64d6b7e78dc810b4fb09331775eaa357816bd06f7fec084e7cec6503f8b46f47

Analysis

max time kernel
198s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a463662dc523ce4acfa3addc568549bd.exe
Size

407KB
MD5

a463662dc523ce4acfa3addc568549bd
SHA1

583ccdfbcaae6d7c16f5f1977ab22db04ea5207f
SHA256

64d6b7e78dc810b4fb09331775eaa357816bd06f7fec084e7cec6503f8b46f47
SHA512

77a71e60f18211f261435e238a8b68c1797cf6d2baae61a51760cc2c80869a87cce881772286de59a511d0d9c68c0e92ec100ff667fe42f5712eb9d9aad72c94
SSDEEP

12288:Xpr6c7UspV6yYP3pV6yYPg058KpV6yYPS:XtdUsW3WleKWS

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocdgahag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nfnjbdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hjieii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phhpic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hphpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hlnqfanb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opgloh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjanjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Plfipakk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kqknekjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbjpjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajnkmjqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdqffaql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hmicee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Faholm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofadlbhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fnoboc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoifoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdkdqinj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcggbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qqamieno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlhnng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qofjjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jglkkiea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfabok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fnofpqff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phmjdbpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppopcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aoifoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jggapj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qofjjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqknekjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmfalimb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apbngn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dakieedj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgqfmcge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhqll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hgkimn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnfnfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kclnfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofadlbhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qlhnng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcggbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfjfoidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jqofippg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppopcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ikkppgld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnelha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgqfmcge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gckcap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Emfgpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Idceim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Obgeqcnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aacjofkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fdqffaql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgjicb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjabgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oianmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egiohh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jidkek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agbkfood.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmnmqdee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jcphkhad.exe

Executes dropped EXE 64 IoCs

pid	Process
4400	Nfnjbdep.exe
4832	Nbdkhe32.exe
4472	Ocdgahag.exe
876	Ohqpjo32.exe
2952	Ofdqcc32.exe
4740	Okceaikl.exe
2864	Gjcfcakn.exe
872	Nggjog32.exe
1008	Akjnnpcf.exe
1676	Gegchl32.exe
3592	Gckcap32.exe
1968	Gledpe32.exe
2388	Hgkimn32.exe
2732	Hjieii32.exe
2532	Hgmebnpd.exe
3904	Hcdfho32.exe
1168	Hfbbdj32.exe
4488	Hphfac32.exe
1276	Hgdlcm32.exe
3432	Hladlc32.exe
2996	Imcqacfq.exe
5020	Imfmgcdn.exe
2124	Jggapj32.exe
5068	Jqofippg.exe
4432	Jjhjae32.exe
4188	Jglkkiea.exe
436	Jjjggede.exe
4088	Kakednfj.exe
4988	Kciaqi32.exe
1584	Kanbjn32.exe
2232	Kclnfi32.exe
4960	Nfabok32.exe
4128	Nbhcdl32.exe
3240	Nbjpjl32.exe
4544	Cjabgm32.exe
2424	Jnoopm32.exe
1488	Nfgbec32.exe
3120	Ofnhfbjl.exe
3340	Oimdbnip.exe
960	Opgloh32.exe
1784	Ofadlbhj.exe
1620	Obgeqcnn.exe
4604	Oianmm32.exe
4708	Egiohh32.exe
3152	Emfgpo32.exe
4668	Ecpomiok.exe
4368	Ecblbi32.exe
4704	Fjldocde.exe
1384	Fceihh32.exe
2004	Fnjmea32.exe
1076	Fcgemhic.exe
4848	Fjanjb32.exe
2536	Fpnfbi32.exe
2168	Fnofpqff.exe
2344	Palkgi32.exe
1280	Phfcdcfg.exe
368	Pejdmh32.exe
3800	Phhpic32.exe
3892	Pbndgl32.exe
4648	Plfipakk.exe
4436	Phmjdbpo.exe
4116	Qniogl32.exe
4340	Abnnnjfh.exe
3092	Apbngn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pkencn32.exe	Liqibm32.exe
File created	C:\Windows\SysWOW64\Hlilah32.dll	Njinfk32.exe
File opened for modification	C:\Windows\SysWOW64\Ieijkcej.exe	Gjmffn32.exe
File created	C:\Windows\SysWOW64\Kihnhc32.dll	Hladlc32.exe
File created	C:\Windows\SysWOW64\Kanbjn32.exe	Kciaqi32.exe
File opened for modification	C:\Windows\SysWOW64\Nfabok32.exe	Kclnfi32.exe
File opened for modification	C:\Windows\SysWOW64\Oimdbnip.exe	Ofnhfbjl.exe
File created	C:\Windows\SysWOW64\Obgeqcnn.exe	Ofadlbhj.exe
File created	C:\Windows\SysWOW64\Bjqafj32.dll	Fjldocde.exe
File opened for modification	C:\Windows\SysWOW64\Ipflcnln.exe	Igmgji32.exe
File created	C:\Windows\SysWOW64\Bgabmp32.dll	Ikkppgld.exe
File created	C:\Windows\SysWOW64\Mnkmlhab.dll	Mkhajq32.exe
File created	C:\Windows\SysWOW64\Alioloje.exe	Aacjofkp.exe
File created	C:\Windows\SysWOW64\Ehhjekgq.dll	Mnfnfl32.exe
File opened for modification	C:\Windows\SysWOW64\Nbhcdl32.exe	Nfabok32.exe
File created	C:\Windows\SysWOW64\Oeehdcij.exe	Naecieef.exe
File created	C:\Windows\SysWOW64\Pichac32.dll	Kciaqi32.exe
File opened for modification	C:\Windows\SysWOW64\Pjgellfb.exe	Ppopcf32.exe
File created	C:\Windows\SysWOW64\Mkhajq32.exe	Mmfalimb.exe
File opened for modification	C:\Windows\SysWOW64\Faholm32.exe	Pjjfnlho.exe
File created	C:\Windows\SysWOW64\Nnpalk32.exe	Nmpdbh32.exe
File created	C:\Windows\SysWOW64\Nghcnkop.dll	Nelfnd32.exe
File created	C:\Windows\SysWOW64\Lhdphl32.dll	Jidkek32.exe
File opened for modification	C:\Windows\SysWOW64\Nbdkhe32.exe	Nfnjbdep.exe
File created	C:\Windows\SysWOW64\Gohoibbd.dll	Gledpe32.exe
File created	C:\Windows\SysWOW64\Oegbgf32.dll	Kclnfi32.exe
File opened for modification	C:\Windows\SysWOW64\Oianmm32.exe	Obgeqcnn.exe
File opened for modification	C:\Windows\SysWOW64\Jjjggede.exe	Jglkkiea.exe
File opened for modification	C:\Windows\SysWOW64\Lgqfmcge.exe	Ldbjah32.exe
File created	C:\Windows\SysWOW64\Ahhiog32.dll	Qlhnng32.exe
File created	C:\Windows\SysWOW64\Faholm32.exe	Pjjfnlho.exe
File created	C:\Windows\SysWOW64\Ieijkcej.exe	Gjmffn32.exe
File created	C:\Windows\SysWOW64\Hgmebnpd.exe	Hjieii32.exe
File created	C:\Windows\SysWOW64\Daacgiil.dll	Egiohh32.exe
File created	C:\Windows\SysWOW64\Macjbdpf.dll	Pejdmh32.exe
File opened for modification	C:\Windows\SysWOW64\Gegchl32.exe	Akjnnpcf.exe
File opened for modification	C:\Windows\SysWOW64\Hladlc32.exe	Hgdlcm32.exe
File opened for modification	C:\Windows\SysWOW64\Imfmgcdn.exe	Imcqacfq.exe
File opened for modification	C:\Windows\SysWOW64\Kqknekjf.exe	Jnelha32.exe
File created	C:\Windows\SysWOW64\Pbndgl32.exe	Phhpic32.exe
File created	C:\Windows\SysWOW64\Bggqfk32.dll	Ppopcf32.exe
File created	C:\Windows\SysWOW64\Qlhnng32.exe	Qqamieno.exe
File created	C:\Windows\SysWOW64\Ncecfm32.dll	Jjgcbb32.exe
File opened for modification	C:\Windows\SysWOW64\Ldbjah32.exe	Ljmfdp32.exe
File created	C:\Windows\SysWOW64\Ppljlh32.dll	Mlhqll32.exe
File opened for modification	C:\Windows\SysWOW64\Lmicnj32.exe	Kjknkann.exe
File created	C:\Windows\SysWOW64\Aekeif32.dll	Mgfabo32.exe
File created	C:\Windows\SysWOW64\Ocdgahag.exe	Nbdkhe32.exe
File created	C:\Windows\SysWOW64\Ejdobfce.dll	Fpnfbi32.exe
File created	C:\Windows\SysWOW64\Plfdmnqa.dll	Ipflcnln.exe
File opened for modification	C:\Windows\SysWOW64\Lmbhqj32.exe	Lcggbd32.exe
File created	C:\Windows\SysWOW64\Naecieef.exe	Nenbdd32.exe
File created	C:\Windows\SysWOW64\Gjmffn32.exe	Faholm32.exe
File opened for modification	C:\Windows\SysWOW64\Njinfk32.exe	Nelfnd32.exe
File created	C:\Windows\SysWOW64\Aacjofkp.exe	Apbngn32.exe
File created	C:\Windows\SysWOW64\Agkejbik.dll	Lgqfmcge.exe
File created	C:\Windows\SysWOW64\Mpqellmb.dll	Nggjog32.exe
File created	C:\Windows\SysWOW64\Hfbbdj32.exe	Hcdfho32.exe
File created	C:\Windows\SysWOW64\Ecpomiok.exe	Emfgpo32.exe
File opened for modification	C:\Windows\SysWOW64\Nmpdbh32.exe	Mchpibng.exe
File created	C:\Windows\SysWOW64\Akjnnpcf.exe	Nggjog32.exe
File created	C:\Windows\SysWOW64\Ckpenokc.dll	Oianmm32.exe
File created	C:\Windows\SysWOW64\Ajlngk32.exe	Qofjjb32.exe
File opened for modification	C:\Windows\SysWOW64\Fdqffaql.exe	Pkencn32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Obgeqcnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Idceim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Alioloje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Igmgji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nclida32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njinfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bggqfk32.dll"	Ppopcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aichng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hmicee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Igmgji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqclce32.dll"	Pjgellfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmabiboo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kakednfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nbhcdl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pejdmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhdphl32.dll"	Jidkek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqgkidki.dll"	Nbdkhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pbndgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcqdkcfn.dll"	Jdkkjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hjieii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofnhfbjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajlngk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlkffifj.dll"	Agpoqoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dakieedj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aekeif32.dll"	Mgfabo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neaglfck.dll"	Imfmgcdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jnoopm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ecpomiok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fceihh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gegchl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acihep32.dll"	Fnoboc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qofjjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfafobpd.dll"	Kqknekjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Apbngn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chnlbndj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jnqbmadp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inckcj32.dll"	Jnelha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcokoo32.dll"	Ohqpjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Imcqacfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fdqffaql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbcldbpf.dll"	Opgloh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aqjpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kjccna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a463662dc523ce4acfa3addc568549bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lagqnoge.dll"	Jjjggede.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Phhpic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcmdcg32.dll"	Pkencn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Naecieef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngcjqemf.dll"	Idceim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mkhajq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Opgloh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fnofpqff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccmaihoc.dll"	Aqjpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Peflco32.dll"	Igmgji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Faholm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Plfipakk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qniogl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amaqde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njinfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oeehdcij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gmabiboo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hgdlcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Femdjbab.dll"	Imcqacfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fnoboc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4400	3308	a463662dc523ce4acfa3addc568549bd.exe	86
PID 3308 wrote to memory of 4400	3308	a463662dc523ce4acfa3addc568549bd.exe	86
PID 3308 wrote to memory of 4400	3308	a463662dc523ce4acfa3addc568549bd.exe	86
PID 4400 wrote to memory of 4832	4400	Nfnjbdep.exe	87
PID 4400 wrote to memory of 4832	4400	Nfnjbdep.exe	87
PID 4400 wrote to memory of 4832	4400	Nfnjbdep.exe	87
PID 4832 wrote to memory of 4472	4832	Nbdkhe32.exe	88
PID 4832 wrote to memory of 4472	4832	Nbdkhe32.exe	88
PID 4832 wrote to memory of 4472	4832	Nbdkhe32.exe	88
PID 4472 wrote to memory of 876	4472	Ocdgahag.exe	89
PID 4472 wrote to memory of 876	4472	Ocdgahag.exe	89
PID 4472 wrote to memory of 876	4472	Ocdgahag.exe	89
PID 876 wrote to memory of 2952	876	Ohqpjo32.exe	91
PID 876 wrote to memory of 2952	876	Ohqpjo32.exe	91
PID 876 wrote to memory of 2952	876	Ohqpjo32.exe	91
PID 2952 wrote to memory of 4740	2952	Ofdqcc32.exe	92
PID 2952 wrote to memory of 4740	2952	Ofdqcc32.exe	92
PID 2952 wrote to memory of 4740	2952	Ofdqcc32.exe	92
PID 4740 wrote to memory of 2864	4740	Okceaikl.exe	93
PID 4740 wrote to memory of 2864	4740	Okceaikl.exe	93
PID 4740 wrote to memory of 2864	4740	Okceaikl.exe	93
PID 2864 wrote to memory of 872	2864	Gjcfcakn.exe	95
PID 2864 wrote to memory of 872	2864	Gjcfcakn.exe	95
PID 2864 wrote to memory of 872	2864	Gjcfcakn.exe	95
PID 872 wrote to memory of 1008	872	Nggjog32.exe	96
PID 872 wrote to memory of 1008	872	Nggjog32.exe	96
PID 872 wrote to memory of 1008	872	Nggjog32.exe	96
PID 1008 wrote to memory of 1676	1008	Akjnnpcf.exe	97
PID 1008 wrote to memory of 1676	1008	Akjnnpcf.exe	97
PID 1008 wrote to memory of 1676	1008	Akjnnpcf.exe	97
PID 1676 wrote to memory of 3592	1676	Gegchl32.exe	98
PID 1676 wrote to memory of 3592	1676	Gegchl32.exe	98
PID 1676 wrote to memory of 3592	1676	Gegchl32.exe	98
PID 3592 wrote to memory of 1968	3592	Gckcap32.exe	99
PID 3592 wrote to memory of 1968	3592	Gckcap32.exe	99
PID 3592 wrote to memory of 1968	3592	Gckcap32.exe	99
PID 1968 wrote to memory of 2388	1968	Gledpe32.exe	100
PID 1968 wrote to memory of 2388	1968	Gledpe32.exe	100
PID 1968 wrote to memory of 2388	1968	Gledpe32.exe	100
PID 2388 wrote to memory of 2732	2388	Hgkimn32.exe	101
PID 2388 wrote to memory of 2732	2388	Hgkimn32.exe	101
PID 2388 wrote to memory of 2732	2388	Hgkimn32.exe	101
PID 2732 wrote to memory of 2532	2732	Hjieii32.exe	102
PID 2732 wrote to memory of 2532	2732	Hjieii32.exe	102
PID 2732 wrote to memory of 2532	2732	Hjieii32.exe	102
PID 2532 wrote to memory of 3904	2532	Hgmebnpd.exe	103
PID 2532 wrote to memory of 3904	2532	Hgmebnpd.exe	103
PID 2532 wrote to memory of 3904	2532	Hgmebnpd.exe	103
PID 3904 wrote to memory of 1168	3904	Hcdfho32.exe	104
PID 3904 wrote to memory of 1168	3904	Hcdfho32.exe	104
PID 3904 wrote to memory of 1168	3904	Hcdfho32.exe	104
PID 1168 wrote to memory of 4488	1168	Hfbbdj32.exe	105
PID 1168 wrote to memory of 4488	1168	Hfbbdj32.exe	105
PID 1168 wrote to memory of 4488	1168	Hfbbdj32.exe	105
PID 4488 wrote to memory of 1276	4488	Hphfac32.exe	106
PID 4488 wrote to memory of 1276	4488	Hphfac32.exe	106
PID 4488 wrote to memory of 1276	4488	Hphfac32.exe	106
PID 1276 wrote to memory of 3432	1276	Hgdlcm32.exe	107
PID 1276 wrote to memory of 3432	1276	Hgdlcm32.exe	107
PID 1276 wrote to memory of 3432	1276	Hgdlcm32.exe	107
PID 3432 wrote to memory of 2996	3432	Hladlc32.exe	108
PID 3432 wrote to memory of 2996	3432	Hladlc32.exe	108
PID 3432 wrote to memory of 2996	3432	Hladlc32.exe	108
PID 2996 wrote to memory of 5020	2996	Imcqacfq.exe	109

C:\Users\Admin\AppData\Local\Temp\a463662dc523ce4acfa3addc568549bd.exe
"C:\Users\Admin\AppData\Local\Temp\a463662dc523ce4acfa3addc568549bd.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\Nfnjbdep.exe
  C:\Windows\system32\Nfnjbdep.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\Nbdkhe32.exe
    C:\Windows\system32\Nbdkhe32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Windows\SysWOW64\Ocdgahag.exe
      C:\Windows\system32\Ocdgahag.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:876
      - C:\Windows\SysWOW64\Ofdqcc32.exe
        
        C:\Windows\system32\Ofdqcc32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\Okceaikl.exe
        
        C:\Windows\system32\Okceaikl.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4740
        
        C:\Windows\SysWOW64\Gjcfcakn.exe
        
        C:\Windows\system32\Gjcfcakn.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\Nggjog32.exe
        
        C:\Windows\system32\Nggjog32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\SysWOW64\Akjnnpcf.exe
        
        C:\Windows\system32\Akjnnpcf.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\Gegchl32.exe
        
        C:\Windows\system32\Gegchl32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Gledpe32.exe
        
        C:\Windows\system32\Gledpe32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Hgkimn32.exe
        
        C:\Windows\system32\Hgkimn32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Hjieii32.exe
        
        C:\Windows\system32\Hjieii32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Hgmebnpd.exe
        
        C:\Windows\system32\Hgmebnpd.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\Hcdfho32.exe
        
        C:\Windows\system32\Hcdfho32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Hfbbdj32.exe
        
        C:\Windows\system32\Hfbbdj32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Hphfac32.exe
        
        C:\Windows\system32\Hphfac32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Hgdlcm32.exe
        
        C:\Windows\system32\Hgdlcm32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Hladlc32.exe
        
        C:\Windows\system32\Hladlc32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\Jqofippg.exe
        
        C:\Windows\system32\Jqofippg.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Jjhjae32.exe
        
        C:\Windows\system32\Jjhjae32.exe
        26⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Jglkkiea.exe
        
        C:\Windows\system32\Jglkkiea.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4188
        
        C:\Windows\SysWOW64\Jjjggede.exe
        
        C:\Windows\system32\Jjjggede.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Kakednfj.exe
        
        C:\Windows\system32\Kakednfj.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4088
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4988
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        31⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\SysWOW64\Kclnfi32.exe
        
        C:\Windows\system32\Kclnfi32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\Nfabok32.exe
        
        C:\Windows\system32\Nfabok32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4960
        
        C:\Windows\SysWOW64\Nbhcdl32.exe
        
        C:\Windows\system32\Nbhcdl32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4128
        
        C:\Windows\SysWOW64\Nbjpjl32.exe
        
        C:\Windows\system32\Nbjpjl32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3240
        
        C:\Windows\SysWOW64\Cjabgm32.exe
        
        C:\Windows\system32\Cjabgm32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Jnoopm32.exe
        
        C:\Windows\system32\Jnoopm32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2424
        
        C:\Windows\SysWOW64\Nfgbec32.exe
        
        C:\Windows\system32\Nfgbec32.exe
        38⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Ofnhfbjl.exe
        
        C:\Windows\system32\Ofnhfbjl.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Oimdbnip.exe
        
        C:\Windows\system32\Oimdbnip.exe
        40⤵
        Executes dropped EXE
        
        PID:3340
        
        C:\Windows\SysWOW64\Opgloh32.exe
        
        C:\Windows\system32\Opgloh32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:960
        
        C:\Windows\SysWOW64\Ofadlbhj.exe
        
        C:\Windows\system32\Ofadlbhj.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1784
        
        C:\Windows\SysWOW64\Obgeqcnn.exe
        
        C:\Windows\system32\Obgeqcnn.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Oianmm32.exe
        
        C:\Windows\system32\Oianmm32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4604
        
        C:\Windows\SysWOW64\Egiohh32.exe
        
        C:\Windows\system32\Egiohh32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4708
        
        C:\Windows\SysWOW64\Emfgpo32.exe
        
        C:\Windows\system32\Emfgpo32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3152
        
        C:\Windows\SysWOW64\Ecpomiok.exe
        
        C:\Windows\system32\Ecpomiok.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Ecblbi32.exe
        
        C:\Windows\system32\Ecblbi32.exe
        48⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Fjldocde.exe
        
        C:\Windows\system32\Fjldocde.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4704
        
        C:\Windows\SysWOW64\Fceihh32.exe
        
        C:\Windows\system32\Fceihh32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Fnjmea32.exe
        
        C:\Windows\system32\Fnjmea32.exe
        51⤵
        Executes dropped EXE
        
        PID:2004
        
        C:\Windows\SysWOW64\Fcgemhic.exe
        
        C:\Windows\system32\Fcgemhic.exe
        52⤵
        Executes dropped EXE
        
        PID:1076
        
        C:\Windows\SysWOW64\Fjanjb32.exe
        
        C:\Windows\system32\Fjanjb32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\SysWOW64\Fpnfbi32.exe
        
        C:\Windows\system32\Fpnfbi32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2536
        
        C:\Windows\SysWOW64\Fnofpqff.exe
        
        C:\Windows\system32\Fnofpqff.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\Palkgi32.exe
        
        C:\Windows\system32\Palkgi32.exe
        56⤵
        Executes dropped EXE
        
        PID:2344
        
        C:\Windows\SysWOW64\Phfcdcfg.exe
        
        C:\Windows\system32\Phfcdcfg.exe
        57⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Windows\SysWOW64\Pejdmh32.exe
        
        C:\Windows\system32\Pejdmh32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:368
        
        C:\Windows\SysWOW64\Phhpic32.exe
        
        C:\Windows\system32\Phhpic32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Pbndgl32.exe
        
        C:\Windows\system32\Pbndgl32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Plfipakk.exe
        
        C:\Windows\system32\Plfipakk.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Phmjdbpo.exe
        
        C:\Windows\system32\Phmjdbpo.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Qniogl32.exe
        
        C:\Windows\system32\Qniogl32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Abnnnjfh.exe
        
        C:\Windows\system32\Abnnnjfh.exe
        64⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Apbngn32.exe
        
        C:\Windows\system32\Apbngn32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Aacjofkp.exe
        
        C:\Windows\system32\Aacjofkp.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4180
        
        C:\Windows\SysWOW64\Alioloje.exe
        
        C:\Windows\system32\Alioloje.exe
        67⤵
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\Aogkhjii.exe
        
        C:\Windows\system32\Aogkhjii.exe
        68⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Blkkaohc.exe
        
        C:\Windows\system32\Blkkaohc.exe
        69⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Bedpjdoc.exe
        
        C:\Windows\system32\Bedpjdoc.exe
        70⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Chnlbndj.exe
        
        C:\Windows\system32\Chnlbndj.exe
        71⤵
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Jidkek32.exe
        
        C:\Windows\system32\Jidkek32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Aclpkffa.exe
        
        C:\Windows\system32\Aclpkffa.exe
        73⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\Bjokno32.exe
        
        C:\Windows\system32\Bjokno32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4908
        
        C:\Windows\SysWOW64\Fnoboc32.exe
        
        C:\Windows\system32\Fnoboc32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2388
        
        C:\Windows\SysWOW64\Ppopcf32.exe
        
        C:\Windows\system32\Ppopcf32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Pjgellfb.exe
        
        C:\Windows\system32\Pjgellfb.exe
        77⤵
        Modifies registry class
        
        PID:2568
        
        C:\Windows\SysWOW64\Qqamieno.exe
        
        C:\Windows\system32\Qqamieno.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4488
        
        C:\Windows\SysWOW64\Qlhnng32.exe
        
        C:\Windows\system32\Qlhnng32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3616
        
        C:\Windows\SysWOW64\Qofjjb32.exe
        
        C:\Windows\system32\Qofjjb32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Ajlngk32.exe
        
        C:\Windows\system32\Ajlngk32.exe
        81⤵
        Modifies registry class
        
        PID:2828
        
        C:\Windows\SysWOW64\Aoifoa32.exe
        
        C:\Windows\system32\Aoifoa32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4544
        
        C:\Windows\SysWOW64\Agpoqoaf.exe
        
        C:\Windows\system32\Agpoqoaf.exe
        83⤵
        Modifies registry class
        
        PID:2376
        
        C:\Windows\SysWOW64\Ajnkmjqj.exe
        
        C:\Windows\system32\Ajnkmjqj.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4088
        
        C:\Windows\SysWOW64\Agbkfood.exe
        
        C:\Windows\system32\Agbkfood.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:960
        
        C:\Windows\SysWOW64\Aichng32.exe
        
        C:\Windows\system32\Aichng32.exe
        86⤵
        Modifies registry class
        
        PID:3412
        
        C:\Windows\SysWOW64\Aqjpod32.exe
        
        C:\Windows\system32\Aqjpod32.exe
        87⤵
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Agdhln32.exe
        
        C:\Windows\system32\Agdhln32.exe
        88⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Amaqde32.exe
        
        C:\Windows\system32\Amaqde32.exe
        89⤵
        Modifies registry class
        
        PID:4028
        
        C:\Windows\SysWOW64\Liqibm32.exe
        
        C:\Windows\system32\Liqibm32.exe
        90⤵
        Drops file in System32 directory
        
        PID:1640
        
        C:\Windows\SysWOW64\Pkencn32.exe
        
        C:\Windows\system32\Pkencn32.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Fdqffaql.exe
        
        C:\Windows\system32\Fdqffaql.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:512
        
        C:\Windows\SysWOW64\Hmicee32.exe
        
        C:\Windows\system32\Hmicee32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3364
        
        C:\Windows\SysWOW64\Hphpap32.exe
        
        C:\Windows\system32\Hphpap32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2040
        
        C:\Windows\SysWOW64\Hgahnjpk.exe
        
        C:\Windows\system32\Hgahnjpk.exe
        95⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\Hlnqfanb.exe
        
        C:\Windows\system32\Hlnqfanb.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3064
        
        C:\Windows\SysWOW64\Hmnmqdee.exe
        
        C:\Windows\system32\Hmnmqdee.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4680
        
        C:\Windows\SysWOW64\Inecac32.exe
        
        C:\Windows\system32\Inecac32.exe
        98⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Igmgji32.exe
        
        C:\Windows\system32\Igmgji32.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:704
        
        C:\Windows\SysWOW64\Ipflcnln.exe
        
        C:\Windows\system32\Ipflcnln.exe
        100⤵
        Drops file in System32 directory
        
        PID:1276
        
        C:\Windows\SysWOW64\Ikkppgld.exe
        
        C:\Windows\system32\Ikkppgld.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5000
        
        C:\Windows\SysWOW64\Idceim32.exe
        
        C:\Windows\system32\Idceim32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1932
        
        C:\Windows\SysWOW64\Jnqbmadp.exe
        
        C:\Windows\system32\Jnqbmadp.exe
        103⤵
        Modifies registry class
        
        PID:3240
        
        C:\Windows\SysWOW64\Jdkkjl32.exe
        
        C:\Windows\system32\Jdkkjl32.exe
        104⤵
        Modifies registry class
        
        PID:1332
        
        C:\Windows\SysWOW64\Jjgcbb32.exe
        
        C:\Windows\system32\Jjgcbb32.exe
        105⤵
        Drops file in System32 directory
        
        PID:3652
        
        C:\Windows\SysWOW64\Jcphkhad.exe
        
        C:\Windows\system32\Jcphkhad.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4988
        
        C:\Windows\SysWOW64\Jnelha32.exe
        
        C:\Windows\system32\Jnelha32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1772
        
        C:\Windows\SysWOW64\Kqknekjf.exe
        
        C:\Windows\system32\Kqknekjf.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3324
        
        C:\Windows\SysWOW64\Kjccna32.exe
        
        C:\Windows\system32\Kjccna32.exe
        109⤵
        Modifies registry class
        
        PID:1292
        
        C:\Windows\SysWOW64\Kjepcqnd.exe
        
        C:\Windows\system32\Kjepcqnd.exe
        110⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Kdkdqinj.exe
        
        C:\Windows\system32\Kdkdqinj.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3852
        
        C:\Windows\SysWOW64\Ljmfdp32.exe
        
        C:\Windows\system32\Ljmfdp32.exe
        112⤵
        Drops file in System32 directory
        
        PID:996
        
        C:\Windows\SysWOW64\Ldbjah32.exe
        
        C:\Windows\system32\Ldbjah32.exe
        113⤵
        Drops file in System32 directory
        
        PID:4668
        
        C:\Windows\SysWOW64\Lgqfmcge.exe
        
        C:\Windows\system32\Lgqfmcge.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3076
        
        C:\Windows\SysWOW64\Lcggbd32.exe
        
        C:\Windows\system32\Lcggbd32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3708
        
        C:\Windows\SysWOW64\Lmbhqj32.exe
        
        C:\Windows\system32\Lmbhqj32.exe
        116⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Lclpmdhd.exe
        
        C:\Windows\system32\Lclpmdhd.exe
        117⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Mmdefi32.exe
        
        C:\Windows\system32\Mmdefi32.exe
        118⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Mgjicb32.exe
        
        C:\Windows\system32\Mgjicb32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1892
        
        C:\Windows\SysWOW64\Mmfalimb.exe
        
        C:\Windows\system32\Mmfalimb.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2536
        
        C:\Windows\SysWOW64\Mkhajq32.exe
        
        C:\Windows\system32\Mkhajq32.exe
        121⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\Mnfnfl32.exe
        
        C:\Windows\system32\Mnfnfl32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2872
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        123⤵
        Drops file in System32 directory
        
        PID:4832
        
        C:\Windows\SysWOW64\Nmpdbh32.exe
        
        C:\Windows\system32\Nmpdbh32.exe
        124⤵
        Drops file in System32 directory
        
        PID:4412
        
        C:\Windows\SysWOW64\Nnpalk32.exe
        
        C:\Windows\system32\Nnpalk32.exe
        125⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Nclida32.exe
        
        C:\Windows\system32\Nclida32.exe
        126⤵
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\Njfaalao.exe
        
        C:\Windows\system32\Njfaalao.exe
        127⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Nelfnd32.exe
        
        C:\Windows\system32\Nelfnd32.exe
        128⤵
        Drops file in System32 directory
        
        PID:4540
        
        C:\Windows\SysWOW64\Njinfk32.exe
        
        C:\Windows\system32\Njinfk32.exe
        129⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Nenbdd32.exe
        
        C:\Windows\system32\Nenbdd32.exe
        130⤵
        Drops file in System32 directory
        
        PID:3040
        
        C:\Windows\SysWOW64\Naecieef.exe
        
        C:\Windows\system32\Naecieef.exe
        131⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1544
        
        C:\Windows\SysWOW64\Oeehdcij.exe
        
        C:\Windows\system32\Oeehdcij.exe
        132⤵
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Mfjfoidl.exe
        
        C:\Windows\system32\Mfjfoidl.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1504
        
        C:\Windows\SysWOW64\Dakieedj.exe
        
        C:\Windows\system32\Dakieedj.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2020
        
        C:\Windows\SysWOW64\Gnkfgb32.exe
        
        C:\Windows\system32\Gnkfgb32.exe
        135⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Mlhqll32.exe
        
        C:\Windows\system32\Mlhqll32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:756
        
        C:\Windows\SysWOW64\Pjjfnlho.exe
        
        C:\Windows\system32\Pjjfnlho.exe
        137⤵
        Drops file in System32 directory
        
        PID:4704
        
        C:\Windows\SysWOW64\Faholm32.exe
        
        C:\Windows\system32\Faholm32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3476
        
        C:\Windows\SysWOW64\Gjmffn32.exe
        
        C:\Windows\system32\Gjmffn32.exe
        139⤵
        Drops file in System32 directory
        
        PID:1244
        
        C:\Windows\SysWOW64\Ieijkcej.exe
        
        C:\Windows\system32\Ieijkcej.exe
        140⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Cfekaajm.exe
        
        C:\Windows\system32\Cfekaajm.exe
        141⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Fcmndncl.exe
        
        C:\Windows\system32\Fcmndncl.exe
        142⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Gmabiboo.exe
        
        C:\Windows\system32\Gmabiboo.exe
        143⤵
        Modifies registry class
        
        PID:3804
        
        C:\Windows\SysWOW64\Icifgjjl.exe
        
        C:\Windows\system32\Icifgjjl.exe
        144⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Kjknkann.exe
        
        C:\Windows\system32\Kjknkann.exe
        145⤵
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Lmicnj32.exe
        
        C:\Windows\system32\Lmicnj32.exe
        146⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Mgfabo32.exe
        
        C:\Windows\system32\Mgfabo32.exe
        147⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Akjnnpcf.exe

Filesize
407KB

MD5
cf8e2036bf3fa39edc56721097aae922

SHA1
c1133eb46034c15b123dc350279bae2097980b82

SHA256
510d9570df3124c358456b155712f0b5de7a066724e173745631efcdcea69d79

SHA512
478d433a0ff26006c9de48fb7600c9a44384de47d1444fdd5ca9c16a0c4a2b02203cdc0536fc380722a2371fa130de957fcdec6fd27db76f80b8e4ee5aced389

Download Submit
C:\Windows\SysWOW64\Amaqde32.exe

Filesize
64KB

MD5
c13f00ee742ab92808ddb3c3d7ba56d9

SHA1
fd3c49adfd628598962a04d3c49a06f01b12217e

SHA256
cf23dd33613333be0449fe987b122a950a96d6d6566fe5ec19939ca98762aa04

SHA512
af7ba3711c8eb6c69d5d5c3c0738f83a42e8a1ed33f94383b8dfba6ad1dd519649d325778744fb2b5c7003e415cb4575c961a189379a73c2c28e1bd7e2d93f8e

Download Submit
C:\Windows\SysWOW64\Aogkhjii.exe

Filesize
407KB

MD5
1eba63566cfe70fecf6ed6ea583b4ab8

SHA1
cd2435a63ab25854e842c0d42811343228f9ae05

SHA256
0a128d716ccbdf5957219c113cd7e03ea84c53a433508f8a99797e5862e1a788

SHA512
7b632f32f8f241a64a9ac879df033c0cced446e448961473399c74cf77ac577e912fe786268c408cf287c79b871d19c4a37e3ad4663a2c15df70d9bb4e6d2706

Download Submit
C:\Windows\SysWOW64\Cjabgm32.exe

Filesize
384KB

MD5
4dc913fc65e226fdd1c006cf88c41eb6

SHA1
5aeaa9ad3ba5a7eabbbdaab51aeaa4bce144e228

SHA256
4e24b6b49e37c4b81f4418165d8bf458dc28b0582dd78a34c565c07226500383

SHA512
afbfea58161eeabb983034eebac54c0acc6858d5d0e11f0c845736690485c16c8780977ce9a08b7302dabfba9877b35837b5a3264b5d47d1e257e930695f7a22

Download Submit
C:\Windows\SysWOW64\Fdqffaql.exe

Filesize
407KB

MD5
d70e7d09fbb7d7a80379f192927a3e13

SHA1
533a96234018c327aaf0d7a2f4b70d2cb3eff4cc

SHA256
685cb5c67a7fca5482f907de3d4d931b44a70a4140e6e209a346955104f3e112

SHA512
10d51aa7784e90eaa6f3bfc03b4a2eb429f891a8782f5be88f6b3635dff0658b2a2226b1f0e44dd466308e6609340e8fa8bcef6d812a91c23b09bcd85923bb33

Download Submit
C:\Windows\SysWOW64\Fnoboc32.exe

Filesize
407KB

MD5
44732ca1fc24b60be03529f8484ced86

SHA1
0a09963ce4ab6c0c542cf6b1b297a8b61f4617d4

SHA256
f816701f0ecd1937624a7ba02eeba36122930c2e042966e5bfb14ee634364f38

SHA512
b804477de891065c47e9418cc9567748d6d434e699bdd555782526f4c5c1dbd62af3f418775b42809da4ccd27830eedc3622eb4e3edbcd08856f09c223259017

Download Submit
C:\Windows\SysWOW64\Fnofpqff.exe

Filesize
407KB

MD5
645449deb3414a37b8d8b5a9967ca6be

SHA1
3aa04cad385da949e14ad087595257cf15245787

SHA256
dec198f103d76eed91111ad1066a46cc3afc2ed66f4c18d45491dd299e7e0cfa

SHA512
eab8a01b028f5ba0def462773de14285dc48a303694bde2f49cc45e0ff8dbc89ae30debd198f0ae291c0a7e749c58e196c16eed267179b117ba1da91aadd685d

Download Submit
C:\Windows\SysWOW64\Gckcap32.exe

Filesize
407KB

MD5
f5937416ecbd3a56e540769e4b67063a

SHA1
4626b45f6849956b20287ff844775bbfe289f3de

SHA256
b3147abc8b17156166774da18b47c5c200b0ec6de436fca520ee67e2811c94fd

SHA512
47e2d30b1a19b18351a07563d641b478c76a0e076504e847318568013bdd0f431b442949200a50e3492412896336306cf9de52117ef9fe18a589af982553043c

Download Submit
C:\Windows\SysWOW64\Gegchl32.exe

Filesize
407KB

MD5
5eb64873e4ff5b45e63b250c8bb7b474

SHA1
4e8f2ac6fc88d29c74c29526577e2120d49f86d5

SHA256
4942141e34fe50ce88aa85e142d50ab6e8ac0324ee515d568a5f7c73044088e5

SHA512
6c63db4fb6eebd5e0918d59f1b61cd2aceb35200493cd37acdf71e39df3759694813ddfa604a404f5b9d9c76aaa9804ef7ee593aa181df627c335892c6ed1211

Download Submit
C:\Windows\SysWOW64\Gjcfcakn.exe

Filesize
407KB

MD5
b6cce8d7f3e6c58d1924dbcf0860d0c4

SHA1
5eac1f6a5bdba0b3961c0af8df47ecdaae8a8237

SHA256
87fe0db21791e166b47422afbbd918bc95eb86e15f745055ed357e450c67d4ab

SHA512
9458159e34f80ddbf83966b8f9c29d706beaf4e6bb830d404de800d150fde3ac850e9198c8225ec69bcbd1bb155c57648487de4ed5d7809ef6727fc12534c09f

Download Submit
C:\Windows\SysWOW64\Gledpe32.exe

Filesize
407KB

MD5
548ce8098f949da513c8ae796b949fd0

SHA1
2363b03e38786011936b00b274be194ce032bbf9

SHA256
dab3071f64d4c4faeedd2bbb27db8d05239856865bc5d4886c220f9e6b45ffe5

SHA512
8da3a1dc7a3c09c2c9c0db437ee611e13653c0588405969e41e658cc1920a60fd6c1f854771e1b398f4cd1d16d50e8247a23bf32440d64189fe9b0ba23a1c6a8

Download Submit
C:\Windows\SysWOW64\Hcdfho32.exe

Filesize
407KB

MD5
c22f42750a6e0b77eef62d0500781815

SHA1
37d2cf706e7e61df9f1543a59c7209863c10e841

SHA256
eb8810a063b46fcdf79ec9416997d0c6f675c7ffa557e9277099a22bb9cd2c57

SHA512
1c99367cdde0d56990ff07472598159f3f14d96eb3cae0228063abadc0c996338c6bd497e4e2443df8d3d4aa8544cd7c913c68f369b19071f67476a8ccfeba03

Download Submit
C:\Windows\SysWOW64\Hfbbdj32.exe

Filesize
407KB

MD5
c32120db52899975bf56893fa9738e2a

SHA1
5ad5144dc4e8ba52ab08510b454bd7b84d7e6681

SHA256
696706a32c4b8905528dad4e64d5b8fae3fca67d6c1802e06fff819d95e5e3ab

SHA512
d32bff3bf46b0806076fa3ae98ea6adc663d5ab7762dc5beffc6bbe56b8f6e14794b4aa72e3f4111d3a8c7fe822611fe48db74df95d7eb8554c430d5c47add47

Download Submit
C:\Windows\SysWOW64\Hgdlcm32.exe

Filesize
407KB

MD5
1c9812a745928547954c6e0cb456d6de

SHA1
e4607ffd37591754b1f8e87910b9fa169a6c3598

SHA256
6429bb19f51d631aa7d28f17d6ad9ef823230a15fa9fa6b24bef748ce231d587

SHA512
cf45ad92900fbb7b630fccd5005ab468b815baa610d111805b1e0408517b61e7cbfcdefc33d962acdfc974ca54f569dfbbcb6efbb84ab4d641a9cc0d51e37532

Download Submit
C:\Windows\SysWOW64\Hgkimn32.exe

Filesize
407KB

MD5
41ab89e7afcfcf7683082faba33676a5

SHA1
e5af36137bff96445fbae9895ba7e28139d9394d

SHA256
adc4e6b7cde1c7902ce162058b66d6978480e423f56d048717566571b3f22b6c

SHA512
eb02413b3f7721ca98b7f5e7235e92ed6166aecd484fb140df3aa3c6149e684d69646524033ebbae7a1e762d7aab3c100fba4cfad175f7ec3fcfd74e8623ea16

Download Submit
C:\Windows\SysWOW64\Hgmebnpd.exe

Filesize
407KB

MD5
dbef06a4d3410f3a5acf847f07ab825d

SHA1
d2c696a67260121f71e6ea83e3098e2d775d6d19

SHA256
df75e43ae0ffb1ed3f1a60ed898102f69b8feec45dd77977f24197506c33bc88

SHA512
22d1016df3dc6fdcfd8ae3e0b1bf94684fbea0575d59febdebc15311b3af355f43fd562c4338e1b2dad71ccfcf623fc3d3444cc1fde04f9dfb1226eca444a255

Download Submit
C:\Windows\SysWOW64\Hjieii32.exe

Filesize
407KB

MD5
5b481237c6207a1897d671fbbf1b2cc4

SHA1
8f7cab835f5abfca481ee2fa65d3a6fdc26a423c

SHA256
bc9f5b2e215be7b1cd8e9cee437f67be39540052471ac40c41053ada06ce3c34

SHA512
95fd7f205a87798cf656e6847a4542548e1991a1440df45a67f74f6215e62542550268151a503d05bbd982714630881bd788a37168e313b0dbb187fddb17467d

Download Submit
C:\Windows\SysWOW64\Hladlc32.exe

Filesize
407KB

MD5
ba5b899406eb68c50a8cf0cc07d6a5da

SHA1
fef26b038e4a704a61d20f3159e3b10926767340

SHA256
f1278002ddc463b836d10a111b05539717405b87da4f9383a7eda8e4f4ba7fdc

SHA512
482323886b2455f24a2d4499cd83edb974a39ca2a8adb49369ffcffc52123507955b2580fd11331e5a68589c7b982aaa4834c233afe38b07ea4b428c03a86b71

Download Submit
C:\Windows\SysWOW64\Hlnqfanb.exe

Filesize
407KB

MD5
38cd204a09c6195844f6f8041700c918

SHA1
71ea499482ae910dc1ec6c2b76d8d10c31a7f878

SHA256
9102da50dfaf4126943cb5a64578e55904ad13e4c8636805a57595ad451f4d0a

SHA512
594fd8917fff55bb3b6f2a53d717bf8cd998cd0dc25b60132f047a551c54f6a481048c08c631b11361f45ee0a6414187028c240b0a0f1f8b3722213756da26f8

Download Submit
C:\Windows\SysWOW64\Hphfac32.exe

Filesize
407KB

MD5
6e5cb7d809a62acc67415b5e9dafcf1b

SHA1
eaeaf2c1b831c005376d4e7bbbfa8a1282aa9719

SHA256
7cc82fcebebc72ffce910e78822e6b9daacb7fa323cbe50559c1b2cb1da6388e

SHA512
366388f246dbbcbd1aeb6c9c06af08807b5bbd831a96fb8b457bc653b7ff9d3675216c960b4500b7dc6429bb0953e7a4eacbddc0faa77c4718000beaf21692f4

Download Submit
C:\Windows\SysWOW64\Idceim32.exe

Filesize
407KB

MD5
5a23585ffbb2983e9532c2316e758aa9

SHA1
6881a35062cd403fc55c265f1b0d474e14a0cfd7

SHA256
d8a8c25092080fa86dd5c7ed447b55e84686838158d681b04c167ec7bbc2eaa5

SHA512
78d1c8031911f186ebe4418345d5e7ba21c9d18c4225af4d090e04dda70946486104934b6d23832ec274bc2931c5dfde1c9d96c294a14c7c2f7a8ddbcd3a0927

Download Submit
C:\Windows\SysWOW64\Imcqacfq.exe

Filesize
407KB

MD5
23160977e1d21bd984f37f3116137c4f

SHA1
c9dc49422dde840f80cb6d92bc6635fc188a9157

SHA256
69ff38103a6d7e76842ed94ea1325d7ed73b3d470f73b155b0b3460aea834893

SHA512
f235fbe53a54c6ae6801dc52e5238c07c5a6db43b48de3da4ed116879aa40d2ce03fe11fd191419fdd266f349b28d94a3ee071f4e131f346343d531c67464764

Download Submit
C:\Windows\SysWOW64\Imfmgcdn.exe

Filesize
407KB

MD5
08051f8f7ccd6b1c356536bd6bcf44d4

SHA1
c22ca0f540787f60f9effd26672854a383bb9d39

SHA256
2c1595d9ab84b2626dfe45849db811441a18516c267363a631f0d9fbb8825639

SHA512
a040df6cda153b460b0eee27f74e2bd6458f129692539424032c2c7126701393e57d5c14ff8f34492895b02a161706d699b4b47f63ee52fa8903565185816f0e

Download Submit
C:\Windows\SysWOW64\Inecac32.exe

Filesize
407KB

MD5
35ce3c233a5c9bb431ede201bfa5a95c

SHA1
a713906e5b43f98b7f9483ae943c6e09b724a437

SHA256
9d17b5d126b7e8fc2442715f3f17f6e85cb72bf3d35e98e41c271e60836627c8

SHA512
c0209e6c00a415168d2fd4ee63bca5cf2880f4aa1e4ad0b5f7522d978c27d952c48c6ba5998d12f6d45e049d92ee2ffb31d8a8a52a0bddd520cf7a311d20bb61

Download Submit
C:\Windows\SysWOW64\Jcokoo32.dll

Filesize
7KB

MD5
94720fb3001fecc20bb233972e0318fa

SHA1
5c56801c10c1d160457cef3993d7dcd893c7890d

SHA256
902a464819adcdecbd506a3090835d1c0e0f93bb96d8e68c409007a93bab001a

SHA512
fe07537cfbeeccae00e6787760c00628ee57f9b7675a47c0077fffb98d5b745c9045c941558cc7cc86d38dad395ed2819f0a3f853777afd7509cafd753d1ad19

Download Submit
C:\Windows\SysWOW64\Jggapj32.exe

Filesize
407KB

MD5
0a355438c89bc2f5b7d01f7bef4015f0

SHA1
11a4bd0f7a8b6b52a0ed9142930d867df0ec317e

SHA256
658de35eb2ac66134759840e9d6e04c7faeaf7c1015982152a7efeda8dd95573

SHA512
239949258655577804603405e728d8c36ad7141fbed8247ea8e0b083d966207b46fe0d64ad9ce438247755ab8f5520f23c6415dd0a5fd06310624259ae9612ce

Download Submit
C:\Windows\SysWOW64\Jglkkiea.exe

Filesize
407KB

MD5
f50e98cbf7555aee287062daf8ecd65c

SHA1
ae62b006f0fd840302385530a3231940ad0e1d0d

SHA256
266c82c67a9db1eca33def78adbf9ec758cd9b080d6035b25fee713b89b4f90e

SHA512
8f6e3456782c789f7f600f10ff1e55949fca116fdae857cd0bae36c97ede1e0c2e1fdb3c3341c8becfc529cbcad3b492beb15766c6bab55d103fd332594be20b

Download Submit
C:\Windows\SysWOW64\Jidkek32.exe

Filesize
407KB

MD5
373b5a2b8e6c743cfc42f3f8fa072f9a

SHA1
fd638ae8782b87a0dfa27b01c38e1637ac73f487

SHA256
bfac18d8d8123e7fa74c83cb3925796371ea975895ac2d5ff3ba298921927170

SHA512
198d4cbb017c27a72bc5e0335522ca2ecea5d495564b4da11647de48a96d14bde8c5c3be20f5fe38aab5f1c903202c17d474dcc0ac4d0836fc7d605d5d98c8b0

Download Submit
C:\Windows\SysWOW64\Jjgcbb32.exe

Filesize
407KB

MD5
be238197ba44207a6bdea0f1d4082ce5

SHA1
e53d16931bf40d73030f4a637f5270ce00702587

SHA256
59630d7f615782e8084af5ff064acc626d55c6710ee544070d2275e358ac0e31

SHA512
f6e56fa34629be90e2bf2fd639395d13119f5f22ad6f0ed88da5bd2e0f76e4084c88e2e29e45eabe23eed5c21630b3d1e2169f1798f438f3fd5088d295faae9d

Download Submit
C:\Windows\SysWOW64\Jjhjae32.exe

Filesize
407KB

MD5
eb3244336bd7bbc89a236cba9eefa2ea

SHA1
6bcd7acdaddc0e6bee52c1e22136dbf6f78ea809

SHA256
e6c9ea3cd04ec0310a4715c2f0eeedf42b882f13297008203b6561fa65885a74

SHA512
208d57396671eda15884e970940d0b255c64545bca2fec9cca093b530ccca877809c8ec5b1c9891ee95cd083bea2ed84bb613ce2e794d3f1558ac75718e78e55

Download Submit
C:\Windows\SysWOW64\Jjjggede.exe

Filesize
407KB

MD5
74cc51ce0c311781c9f78e4652df847b

SHA1
97c1d05a627a9ea4e3111a60d1c61fcfa0b22003

SHA256
a33dd8d29e14311907fb8001516632a27c6d7d9444da7ccec8ef5a9dad41dd1d

SHA512
30b539e66303f17f531d67789da51ccbba009fdedcc10b4c3ee2342d7742723d47f512cc836626d59fa37faaf93ea1fe6679b127055210501d1bd282874f29f2

Download Submit
C:\Windows\SysWOW64\Jqofippg.exe

Filesize
407KB

MD5
69a4974e0d3ec62ab5f0214d10d5e29e

SHA1
780d504da54a824c63a0bd54ccf24a932ecd9380

SHA256
6f3a3fe9e83af14d1802749f9ccd4590c0913c2ad3c9b96e67732f9ecd667615

SHA512
11b426570c3e1e21e88307456911118f0d7ca4f300b4a21ac4cd5049b074e4a6fd213c99c3479c670eb6db28d0e6f3928847f18694331569d1e789ec1e4a9966

Download Submit
C:\Windows\SysWOW64\Kakednfj.exe

Filesize
407KB

MD5
1a886d56710f71e6b2f65bb5dae14881

SHA1
2ed8aae4eb7f2e548b0c5c4dbbe4d4cff13305f8

SHA256
b35e748b9862d664b2a81c42c281383c1b1023eecbc4c654a75f30a4f0d08499

SHA512
d22d4eff8566630579ab27b56e9c13bcfff75850322f90e7413d5c603a04b6b8c3e1e58d06ed84cc7233a32c14f01f5494b7f73700dbe51927e0d06a2637a2e3

Download Submit
C:\Windows\SysWOW64\Kanbjn32.exe

Filesize
407KB

MD5
b02e1a8c04d3c90ff8c5f56673f816e7

SHA1
7f0ba8eeec6363d33f50984957a022e8aeee8d82

SHA256
33f39aaa629374fd7754b62b9e26396b69376c1d214210c9c0d0a1574f9b9d52

SHA512
b29657164b3a4a6269bc044252edf19fd88230c3be1c4a72f57a7f5ab0aeddd06cf3de40ee3d7b642948a7a8cf0fa5bead905dd91ad0a8e07e9f7e1560863880

Download Submit
C:\Windows\SysWOW64\Kciaqi32.exe

Filesize
407KB

MD5
e727663342037bc13e29c7afbc9b0f98

SHA1
022705b84d9a7ecfcdafd6e5b1e1b6186dbffd88

SHA256
b52dc8e37d4444fe9be49567a238676a376b125b48b329059183cdcae9d82b68

SHA512
bd1e20a31ffb7760445f972613f8b81edd3cd18f9131dbb55124d41e3fe6280c961bb331b68b828246c7ae9beaf30df2d7e9d1e9a652f8804decf489fcb50243

Download Submit
C:\Windows\SysWOW64\Kclnfi32.exe

Filesize
407KB

MD5
1b6e50097b312dd81d428e93a527ded5

SHA1
1a6ffc44ce5ef5251693474ad3c14cb424a757cc

SHA256
f3a320e5421b60d2bba485f6039290ac3ff048cb4f163007652b4f4577395c07

SHA512
42d126f588dfc132014804b27ba8bdefbb6e26527083e3d63b133b69209d54c24984bfacee4148b98d6cff753f6f8a59a7b518d4ac4ed70ccdb97e5be9b5c0ee

Download Submit
C:\Windows\SysWOW64\Kdkdqinj.exe

Filesize
407KB

MD5
3dae92aacdcfb4e136b8399ba9b3ec23

SHA1
81763e7a68421d9a3360da819e92de14a1e9d083

SHA256
7ffbc8bae83e0c975e494acc373e949cfcbb5b99539258e1071f13256224987a

SHA512
35aeffb0741289e0a3d936aad5da132b1e90e27dbf9ba747a535396c91e1b4ad2a8a2a8d600bbb4b49a6cf9925a93a1f71f0bc81245c20bf1b1481a133a09b3b

Download Submit
C:\Windows\SysWOW64\Kjknkann.exe

Filesize
320KB

MD5
f87470776b964b91718ce1ab7649f436

SHA1
39b3e4d9c09ebe18881bb2648e46a84b5a170494

SHA256
39b099a225eb9273ac413bac887867e89b3e4e29a569e46d5270429eab28fc6d

SHA512
1f6428512784c3249ad252dc204413c21836aa2c7684179c0ee5973f64e4b0ab39155bda54cce2a2e7fb250aa8d105523efab0ce133d72ea67055e2f098621bf

Download Submit
C:\Windows\SysWOW64\Lcggbd32.exe

Filesize
407KB

MD5
b28a0bdd1c9cea8e1b8ee7931d80f5fe

SHA1
292e6ebc6bafd87fc7bdcba974f0389a616d27b6

SHA256
7eab33dc13626fe469b3b74f15a5ebb8aab11ff0ffda1971344a23f60acf9230

SHA512
05a563078055b069c4219851265f467042de98cea949e153b7287cb3d4b8b4118bcf93c810a75d6d0b1580dbd45d6bf02dd35e58ed7f7a6be70ac576f2e84cea

Download Submit
C:\Windows\SysWOW64\Naecieef.exe

Filesize
407KB

MD5
8c323b8cf8cd50ffb02ccd51d49d6a68

SHA1
4161582d16fcdd9912750f8960e9633406b6b7bc

SHA256
d96152fa6962047d39e0a541c097c18e49b907564d7ca857c3191c24c2e0e3a8

SHA512
0185371078174a659de91a2d01ed88013d2520cd34b0acf59ba5f616c1b3e24561f6adb654659d6611af955249cdd5711ea82ba95f86ceed9d06f19c3f749f7c

Download Submit
C:\Windows\SysWOW64\Nbdkhe32.exe

Filesize
407KB

MD5
eafde56ff72111454ac7da7b46602a69

SHA1
5edcdcc17c62e0ca6032a1a84f242468467fc67d

SHA256
50ddcfc7ce6a0be490762adbaf67dc09b312a4cbde7096d6680214e61b66d2e3

SHA512
ba9644b0a92d42a2015e60657d87eb1d9d77211596e4bc196a17a2407f029612bf8fbd32c3b9e778a220756238356b5d837c7e2887fc6750b3f634bdc029095f

Download Submit
C:\Windows\SysWOW64\Nfabok32.exe

Filesize
407KB

MD5
56b3fb2212b06504510b64d85542ee74

SHA1
b7092c9c29a1bffaeadf012dfb22a703545f15f6

SHA256
393f5330c4fbc7c3387b424082bdcc34418adfb47b9e25d9ce871b2499d5ef7c

SHA512
595c7869a1573552812f48c00ea77477022d91a16a6f496c969179d2479b7632e34a3bdcd20ca799cd994d3b5a6d27cfac2bb2381efea7c2e3c3f82e2048f6ef

Download Submit
C:\Windows\SysWOW64\Nfnjbdep.exe

Filesize
407KB

MD5
5f9b185b12ea627e2f2ac0fdcbdd22e9

SHA1
500104a090d537fa104fdb8747e406b1e60a7b8a

SHA256
55153e02b2dce97cecfbd4e5c2b9109a215521bbb2014d6169167817643a16ca

SHA512
d6dcedcfd9d253427a70d748bebe2e472cd6fa29b70ddb46b77a423d9bb910244ed5fb4448a2e8dac5840b519efa1776bee78d6e4cbce0e36d4770cdcf4d1ec1

Download Submit
C:\Windows\SysWOW64\Nggjog32.exe

Filesize
407KB

MD5
4dcc444437c083ce47784b53c0dc0ae5

SHA1
884d6a736114d594354cd301b62789904cf22d36

SHA256
ac83d534f201e27263f6223dacfbf24c096cf05a8db1c188721e966bb61b90a1

SHA512
a3aaf4f091b5deb970108a239abf812b31d740695083cd44940d7fd60975999bc9842d9b37a650ccefd66832cb0206482fea3055f75d8186518f7edb49200971

Download Submit
C:\Windows\SysWOW64\Njinfk32.exe

Filesize
407KB

MD5
a681303d4db765c8f1286253f6ce5320

SHA1
21e3ce60b293114be8cc98213407696c31f3b354

SHA256
34b0a797ff1c2c54b031d67f5991db44fc32a600f8b792985bbe643eed90ce07

SHA512
e623ce9348487734581585488910f87b867b267464ddb80c6f7896d6726a5b584631842d53f369bb2db60b1e10c6a6eb87ae860c282e70768bf8a958b42cb229

Download Submit
C:\Windows\SysWOW64\Ocdgahag.exe

Filesize
407KB

MD5
d25055a6af6b11c5b09fb428582d7644

SHA1
901696e907062044882c50f053ff271ad4270c5c

SHA256
81f144abb1948ff2d03e7d55f088ded8fb194d1e7ff77694866009e90eff3753

SHA512
ee27ece6bf2516e0b9f8c2f8caf53434c77ada47ac1b6f663866fc3083fd96da747cfb826d99890f9d6e3e51b1282a8212ee13529ac92379d50f5bea0e961059

Download Submit
C:\Windows\SysWOW64\Ofdqcc32.exe

Filesize
407KB

MD5
e43e0637649b802130522cff4378d374

SHA1
25117e1bdee642eee297b2d5c3a575c1ddf698de

SHA256
0adfd087eedcd5301131f96118f2e03904689441b0c7e2955829abe936ef0830

SHA512
38e6381867e1d503722ecd20fc31819eafec46b00e42579a0934058eb2f0b457b6698d5b924e058e5ca52594b5dd196b41dbb8c727148a802411b273d7301e8e

Download Submit
C:\Windows\SysWOW64\Ohqpjo32.exe

Filesize
407KB

MD5
b315fb7993512e2b970620ef6ae9d369

SHA1
b786269aa0b3490eb9baa781ae507c7fdbd7d4b3

SHA256
607f238da9afed1e8511627c850bfc91298bff5e23089aad570a95d347e6c382

SHA512
f22c6d14e569f84ac43c9b9a6db291e45718752da616b4b7a946a59a858b8b9089ab2328e5ae91e1f7450770ee7a691c8c264a0fb71dd8d0f3e14086bc2a907e

Download Submit
C:\Windows\SysWOW64\Okceaikl.exe

Filesize
407KB

MD5
b2cfe82d2f904032528cb9b0502c6efa

SHA1
b6afd5573ca53a3ac683fc4af0a239599ce2a573

SHA256
1f47bfcd5ca1e34545089acdc237da7b68ef78bff8a73dc814a5d0b9da738674

SHA512
9c032235d9b76372f38bb8c28e7939d1da1a3f61e5ab652dde50de11048e902e45c5b4fc38cde45142f09c7bc13fd54208aee915219e66772d362f1538a59e2c

Download Submit
C:\Windows\SysWOW64\Pjjfnlho.exe

Filesize
407KB

MD5
26210720f2449074347113679d2ab210

SHA1
0fc704dfef1ef0a954b1e532cd0bf8d0e8aeb33f

SHA256
4e5cd941ce06dbda85984af063c7dba3510121f4d77bb6a206f7c4d171c33771

SHA512
85c777431e15b5f68f023703a83384399d3d172e14feea37919371a14ba21255869f89366dd4950e986623b76720c41c7f77894c022176869b6ae2af1b8edd0e

Download Submit
C:\Windows\SysWOW64\Qniogl32.exe

Filesize
407KB

MD5
fe5aa4f7e1df34a5881551b8fa61f4fe

SHA1
64b9851ed7c980b39c79965af67b5d6bc56d5e30

SHA256
2724b2d4443bafe8aeab80ad5f5c226b758f2ed318d1cf7deede15a802b538e1

SHA512
c80805aa539411d2f93d064e232d64192530bbf8bc33ab7cbb031a4fb2832d12af44849eadd5818a13f087cb10577e7035ccdd5745ffa341079ed690eb6ec4d5

Download Submit
memory/368-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/436-283-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/436-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/872-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/876-36-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/960-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1008-84-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1076-458-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1168-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1276-163-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1280-531-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1384-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1488-367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1584-295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1584-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1676-265-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1676-87-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-102-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2004-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2124-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2168-525-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2232-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2232-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-526-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2388-115-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2388-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2532-139-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2732-123-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2864-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2864-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2952-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2996-180-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3120-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3152-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3240-320-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3308-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3308-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3340-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3432-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3432-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3592-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3592-99-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3800-538-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3892-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3904-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4088-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4088-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4116-558-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4128-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4188-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4188-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-564-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4368-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4472-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4472-71-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4488-155-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4604-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4704-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4708-416-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4740-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4740-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4832-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4832-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4960-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5020-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5020-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5068-204-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads