2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494.exe
Size

224KB
MD5

15fcabd3da528d95e4882a9af753c98c
SHA1

1fa1cd33bcb45160dd34a5c4e5404c9a193e6c6e
SHA256

2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494
SHA512

a88d92f1c012406cf53c1b8c2206594af163a65267d9dcf0ff47673372b52589030dc930e1c6ea7ad0f9ef35db43dd8fc5a260cf6916e8a2b41aad4f7c5eb780
SSDEEP

3072:CAJpJ9HktFfMiVKgzL20WKFcp9jRV5C/8qy4p2Y7YWlt63cp9jRV5q:JyXYgzL2V4cpC0L4AY7YWT63cpq

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhaebcen.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaqgek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcbihpel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbbkaako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kedoge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahkobekf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmdqgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfaigm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbmhlihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anpncp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jianff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfgjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kedoge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmnlj32.exe

Executes dropped EXE 64 IoCs

pid	Process
2160	Agffge32.exe
4320	Anpncp32.exe
4220	Aaqgek32.exe
3716	Ahkobekf.exe
4068	Adapgfqj.exe
4972	Angddopp.exe
1184	Alkdnboj.exe
3236	Bhaebcen.exe
1808	Bajjli32.exe
3872	Blpnib32.exe
3124	Baocghgi.exe
1792	Bhkhibmc.exe
4672	Cdainc32.exe
2424	Chpada32.exe
2056	Fomhdg32.exe
3196	Flqimk32.exe
2868	Ffimfqgm.exe
5000	Fkffog32.exe
3460	Gkhbdg32.exe
1768	Gbbkaako.exe
4328	Gofkje32.exe
388	Gdcdbl32.exe
3228	Gohhpe32.exe
1088	Gmlhii32.exe
5032	Gbiaapdf.exe
1660	Gdhmnlcj.exe
1248	Gkaejf32.exe
3568	Gfgjgo32.exe
1508	Hmabdibj.exe
2312	Hfifmnij.exe
4020	Hihbijhn.exe
4528	Hcmgfbhd.exe
4788	Hcpclbfa.exe
680	Hkkhqd32.exe
3804	Hioiji32.exe
4304	Hoiafcic.exe
1708	Immapg32.exe
2204	Icifbang.exe
2324	Ildkgc32.exe
2968	Iihkpg32.exe
2236	Ibqpimpl.exe
1300	Iikhfg32.exe
3808	Jfoiokfb.exe
844	Jmhale32.exe
1436	Jcbihpel.exe
1632	Jioaqfcc.exe
1096	Jbhfjljd.exe
2560	Jianff32.exe
2328	Jplfcpin.exe
3048	Jfeopj32.exe
1504	Jidklf32.exe
1936	Jlbgha32.exe
3212	Jblpek32.exe
4736	Jeklag32.exe
4420	Jmbdbd32.exe
1444	Jcllonma.exe
3540	Kemhff32.exe
5112	Kmdqgd32.exe
4820	Kdnidn32.exe
3940	Kfmepi32.exe
1608	Kmfmmcbo.exe
2348	Kdqejn32.exe
1968	Kebbafoj.exe
2104	Klljnp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ahioknai.dll	Ngpccdlj.exe
File created	C:\Windows\SysWOW64\Ofnckp32.exe	Ocpgod32.exe
File created	C:\Windows\SysWOW64\Donfhp32.dll	Ocbddc32.exe
File opened for modification	C:\Windows\SysWOW64\Pgioqq32.exe	Pcncpbmd.exe
File opened for modification	C:\Windows\SysWOW64\Gbbkaako.exe	Gkhbdg32.exe
File created	C:\Windows\SysWOW64\Nepgjaeg.exe	Ncbknfed.exe
File created	C:\Windows\SysWOW64\Oflgep32.exe	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Lhclbphg.dll	Flqimk32.exe
File created	C:\Windows\SysWOW64\Kebbafoj.exe	Kdqejn32.exe
File opened for modification	C:\Windows\SysWOW64\Blpnib32.exe	Bajjli32.exe
File created	C:\Windows\SysWOW64\Gkaejf32.exe	Gdhmnlcj.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Ndhmhh32.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Ageolo32.exe	Adgbpc32.exe
File opened for modification	C:\Windows\SysWOW64\Kbfbkj32.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Kedoge32.exe	Kbfbkj32.exe
File created	C:\Windows\SysWOW64\Kemhff32.exe	Jcllonma.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Kebbafoj.exe	Kdqejn32.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Kmmfbg32.dll	Liimncmf.exe
File created	C:\Windows\SysWOW64\Lmgfda32.exe	Lepncd32.exe
File created	C:\Windows\SysWOW64\Jocbigff.dll	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Jioaqfcc.exe	Jcbihpel.exe
File opened for modification	C:\Windows\SysWOW64\Jfeopj32.exe	Jplfcpin.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Agffge32.exe	2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494.exe
File created	C:\Windows\SysWOW64\Knfoif32.dll	Oflgep32.exe
File opened for modification	C:\Windows\SysWOW64\Odkjng32.exe	Olcbmj32.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Bajjli32.exe	Bhaebcen.exe
File opened for modification	C:\Windows\SysWOW64\Lingibiq.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pjeoglgc.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Nnbnoffm.dll	Jblpek32.exe
File created	C:\Windows\SysWOW64\Lfkaag32.exe	Ldleel32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Mdjagjco.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Gkaejf32.exe	Gdhmnlcj.exe
File created	C:\Windows\SysWOW64\Cojlbcgp.dll	Lbmhlihl.exe
File opened for modification	C:\Windows\SysWOW64\Ofnckp32.exe	Ocpgod32.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Empbnb32.dll	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Angddopp.exe	Adapgfqj.exe
File opened for modification	C:\Windows\SysWOW64\Njefqo32.exe	Nggjdc32.exe
File created	C:\Windows\SysWOW64\Kmfmmcbo.exe	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Bhaebcen.exe	Alkdnboj.exe
File created	C:\Windows\SysWOW64\Mfadpi32.dll	Icifbang.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Hioiji32.exe	Hkkhqd32.exe
File created	C:\Windows\SysWOW64\Edgbbfnk.dll	Kpjcdn32.exe
File created	C:\Windows\SysWOW64\Codqon32.dll	Nngokoej.exe
File created	C:\Windows\SysWOW64\Ibqpimpl.exe	Iihkpg32.exe
File opened for modification	C:\Windows\SysWOW64\Ncbknfed.exe	Mnebeogl.exe
File created	C:\Windows\SysWOW64\Madnnmem.dll	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Lemphdgj.dll	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Efmolq32.dll	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Anogiicl.exe	Ageolo32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8112	8008	WerFault.exe	290

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahkobekf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eikdngcl.dll"	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocljjj32.dll"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpphah32.dll"	Jfeopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kedoge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nedmmlba.dll"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiggphnk.dll"	Ahkobekf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alkdnboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmlhii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhaebcen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhkhibmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jidklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlbgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjkmdp32.dll"	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kebbafoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elfana32.dll"	Angddopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhaoapj.dll"	Ligqhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbbkaako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqnjfo32.dll"	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gohhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbiaapdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opakbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jioaqfcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmmfbg32.dll"	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiljkifg.dll"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgmkm32.dll"	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Angddopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leedqpci.dll"	Llcpoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lphoelqn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dddhpjof.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 2160	684	2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494.exe	90
PID 684 wrote to memory of 2160	684	2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494.exe	90
PID 684 wrote to memory of 2160	684	2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494.exe	90
PID 2160 wrote to memory of 4320	2160	Agffge32.exe	91
PID 2160 wrote to memory of 4320	2160	Agffge32.exe	91
PID 2160 wrote to memory of 4320	2160	Agffge32.exe	91
PID 4320 wrote to memory of 4220	4320	Anpncp32.exe	92
PID 4320 wrote to memory of 4220	4320	Anpncp32.exe	92
PID 4320 wrote to memory of 4220	4320	Anpncp32.exe	92
PID 4220 wrote to memory of 3716	4220	Aaqgek32.exe	93
PID 4220 wrote to memory of 3716	4220	Aaqgek32.exe	93
PID 4220 wrote to memory of 3716	4220	Aaqgek32.exe	93
PID 3716 wrote to memory of 4068	3716	Ahkobekf.exe	94
PID 3716 wrote to memory of 4068	3716	Ahkobekf.exe	94
PID 3716 wrote to memory of 4068	3716	Ahkobekf.exe	94
PID 4068 wrote to memory of 4972	4068	Adapgfqj.exe	95
PID 4068 wrote to memory of 4972	4068	Adapgfqj.exe	95
PID 4068 wrote to memory of 4972	4068	Adapgfqj.exe	95
PID 4972 wrote to memory of 1184	4972	Angddopp.exe	97
PID 4972 wrote to memory of 1184	4972	Angddopp.exe	97
PID 4972 wrote to memory of 1184	4972	Angddopp.exe	97
PID 1184 wrote to memory of 3236	1184	Alkdnboj.exe	98
PID 1184 wrote to memory of 3236	1184	Alkdnboj.exe	98
PID 1184 wrote to memory of 3236	1184	Alkdnboj.exe	98
PID 3236 wrote to memory of 1808	3236	Bhaebcen.exe	99
PID 3236 wrote to memory of 1808	3236	Bhaebcen.exe	99
PID 3236 wrote to memory of 1808	3236	Bhaebcen.exe	99
PID 1808 wrote to memory of 3872	1808	Bajjli32.exe	100
PID 1808 wrote to memory of 3872	1808	Bajjli32.exe	100
PID 1808 wrote to memory of 3872	1808	Bajjli32.exe	100
PID 3872 wrote to memory of 3124	3872	Blpnib32.exe	101
PID 3872 wrote to memory of 3124	3872	Blpnib32.exe	101
PID 3872 wrote to memory of 3124	3872	Blpnib32.exe	101
PID 3124 wrote to memory of 1792	3124	Baocghgi.exe	102
PID 3124 wrote to memory of 1792	3124	Baocghgi.exe	102
PID 3124 wrote to memory of 1792	3124	Baocghgi.exe	102
PID 1792 wrote to memory of 4672	1792	Bhkhibmc.exe	103
PID 1792 wrote to memory of 4672	1792	Bhkhibmc.exe	103
PID 1792 wrote to memory of 4672	1792	Bhkhibmc.exe	103
PID 4672 wrote to memory of 2424	4672	Cdainc32.exe	104
PID 4672 wrote to memory of 2424	4672	Cdainc32.exe	104
PID 4672 wrote to memory of 2424	4672	Cdainc32.exe	104
PID 2424 wrote to memory of 2056	2424	Chpada32.exe	105
PID 2424 wrote to memory of 2056	2424	Chpada32.exe	105
PID 2424 wrote to memory of 2056	2424	Chpada32.exe	105
PID 2056 wrote to memory of 3196	2056	Fomhdg32.exe	107
PID 2056 wrote to memory of 3196	2056	Fomhdg32.exe	107
PID 2056 wrote to memory of 3196	2056	Fomhdg32.exe	107
PID 3196 wrote to memory of 2868	3196	Flqimk32.exe	108
PID 3196 wrote to memory of 2868	3196	Flqimk32.exe	108
PID 3196 wrote to memory of 2868	3196	Flqimk32.exe	108
PID 2868 wrote to memory of 5000	2868	Ffimfqgm.exe	109
PID 2868 wrote to memory of 5000	2868	Ffimfqgm.exe	109
PID 2868 wrote to memory of 5000	2868	Ffimfqgm.exe	109
PID 5000 wrote to memory of 3460	5000	Fkffog32.exe	110
PID 5000 wrote to memory of 3460	5000	Fkffog32.exe	110
PID 5000 wrote to memory of 3460	5000	Fkffog32.exe	110
PID 3460 wrote to memory of 1768	3460	Gkhbdg32.exe	111
PID 3460 wrote to memory of 1768	3460	Gkhbdg32.exe	111
PID 3460 wrote to memory of 1768	3460	Gkhbdg32.exe	111
PID 1768 wrote to memory of 4328	1768	Gbbkaako.exe	112
PID 1768 wrote to memory of 4328	1768	Gbbkaako.exe	112
PID 1768 wrote to memory of 4328	1768	Gbbkaako.exe	112
PID 4328 wrote to memory of 388	4328	Gofkje32.exe	113

C:\Users\Admin\AppData\Local\Temp\2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494.exe
"C:\Users\Admin\AppData\Local\Temp\2ce1946c7c0b3b431ed7b15d32293b28609072f089827f5b7f6def791286f494.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\SysWOW64\Agffge32.exe
  C:\Windows\system32\Agffge32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\Anpncp32.exe
    C:\Windows\system32\Anpncp32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\SysWOW64\Aaqgek32.exe
      C:\Windows\system32\Aaqgek32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3716
      - C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        23⤵
        Executes dropped EXE
        
        PID:388
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3228
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1660
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1248
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        30⤵
        Executes dropped EXE
        
        PID:1508
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2312
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        32⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        33⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        34⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:680
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        36⤵
        Executes dropped EXE
        
        PID:3804
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1708
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2204
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        40⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2236
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        43⤵
        Executes dropped EXE
        
        PID:1300
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3808
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        45⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1436
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1096
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2328
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1504
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3212
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        56⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1444
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        58⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        60⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        62⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2348
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2104
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        66⤵
        Drops file in System32 directory
        
        PID:3756
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4280
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        68⤵
        Drops file in System32 directory
        
        PID:2356
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5188
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        71⤵
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        73⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        74⤵
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        76⤵
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        78⤵
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        80⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        82⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        83⤵
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        85⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        86⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        87⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        88⤵
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6060
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        90⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        91⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        92⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        93⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5340
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        96⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        97⤵
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        98⤵
        Drops file in System32 directory
        
        PID:5656
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        100⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        101⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        102⤵
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6056
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        104⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        105⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        106⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        107⤵
        Modifies registry class
        
        PID:5540
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        110⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        111⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        112⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        113⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        114⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        115⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5872
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        117⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        118⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        119⤵
        Drops file in System32 directory
        
        PID:6184
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6228
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        121⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        122⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        123⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        125⤵
        Drops file in System32 directory
        
        PID:6444
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        126⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        127⤵
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        128⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        129⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6696
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        131⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        132⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        133⤵
        Drops file in System32 directory
        
        PID:6836
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        134⤵
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        135⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6964
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        137⤵
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7044
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        139⤵
        Drops file in System32 directory
        
        PID:7092
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        141⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        143⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        144⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        145⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        147⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        149⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        150⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        151⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        152⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        154⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        162⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        163⤵
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        164⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        165⤵
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6728
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        167⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7120
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        169⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        170⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        171⤵
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        173⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        175⤵
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7228
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        178⤵
        Drops file in System32 directory
        
        PID:7312
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        181⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7480
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        185⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7608
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7652
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        187⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        188⤵
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        189⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        190⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        191⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        192⤵
        Modifies registry class
        
        PID:7912
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7964
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        194⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8008 -s 396
        195⤵
        Program crash
        
        PID:8112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 8008 -ip 8008
1⤵
PID:8076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2284,i,2771196087253062161,8107167670425198948,262144 --variations-seed-version /prefetch:8
1⤵
PID:8000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaqgek32.exe

Filesize
224KB

MD5
646d518b66510d43c912c29ca9307a7a

SHA1
e8228201bfd6c4ac6f661cf50de77d5ef14c828f

SHA256
68d9836b4b2d24be09c7e70506052ef19e9d010079a068c057b0f288e2fdb604

SHA512
b0b1d816dda7ecb7c232906e460db7a84ba09de0794fc3296ef2ca40ca0fde6eda4e2b2d68105683b88b897752f2c53b425a53d4bf4a2b5cbbad836e4e81680a

Download Submit
C:\Windows\SysWOW64\Adapgfqj.exe

Filesize
224KB

MD5
cd631dfb500fd2eac34594af325827af

SHA1
c9d0bfbad322e311b87bd35dc6efdf235c8addbb

SHA256
cf62672297efa6eb00d097ab91d1df798d94f2df261df199c61f457aec9abd36

SHA512
417e4b50f2943802c504567fed43efb442b6bbc5d1f726d06ba2d20acf697092952ecd8f1b9884fa7fd827c7f1857182c39fbaf6a4daaa7e017267c25205b286

Download Submit
C:\Windows\SysWOW64\Agffge32.exe

Filesize
224KB

MD5
7e581d0e4d20cd09c8d2dc4f1e0ff652

SHA1
f3f97b509b52a66e80ba348fdd5182a0a6c2da37

SHA256
44b312ce4dad2ad5aeadf79b3e488c8bf3f2111f539b558ff3de38120e9e16d8

SHA512
045b1670e6efca5ae0f00d8437ca480f954b13afee6fb4a7e9e5281a62c2a9434681c67979c36dbc5287532dfb694fef92076cb04c1321e511079da64e06ef8b

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
224KB

MD5
b781da32be8fcbab986c2ea6328f25a2

SHA1
7b007c9db72836539cfee6be6ef34044536a40e1

SHA256
983f01e48ba3a164b53972cd58fbbf02566c98fe14508543e6c3a3d71e7a18d7

SHA512
70aa2f136f7b160697c89305012aa80015c7825453f4c33ffbd6ed4517af409e8291de8318a5392ea0da3c173f9b891bda3f57fa20ada9dcc7b7df469ab3df62

Download Submit
C:\Windows\SysWOW64\Ahkobekf.exe

Filesize
224KB

MD5
36d6bf826bdd85135c7a791adfc68669

SHA1
b1285c3179208c1d28d4146aee10ac6690ebd84b

SHA256
849a5ede8f8d00e6aa99ebc3d8ea2cf963e0d6a8106b4e6ea9833549456254d7

SHA512
c679284ea537294aa916667acc647d7560f109d3c4abfd0287bb09561be88b07348fbb70d34b08a980f6c167451d0d9a55818be9e6fabd4c27dd9d29aefdb7f9

Download Submit
C:\Windows\SysWOW64\Alkdnboj.exe

Filesize
224KB

MD5
91e07eab4602ecebf5b9ae6d8518595e

SHA1
e7a8857b91b0ac85b827d8662e1f61bc11aa38f4

SHA256
5c29d30bdd2b7c9c6186d8afc1b52a43dfabaaf53cb6b5ace6223b462c3530ad

SHA512
0a065c06a81d763cc88981aa36edefb214f4c91c41b0aeb4865650091de919416b7c1692f4635709bb6be277f41f727a0a546f764664b1a3237469afd89c4363

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
224KB

MD5
cf832065eee551ac71036d79c6598c19

SHA1
2c7109f084763502b0a4ed006dfb43c7828cc1b9

SHA256
ce4e4020ad0747748215641d7c355a287e714701052ee29e065fa2ff2838a503

SHA512
53d60d3cd7d286afcb2fc01754558fda87fdfa281b91df7aaa58b480d9a4b1bd4cd8770d3fed6fdb5b9f6065a64164ec809b5a900cf235993197c3bc22b99ce2

Download Submit
C:\Windows\SysWOW64\Angddopp.exe

Filesize
224KB

MD5
a564231aaafee7c53f53c656ba143835

SHA1
f549957fc678d281b818fa72c247b9c97f2a956d

SHA256
76a156c637ae43389674c52246f18fac0a4f48a1060c09ba09b79040fa75f78f

SHA512
cb8aef9d3266b3c7ae5ebaf058a72312752e99798dc9dba1a1cfc5bee55fb248db125b5d8aaff7fb117c1279fc82214ff464fe9d23d265fbe2ab40cccd62ee8d

Download Submit
C:\Windows\SysWOW64\Anpncp32.exe

Filesize
224KB

MD5
faa2802f2958b7dfcfea4f5d431374c1

SHA1
2ce36419586db2ccc0c243c34ca3bccd53a9b900

SHA256
d64c30e447da5b606ef9a1bd51a87121f3f3c7a0d92a9c3b42c0e0f35a23930c

SHA512
4aa0f8293edfdf1d23402c344841be5b6f4ff9b41cbd47f002c48bfcb957ca5af6d97a90970dbda25d3bcd08211867a9461b6f3e9253d6153e24845b9a531feb

Download Submit
C:\Windows\SysWOW64\Bajjli32.exe

Filesize
224KB

MD5
cdabc36a86fe8e99d7351ea88dc86514

SHA1
a30104096c4f5ffae164ebb8b2358a68de46138e

SHA256
2f0dc299e0775a29e51ef4e34cf2912fb20ef0c90b251a48b2de3f3b251011ef

SHA512
0b3f3fb4bf79151ac7e847a547f9a6931963ef22c7a0e4dc14a4a6068f0647ef0fcf117be642c9a5db69d6ba73bb7512834f5a82e1d7bbb350f05077ade3952b

Download Submit
C:\Windows\SysWOW64\Baocghgi.exe

Filesize
224KB

MD5
d6231dc5d1503f0c8bd25d71906d9e2d

SHA1
c6369834f7e7b159b9e71338412c6d1791dde817

SHA256
0414c683e1f17da8e5406a7ef275ba29f0cf31b381c4e893a0d64896c9e8e486

SHA512
3e0595adce4e70ac5d4360f9927cdd6bd16342b7a111c702f5d9604c137a247ac4d2eb3beba2e4b42f7856f42937f836788a1b85b8da58f569ac8a4f84a7838e

Download Submit
C:\Windows\SysWOW64\Bhaebcen.exe

Filesize
224KB

MD5
f6bcc725fbc65c7e175613a2f23ae0bd

SHA1
b9b064705cd19af5e1c0d2780de0f22907a769c8

SHA256
d8e6728439baa7be791586a466328803e391d1c33ef9a07849a5491eda4609cc

SHA512
ff294562121178f472797008e82ef1aaf9050d7b1bfaf0eac6f7280cf583ca1a41e640d753f52d2b4853976cd1d9736b24a5acd95c9a3a30dfe6a80f94c1cc07

Download Submit
C:\Windows\SysWOW64\Bhkhibmc.exe

Filesize
224KB

MD5
33dd23906a0d87570b78838937b33719

SHA1
faf63948da97416708f357631a82d1de6693496d

SHA256
ca1a011bae86e371c4e014b40a8c8880f3773d5c6f0e8f154f866d72afac1372

SHA512
d19fce5cd5e30c99002447c0b29ff5b28811ea2dc1bad254b0631417fa41267f177bb10d64bd62396a6e2861f55bef4902fe18a501e0f07cad7b55a7d53b245d

Download Submit
C:\Windows\SysWOW64\Blpnib32.exe

Filesize
224KB

MD5
f445bf31e23d46dbca6c61f3eadfa78f

SHA1
94fa1bf6e9e867c3615c52258bce8b9dacc7bbfb

SHA256
b01eced1d42d7bf90a630cfc42afc0bcb46da307d706bea00f76fea60bdd82b4

SHA512
7d1041db137bc03112fc013eb74f108d24d34a0da85cad68cdc3cc46cf84b4032acb9f1d677e27611bf0754fc5d9d52a02b3809348e4e88bb688fa28572b6598

Download Submit
C:\Windows\SysWOW64\Cdainc32.exe

Filesize
224KB

MD5
f73f5bbd679a9e0ef3e1976c42926580

SHA1
d26b0d362300a4ae335dbe157c5b47f55eb55717

SHA256
9f45086bf63ae11d1ffedc92c9836c2581c8c22e3fc06f5c8a6ca39c23332c83

SHA512
7e11c340f2c62dffa83073057440cdebb66563464ef59fc0b1f6b0d6ca1e39109c1099fcbff2bfa8f49462152d9278a2da52ab1318d79385d56d24453731abda

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
224KB

MD5
f3412889007ce9f8ed7c8189fd9b2ace

SHA1
35d15910efbb9acfbc7aa84848dc8dfec0e0500e

SHA256
a5a9cfd393c6ea7db482f7b673ff72dfc4b0ba90eba38dc9517c7d4f788f50ec

SHA512
c8ec15bc7cada3b3896835f0e55b886c5477af8d066f512a0c69df1b9cfd5556bdd0fe0c328116bb749a4d3b40920443cfbe96c285440730223e2dd69dc55b38

Download Submit
C:\Windows\SysWOW64\Chpada32.exe

Filesize
224KB

MD5
3585c7d1e1a77e1e2d11978bcf377416

SHA1
f6f73178b79c0430bf0e46ddaf2a867d069f0d17

SHA256
3e885e1c9b4c0e283385d642fe3676f0ba33faf458461a33c4c1ef17cfaecfa1

SHA512
60580fa60b4b8bf7a0144cc6b4fb036e694be0cefa61cadd54f375f6a64878cadcf00a62ddbe984b8b90913c01c9f3c4eee52544820b04a47804236d4023895a

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
224KB

MD5
07e7472485f3772c657f237475aa61aa

SHA1
fefceda0bc3e63d503147baa3007d9c3a7900f0f

SHA256
0a198842f99fe44fafa51551631b8a390dd89a1f0efacc389988e8aa93993cd6

SHA512
a8f6660036fd0606d1adec840756677496bc3e1765d4a25dcbf780d3c78e6a518bcd53cc62122caf45af96071538eccd5e8a795cfc457d3f019fee9ce95a4cc9

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
224KB

MD5
76f3ca4cd8581343b4eac85b4d04f5e2

SHA1
ec44fe235c8d282cfeedf3c73ff34cca2e0bb0f4

SHA256
701baf3d48c0c7cb01defa4ccaba092b4815c3423c4a6ccf98bb2cd0d63e866e

SHA512
40f1835a00086d53733b462f365759bdf282f96b9249a922d602e90eb1b5a71e0b4df832483b35ce58dab6fa1a25be09502a567f3c15537b4a2e7bbec80e1bed

Download Submit
C:\Windows\SysWOW64\Fkffog32.exe

Filesize
224KB

MD5
8cc0b26963a3b4d72649d9ba60ab52b5

SHA1
485c386e4b5b5d792b778f02ea07f16e893780a0

SHA256
9d03309d3e2bfb4f6ee8417429a14eabe9c922bfa1d2d93ca6e3137ba8d2e714

SHA512
1f84228b61b4d84737ebf211b0f0c6cb1fdbb4b2786a51a2553928cc18ea75e7c6798bf6d7aa9fe0dae3bf2152acae48cf584de4dcc4a260a619c38c80f58124

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
224KB

MD5
db650c04b212a57efb6b0f5d7c8f6f2f

SHA1
8072596b0076cb91033868c3a81acc5bfe064407

SHA256
30cb1ec8a3a1b8fb9862b95cbdf087f52618fb37c8fbc7f3ba74808b34750e72

SHA512
b1d51059b4745b2d016bdfa7b3673621ab7d4902494e15ccfa062c21f508f833178c5205d0efe76df5434b4c3a390a20ff50d5b7db02cd27374be40ce4143ea4

Download Submit
C:\Windows\SysWOW64\Fomhdg32.exe

Filesize
224KB

MD5
397513d8ba946b04527a27edaaede942

SHA1
163f564725bfa283110eff43ff55ea25d3be70d5

SHA256
f27eccd9ac462233af291c17f790d6861267e2e8085ee6662a057d861d90246d

SHA512
4d221953ee2c0bb7a3bf6954ca81b829f8fb3b6e0a31751cfd4a40d8d0e4aa59ac6f26934d17da3fb320934b7b68018637bb926153340ccad5a3be258f120db8

Download Submit
C:\Windows\SysWOW64\Gbbkaako.exe

Filesize
224KB

MD5
169a5185373d5691c2e41dc88c8d5fad

SHA1
57d9326b960969c5796199770b5e7cf8e78bb66c

SHA256
ef7e76519c2c8f91852bcd551f5003f160be5ff31ef2c8ccf3fcce3426355790

SHA512
03ea6be557da552ab297fe6851e57dec6db60efa9aa7c72ba746e76354cc1aeeba08e4e5ad0b3652cf958660863be86d09cb7c010013856ad1821cc39069d48b

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
224KB

MD5
241182b6982a523895f311f4f6209cae

SHA1
3d29bf63e2f82f282ea940271d51bc01e6f1e0a2

SHA256
9c87a62dcdcbf9329f57ba7f427baaeed29762ef70625b0b65398ce854b3166e

SHA512
c648c206324e28d3c78c8cc0fa493b2497487d97a251b3a9a3ab8688f1c71578f042374d67cd53599d81913d02acebd323ba829efc3896fe9be9d914da3b229e

Download Submit
C:\Windows\SysWOW64\Gdcdbl32.exe

Filesize
224KB

MD5
8cf679d5ab60b5ef2b6d9ffb03df57df

SHA1
7547b79453daa20b8e7f7b58f0c7e98a58600e12

SHA256
69db843fd889bb80c1e0db01ef5e82915dde5157479c89255abfca0818ba287a

SHA512
b1e5c8928a25425f11ce8d9beb0c86023f881ae75d599c169912cca690a4df455df0e540f8936ffc587cd35a5283113b6780e6ce68fed5a7267df5b1de1e20ce

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
224KB

MD5
58601e764e454a56cf718623ca2edde5

SHA1
51233e056a5add81f5efeb7b36d0cae01054059c

SHA256
4823ef9ab365d16af4ca1c7d3189cce95561810d3c3019cd68ee6bdd1f4374a3

SHA512
a551d62177f244229fdd70fb2557e9adc5d314a1daa7990292337f3ae7d2f9c102a1a02fa5880bb4eb003d8b8ea47bf5863625eba8bdcc8fa1e63db0fdce2758

Download Submit
C:\Windows\SysWOW64\Gfgjgo32.exe

Filesize
224KB

MD5
952f9cbc5d0adbb436c073c73b5c6c9d

SHA1
a774ccc3ad41bc2fd51f8c623285a08c807d0d8f

SHA256
6c1ac9317313fdb545c8d493a21316f4ece60b4fe55ff73950d1f6b2a1ba8edc

SHA512
f0302c0fd586df358bdd7a9b8479917fad6efea4196a5d58ea698844a6a95db98cb8c10d23088b6a23ea865e0921818615f66d578f84b2837e322e02cf5a12a5

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
224KB

MD5
26675e2a14d80190deb8854477a8e374

SHA1
a9ae8c918cea7604df29ab3c0c808564eff063b1

SHA256
74b479c1787c6abf3e0112884276ceef166dee95a1198cafacbfbc435e698f23

SHA512
8cfbe153256c0436da5531664e77d0186bcfafba8ce536b3acfaf767517caca3e76fe03e220c4f3bdf3e0bf3463ce6f266487fd2d76213f3eec6b80fb5d674f3

Download Submit
C:\Windows\SysWOW64\Gkhbdg32.exe

Filesize
224KB

MD5
422a46a7298794fdd2e231ef3370964f

SHA1
daca2430c7611d974bca78a4ede23313b15b390c

SHA256
16e4349e4020ec546d84acec66e2e6f58f9d082ab6068085220880fee9485ad2

SHA512
d2ed1e0510fdee180cca966c6596fcb3508b212924a7e154c5f029a97d92757f6bd7758d140379852698c4020436154036d4de00acf40c25f5b42213616ac6f3

Download Submit
C:\Windows\SysWOW64\Gkhbdg32.exe

Filesize
192KB

MD5
781f85c9db50f055188f3fefd7aae101

SHA1
612b02a8f06becc4c08263ccfd90824699cd553b

SHA256
18d05020adae8e40feb9add8c3d740d69f2e04b88bfea28142e2cfe62a7e2868

SHA512
328b01ee7fa8e934872a13abcb6598e8a3fcb0146297584dca24bdfea75579ca452d6071bb78df33c8a720424a5be4c63184563c306f6753013e4e057d4afeb0

Download Submit
C:\Windows\SysWOW64\Gmlhii32.exe

Filesize
224KB

MD5
ed1e6ab369fd654acc52e11da5857936

SHA1
fa754ec62858f215127b26e841d5883fd6d119db

SHA256
ffb08b81ef32fce4d5060c415a2327604a7ead133ecb829ca3abdb90d3335019

SHA512
002606cb548fe9d0fd864fe618c988ee66218792b9e0f2952546d4f7c4087e9aa831125354584e926b203cf279846b0277f2386e6073182633d5cc773f81f61b

Download Submit
C:\Windows\SysWOW64\Gofkje32.exe

Filesize
224KB

MD5
3badaead60742a2d0f5b9a63e579cc68

SHA1
b65084f32a68c26e1c31e329f2050c81932da151

SHA256
94514e82e34a5d9363be8fe429e714f25987087291243c6ad9b9c7716adaf4d1

SHA512
971cd2b14ca424350b3d692c933f3005d54f36dd60b773a12003b0c643c9881551c679765a7f49f4e3f84960ca280a150656acf210b5ce4336e4a2273a67aecc

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
224KB

MD5
8035dc2f41d84447ced3c544b1964aeb

SHA1
9134b3a3bb263ed7eae95297d60cb6b6068c8e4b

SHA256
9beb6641d9fc4c987c41ce89b78fb65d220e205fa869b2c2a9df769168ee77f5

SHA512
420ae1cb8d9aa9f558607273baa78af6ed8d7af7f850825d7e09448413c170d300c2a5623814dbc1d2b10d2b849328c9e62a35828797e37468232fd6792eb1fc

Download Submit
C:\Windows\SysWOW64\Hcmgfbhd.exe

Filesize
224KB

MD5
ff6f18ced37a2a92322d1f5fd5ca7759

SHA1
560b93a93d4d7b97c91f2f6aaaeda491e19a6d70

SHA256
335d4f7fc3ea95c7fbe314b56b57ab7cf2f555eea3d8ed6c4050c547683c1e91

SHA512
2364393640a48e90955d7ac4489cc01a0e9a04e63b78b3295be16e9bb5f42390486a7a5f177f2516890e017f9e8fb63780add5c7c0f59f65194e4c01286b7367

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
224KB

MD5
4911e3ed56460a7ab03616c44d80a412

SHA1
e91f87f3bf450fab6794da19125affddd7c23658

SHA256
6a788539d432217fc2076f2f8fe1aa96666656c10cf02d9fadc68ea021256707

SHA512
4d19b9faf79e9abb3111b64a9ea16545d48eaed6b968ff3ba602d135ab93764ce0646dbc6f775cc59baa9c093258f77a657cd2ccd00b11563052b77befacfb63

Download Submit
C:\Windows\SysWOW64\Hihbijhn.exe

Filesize
224KB

MD5
767b877214f4b1d340e1cc34495c6f0b

SHA1
289e800d88f78cd41be654223ad98916ab69d02a

SHA256
62aa3450ee5d6eba7cce0fa088350432da9674433cce22752a96bfe9d1f21c92

SHA512
4c9a6bb757342e795a2f58531bee6239c1bb8f9e568ff5600f6054f01bf7e5062e630ae62e215746ea2139015972f5b1bd7390768650a21111ff152863deed38

Download Submit
C:\Windows\SysWOW64\Hmabdibj.exe

Filesize
224KB

MD5
5351f9c5d06bb294ece24f9bdd7324c1

SHA1
4e910b222cb6bb5ff51c5bde95be7b1f4c452842

SHA256
299e2c1d8f0e93fd50773461fb326fbc054353409cfa97144f55d92ca4c8ea6f

SHA512
f7005fcf2d54e796be91b3e33e745cc0b781a3ed8948f14c26ff98911a24c464bd8a8c19f4701f3d373003c014a1026590a98d9c781d857df16d5bbff22d157f

Download Submit
C:\Windows\SysWOW64\Jbhfjljd.exe

Filesize
224KB

MD5
aac65406087fd7a32944c0f26c4e2f66

SHA1
81920a7f15008655eacde58d0d67e8311df0888d

SHA256
3972381582f416d0c2b1846116cd443b247ded8fadb9d7e73542aeb1a22fb8c2

SHA512
a8d79bda2879e3035fb190eac44de84a5f733abde60e6e780420410e365da47b746bbc5385fcabcae55fc69a71eeb5642d4a82dab300b1d831194bc10745b88b

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
128KB

MD5
ff85a181fef494c24118a7275bdc9156

SHA1
122d3b9da1574448599be7929557908a96976473

SHA256
cb7c8f5b226f76130cb91e2b7fb8abcac0c25be67d8aaa6005edda4377e73af3

SHA512
0c025cc2ba89266ba89cfec3fbe723f3be72f8f39b1a15870acaf354aae3a5f5d0f296f19be4c69587c6e47eddd5cab81a894e8ccff1064389d8fe9d653dd578

Download Submit
C:\Windows\SysWOW64\Kpjcdn32.exe

Filesize
224KB

MD5
581af8e18dec6357cee0dd1b764510bb

SHA1
c1be577ad434a5634281dcfe6d3e2bbd60ade10d

SHA256
3f997d7426ecc14f138e9ac0ac2c45a97de9b262cda3ea62411892f508643c46

SHA512
7caf530514e46559c8d5f0f8183d702db060dfbeea97e52b97b96e18926d5e9f2a43355561406be38fa966494fc0ac9e665361ea6238da6a448d7091fd3c28ac

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
224KB

MD5
311ef0b3a38ce17d8b8fb0ba14bfea5d

SHA1
62b9f2b7f8578cd2d8ef66eae34631e6e32aa6d0

SHA256
3be53801fb1d940268e482ba222f0a759a11010f010ff5a50c8d489020856372

SHA512
7a508fa110723e4b5d6713adcdc1bd92f140cfe21d67998287d62563b7da8166196b7798a139d0cba3a3696a5e7cd9000b845b2d24cc0a0fd700c695e7c60e39

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
224KB

MD5
eeac6210e872cb65f1e201b375888f32

SHA1
a5b1ea55ce94851561d010ab044665938c12748a

SHA256
e59c20541fad5f76cd7433af888b637d6db1b85a015af6f412398a7110a587e7

SHA512
e9470dbfaba1fac25dafe9f3b352838bdc7aa273514bbe7af7218ffe9611a411ae5e9e0b151c5d6e5f76fa3de3875be27220a906ba3ab23cd2afa314e30943bf

Download Submit
memory/388-190-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/680-295-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/684-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/684-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/844-345-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1088-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1184-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1184-146-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1248-261-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1300-333-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1436-351-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1508-267-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1632-357-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1660-253-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1708-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1768-320-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1768-169-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1792-99-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1792-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1808-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1808-159-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2056-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2056-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2160-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2160-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2204-307-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2236-331-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2312-273-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2324-314-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2424-283-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2424-115-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2868-148-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2968-325-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3124-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3124-177-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3196-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3196-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3228-199-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3236-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3236-150-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3460-165-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3568-265-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3716-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3716-114-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3804-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3808-343-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3872-86-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4020-275-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4068-123-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4068-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4220-29-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4304-303-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4320-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4320-97-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4328-185-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4528-289-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4672-107-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4672-207-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4788-290-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4972-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4972-132-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5000-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5000-313-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5032-281-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads