8fa815e963d006afb4fa97a137e439ceb03ca47e20e88e7f6db

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
80KB

MD5
54ecdb409b31cf47b1713a7a10c7ba0f

SHA1
915d6a8e93e91a9759f3fe3a20787618ab0830ef

SHA256
15d99e48baa91530e68a70738ce22f6669bd65dc7b955d9c7254c2c1472741ea

SHA512
7b0a39ff03acd1d0f356a033ae1b2c05bee3461f3f95fae7d845ae9344f522c14f72f028e196ccc43d4163fba300e98bda32f111fe29793accf5df32216781ba

Download Submit
C:\Windows\SysWOW64\Ehhgfdho.exe

Filesize
80KB

MD5
a0bd4e31ec410388613f1c86b431ba40

SHA1
c08fa1daa214a6a693de04c8ce597759c0409566

SHA256
8180a77d98d6f30d0c9382789d5faa40294ba4670d545d51a0b0948275156a85

SHA512
59ec183bd9f46deeb7ceba03f41e6f059dd4db166a27355d6af7b22d635c6d58c0a1c16953ba548bb63b7e8d4c0cf3a22165b6151b16fecb55730688830d4427

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
80KB

MD5
1a147db10fb52be813587c8c8fff60e1

SHA1
4c5c9187dc464145cc3f15eb3a95a7130648803d

SHA256
f3c66bbfa5b7b833a8aa8838110a8c357d93d13480a182d8022f7bf43286b2d6

SHA512
d58c58d855aca360dd816a16e452dcda80d698966042643213fd82c5e7126e308aed52c18b0d48af2176ab400cacfcd6aee96d90215f9115244bf24cad0807b7

Download Submit
C:\Windows\SysWOW64\Ejbkehcg.exe

Filesize
80KB

MD5
8b048dce6a7bb81266fa1b1acef32cd0

SHA1
ae5c6aae07bea9649f5ced7f63788c70d980d3ee

SHA256
eb413f8bf004d70fe16bc47bdf1c8d13b17ce550558d58f0da81826800731373

SHA512
3d6b62eefdd4d72e78588df3a2f00fa930367bba0eac59ae6da16f5c89681602f3b27ce5761219fc1a811fd6525ed4547f145eeafa03fdf488d09c9a4190f1b4

Download Submit
C:\Windows\SysWOW64\Ejgdpg32.exe

Filesize
80KB

MD5
85e1a95770d0cda300a23645923235a3

SHA1
84d2e7761a8f1e6e7c9b2eaea1777d81f5788e75

SHA256
a6ec326802b8cbb62521853a371efcf6fab72037aec70105e8c76946ff53f199

SHA512
026e6007f53cd319f436ac473508cc646f9b49e2e49eb170bc4ee70e0d6fe5120e255c01ed4e514f6af504038838f4a948e563edc82678cbc65a985712ae34ec

Download Submit
C:\Windows\SysWOW64\Ejlmkgkl.exe

Filesize
80KB

MD5
509504a21e3de9ed19167325f47efbc9

SHA1
398ecc7d6b29ebac95cf220c529da0616e0ab1d8

SHA256
0c8e8a041a2bd9d4b94447db8869691d6f39b09b9c7a966d0421b01eb0fe9acb

SHA512
35c0792ddd70fd78de0ce61e46294dacc8e2ef49cb4796e9c0ad693ddda44a83f3974e2600af3f822d4b9fabb9e12bbbe4005adcbd55ade98afd7c632b7781dd

Download Submit
C:\Windows\SysWOW64\Elagacbk.exe

Filesize
80KB

MD5
cadf59ea12f65e9aa6f50ea3dfa9f2a3

SHA1
dc8001ecd1bad0a88ad65ea8f5148227f0d79ced

SHA256
c7849dd81c56a7680d1bdfab8217331253f7a3bed74a2993c8bee225ed01ba88

SHA512
bbe9948961d7c1671764e9622c8db5ca0dbf9bccb5a090b288d7902cd94fde1661ab325a279579cee089a050eecb893365ab3a0793ace3fbd2728b145fc4a524

Download Submit
C:\Windows\SysWOW64\Eleplc32.exe

Filesize
80KB

MD5
470e658d2c8f82eb11fc6a1dc042c4b8

SHA1
d38cc609c42b00aa3185b61ca0ed4bef2a610891

SHA256
11a0d74fa2330d16ca6ec95e84f1e5a8a53ed19620ada606298ad5aa0afa2167

SHA512
5862a0a2d59e3d21781c595c065a00ea749a7eff4c913a68ddaefc0647c092a82d15e69617ce14c0d94ddb098b8a7853f9b2a56cef85119b36f201d7e173d275

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
80KB

MD5
99f85d409d3bcd6ccce66dc7b660bd0d

SHA1
1c8b9403a4900c1e95a692a3339390a44c2d0de2

SHA256
d23f6b3a1ec56906b1bbd35df8ffc55789621c155e9079ee03d7949dfa8407a5

SHA512
4dc091352733f78ccf3abcde62cfc328bd5edd6686c107d70e83b30402d4655b48b45fcca7c1191b6b8a11067b79fd727403ac179ea9bfd98c65490b01b07e9b

Download Submit
C:\Windows\SysWOW64\Eoapbo32.exe

Filesize
80KB

MD5
5e14c055110ed15ea361978b81088dca

SHA1
d09b308028e71954b196484de76b4274cea31ed7

SHA256
72d6829be4ef097a6f7253b585c6c267bb6aaf55255e125788c2c99fb7540a62

SHA512
febd25631daf8ccd891d4fc6e599e04582fec128c40c0249ec6ed899dfb8574bdef23eb99c5cd60a0a8bf06210635d08471c7bd2d46d6240b8ec3d6c40402da4

Download Submit
C:\Windows\SysWOW64\Eoifcnid.exe

Filesize
80KB

MD5
c42370b28990b49a7ff161a8e8c424c5

SHA1
6dcd4e7c38d6d3bed46a2bb3e3a714b81f5f1742

SHA256
e35baee4ed2bd6990b71d4c6fe3f6e48181fe79b7501dd933b6e301cb5e595dc

SHA512
dab89af7c51722538b45e7b39cd61d90837ae852aed1076ced802eab7c2e61891b4395edd4baec63d7f883b56eee38ffcf6a72562e63b5c9a289b64e13eb764d

Download Submit
C:\Windows\SysWOW64\Eoocmoao.exe

Filesize
80KB

MD5
c74bdf51a1df736de002a2ce5078c030

SHA1
a000a4ba456dcc3d1064f06416f3da98a865318f

SHA256
2daf3f3c691d33e50048b071b6e35ea05f24acaca969367da4dbccd437888452

SHA512
a0974db5af6d080921fa23548d886aad1104c381044fb5dc8c2e11cb9eda80752381da69a08c58d7b85f5ab4aa9e5ad3b0ef59c1817a02c2bf27098e89ea7242

Download Submit
C:\Windows\SysWOW64\Eqciba32.exe

Filesize
80KB

MD5
cbe1ac9709a56a42cd7bb12320fcc5a6

SHA1
94e3666423fc035dcaee60231bcd28f490080bd3

SHA256
7184f7d0caef9ee6f62cb0ebb022d9e1b5d5dcbee16d546ed24bdaf80eea766b

SHA512
259f74660c73772694ca196b48cc1802e2ec760c4ba5c616322798fa1a72857e443b27b77ac677d523d569a41df5bf039faa52dc7615cb07d3a8e852e4796690

Download Submit
C:\Windows\SysWOW64\Fbioei32.exe

Filesize
80KB

MD5
a637158bd4fb474b7e3f5bf4e1444f49

SHA1
d04062c2059f581b7df0252503053db682170bda

SHA256
19c8e9169474cd3c35db2bb88b85b88040146b96f165245831e1eb5d2a92d15b

SHA512
e6e1819ea2bf80b476223279091ac372b7b7a4224b026c724c2280320e39f4f383c40ac026cb292c8f5aab9b76994c998f4478aa653b1cd2f8a8795008e5882c

Download Submit
C:\Windows\SysWOW64\Fcikolnh.exe

Filesize
80KB

MD5
35e5921481ed2ca4ac767e5cc8b85210

SHA1
ee5dbef132096d5af6ee627d7fece41661481e86

SHA256
26313dedbf91ee67bda53456b0bc1fd2d5390341c7834fced286206f4db2b723

SHA512
a826a0c0b0d33063adb949bef83350cbca93758c964dd42ff9364e744822bfefe3ffe5e1c2539f1703a2484a3296303c5c08d517ae02a550548ee8f2c1a926a2

Download Submit
C:\Windows\SysWOW64\Fcnejk32.exe

Filesize
80KB

MD5
8074eb0dac26c0cd2f192726b56d1037

SHA1
d413ede5db9b83fceabeda727e145773c3083f10

SHA256
971cdcd9c393d9442e5c4c0b84af628756f565c4435bfa293b75140c9307a28a

SHA512
e8f51f39e5dbcc9e5db3e3f96625651318a333c0a53e3192d2d1d70ae418d44d7573f8c5b7a70898d14a169645ab509f794afc6486f732f87aae029548c846a7

Download Submit
C:\Windows\SysWOW64\Ffbnph32.exe

Filesize
80KB

MD5
e2e8eeb24a7b7c1cfe626832225f13e1

SHA1
60d3567e9462bddf0551d5ab5d04700769fe711b

SHA256
bdfe3134ca79ccf840b6adeaaf592c64f458a02e9cf4dae72b183fa3efac4160

SHA512
69ec3d1380c3a0925dfa844f7629abd39be35d0fbbe3d0192e39d907e175e274201010f0f308beba95f8c86a04fb81ed7b7f529c223bfc67d1ee9a9da794fbcd

Download Submit
C:\Windows\SysWOW64\Ffggkgmk.exe

Filesize
80KB

MD5
5aed5008bd664aa7945ec7e3d5580179

SHA1
fcf66ecb299a52ec096e56812a02d738506c8102

SHA256
ee531770942ad6788e3d07d50f462a9a552211790410af5cf1ba2e56ef4bdb69

SHA512
9e69615ad1a1a37b636b5d7a66db96b347ff55178bc47a3f15dd287dea2d8f39f11892140e306e0d02f114e7f805e671a5736235c75a5e71ad6ae1ca64f8779c

Download Submit
C:\Windows\SysWOW64\Fflaff32.exe

Filesize
80KB

MD5
8e0c08bd331133e76b303acc5f11b2d4

SHA1
6cb076f848c8e523d86066af6afd973841e88831

SHA256
526834123cee544669dbec01e0642e7d5178d78e52ca07dc2a88b402b71165da

SHA512
000dafeee549c2ecedd3f331dc7dd18c8d25b35acc8757b1cbf5a5b6ad9fe2c5262c8b81c64218ab9a0571c2120472ce9a3fca5867281e1deadaa933e029186d

Download Submit
C:\Windows\SysWOW64\Fhajlc32.exe

Filesize
80KB

MD5
c0f2d36c1c1a334984cc29099ea989b8

SHA1
4988740777f871e34143b627cd2dfa1e05fa27d3

SHA256
69405ba27391899d58faff3d8efe3b82e08c16c01c2dc02c99c7130b9b02943e

SHA512
e82928f1ea6463fe59683d3a53f42317cf9f692abad80badfd7cc3fe8dae7a4396d6944b2a2a6f8863cff03aab78995654fd8be05f763eaad2ed8d6e1c608476

Download Submit
C:\Windows\SysWOW64\Fjhmgeao.exe

Filesize
80KB

MD5
210bce551d7e51ed8bcd2186da58dfd9

SHA1
f67c293e772d4dcb15382a85a4c7ee0eab49e6ee

SHA256
0581f0b723190eeef7fb003f544e22a629aab4b5b21bb3e8c8fc46e7fedbf4a0

SHA512
9824c495d33d5604f06171f1678e8bd85b94d5a078428dac67309d92b88f87f4cb27183d9bd8852eca82f19c97b784eebd88a7ba5ca68449f20a34917370867c

Download Submit
C:\Windows\SysWOW64\Fjqgff32.exe

Filesize
80KB

MD5
64cb4ad951a86438f32c19f4e690cc49

SHA1
4cbc26242bb09fb5898ece9ad5c46d354b245181

SHA256
afde7e1da0e3b9e496946f3d27a87e2bf9372283fe5102847f771ca584b9a8fa

SHA512
9b9576a007f5c4d51376c62c245940115fcb57c2ae9d91e2df25761b0c391f08451450180d641a236df7b85f2dfb5ad9a5e6842c85cfff4d1dfc6b5d9ccc43e2

Download Submit
C:\Windows\SysWOW64\Fmapha32.exe

Filesize
80KB

MD5
41fbf1f0501cdcc67def94775e3bb9ab

SHA1
ff9fac439be66b3cbf572e5908edf50472dd0147

SHA256
ffbf090459fbb72df68e9f245db70f308727fc437ebaf469adba85208dc38b6f

SHA512
b3cbdde56820d4e7df468bbb6f4c0535b2771032a56eb8efc535ff80d3ebe71e300a293093ca94f8c2c2a96432077877ba3622d48b81468a434495be5f5e4d46

Download Submit
C:\Windows\SysWOW64\Fqaeco32.exe

Filesize
80KB

MD5
cfe0dd9d23bd0a316b04d9be9e91757f

SHA1
de69ba7eea671b459a831a908a0d831cad89e074

SHA256
92a1ab30c2cf349e5fdc97434992cc2041dd579eb40c68b49cea88c08b9c0215

SHA512
d7776dee110bfd6e2df08564dfbe0d9452ee41f4ddc44aa6dd18490ae405e9c1c3c6327ee784acd6a4e2ad3ee1fe09e5406d3f04f6a9c58e7edc910ada9b2a03

Download Submit
C:\Windows\SysWOW64\Fqhbmqqg.exe

Filesize
80KB

MD5
5d7ad66407a87d45598d165231dfa37f

SHA1
0518af7493c0715b8df33cc2b8a6cf51d59f515e

SHA256
7b854b4be60a508590473922184462ee16f21119d400c84802edd83d9576bcc3

SHA512
f2e21a0cc88b3099c1c331294c99731ff59e98876915c4ded836b67d5ab21ae63870c8ac8639a4f540ffee607f518328f4b6c623f42b9762d22353defc0f33cc

Download Submit
C:\Windows\SysWOW64\Fqkocpod.exe

Filesize
80KB

MD5
1b818b575564987640ccbc33af43a3d5

SHA1
2369905d6d673427223971804ab11a8d55cd0d4d

SHA256
d09de72fe6ff74f16160a5ce077e03683e7665bc1f0037f50a07a292d5eb8e82

SHA512
f22fd9c4961c5b6883fea49da2e679557ece45d9770eb724b743fe9eadea216f41122a6ef02ce72fdf83ec20f328777d382955ae1517c3397c44db62314c0a87

Download Submit
C:\Windows\SysWOW64\Fqohnp32.exe

Filesize
80KB

MD5
7399525fbd46bea28d39e79a4c49230a

SHA1
1641d6a26a923241723ddf17826b298908aaa146

SHA256
86c012df460fadbc04a5f078d00494ba46fc17cd9d9690520c00a1b0806e193d

SHA512
cbfedb1bf0cb992953d790687febd8d7a1a966e6fdab15bc3f68b50b3e8787d30a8039e476e0cbdf2d55e64d36ec4ebbea92e825da064af288c49c1419b412d7

Download Submit
C:\Windows\SysWOW64\Gcidfi32.exe

Filesize
80KB

MD5
4d3d4deb2b2adc999d22ed30b610e0c0

SHA1
20e969780b16b0079adb19a807d65465f393a56e

SHA256
3bdd19381e7cd0a83d500d746d13988af982bed33e9035f7fd6c64654a65f5f4

SHA512
918bbc9870f4654ddc40da692ad090c29031787fe590bc94a15cb756417cfe118f89d3d2ced0e93138bd4446d203699982df1a3dab1ebd934bff9de4aef14318

Download Submit
C:\Windows\SysWOW64\Gjocgdkg.exe

Filesize
80KB

MD5
d097dcf88e8cdb10b81b8222da6fc5e5

SHA1
1baed851c7ed43594e92a9c2c7663d273ba69bd7

SHA256
d8f4aee3472673d6d9d10d58194df2315f7fb5e24320e08fdf2f8ee886327566

SHA512
f31d8371b34cdb1e4072ab4d7bc8d0d4ef13f56dcca090fb36e90555ef9f8dfe2cf8a0e2d900566a272f9d26f4dca22b419fdac87189ed12895d2e54dfa9347d

Download Submit
memory/372-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/396-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/440-65-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/512-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/684-125-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/772-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/784-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/956-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1128-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1236-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1280-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1372-340-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1380-420-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1524-213-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1556-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1664-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1672-318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1752-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1784-414-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1812-173-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1888-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2032-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2040-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2132-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2240-261-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2268-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2276-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2324-375-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2408-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2464-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2576-360-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2644-93-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2668-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2884-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3040-349-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3092-101-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3124-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3432-390-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3472-324-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3496-128-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3516-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3516-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3744-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3868-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3968-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3984-345-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4012-400-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4056-117-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4160-205-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4220-366-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4252-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4428-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4484-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4520-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4524-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4644-197-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4656-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4680-108-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4856-221-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4864-358-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4872-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4876-378-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4928-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4964-176-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads