4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7.exe
Size

352KB
MD5

1a0fd91da7e783521f6af6b27d3f6fe5
SHA1

75f6499e788bd8555d2fc39f8ef8a9a1407723a1
SHA256

4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7
SHA512

e4cf092541f8482e14b3f6ad3c37395bb49ce431bafd59d5d76f788a5e7dafdb927f9bd15191782edb6d75dfbdc4c1c0396178f70848675d3e7bac0c5c2d4183
SSDEEP

6144:s/9TQ00KbQZVUVFpr1ItvLUErOU7amYBAYpd0ucyEWJrj1mKZHPSv/rpwMBhpNFD:cFFVprCZYE6YYBHpd0uD319ZvSntnhpn

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dagiil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfqjafdq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjapmdid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgdbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fmmfmbhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkdnpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcggpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epopgbia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eodlho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcnejk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Capchmmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Diihojkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpgdbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebnoikqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbcakg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fijmbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiibkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhcnke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebploj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpihai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emjjgbjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fihqmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehekqe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmlnbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhqaefng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipnalhii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laopdgcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doccaall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhqaefng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijaida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jangmibi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hippdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gogbdl32.exe

Executes dropped EXE 64 IoCs

pid	Process
4520	Ceibclgn.exe
3556	Coagla32.exe
3680	Capchmmb.exe
4560	Dlegeemh.exe
4000	Doccaall.exe
212	Denlnk32.exe
4012	Diihojkb.exe
3620	Dlgdkeje.exe
544	Dofpgqji.exe
456	Dadlclim.exe
4244	Djlddi32.exe
1592	Dljqpd32.exe
3736	Dagiil32.exe
3500	Debeijoc.exe
3124	Dhqaefng.exe
4148	Dphifcoi.exe
4060	Daifnk32.exe
1640	Djpnohej.exe
2276	Dhcnke32.exe
4924	Dpjflb32.exe
4752	Dchbhn32.exe
3564	Efgodj32.exe
3492	Ehekqe32.exe
3260	Epmcab32.exe
4332	Eckonn32.exe
3772	Ebnoikqb.exe
5000	Ejegjh32.exe
3628	Elccfc32.exe
4876	Epopgbia.exe
2632	Eoapbo32.exe
1852	Ebploj32.exe
2896	Eflhoigi.exe
2284	Eqalmafo.exe
1224	Eodlho32.exe
4292	Ebbidj32.exe
4716	Efneehef.exe
1896	Ehlaaddj.exe
4580	Elhmablc.exe
400	Eqciba32.exe
1108	Eofinnkf.exe
2032	Ebeejijj.exe
540	Efpajh32.exe
468	Ejlmkgkl.exe
560	Emjjgbjp.exe
4652	Eoifcnid.exe
2664	Ecdbdl32.exe
2812	Ffbnph32.exe
4720	Fmmfmbhn.exe
1508	Fokbim32.exe
2492	Fbioei32.exe
4432	Ffekegon.exe
3860	Fmocba32.exe
4928	Fomonm32.exe
1992	Ffggkgmk.exe
3384	Fmapha32.exe
5044	Fckhdk32.exe
4420	Ffjdqg32.exe
3936	Fihqmb32.exe
64	Fqohnp32.exe
2416	Fcnejk32.exe
1512	Fflaff32.exe
2924	Fijmbb32.exe
2432	Fqaeco32.exe
4496	Gbcakg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jdmaid32.dll	Ehlaaddj.exe
File created	C:\Windows\SysWOW64\Bbamkcqa.dll	Hjfihc32.exe
File created	C:\Windows\SysWOW64\Iakaql32.exe	Iidipnal.exe
File created	C:\Windows\SysWOW64\Dmnlpfhd.dll	Fomonm32.exe
File created	C:\Windows\SysWOW64\Iinlemia.exe	Ijkljp32.exe
File opened for modification	C:\Windows\SysWOW64\Kkkdan32.exe	Kgphpo32.exe
File created	C:\Windows\SysWOW64\Kmnjhioc.exe	Kibnhjgj.exe
File opened for modification	C:\Windows\SysWOW64\Lcpllo32.exe	Lpappc32.exe
File opened for modification	C:\Windows\SysWOW64\Doccaall.exe	Dlegeemh.exe
File created	C:\Windows\SysWOW64\Hmfbjnbp.exe	Hjhfnccl.exe
File created	C:\Windows\SysWOW64\Eeopdi32.dll	Ijfboafl.exe
File created	C:\Windows\SysWOW64\Jjblgaie.dll	Kkihknfg.exe
File opened for modification	C:\Windows\SysWOW64\Mamleegg.exe	Mnapdf32.exe
File opened for modification	C:\Windows\SysWOW64\Elhmablc.exe	Ehlaaddj.exe
File opened for modification	C:\Windows\SysWOW64\Hcnnaikp.exe	Hapaemll.exe
File opened for modification	C:\Windows\SysWOW64\Jangmibi.exe	Jkdnpo32.exe
File created	C:\Windows\SysWOW64\Kdcijcke.exe	Kmjqmi32.exe
File created	C:\Windows\SysWOW64\Ldohebqh.exe	Lnepih32.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Laciofpa.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Lfmona32.dll	Efgodj32.exe
File created	C:\Windows\SysWOW64\Ffbnph32.exe	Ecdbdl32.exe
File opened for modification	C:\Windows\SysWOW64\Ehekqe32.exe	Efgodj32.exe
File opened for modification	C:\Windows\SysWOW64\Gogbdl32.exe	Gjjjle32.exe
File opened for modification	C:\Windows\SysWOW64\Iakaql32.exe	Iidipnal.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mamleegg.exe
File created	C:\Windows\SysWOW64\Fbioei32.exe	Fokbim32.exe
File created	C:\Windows\SysWOW64\Hjolnb32.exe	Hbhdmd32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Fihqmb32.exe	Ffjdqg32.exe
File created	C:\Windows\SysWOW64\Iiibkn32.exe	Ijfboafl.exe
File opened for modification	C:\Windows\SysWOW64\Kmjqmi32.exe	Kkkdan32.exe
File created	C:\Windows\SysWOW64\Egmhjb32.dll	Hapaemll.exe
File opened for modification	C:\Windows\SysWOW64\Iidipnal.exe	Ijaida32.exe
File opened for modification	C:\Windows\SysWOW64\Jbfpobpb.exe	Jpgdbg32.exe
File created	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Dphifcoi.exe	Dhqaefng.exe
File created	C:\Windows\SysWOW64\Iifpphha.dll	Ehekqe32.exe
File opened for modification	C:\Windows\SysWOW64\Ehlaaddj.exe	Efneehef.exe
File created	C:\Windows\SysWOW64\Cmddeh32.dll	Ffggkgmk.exe
File opened for modification	C:\Windows\SysWOW64\Kbapjafe.exe	Kpccnefa.exe
File created	C:\Windows\SysWOW64\Khehmdgi.dll	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Mdfofakp.exe	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Fckhdk32.exe	Fmapha32.exe
File opened for modification	C:\Windows\SysWOW64\Mjcgohig.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Diihojkb.exe	Denlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Gcggpj32.exe	Giacca32.exe
File opened for modification	C:\Windows\SysWOW64\Kkihknfg.exe	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Pellipfm.dll	Liggbi32.exe
File created	C:\Windows\SysWOW64\Lkiqbl32.exe	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Djlddi32.exe	Dadlclim.exe
File opened for modification	C:\Windows\SysWOW64\Gqfooodg.exe	Gmkbnp32.exe
File created	C:\Windows\SysWOW64\Hjhfnccl.exe	Hcnnaikp.exe
File created	C:\Windows\SysWOW64\Jdemhe32.exe	Jagqlj32.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Omlami32.dll	Dlgdkeje.exe
File opened for modification	C:\Windows\SysWOW64\Jibeql32.exe	Jfdida32.exe
File created	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Mcklgm32.exe
File opened for modification	C:\Windows\SysWOW64\Ebeejijj.exe	Eofinnkf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7260	6404	WerFault.exe	301

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fmapha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ebnoikqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Diihojkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ejegjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miimhchp.dll"	Eqciba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akihmf32.dll"	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceibclgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipqnahgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jpgdbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fphbondi.dll"	Ejegjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll"	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dpjflb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lppaheqp.dll"	Jkdnpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjbako32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gjapmdid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gifmnpnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hjhfnccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmebabl.dll"	Iiffen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjlcankg.dll"	Jagqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjbako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jbocea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fokbim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lnepih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfhilofo.dll"	Eodlho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emjjgbjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hofddb32.dll"	Fckhdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oddfqf32.dll"	Gmkbnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjmhppqd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbkiioa.dll"	Efneehef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjoceo32.dll"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Epopgbia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chbijmok.dll"	Gqfooodg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjmhppqd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jplifcqp.dll"	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lppbjjia.dll"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dljqpd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fflaff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jaedgjjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dadlclim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hjfihc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidmdfdo.dll"	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpfijcfl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4520	3792	4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7.exe	86
PID 3792 wrote to memory of 4520	3792	4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7.exe	86
PID 3792 wrote to memory of 4520	3792	4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7.exe	86
PID 4520 wrote to memory of 3556	4520	Ceibclgn.exe	87
PID 4520 wrote to memory of 3556	4520	Ceibclgn.exe	87
PID 4520 wrote to memory of 3556	4520	Ceibclgn.exe	87
PID 3556 wrote to memory of 3680	3556	Coagla32.exe	88
PID 3556 wrote to memory of 3680	3556	Coagla32.exe	88
PID 3556 wrote to memory of 3680	3556	Coagla32.exe	88
PID 3680 wrote to memory of 4560	3680	Capchmmb.exe	89
PID 3680 wrote to memory of 4560	3680	Capchmmb.exe	89
PID 3680 wrote to memory of 4560	3680	Capchmmb.exe	89
PID 4560 wrote to memory of 4000	4560	Dlegeemh.exe	90
PID 4560 wrote to memory of 4000	4560	Dlegeemh.exe	90
PID 4560 wrote to memory of 4000	4560	Dlegeemh.exe	90
PID 4000 wrote to memory of 212	4000	Doccaall.exe	91
PID 4000 wrote to memory of 212	4000	Doccaall.exe	91
PID 4000 wrote to memory of 212	4000	Doccaall.exe	91
PID 212 wrote to memory of 4012	212	Denlnk32.exe	92
PID 212 wrote to memory of 4012	212	Denlnk32.exe	92
PID 212 wrote to memory of 4012	212	Denlnk32.exe	92
PID 4012 wrote to memory of 3620	4012	Diihojkb.exe	93
PID 4012 wrote to memory of 3620	4012	Diihojkb.exe	93
PID 4012 wrote to memory of 3620	4012	Diihojkb.exe	93
PID 3620 wrote to memory of 544	3620	Dlgdkeje.exe	94
PID 3620 wrote to memory of 544	3620	Dlgdkeje.exe	94
PID 3620 wrote to memory of 544	3620	Dlgdkeje.exe	94
PID 544 wrote to memory of 456	544	Dofpgqji.exe	95
PID 544 wrote to memory of 456	544	Dofpgqji.exe	95
PID 544 wrote to memory of 456	544	Dofpgqji.exe	95
PID 456 wrote to memory of 4244	456	Dadlclim.exe	96
PID 456 wrote to memory of 4244	456	Dadlclim.exe	96
PID 456 wrote to memory of 4244	456	Dadlclim.exe	96
PID 4244 wrote to memory of 1592	4244	Djlddi32.exe	97
PID 4244 wrote to memory of 1592	4244	Djlddi32.exe	97
PID 4244 wrote to memory of 1592	4244	Djlddi32.exe	97
PID 1592 wrote to memory of 3736	1592	Dljqpd32.exe	98
PID 1592 wrote to memory of 3736	1592	Dljqpd32.exe	98
PID 1592 wrote to memory of 3736	1592	Dljqpd32.exe	98
PID 3736 wrote to memory of 3500	3736	Dagiil32.exe	99
PID 3736 wrote to memory of 3500	3736	Dagiil32.exe	99
PID 3736 wrote to memory of 3500	3736	Dagiil32.exe	99
PID 3500 wrote to memory of 3124	3500	Debeijoc.exe	101
PID 3500 wrote to memory of 3124	3500	Debeijoc.exe	101
PID 3500 wrote to memory of 3124	3500	Debeijoc.exe	101
PID 3124 wrote to memory of 4148	3124	Dhqaefng.exe	102
PID 3124 wrote to memory of 4148	3124	Dhqaefng.exe	102
PID 3124 wrote to memory of 4148	3124	Dhqaefng.exe	102
PID 4148 wrote to memory of 4060	4148	Dphifcoi.exe	103
PID 4148 wrote to memory of 4060	4148	Dphifcoi.exe	103
PID 4148 wrote to memory of 4060	4148	Dphifcoi.exe	103
PID 4060 wrote to memory of 1640	4060	Daifnk32.exe	104
PID 4060 wrote to memory of 1640	4060	Daifnk32.exe	104
PID 4060 wrote to memory of 1640	4060	Daifnk32.exe	104
PID 1640 wrote to memory of 2276	1640	Djpnohej.exe	105
PID 1640 wrote to memory of 2276	1640	Djpnohej.exe	105
PID 1640 wrote to memory of 2276	1640	Djpnohej.exe	105
PID 2276 wrote to memory of 4924	2276	Dhcnke32.exe	106
PID 2276 wrote to memory of 4924	2276	Dhcnke32.exe	106
PID 2276 wrote to memory of 4924	2276	Dhcnke32.exe	106
PID 4924 wrote to memory of 4752	4924	Dpjflb32.exe	107
PID 4924 wrote to memory of 4752	4924	Dpjflb32.exe	107
PID 4924 wrote to memory of 4752	4924	Dpjflb32.exe	107
PID 4752 wrote to memory of 3564	4752	Dchbhn32.exe	108

C:\Users\Admin\AppData\Local\Temp\4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7.exe
"C:\Users\Admin\AppData\Local\Temp\4def6cf0f47e1704ac872231fe124bbc3040c13ccfb2930e8fa21ba60e894bb7.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\Ceibclgn.exe
  C:\Windows\system32\Ceibclgn.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\Coagla32.exe
    C:\Windows\system32\Coagla32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\SysWOW64\Capchmmb.exe
      C:\Windows\system32\Capchmmb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4560
      - C:\Windows\SysWOW64\Doccaall.exe
        
        C:\Windows\system32\Doccaall.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Denlnk32.exe
        
        C:\Windows\system32\Denlnk32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Diihojkb.exe
        
        C:\Windows\system32\Diihojkb.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\SysWOW64\Dlgdkeje.exe
        
        C:\Windows\system32\Dlgdkeje.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\SysWOW64\Dofpgqji.exe
        
        C:\Windows\system32\Dofpgqji.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\SysWOW64\Dadlclim.exe
        
        C:\Windows\system32\Dadlclim.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Dchbhn32.exe
        
        C:\Windows\system32\Dchbhn32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Efgodj32.exe
        
        C:\Windows\system32\Efgodj32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        25⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Eckonn32.exe
        
        C:\Windows\system32\Eckonn32.exe
        26⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3772
        
        C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        29⤵
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Eoapbo32.exe
        
        C:\Windows\system32\Eoapbo32.exe
        31⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        33⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        34⤵
        Executes dropped EXE
        
        PID:2284
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        36⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1896
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        39⤵
        Executes dropped EXE
        
        PID:4580
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:400
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1108
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        42⤵
        Executes dropped EXE
        
        PID:2032
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        43⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        44⤵
        Executes dropped EXE
        
        PID:468
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:560
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        46⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2664
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        48⤵
        Executes dropped EXE
        
        PID:2812
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4720
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        51⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        52⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        53⤵
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4928
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1992
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3384
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4420
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        60⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1512
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        64⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        66⤵
        Drops file in System32 directory
        
        PID:4616
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3408
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:632
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        70⤵
        Modifies registry class
        
        PID:4112
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        71⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        72⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        73⤵
        Drops file in System32 directory
        
        PID:4944
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2532
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        76⤵
        
        PID:744
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        77⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        78⤵
        Modifies registry class
        
        PID:4872
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        79⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        80⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3508
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        82⤵
        Drops file in System32 directory
        
        PID:4320
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        83⤵
        Drops file in System32 directory
        
        PID:2124
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:556
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        85⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        86⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        87⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        88⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        89⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        90⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4368
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3132
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5072
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        94⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        95⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        96⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        98⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5276
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5316
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        101⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        102⤵
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        103⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        104⤵
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        105⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        108⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        109⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        110⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        111⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        112⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        113⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        115⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        116⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        118⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        119⤵
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1352
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        121⤵
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        122⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        123⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        124⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        126⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        127⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        128⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        129⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        130⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5912
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        134⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        136⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        137⤵
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        138⤵
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        139⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        141⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        144⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        145⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5452
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        147⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        148⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6004
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        150⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        151⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        152⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        154⤵
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        155⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        156⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        157⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        158⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6220
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        162⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        163⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        165⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        168⤵
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        169⤵
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        171⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        172⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        174⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        177⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        178⤵
        Drops file in System32 directory
        
        PID:7080
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7128
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        180⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        181⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        185⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        187⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        188⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        190⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        191⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        192⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        193⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        194⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        195⤵
        Drops file in System32 directory
        
        PID:7156
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        196⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6292
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        198⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        199⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6696
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        201⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        202⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7060
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        205⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        206⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        207⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        209⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        210⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 412
        211⤵
        Program crash
        
        PID:7260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6404 -ip 6404
1⤵
PID:7220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bamagp32.dll

Filesize
7KB

MD5
f80bd3a6a2d37ac43eb597c72546ebd2

SHA1
6a7a88b5f4b9e4ced3ba1232b68dbb4fbcc5c6ce

SHA256
c8c7af5cb2163effd05552ac55d2e51b0c8a68232e5609f76f3b465b525fe4ca

SHA512
16a45c5c3e17a3dd4ce3b13465a639bb72f257e67dff670fa0933f9f68e8adaa3b19157df66caa223c6a7afa1c4e30f734ba03fb5bc9110687784ec00f894d9b

Download Submit
C:\Windows\SysWOW64\Capchmmb.exe

Filesize
352KB

MD5
06ede45e142a70d9beb60920d02e3f99

SHA1
2d7b35decc5eb4c2afc33dd63191bfea516cc8a2

SHA256
d6722d790b6a848352af130a18aff8ce12ad2b2e6306034244cbd9b7ec3ec483

SHA512
404961ed34c0347ba9a158651718c866cbb47a2711d650067f2dcd67ae02d5a0fdb170f7a23b6eed9375c45ca926f1c95f9f7af4f7f6035eabc5fc589bc31e81

Download Submit
C:\Windows\SysWOW64\Ceibclgn.exe

Filesize
352KB

MD5
2995c7d82dd5e5b44c998ff44abb7668

SHA1
925e05a252a40399ad984fd35ec693dbc6b41bca

SHA256
ab934acfc06910b1f0c5b2a7e01b4952597ca9714370aa214ea3d3e70e8c8334

SHA512
d53d2f3b1813eb58b5d766891e4655c27db173030677390bd4e9739772e2b30e329bfec9288c59d0902945348b80b89f64565317310ad88f11c23463dd50feb4

Download Submit
C:\Windows\SysWOW64\Coagla32.exe

Filesize
352KB

MD5
12d2bb7155afd225f3772ccb1d265205

SHA1
d17cc1fd6c841fa6b3fb9271d2982430ac4916ec

SHA256
0c462676cd0618252f506da87f3f78a30e6ccf170c9e2ab90c1dcc75f2a68fb3

SHA512
fbd69b171c0291ef59150d2fdbd49dd2706abf605f10fd311f0cca1c8678e00475cda45e9b4097d7bc6ddd08a802f7708d156e96c4222d534d6af10dc650f400

Download Submit
C:\Windows\SysWOW64\Dadlclim.exe

Filesize
352KB

MD5
0ac60a0fb888b5dd038856d10a594a47

SHA1
1c1a3bc34004cbdcf5e54a0b70c7f0964c0a549a

SHA256
1d35a3db8a13d757c37ac7855d79b1344abeb9cfb9d456b7dd0f60768a34e333

SHA512
1cbf5ede797ff5c3f99ad8c4c54c8e514b21476381bd9cac2c569e3510b50bd47fe666064050e29b4de2748f65c468cd40382e385bd3692b8d8abdc87c12d196

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
352KB

MD5
548d60e9c29fd875e4abede7d260fa40

SHA1
f26fabb5668395b75d7712b2034236cb5acf7a7b

SHA256
d19e57ac44d358ce258d4a83d4b2fcfcbc8d8d33d89aa16820871d97af05c880

SHA512
925e298083e5d7a23c3322a8cb62c051baee1645a4510e7a8a3dbb54c81dc9dca7b2cbb6425bc810fb73556624f20085c39172e46c3612430b12afbdd098004e

Download Submit
C:\Windows\SysWOW64\Daifnk32.exe

Filesize
352KB

MD5
e4418285ed990ff239f6c3b35c5ac039

SHA1
deda37192496659070e0f55e6e4e2a70f2f65e34

SHA256
1fb84024151410a682f436b3902978e3eff468d73209985585b57f159dbfa3b2

SHA512
d668166387a18c74aad12ea43eafd79a7ba33b47c153ae29b21ae940593c06662bd38b9fe1f94248b7ba3ff531a91f213b138db141385c1ea294383362cdcd82

Download Submit
C:\Windows\SysWOW64\Dchbhn32.exe

Filesize
352KB

MD5
e967db28eea496cfd3b3331857bc4532

SHA1
5b43698b46d22c0e64c1b80a5ab6729e8db01f37

SHA256
72bd06d73d662750646fab701bd7f2827517646e197295c0b2e388580863a81d

SHA512
b8022244101ed19178476a5001074d207413547f3f2ae7d0859268c763d73f443cacb9443e226bc36d59c259088dd2079d46c1c28f752dbeaf809c418eb8a535

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
352KB

MD5
32dd8c46f297ee4772ae52070954c8a9

SHA1
f7231f94d63baba8a5cd5acaad732ed75711da57

SHA256
658b9a2818ba9dbfe7a4edae8f806d3413977b4c6e8c3a04c9f8cbde3366ad87

SHA512
c0f4548563b4148435e07e6474b726d3a44983b7365002cf3dd353e4eb0f3c4594a8ee19a5c8afef45be2cc6ba7bd299768b4cd56faf37847cfc406f3be2af7f

Download Submit
C:\Windows\SysWOW64\Denlnk32.exe

Filesize
352KB

MD5
1e9af1e4761ab9435785036e219e5e26

SHA1
dd750c7431caae1c3002a7a50ae285ca1039e3a4

SHA256
f566c0b9adcf806dfe35c710f424e42f900c2e1de17b9f00176eb33d9c6217d9

SHA512
26e3be521cfc267478e69e4091f870fa36ee714417941236ef37b9818658dca543b7bc10719131c06d8af431636eb54bc1a61b0c1107a8e61d19d2c22ed13327

Download Submit
C:\Windows\SysWOW64\Dhcnke32.exe

Filesize
352KB

MD5
3b2766a159bc512bec5b4e4ca91f6893

SHA1
4d3fc3733e1e2dec9532f8dae37d5cd9d74c9916

SHA256
b65d6466fbad0333c61492ab293ff3055755e1d5deb54aec284f1b00505a4ae8

SHA512
bc6aaa74bd8fdbac7f90b31c103f693ff5e6df3d4805d6402333222c8707107849f675d1cbf31f759807e868cd207defe15cfdc521d53744dab7048c0e238f53

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
352KB

MD5
81a36e671153dca8f8dc1126ba518770

SHA1
1dbf911de96f6460702159884e670150d969c61a

SHA256
4a32fd7f37c9856a6704115df91f925851340285343565a470e7b10afbdb907c

SHA512
23a60800678bfeaba4a0e7b2a30edadba5941235319859ba20bdf756ed5a67e8c20eaa8f26658daaaf49d5f139bbb6a8ec3cf9c712219f31272417cba8c8d6d1

Download Submit
C:\Windows\SysWOW64\Diihojkb.exe

Filesize
352KB

MD5
823c3f207b3845fb288a9001c318ae44

SHA1
f8ea7210b6d93c6de2960630469ea13a0e8099f7

SHA256
f02bf589efb822a5fe54ecc6732371f28feaf250458d1278da7190733880cdc1

SHA512
7b107863288128e7e020ed4a1a95215a49c14bd50e1e402f61480cb5f3c8af6a5be4af965b49c348ce36a08ae4977b27f0ae8c8593411c69cc8e45abaae00957

Download Submit
C:\Windows\SysWOW64\Djlddi32.exe

Filesize
352KB

MD5
e1d1a94f76e6941a0f148e93e09ad454

SHA1
dc953c384cdfe1776b6d597bb948cb36595db534

SHA256
78ba3f7d5cf42fb579128c221ee36818d7739decc3d2e0e9c6861b0334930c8a

SHA512
084d3c7dae8ab0819681031e01cd3c2d8301689b2abac293b6cba8b30462feb719b1513eeeef289de5f470d009f624b917b51738805145679cbe6301de617806

Download Submit
C:\Windows\SysWOW64\Djpnohej.exe

Filesize
352KB

MD5
912c70797190a653fb5e0fb3f9c3abb1

SHA1
137bc9f19eec20f5eec7a6bf46515ff008584460

SHA256
29f80eb314996639f784c58639c2efd6071b9c7728ce9a4f42d95ee1cd87e38d

SHA512
9d4fce45c393e894aec181127a7fc2fc85338912d06b6edddea6cef367d49ba4c41818cc47b50a79f4355902b16839455ef72ecca4ea13e8dab29cc6b9e5a310

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
352KB

MD5
505be6d39b45f586318db032574c4ab7

SHA1
7cfc54422cad5bdc463178ad154c47d8f050573d

SHA256
220a1c23db707cbb3c6b8eb958d2d06eb9cf760ddd18473471f651d178c774e4

SHA512
ea0d8cd8ff3653a936f01f2fa0fed231e3f2ef9d68b812e08355cbdcfbb72cc3551ff812c44ddd8f03930a45ce080202880d547c98f9a1faca01d2f8e7227ae0

Download Submit
C:\Windows\SysWOW64\Dlgdkeje.exe

Filesize
352KB

MD5
905efb7900f5c0da1ce1cd26b0e5d26e

SHA1
5102cd66ac51f2438d75878d9f26f7044e922895

SHA256
c32fe338855fe61eadfc20c6ab0c163767d9384c5b1757c09c319bf3e27ecff7

SHA512
3cd24976e0054b0988451d57395525ca66b3998188fe22296d7cc4d25169c6a712ed95981d19171c2f3ee0ac527fc050aeb4bc54aa654d30e5601639b935b95b

Download Submit
C:\Windows\SysWOW64\Dljqpd32.exe

Filesize
352KB

MD5
6a1faba0d5a5268c0463315cdac43853

SHA1
89f4bf50513d75aba9c252d88b97bdaea994c5d9

SHA256
c915e0a9543a64a531e1279063988ff13820afa5a18f7d1c7a104df8d4fd5aa0

SHA512
49ac8fb3d68e003ef76f20e7a5cd6d891c073a7f0fae1d048267fbace233b1b1d78d6214d9f7db55255750dd74a08a9a7148f3ea810239f315df50e9ec6496c5

Download Submit
C:\Windows\SysWOW64\Doccaall.exe

Filesize
352KB

MD5
702a6aca6bc2157d43ef34b11d56d903

SHA1
945ab0910c4b8eedeb0bc3c34510d4d9edacd347

SHA256
43531957ec0fc70f422acbb48e18e26193af8332591ded57f8dcd0c7e49ca2de

SHA512
673adcb15a3992c388be9fd3a60d8888632978a8cf95b47f4feb5d0da08bcb2ed3e05aae1296e69dbdb5e94f6ad1f5173c82134355524d84f0b2d55ce0474600

Download Submit
C:\Windows\SysWOW64\Dofpgqji.exe

Filesize
352KB

MD5
f20f37e02b9e39b5e42ef5cece7eccca

SHA1
5a07e90e9f8bce65f415dcd62f0ac9f22bc4c7e1

SHA256
4e4245008ea01b009db705921362edabd842259e6c6ca6172404e9804920cd51

SHA512
6340ee38f1a835fc3f379ca192c8317ceeebe84639e3b2937d2b335884137aae38ceaf1a55dca26e7c5fd7ef92b5703d00389cce317638af163628d55cc1ef3e

Download Submit
C:\Windows\SysWOW64\Dphifcoi.exe

Filesize
352KB

MD5
8eba2988171c3b36713ef5b83d382770

SHA1
4862bde0f7b2090a777406b2a3753324c88ee1a4

SHA256
f95a09beb1461ee6735475612d9938ac918e2d10e7db2c7d684c2053fe8244c4

SHA512
e597f70b93c1869c63f507fab2b50ec06112c312dd585c5f94593a044e30b4b74124bbdc0435a0ab68e62ef9b503e071d4fc818ad6dcf53edd0fe98639c0f788

Download Submit
C:\Windows\SysWOW64\Dpjflb32.exe

Filesize
352KB

MD5
b433c69ef95e28784550eb10214fcaad

SHA1
db196d68cff3c2e50c241b15d0614d99b8327520

SHA256
12a2e15c0a5dec7eb9b35f3d3ec2f5450be4bd6d19208bfd3d7e63169183131d

SHA512
93bc7e8b03755465d2ceb7cdbe53e2a304f5e74cb7f3156c694c85a6273d46005155963dabfc72109a8ad998520127447adeb552ffc75dba722b4ce424b9a361

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
352KB

MD5
f8c2021280b6dab597a59e9b3c55f532

SHA1
a4a8517a4ea727e9dc4cc309307a48354eac3aa9

SHA256
f427b141f5ea005986d10a02a22c348478ac0b65098f256fd5b89d267b6d88e3

SHA512
1c10f8cb9ef25bc5e667a8bf5b79db3a64891202bb588982d6cc0f7ab5a6da24d0c8034819735b723352ae571204b982971f41e32dec5a9a8a7129c6f747abe5

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
352KB

MD5
c90edd89d817d67e322f63a68d719cde

SHA1
9a263fc4a71bb2c420f3a4399eff277b5f92d3a8

SHA256
3bf5af76819f9b11770d8febd67ed5281e7570b4617cf2278c1fd63b207f9201

SHA512
2ff8765682f766885694f5af4c9cacc827b0e7ac64c7d5a5d96ae8a6de4b91f61457a91c693cb6b3bc5930920d5fb1b86f570183236d48c02f9ff5d103568438

Download Submit
C:\Windows\SysWOW64\Eckonn32.exe

Filesize
352KB

MD5
4a61c75bf57b6cd6a43fc90f57d8c01e

SHA1
8518538e891c9109843d5da6bc0a21db163d3ff8

SHA256
7e91b72544931e0b5a340a1258982d701806172fa17d96a38af8aa1621b5531b

SHA512
7572e061bfd81b93c8ae1d791263353456f63a2c9e1e0d3020403fbd4072741d4493b35eee1477faf0c1619f3b26e93a042b63874040d78f3e2be43d06d115c8

Download Submit
C:\Windows\SysWOW64\Efgodj32.exe

Filesize
352KB

MD5
806d4011fe2a9b0f7a449019954d9d38

SHA1
3835cb4f9e4eca7a1fdb26a815fac95ffa6d8275

SHA256
dfb74f5bd59f553cafed2c9a69be829de86c90ff15f5bb80e9f971fb82580045

SHA512
a2acf60541bcaa6234b3e6547692f4fbc816fae2ffc76234efd8565763904365c7def264a8b4cb8232b4cd82d88702980957bace76dae88286780abb69e16b0c

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
352KB

MD5
13e8b7b7d6c9200367f38c1f9e1e7a2c

SHA1
0ffe88234065228c00267df963857dd7d9d0fc9a

SHA256
6dc38ed52cf7d4240c394e86f866b2345faba14b3129883fca639f5cb619a67f

SHA512
84ed826aee5835f20397098a665e6859c7f80b7216956325dae560d8a67e2b2d6ed4fae5884ce9c6d76fbfb7126eddecf4f1e37c011088832bee43d3eb0eb32f

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
352KB

MD5
a3a137cb6bcd1d3c988c59abc9b51c2d

SHA1
df43458f307daffa35b15b0208421c7a028beb25

SHA256
8fdc316e01e410402ddf30e37a0b946de6162c4acda48987e7f6a067d467ec0a

SHA512
3a57edd7264988fcc7d7c2f6b9d71356b62c3e10538999abd30c7e08ca4ab29c428d4b03f70bbd586ab7b9c4f93da5ca612db0d60bf02cab913a066d19712577

Download Submit
C:\Windows\SysWOW64\Ejegjh32.exe

Filesize
352KB

MD5
4d299b8c25eb698c91178dcbe0428213

SHA1
68777cc8f76578260e920b876da6ae4587746fa0

SHA256
d213f40614bfa5b2e25dca7617d1c27351b68bc0ef3e2e1f2205bbc9bbbcef03

SHA512
12df9dfc0bf0270b1ca7dfc7fb49ff50295e099855859b5238065446f33f49726b77f7aac1cbb848b3885bda5dc93d1a7eacc685b062d43c27d88c06ad50e41c

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
352KB

MD5
5d84d8f2266ca044ca600059bc1bb9a0

SHA1
b4e1a89a316d1768a83da749ba83a17f8c30bdbe

SHA256
c24b43654d844ef68258634477b6efd75baee0353df12591adafb80853d6f664

SHA512
4c98a0242dae4d6e3642317798af7cf672b4c4bebabeeefc54670cd5cf1437b145c6c492d48429d40c915a2bc662adfbd71b2e67e4ff6c84a71159f6af7127c5

Download Submit
C:\Windows\SysWOW64\Eoapbo32.exe

Filesize
352KB

MD5
757a8bd23c0eb36a646eedd0e5ec8233

SHA1
3acd12a91449dd02d44333877cfdfe94de2af906

SHA256
f8406e3e22ef8660f5c289b474079c7b929984e71bb95fc28be46661d5835bfa

SHA512
50d6c9933fdd1075cfd338deb43d2b442526cfe46f2ba2cda1054208dcb160abbea01aace291ecd92f5d5505cbe6e278835448719e9633e4840e86fac4a19453

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
352KB

MD5
01b5521ee788fce3af0fd2de6c7bdf4e

SHA1
6695f7d375bacff946e7430aa21eb6b87403955f

SHA256
cf7320afc4fb9e13e6f188d220a8c51920dc7797901c012b9da9fe4991d7d906

SHA512
4dfef7a288d0bd1a5a1abbe106554dc4e0f1430d9764ddf0f896619301093847f32c69080b627b474b8dd3ea57a19a972bb77197dc57598558a867ae67b98b89

Download Submit
C:\Windows\SysWOW64\Epopgbia.exe

Filesize
352KB

MD5
1166d58025d622986ccfa61d27de2cee

SHA1
b2f428b0a4f581c2cc1233854b141220f473d49d

SHA256
6571a7c62fcdfda8a559d438d19cc21c8765cbfb513bd2978b0a8b25ed71da47

SHA512
128c857a19046ab58ce9a75af0e57ae7e11daf9b797d989bc3876ffe6446af7b56d7daffe8c425f0f473910517f456502686ba1d611beabc53b06ea18c46c928

Download Submit
memory/64-443-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/212-54-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/400-368-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/456-93-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/468-378-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/540-372-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/544-76-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/560-379-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1108-370-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1224-353-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1508-403-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1512-448-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1592-122-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-387-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1852-340-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1896-362-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-422-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2032-371-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2276-306-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2284-348-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2416-444-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2432-456-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2492-409-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2632-339-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2664-395-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2812-396-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2896-347-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2924-451-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3124-153-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3260-318-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3384-424-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3492-313-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3500-147-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3556-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3564-311-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3620-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3628-332-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3680-24-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3736-114-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3772-321-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3792-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3860-416-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3936-441-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4000-40-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4012-60-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4060-160-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4148-381-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4244-91-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4292-355-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4332-320-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4420-436-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4432-414-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4520-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4560-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4580-363-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4652-380-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4716-356-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4720-402-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4752-393-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4876-334-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4924-388-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4928-417-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5000-327-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5044-430-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads