6cee5f2b8460066abc1ab8323fe4add556263d03b330a374bae4d5cfca45166a

Analysis

max time kernel
162s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 19:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1958678990866415b16e6177fb8df591.exe
Size 136KB
Sample240409-xxcp9aad41
SHA256 6cee5f2b8460066abc1ab8323fe4add556263d03b330a374bae4d5cfca45166a
MD5 1958678990866415b16e6177fb8df591
SHA1 5b710331774c213b646cb1ac757947e591a52268
SHA512 3c7efa4b370a0d3182e99b0323883a0165ef4c425ecf9bcf25f2ae7595d1a60c46c76a29ee17f6ccf2101e31b1b4f7768ef74731eaf6738935d83234d5ac943d
SSDEEP 3072:UldqedCRrm5sohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:adqW5sohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbfmgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgjglg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clijablo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgfmeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ooangh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acppddig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkbgjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhlfoodc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piceflpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daeddlco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apkjddke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlncla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkohchko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpjelibg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohobebig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcbgfhii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	1958678990866415b16e6177fb8df591.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glchjedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cplckbmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgfmeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndjcne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcegclgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcbgfhii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjcfcakn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cblebgfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcofbifb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hllcfnhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apkjddke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beaecjab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hofmaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pknghk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfjcep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikhghi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpandm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeglbeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijpepcfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgklmacf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnbgaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npcaie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcnbekok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecdbop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdppaidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belemd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imjgbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljncnhhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmkpipaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ladhkmno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfjcep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclppboi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acppddig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahkkhnpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmbpjfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gajpmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjnlha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjnlha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikhghi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilgcblnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhgdmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edoncm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igjlibib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nandhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlncla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcmnkh32.exe

Executes dropped EXE 64 IoCs

pid	Process
2436	Pcegclgp.exe
2384	Bbfmgd32.exe
1528	Cdhffg32.exe
232	Cgklmacf.exe
4420	Daeifj32.exe
1264	Dkpjdo32.exe
4172	Dkbgjo32.exe
2616	Ecdbop32.exe
2224	Ekqckmfb.exe
980	Fqphic32.exe
3288	Fjjjgh32.exe
2232	Fqfojblo.exe
2356	Ggccllai.exe
3872	Gkalbj32.exe
4480	Gdknpp32.exe
2124	Hkohchko.exe
2116	Ijiopd32.exe
1280	Iccpniqp.exe
5056	Ijpepcfj.exe
2140	Jnbgaa32.exe
2128	Kbjbnnfg.exe
4780	Lhgdmb32.exe
3028	Nhlfoodc.exe
1096	Ooangh32.exe
2836	Pcbdcf32.exe
4700	Piceflpi.exe
556	Qfjcep32.exe
4364	Acppddig.exe
2212	Apkjddke.exe
3800	Bmagch32.exe
3464	Bclppboi.exe
1132	Beaecjab.exe
3796	Cplckbmc.exe
5052	Cmbpjfij.exe
996	Clijablo.exe
452	Dlncla32.exe
1448	Edoncm32.exe
416	Fgfmeg32.exe
4092	Fcmnkh32.exe
732	Fpandm32.exe
4948	Fcbgfhii.exe
1128	Fpfholhc.exe
2820	Gjnlha32.exe
4888	Gjcfcakn.exe
1396	Gnckooob.exe
2296	Hdppaidl.exe
1428	Hjlhipbc.exe
2796	Hgpibdam.exe
316	Igjlibib.exe
1572	Jjakkmpk.exe
4472	Jglaepim.exe
2868	Kjpgmj32.exe
684	Ljncnhhk.exe
3448	Mdmngm32.exe
2352	Mhkgnkoj.exe
3376	Mackfa32.exe
4016	Moglpedd.exe
2100	Aeglbeea.exe
3252	Belemd32.exe
1176	Ciaddaaj.exe
3064	Cblebgfh.exe
3624	Dfemdcba.exe
5132	Ehnpmkbg.exe
5168	Eojeodga.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fochecog.exe	Eipilmgh.exe
File created	C:\Windows\SysWOW64\Biledggj.dll	Hcofbifb.exe
File created	C:\Windows\SysWOW64\Pnlhmpgg.dll	Bbfmgd32.exe
File created	C:\Windows\SysWOW64\Lhgdmb32.exe	Kbjbnnfg.exe
File opened for modification	C:\Windows\SysWOW64\Edoncm32.exe	Dlncla32.exe
File opened for modification	C:\Windows\SysWOW64\Fcbgfhii.exe	Fpandm32.exe
File opened for modification	C:\Windows\SysWOW64\Hdppaidl.exe	Gnckooob.exe
File opened for modification	C:\Windows\SysWOW64\Ljncnhhk.exe	Kjpgmj32.exe
File opened for modification	C:\Windows\SysWOW64\Daeifj32.exe	Cgklmacf.exe
File created	C:\Windows\SysWOW64\Ecdbop32.exe	Dkbgjo32.exe
File created	C:\Windows\SysWOW64\Hdppaidl.exe	Gnckooob.exe
File created	C:\Windows\SysWOW64\Mqhali32.dll	Kjpgmj32.exe
File opened for modification	C:\Windows\SysWOW64\Mackfa32.exe	Mhkgnkoj.exe
File created	C:\Windows\SysWOW64\Fcmnkh32.exe	Fgfmeg32.exe
File created	C:\Windows\SysWOW64\Gnckooob.exe	Gjcfcakn.exe
File created	C:\Windows\SysWOW64\Glchjedc.exe	Ggoiap32.exe
File created	C:\Windows\SysWOW64\Lhpppcge.dll	Glchjedc.exe
File created	C:\Windows\SysWOW64\Dnjhjpin.dll	Kmkpipaf.exe
File created	C:\Windows\SysWOW64\Kfjjbd32.exe	Kmkpipaf.exe
File opened for modification	C:\Windows\SysWOW64\Mbldhn32.exe	Kmjinjnj.exe
File created	C:\Windows\SysWOW64\Fqphic32.exe	Ekqckmfb.exe
File opened for modification	C:\Windows\SysWOW64\Hkohchko.exe	Gdknpp32.exe
File created	C:\Windows\SysWOW64\Kpjlgn32.dll	Hgpibdam.exe
File created	C:\Windows\SysWOW64\Ggoiap32.exe	Fochecog.exe
File created	C:\Windows\SysWOW64\Hcfcmnce.exe	Hllkqdli.exe
File created	C:\Windows\SysWOW64\Jmdjha32.exe	Imjgbb32.exe
File created	C:\Windows\SysWOW64\Pmmfoj32.dll	Gkalbj32.exe
File opened for modification	C:\Windows\SysWOW64\Jnbgaa32.exe	Ijpepcfj.exe
File created	C:\Windows\SysWOW64\Mhhcne32.exe	Mmbopm32.exe
File created	C:\Windows\SysWOW64\Lqcnhf32.dll	Hkohchko.exe
File created	C:\Windows\SysWOW64\Mejcig32.dll	Lhgdmb32.exe
File opened for modification	C:\Windows\SysWOW64\Apkjddke.exe	Acppddig.exe
File created	C:\Windows\SysWOW64\Elomej32.dll	Jglaepim.exe
File opened for modification	C:\Windows\SysWOW64\Pdbbfadn.exe	Ohobebig.exe
File opened for modification	C:\Windows\SysWOW64\Ikhghi32.exe	Hllcfnhm.exe
File created	C:\Windows\SysWOW64\Oqadklae.dll	Ikhghi32.exe
File created	C:\Windows\SysWOW64\Daeifj32.exe	Cgklmacf.exe
File created	C:\Windows\SysWOW64\Igjlibib.exe	Hgpibdam.exe
File opened for modification	C:\Windows\SysWOW64\Igjlibib.exe	Hgpibdam.exe
File created	C:\Windows\SysWOW64\Belemd32.exe	Aeglbeea.exe
File created	C:\Windows\SysWOW64\Cljmka32.dll	Hllkqdli.exe
File created	C:\Windows\SysWOW64\Ndjcne32.exe	Npjnbg32.exe
File created	C:\Windows\SysWOW64\Pcbdcf32.exe	Ooangh32.exe
File created	C:\Windows\SysWOW64\Kmkpipaf.exe	Jcpojk32.exe
File opened for modification	C:\Windows\SysWOW64\Hcofbifb.exe	Gajpmg32.exe
File opened for modification	C:\Windows\SysWOW64\Dkbgjo32.exe	Dkpjdo32.exe
File created	C:\Windows\SysWOW64\Gkalbj32.exe	Ggccllai.exe
File created	C:\Windows\SysWOW64\Qpiidi32.dll	Apkjddke.exe
File opened for modification	C:\Windows\SysWOW64\Clijablo.exe	Cmbpjfij.exe
File created	C:\Windows\SysWOW64\Jkebbq32.dll	Ggoiap32.exe
File created	C:\Windows\SysWOW64\Mkaddkgn.dll	Ladhkmno.exe
File created	C:\Windows\SysWOW64\Cieonn32.dll	Ooangh32.exe
File opened for modification	C:\Windows\SysWOW64\Fgfmeg32.exe	Edoncm32.exe
File opened for modification	C:\Windows\SysWOW64\Hgpibdam.exe	Hjlhipbc.exe
File created	C:\Windows\SysWOW64\Nccmog32.dll	Nfaijand.exe
File created	C:\Windows\SysWOW64\Npcaie32.exe	Nandhi32.exe
File created	C:\Windows\SysWOW64\Dkbgjo32.exe	Dkpjdo32.exe
File created	C:\Windows\SysWOW64\Cblebgfh.exe	Ciaddaaj.exe
File created	C:\Windows\SysWOW64\Kehmcnda.dll	Jcpojk32.exe
File opened for modification	C:\Windows\SysWOW64\Ljmmcbdp.exe	Ladhkmno.exe
File created	C:\Windows\SysWOW64\Npjnbg32.exe	Nfaijand.exe
File opened for modification	C:\Windows\SysWOW64\Ndjcne32.exe	Npjnbg32.exe
File created	C:\Windows\SysWOW64\Cmbpjfij.exe	Cplckbmc.exe
File created	C:\Windows\SysWOW64\Jpgcpo32.dll	Igjlibib.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
208	640	WerFault.exe	205
4932	640	WerFault.exe	205

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nflcpb32.dll"	Ljmmcbdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpjelibg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iccpniqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mejcig32.dll"	Lhgdmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbnanfnm.dll"	Hofmaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eigdflna.dll"	Jcnbekok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjpoio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apkjddke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqhali32.dll"	Kjpgmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljncnhhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcfcmnce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noabkh32.dll"	Fgfmeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmkpipaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmbopm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpgfeb32.dll"	Bmagch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjpgmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eojeodga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bclppboi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbelak32.dll"	Cmbpjfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjnlha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gjcfcakn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	1958678990866415b16e6177fb8df591.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjkdkibk.dll"	Gdknpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofaqkhem.dll"	Qfjcep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acppddig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cqiehnml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlbkfqkc.dll"	Gajpmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdmngm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ciaddaaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggoiap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhhcne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnjhjpin.dll"	Kmkpipaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfjjbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdbdih32.dll"	Lpjelibg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecdbop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fpandm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcbgfhii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njanjn32.dll"	Dfemdcba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkhbnh32.dll"	Cqiehnml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	1958678990866415b16e6177fb8df591.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpfholhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belemd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hofmaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndjcne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gajpmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfabk32.dll"	Fpfholhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohobebig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdaleh32.dll"	Dkbgjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdeeipfp.dll"	Fqphic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmfoj32.dll"	Gkalbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmagch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abocgb32.dll"	Daeifj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmngm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jikjmbmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kehmcnda.dll"	Jcpojk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhgdmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edoncm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilgcblnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkebbq32.dll"	Ggoiap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	1958678990866415b16e6177fb8df591.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbjbnnfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenlmopg.dll"	Nhlfoodc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cblebgfh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2436	1420	1958678990866415b16e6177fb8df591.exe	97
PID 1420 wrote to memory of 2436	1420	1958678990866415b16e6177fb8df591.exe	97
PID 1420 wrote to memory of 2436	1420	1958678990866415b16e6177fb8df591.exe	97
PID 2436 wrote to memory of 2384	2436	Pcegclgp.exe	98
PID 2436 wrote to memory of 2384	2436	Pcegclgp.exe	98
PID 2436 wrote to memory of 2384	2436	Pcegclgp.exe	98
PID 2384 wrote to memory of 1528	2384	Bbfmgd32.exe	99
PID 2384 wrote to memory of 1528	2384	Bbfmgd32.exe	99
PID 2384 wrote to memory of 1528	2384	Bbfmgd32.exe	99
PID 1528 wrote to memory of 232	1528	Cdhffg32.exe	100
PID 1528 wrote to memory of 232	1528	Cdhffg32.exe	100
PID 1528 wrote to memory of 232	1528	Cdhffg32.exe	100
PID 232 wrote to memory of 4420	232	Cgklmacf.exe	101
PID 232 wrote to memory of 4420	232	Cgklmacf.exe	101
PID 232 wrote to memory of 4420	232	Cgklmacf.exe	101
PID 4420 wrote to memory of 1264	4420	Daeifj32.exe	102
PID 4420 wrote to memory of 1264	4420	Daeifj32.exe	102
PID 4420 wrote to memory of 1264	4420	Daeifj32.exe	102
PID 1264 wrote to memory of 4172	1264	Dkpjdo32.exe	103
PID 1264 wrote to memory of 4172	1264	Dkpjdo32.exe	103
PID 1264 wrote to memory of 4172	1264	Dkpjdo32.exe	103
PID 4172 wrote to memory of 2616	4172	Dkbgjo32.exe	104
PID 4172 wrote to memory of 2616	4172	Dkbgjo32.exe	104
PID 4172 wrote to memory of 2616	4172	Dkbgjo32.exe	104
PID 2616 wrote to memory of 2224	2616	Ecdbop32.exe	105
PID 2616 wrote to memory of 2224	2616	Ecdbop32.exe	105
PID 2616 wrote to memory of 2224	2616	Ecdbop32.exe	105
PID 2224 wrote to memory of 980	2224	Ekqckmfb.exe	106
PID 2224 wrote to memory of 980	2224	Ekqckmfb.exe	106
PID 2224 wrote to memory of 980	2224	Ekqckmfb.exe	106
PID 980 wrote to memory of 3288	980	Fqphic32.exe	107
PID 980 wrote to memory of 3288	980	Fqphic32.exe	107
PID 980 wrote to memory of 3288	980	Fqphic32.exe	107
PID 3288 wrote to memory of 2232	3288	Fjjjgh32.exe	108
PID 3288 wrote to memory of 2232	3288	Fjjjgh32.exe	108
PID 3288 wrote to memory of 2232	3288	Fjjjgh32.exe	108
PID 2232 wrote to memory of 2356	2232	Fqfojblo.exe	109
PID 2232 wrote to memory of 2356	2232	Fqfojblo.exe	109
PID 2232 wrote to memory of 2356	2232	Fqfojblo.exe	109
PID 2356 wrote to memory of 3872	2356	Ggccllai.exe	110
PID 2356 wrote to memory of 3872	2356	Ggccllai.exe	110
PID 2356 wrote to memory of 3872	2356	Ggccllai.exe	110
PID 3872 wrote to memory of 4480	3872	Gkalbj32.exe	111
PID 3872 wrote to memory of 4480	3872	Gkalbj32.exe	111
PID 3872 wrote to memory of 4480	3872	Gkalbj32.exe	111
PID 4480 wrote to memory of 2124	4480	Gdknpp32.exe	112
PID 4480 wrote to memory of 2124	4480	Gdknpp32.exe	112
PID 4480 wrote to memory of 2124	4480	Gdknpp32.exe	112
PID 2124 wrote to memory of 2116	2124	Hkohchko.exe	113
PID 2124 wrote to memory of 2116	2124	Hkohchko.exe	113
PID 2124 wrote to memory of 2116	2124	Hkohchko.exe	113
PID 2116 wrote to memory of 1280	2116	Ijiopd32.exe	114
PID 2116 wrote to memory of 1280	2116	Ijiopd32.exe	114
PID 2116 wrote to memory of 1280	2116	Ijiopd32.exe	114
PID 1280 wrote to memory of 5056	1280	Iccpniqp.exe	115
PID 1280 wrote to memory of 5056	1280	Iccpniqp.exe	115
PID 1280 wrote to memory of 5056	1280	Iccpniqp.exe	115
PID 5056 wrote to memory of 2140	5056	Ijpepcfj.exe	116
PID 5056 wrote to memory of 2140	5056	Ijpepcfj.exe	116
PID 5056 wrote to memory of 2140	5056	Ijpepcfj.exe	116
PID 2140 wrote to memory of 2128	2140	Jnbgaa32.exe	117
PID 2140 wrote to memory of 2128	2140	Jnbgaa32.exe	117
PID 2140 wrote to memory of 2128	2140	Jnbgaa32.exe	117
PID 2128 wrote to memory of 4780	2128	Kbjbnnfg.exe	118

C:\Users\Admin\AppData\Local\Temp\1958678990866415b16e6177fb8df591.exe
"C:\Users\Admin\AppData\Local\Temp\1958678990866415b16e6177fb8df591.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\Pcegclgp.exe
  C:\Windows\system32\Pcegclgp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\Bbfmgd32.exe
    C:\Windows\system32\Bbfmgd32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\SysWOW64\Cdhffg32.exe
      C:\Windows\system32\Cdhffg32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:232
      - C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Gdknpp32.exe
        
        C:\Windows\system32\Gdknpp32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Hkohchko.exe
        
        C:\Windows\system32\Hkohchko.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Jnbgaa32.exe
        
        C:\Windows\system32\Jnbgaa32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Lhgdmb32.exe
        
        C:\Windows\system32\Lhgdmb32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Nhlfoodc.exe
        
        C:\Windows\system32\Nhlfoodc.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3028
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1096
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        26⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:556
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Bclppboi.exe
        
        C:\Windows\system32\Bclppboi.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3464
        
        C:\Windows\SysWOW64\Beaecjab.exe
        
        C:\Windows\system32\Beaecjab.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Cplckbmc.exe
        
        C:\Windows\system32\Cplckbmc.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3796
        
        C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:996
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:452
        
        C:\Windows\SysWOW64\Edoncm32.exe
        
        C:\Windows\system32\Edoncm32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1448
        
        C:\Windows\SysWOW64\Fgfmeg32.exe
        
        C:\Windows\system32\Fgfmeg32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:416
        
        C:\Windows\SysWOW64\Fcmnkh32.exe
        
        C:\Windows\system32\Fcmnkh32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\SysWOW64\Fpandm32.exe
        
        C:\Windows\system32\Fpandm32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:732
        
        C:\Windows\SysWOW64\Fcbgfhii.exe
        
        C:\Windows\system32\Fcbgfhii.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Fpfholhc.exe
        
        C:\Windows\system32\Fpfholhc.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1128
        
        C:\Windows\SysWOW64\Gjnlha32.exe
        
        C:\Windows\system32\Gjnlha32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2820
        
        C:\Windows\SysWOW64\Gjcfcakn.exe
        
        C:\Windows\system32\Gjcfcakn.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Gnckooob.exe
        
        C:\Windows\system32\Gnckooob.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1396
        
        C:\Windows\SysWOW64\Hdppaidl.exe
        
        C:\Windows\system32\Hdppaidl.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Hjlhipbc.exe
        
        C:\Windows\system32\Hjlhipbc.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Hgpibdam.exe
        
        C:\Windows\system32\Hgpibdam.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2796
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:316
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        51⤵
        Executes dropped EXE
        
        PID:1572
        
        C:\Windows\SysWOW64\Jglaepim.exe
        
        C:\Windows\system32\Jglaepim.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\Kjpgmj32.exe
        
        C:\Windows\system32\Kjpgmj32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2868
        
        C:\Windows\SysWOW64\Ljncnhhk.exe
        
        C:\Windows\system32\Ljncnhhk.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:684
        
        C:\Windows\SysWOW64\Mdmngm32.exe
        
        C:\Windows\system32\Mdmngm32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3448
        
        C:\Windows\SysWOW64\Mhkgnkoj.exe
        
        C:\Windows\system32\Mhkgnkoj.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2352
        
        C:\Windows\SysWOW64\Mackfa32.exe
        
        C:\Windows\system32\Mackfa32.exe
        57⤵
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\Moglpedd.exe
        
        C:\Windows\system32\Moglpedd.exe
        58⤵
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Aeglbeea.exe
        
        C:\Windows\system32\Aeglbeea.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2100
        
        C:\Windows\SysWOW64\Belemd32.exe
        
        C:\Windows\system32\Belemd32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Ciaddaaj.exe
        
        C:\Windows\system32\Ciaddaaj.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1176
        
        C:\Windows\SysWOW64\Cblebgfh.exe
        
        C:\Windows\system32\Cblebgfh.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Dfemdcba.exe
        
        C:\Windows\system32\Dfemdcba.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3624
        
        C:\Windows\SysWOW64\Ehnpmkbg.exe
        
        C:\Windows\system32\Ehnpmkbg.exe
        64⤵
        Executes dropped EXE
        
        PID:5132
        
        C:\Windows\SysWOW64\Eojeodga.exe
        
        C:\Windows\system32\Eojeodga.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Eipilmgh.exe
        
        C:\Windows\system32\Eipilmgh.exe
        66⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Fochecog.exe
        
        C:\Windows\system32\Fochecog.exe
        67⤵
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Glchjedc.exe
        
        C:\Windows\system32\Glchjedc.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Hofmaq32.exe
        
        C:\Windows\system32\Hofmaq32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Hllkqdli.exe
        
        C:\Windows\system32\Hllkqdli.exe
        71⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Hcfcmnce.exe
        
        C:\Windows\system32\Hcfcmnce.exe
        72⤵
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Imjgbb32.exe
        
        C:\Windows\system32\Imjgbb32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Jmdjha32.exe
        
        C:\Windows\system32\Jmdjha32.exe
        74⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Jcnbekok.exe
        
        C:\Windows\system32\Jcnbekok.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Jikjmbmb.exe
        
        C:\Windows\system32\Jikjmbmb.exe
        76⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Jcpojk32.exe
        
        C:\Windows\system32\Jcpojk32.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Kmkpipaf.exe
        
        C:\Windows\system32\Kmkpipaf.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Kfjjbd32.exe
        
        C:\Windows\system32\Kfjjbd32.exe
        79⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Lgjglg32.exe
        
        C:\Windows\system32\Lgjglg32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Lglcag32.exe
        
        C:\Windows\system32\Lglcag32.exe
        81⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Ladhkmno.exe
        
        C:\Windows\system32\Ladhkmno.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Ljmmcbdp.exe
        
        C:\Windows\system32\Ljmmcbdp.exe
        83⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Lpjelibg.exe
        
        C:\Windows\system32\Lpjelibg.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Mmbopm32.exe
        
        C:\Windows\system32\Mmbopm32.exe
        85⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Mhhcne32.exe
        
        C:\Windows\system32\Mhhcne32.exe
        86⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        87⤵
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Ndjcne32.exe
        
        C:\Windows\system32\Ndjcne32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Nandhi32.exe
        
        C:\Windows\system32\Nandhi32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Npcaie32.exe
        
        C:\Windows\system32\Npcaie32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1940
        
        C:\Windows\SysWOW64\Ohobebig.exe
        
        C:\Windows\system32\Ohobebig.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Pdbbfadn.exe
        
        C:\Windows\system32\Pdbbfadn.exe
        93⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Pknghk32.exe
        
        C:\Windows\system32\Pknghk32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        96⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        97⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Daeddlco.exe
        
        C:\Windows\system32\Daeddlco.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Fjpoio32.exe
        
        C:\Windows\system32\Fjpoio32.exe
        99⤵
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Gajpmg32.exe
        
        C:\Windows\system32\Gajpmg32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Hcofbifb.exe
        
        C:\Windows\system32\Hcofbifb.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:224
        
        C:\Windows\SysWOW64\Hllcfnhm.exe
        
        C:\Windows\system32\Hllcfnhm.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Ikhghi32.exe
        
        C:\Windows\system32\Ikhghi32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Ilgcblnp.exe
        
        C:\Windows\system32\Ilgcblnp.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Jlafhkfe.exe
        
        C:\Windows\system32\Jlafhkfe.exe
        105⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Kmjinjnj.exe
        
        C:\Windows\system32\Kmjinjnj.exe
        106⤵
        Drops file in System32 directory
        
        PID:4028
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        107⤵
        
        PID:640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 400
        108⤵
        Program crash
        
        PID:208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 400
        108⤵
        Program crash
        
        PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 640 -ip 640
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Acppddig.exe

Path C:\Windows\SysWOW64\Acppddig.exe
Size 136KB
SHA256 5dba47cb5c1cb27e95677b97e4ffebc1701d79323abf588643dd4cbe40b6f862
MD5 e9e883c22b4cd02ee40db821a911db5a
SHA1 f7d92140bd9f8b3885c7a42e50dfe66c9e3da166
SHA512 968a48ab07483a1eb50fb284363470aabadc18fb856bb1b6fcd8d2b1bc5517cffb95b55d0c71b4a6a065d99fa5ebabb93f28235cc433b1a81578a3f9fee93bef
SSDEEP 3072:zTOQ+kEp93tsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:z6VkEp93tsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apkjddke.exe

Path C:\Windows\SysWOW64\Apkjddke.exe
Size 128KB
SHA256 f1794cb46b464aed2997d7faf2333a975656146a9184148f6c30b3c838817c26
MD5 956a73ccbcdaa8ed778e4572d148e575
SHA1 b0464a896115e2f3102355b80cf1207fe23febe9
SHA512 fb8361f3c8e4d161d8f3a43c8d02343761712deb79409d076474074c9272573080de8ef72171005320f1334f5c89d338cc68b1fde5a9dbe567c569a97bf259c1
SSDEEP 3072:zTOQ+kEp93tsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWs:z6VkEp93tsohxd2Quohdbd0zss
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apkjddke.exe

Path C:\Windows\SysWOW64\Apkjddke.exe
Size 136KB
SHA256 bf7230a81982bca17a9c6b7c728e1ef09c32a28e004efc41a0b7ce54aa052703
MD5 86c4e04aa42a89aa265d38adecda05c0
SHA1 ab01e8cc7c471005aaf566c4df64a6941238528e
SHA512 83e036c1ba7eb6e076dace590bcc5f32186a0ef8f8322e9fcc8bd98cc2ab89695d837a926804b097f4b25797df4659e4b87641f8f116c95058a7179fdd248fd0
SSDEEP 3072:o31bu20nBisohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:g6Bisohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bbfmgd32.exe

Path C:\Windows\SysWOW64\Bbfmgd32.exe
Size 136KB
SHA256 320b44ce2b1dbba59693edb6e101c648295470a05789d5fe82119259a4f95742
MD5 b8d84b10d1ec2fe11bcce8d16ce16c24
SHA1 d89347c254f330efee5fe7e9eb7e02668bf4fe16
SHA512 0014147b3c8c8c89c5652fec928689f2169be02f94750bc853ba259d3b98f20ed83e598263d5dfd123f8181e1248faf38fcae0083a8c0d9cab9ebcfcc7ab5514
SSDEEP 3072:PCpTnEbWpkcqUGQISdZIusohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:KpTEapRqDIZIusohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bclppboi.exe

Path C:\Windows\SysWOW64\Bclppboi.exe
Size 136KB
SHA256 c912b033f3cbaf072a85d664cdb7ec223a85ab71b99d8d7c3667885d077735ed
MD5 798f92af57633cdaf5f62937ed6e296d
SHA1 270ab148d72388d6cf9483518218c0827a3b15af
SHA512 eca1b5ab31166e919e195fb48ba77253cb8b9598580ae9b3b12f7cd186ae369138f33986f12c359cbcf00abc4b230d8fe66ecc667c7cc238893e6f39eaf073cd
SSDEEP 3072:WZroM3r2swGpLC4txsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:HW6GpLC4txsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Beaecjab.exe

Path C:\Windows\SysWOW64\Beaecjab.exe
Size 136KB
SHA256 1ac19188f932c4a6ffd21ae5c8301a921fd7ab8ff0e92f043555b7feccac9e82
MD5 e80a82f2936a7da5e92abbaca35fca4c
SHA1 b8e790e2699ae0995879a12e1dc4164a975de8f2
SHA512 55c60861202e810502ef089226fa3bd3baa9f96225ca37277defc94db5be810d9694261b5692a2cef10ec569099a1331e1ba479e91e6b331f435f4b4cd35b24e
SSDEEP 3072:/aqs71IsOouoYOJM9KkeMsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:/aqs71aJnKeuMsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmagch32.exe

Path C:\Windows\SysWOW64\Bmagch32.exe
Size 136KB
SHA256 986ce5193009c98bdc1c8a982e142090136db1d8968fc4838943c684ab68c801
MD5 0c31dc8e0fca3d210467db84ade0a0ad
SHA1 fe5088a4f7f3cef3ca10c5510a505da56d713543
SHA512 5a180a005eda6fb015aa6ef1fbfd83bfb511e6374d5bec739d8247d9a88cd775ba4dcbb0d00210147f5bca72e8e055098620471231e4f8db2c94daa9bec9b884
SSDEEP 3072:8Hqzuay6Z5nZaCsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:D607aCsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cdhffg32.exe

Path C:\Windows\SysWOW64\Cdhffg32.exe
Size 136KB
SHA256 b27c97a30e7c7384280c8ef4bf5ea6403e3e2c36dea670c338d311b7d3f6a172
MD5 5b259d61b86c167f38b4bf1880f3a62c
SHA1 4ee99a96ecdf8599cbdb17f84e5198535b1d4ba9
SHA512 b96400d16ba33d5c4aea0113a4f0f5554cf818997554bd5c7df4fb27ec4a55db8c32295c2e77ad666c69074bacec2df25f390cdeacf637a83303233e3f4ebe18
SSDEEP 3072:m87mEzAXar6vKyxcevsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:mUmEzAKevHcevsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cgklmacf.exe

Path C:\Windows\SysWOW64\Cgklmacf.exe
Size 136KB
SHA256 38724747878d931f2a7052b88204a94c3b8eab32789dbeeb9021afa4107d00bd
MD5 6047111eec72fca31639f56d68175a58
SHA1 461c382df3594844cfc16863a7dba7516559b126
SHA512 ed03bd2291f258543a5ce761a80dce66a27d40b30f80a2d27dade82907f9ae9eb5f4a129c505eb563e7e09f9962bf4716fdc9d855f6920fbdfe789415c082d0f
SSDEEP 3072:sAuGdtgcjf0j8ZnMzvF5CjFRMqf1kzjaiHsohLwdNbw+Y92xQuohLwdNbw5bxH0/:sAPB0j8ZnMzvF5CjFeUOvXsohxd2QuoC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daeifj32.exe

Path C:\Windows\SysWOW64\Daeifj32.exe
Size 136KB
SHA256 61949a072acd6722974083433e270163cec28b9d836714bd42739f4af68f125e
MD5 2791c2abfc21d9518a7f401a8d2df255
SHA1 5276f08f28240453bc16217619fb10904d3a2146
SHA512 346fec85583e0cda2c2554620492522a80a892812f4044f59cd4ce3ca2c28ac3749b256d2c09f2329aa2d4a36d9b6d2014cf8f6ab0ebc950330a470bbd3bc358
SSDEEP 3072:qsZFiFrJYsDsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:qsZFiFWsDsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dkbgjo32.exe

Path C:\Windows\SysWOW64\Dkbgjo32.exe
Size 136KB
SHA256 4c509ab9cca099295a162acc616d0a27500b599d0853f59d12dd76639b4fe4c2
MD5 9179882ba26f0bc20a1d8382d27f44df
SHA1 12a6e560f4c1df56be7f831d3504e80ea1daf1f9
SHA512 f67e4392b966899def345186083ef3feeeff08e2dd0c7a8a31c8b1e095104d54d70c9c76f8c2430e0e514d98e7d61a7eea92f0f0891434785f04000218f391fd
SSDEEP 3072:otCpfBpOJN2sohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:otCpfBpg2sohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dkpjdo32.exe

Path C:\Windows\SysWOW64\Dkpjdo32.exe
Size 136KB
SHA256 1578be8878e16275f72d340bba1b551fc1d09315a12f6bf69af8c0fb56d160c5
MD5 b594a57eb6d9b457923ef8d5a06f0822
SHA1 84b5f20f2ded6c0776f6c6b372a7548a76f135e5
SHA512 dc653398fc83619196fcb67cdc8a1d4b3fbf0b79e3c39c84603523baa69972ad96780e0bdb1ebd459ff30bec127944040e788feee75d8736999b7f55a9aa3853
SSDEEP 3072:KqTORgLz6ae4GkTsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:KqTOyLzzxGkTsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ecdbop32.exe

Path C:\Windows\SysWOW64\Ecdbop32.exe
Size 136KB
SHA256 2adabb2cca78fdaa9f1b0da307c1abc0b05442c73995f41b1d21aeaa0da12f41
MD5 d076ce95e1294c1c5a5477e039cd6911
SHA1 378ffe0938807a5cec0c9bdeddd47418f03f1cef
SHA512 927a792ff1a0b5382e6d773840226852aa62fab1af463d7b6c4093051949976524bc759a7d253ef8a418fb46ea5b18c6172b50770c9352099e56fff725cf2830
SSDEEP 3072:38tcooilOQb0sohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:sDoO0sohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ekqckmfb.exe

Path C:\Windows\SysWOW64\Ekqckmfb.exe
Size 136KB
SHA256 0f66f24cf64f08429857d8528d82c3e16f10fc886d7be48954cca416905148af
MD5 a2e0934dfe822996bbdafc25e14be7e3
SHA1 f7025fe0e290649e7252c8c8e6498742d9fe65d0
SHA512 f822dfca83d24528a3e200fc08c89c82af95661ebb108a840b2e7df45eaff459a0b9525d42dd226c6b8199c444d8a917465791203b411d998525fcf58ccf517b
SSDEEP 3072:4/TyoeAiVRl4sohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:qeAyRl4sohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fcbgfhii.exe

Path C:\Windows\SysWOW64\Fcbgfhii.exe
Size 136KB
SHA256 705c2f862545df9204721363daf971fd5df145e473f10490cb00828b1b8fd335
MD5 09359a109d0102bffbbc07debac0c884
SHA1 0ca1b55814b2438d6e7e8680e61d24a2bd08e405
SHA512 ce274423de62f7e43197976ae8588fe04cdec0a207331dd325a8e34ee50b1c93532a5e1a2b04a171e209b50a58b51fbc8701ae1473b413c2b8797395dd2bd54d
SSDEEP 3072:m3MWnl2N9+iXsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:mhAzfXsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjjjgh32.exe

Path C:\Windows\SysWOW64\Fjjjgh32.exe
Size 136KB
SHA256 994e551891cbbeafe1fef6b12ea94bd72d00338ff7c49245ecc761822b3c4117
MD5 3ea629d43620c22cbb0b4387e2b3490e
SHA1 c2f5b265d3e5601bbdbb557fb682b49ae0a0d141
SHA512 b94e2a6f88c1ae739ce3c53cc05e14b27324893a68877e1d604bb8d3131c5bb49176827f5ebb4bdb8570c9899c0099a90339cbff4ee1c86ba70dc2110279cf8c
SSDEEP 3072:WaUaxMzqkMT8+WihA5UC/Ki3TsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:dUaxFkzZihxC/KkTsohxd2Quohdbd0zb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqfojblo.exe

Path C:\Windows\SysWOW64\Fqfojblo.exe
Size 136KB
SHA256 5f80e7667993bb52f19d8d6d6a016f3b083f195b04096d3651ac744c99169332
MD5 e2d8de182a975bffcbb7e8b30c04444c
SHA1 bbe650acd5286e8f7bc1922ee99f2358895c1535
SHA512 c2b78a3010f542833bb7c63f689755bced915d7fd19ee49f7fc5598b44c54b732f8a54f4d0279120e9f53b73b7e65a6c308ae1e7f5fa46710b2cb9fed1b5a86d
SSDEEP 3072:5sW5VgpwYKnCOsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:5TVxYsCOsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqphic32.exe

Path C:\Windows\SysWOW64\Fqphic32.exe
Size 136KB
SHA256 e603771ac93e5df61a26719ca35c6c6e9f75d236b4d46faafef3e8bd0e5f4466
MD5 1e287be3ca067623b5d831cf4c8f9646
SHA1 f76c0b94088d87c1b7b66b3afd314b7ec10cf090
SHA512 4bd1361574b75e581f3bde1620fd4fca825b2a33f347935348b81c485080b139486705a1358da8bb41529cd80a9a72b6db4ae741830bc0cd63f84fe98cbe797f
SSDEEP 3072:UgjjKEhRgghidY1ksohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:UgjjK+KghiS1ksohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gdknpp32.exe

Path C:\Windows\SysWOW64\Gdknpp32.exe
Size 136KB
SHA256 f588a098f2f467da3d2dca0cc107ba9b956ed9d2188b6d77cf1e9f6e7eeb1f0e
MD5 f032d62922a403927fe723b30cf31c0f
SHA1 f9235a78122cafca77bc83837279eb2e65f7365b
SHA512 18334da0aaf273606e9bfb1897eff665a443674bb9ffedd9245c9983f4f455b8a21b64449fa9997fe8b9a56d61352d9f045a5f39020976a8604b37a27574a896
SSDEEP 3072:6bB4pINvJsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:+BNRJsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ggccllai.exe

Path C:\Windows\SysWOW64\Ggccllai.exe
Size 136KB
SHA256 7c803f6f455835dbe6352254921b06187d6ced5b1041755d46c250e5e22338ea
MD5 c9d3aa6d4e0ba6b219660d5d6ff00400
SHA1 21f269b93b62538ba1fb562cb446b4fbb82dec05
SHA512 2f8ad1cf77f6da4fb3829bc8abc78261fa81f9af7d70aa751574fee2cf2f58c041c3276d2a2b3ca353f310d8b402ef9fff4137e40ec883e4630565c20cb9dade
SSDEEP 3072:j6F4ASkVIhE3uw3TYAsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:QxeGYAsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjcfcakn.exe

Path C:\Windows\SysWOW64\Gjcfcakn.exe
Size 136KB
SHA256 309f33200b8b7172483413d60ec6a8707620b50f7cd2ee4e9bfd5ad365144842
MD5 8308dfbf02abe8b8a1c07489c7f53e0d
SHA1 32c642972f091a1c73aa0a88982140ebef46a3d4
SHA512 270eedfc0e8b7ce6f5df8c7e7738aa559e99c6e258feee2a48fe68400dc205997007519e3cfb3b4d99ed481b31f22f64cb032c41ad49f526b95ba3af0c7567fc
SSDEEP 3072:cXtHxcn0/C5FUMhPqVsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:+Onp5FMVsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gkalbj32.exe

Path C:\Windows\SysWOW64\Gkalbj32.exe
Size 136KB
SHA256 a34b262a450dfa37d27e2fc2bc11c849e4ec4da0e2b56f5d88ed6bd00e780fb9
MD5 8463bb86d0a1f674c2b018b6d5fcd262
SHA1 aa8a314fefa8ea5adc23bb42a6301985573cf91d
SHA512 8b13a866fbdc2bd9a33ce97567cdcbb1ab4850b74bb3605e56647ebcb6e5eb71732d253c789306cd278d48a998566bc936ebeeb7d014bb9629fddce07f34ef93
SSDEEP 3072:+O3anOH3uKsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:GOeKsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hkohchko.exe

Path C:\Windows\SysWOW64\Hkohchko.exe
Size 136KB
SHA256 200f9ec2779c970dd4a25c78fbcb929b22b41c4b5e0fe152f613f99192f0eff2
MD5 8c41215fd24e281100c2f7dfd5f8d557
SHA1 3c6b327dc5ce3e822200a8258ed5d5adaf06b168
SHA512 12ed17a78fbeb6607ff2585985df2742a062e5ef6d81218c09bdf916dd0e751c1411c62a1f24fb6d13ac166322cbc12205b3778a1466ce830a37b1e69c07134c
SSDEEP 3072:tlzXnnXpQnScX5gYYYYYYY5oJsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:/rnZQnScX5gYYYYYYY5oJsohxd2QuohU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iccpniqp.exe

Path C:\Windows\SysWOW64\Iccpniqp.exe
Size 136KB
SHA256 dd97c54d890767aca135c89092f228683c6a6c18deabde05d7a635ed4254f06b
MD5 eaf7a8bf7c7fe6546571bc09fd92d263
SHA1 3326a9c344fc1ef7f5ff332ac03b6fb823d24ac5
SHA512 3def97cd83d8e2b51b709a1defdb1dccf587988cabaaf0a9a997a65ac3022e1371416e3f310b439b8a14ac8aed41537273966e2edf05d62d0c56549db63de04e
SSDEEP 3072:/nQF3FkzqUSlf/KANcsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:4NUo/lcsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ijiopd32.exe

Path C:\Windows\SysWOW64\Ijiopd32.exe
Size 136KB
SHA256 f2fc7a4de45debba77c260a5839cf6059f17e34b6dfe88e737467f08497e42d6
MD5 5f26c56f9b4065d6a0d0687c0b2e0888
SHA1 644e0afe7e17b1d58e94c9779e827f61d0e8c6af
SHA512 d8cb499057adaf54f9c0e22216c57155e0da4e29741aab6a8eb2fc8d11d0e7fcf775ee344ede74c838ddb9ca3ce48bc0d2021557d3914cc6b154c167b598ec07
SSDEEP 3072:QUU4zOKaokVGisohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:QUU4SUnisohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ijpepcfj.exe

Path C:\Windows\SysWOW64\Ijpepcfj.exe
Size 136KB
SHA256 c7674b98a2f89bf9086b48e80cd97069246b110b70b65609c2e702100ee866c6
MD5 1cf2ebf0b4af127375b4319e9d9ea280
SHA1 c88941a4d978c900c831308299e1478d95737c4c
SHA512 49e295ee18d70806c205ce5951236b6ea9d8b3b096b9f95036eb74c4895150a7baad68e8188152d1936ad8dba93b306cd8dd623f19db52bd898ed2072ad1a392
SSDEEP 3072:V8j8oDRVZILOHx7H7sohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:otF7J7sohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jnbgaa32.exe

Path C:\Windows\SysWOW64\Jnbgaa32.exe
Size 136KB
SHA256 2087cf25a705365c8dc491694cb0fdca2530b81254cfcd913acbe280854f3c1c
MD5 927a10042c9f36fef3c799b21faca197
SHA1 f07fed40f01f2bba4610e0101303bdbb1da1c16e
SHA512 50fa335e5ff862a4381fb8fec1f6ca8c57e6b88fb828fe13a04e57df0cb315088ebd6057bbf35fc2414430357a91c140551c306bb6e2a86c6c532155fd2c0ae4
SSDEEP 3072:GsfAx/RoHnGyOZrzsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:Gs4smHzsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbjbnnfg.exe

Path C:\Windows\SysWOW64\Kbjbnnfg.exe
Size 136KB
SHA256 54faa4463604800720026323ace00fd5566d4713c12d6a918239576db12edef9
MD5 63122e85b89ba33526661ad5c6527d93
SHA1 ce8143ef6608180cb4aa066f265c1f2a4784d548
SHA512 ccd900f7f857bf8eec94b336a890519628081e0c0897d2f9a6d44449f9035d1c4c093c36b519ca4683cd5cdb5a7c5ed6cca1a897b44858aed2acbcfdb00c6eae
SSDEEP 3072:CG5n6zaQYqUmesohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:CG5neaQHUmesohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kjpgmj32.exe

Path C:\Windows\SysWOW64\Kjpgmj32.exe
Size 136KB
SHA256 fa7dba8164413e88ef17a4edc10ad7144df5014df63ddbee06720c902768a1b2
MD5 4db8eadc349b8486d00fb61721569095
SHA1 a2549b9186d0d0c6de09f09611d1c2ffc388d92c
SHA512 78146a1da013e787138e6cd5808d250173cdfce28e6a429239f776f1eab7ca034f0e3670228d279e406146f22a83b80d51ecd04b1a3cb8970f1ffaaf2fdea74e
SSDEEP 3072:/Xi3PEoMxS/R1GpNETs9/oVWsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:/X6h1Ea+/oVWsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lhgdmb32.exe

Path C:\Windows\SysWOW64\Lhgdmb32.exe
Size 136KB
SHA256 46be07f4fd7f8d65bd8111357bd63a13500ff7e51857664142a150cc82f61394
MD5 9d5f03c6ca30bc49bbc03213b6ac86b0
SHA1 14eeff2580852410ddf6999d6384f6deee96d9ce
SHA512 7538d4c8bdf7126a77f13a8b7be160fa9c595524df17e5110df97a468a8739ee39cce148c4d839df405bd35c62df7ec55e4b57c428db988c41a80eed2b0d4d5c
SSDEEP 3072:gzHBdbHsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:WbHsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nhlfoodc.exe

Path C:\Windows\SysWOW64\Nhlfoodc.exe
Size 136KB
SHA256 7e5de642188754c51d7e664be8bbdcc12c4b9d548dba26c8ac0e32cbe8bab9ed
MD5 6d4f1e187fc14384cb1d8ca2b6fcbc8f
SHA1 02f0621d3d964f94e1ffb78321015d2caf53c260
SHA512 e4d8dd83958d7950dd1cb35416341ecad8ef9a36a74ba099b48799a18d69d40895eef7d907c998ebffbac0cd2ebf1a2fd0229e4b91ed55d0fec7c6177f7aab56
SSDEEP 3072:zF40nrT6z9I1+3FUSsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:G9I1+1USsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ooangh32.exe

Path C:\Windows\SysWOW64\Ooangh32.exe
Size 136KB
SHA256 a7ed05349400c43af32fa9c4aba96fc58ee76851f1f7ac100d3ad4614d25ac6b
MD5 ef54cb1f078eb05e7d06e95ab47ffd56
SHA1 de55a10255470b7812f7747ef1b4b8d5c4d0db58
SHA512 929e97afee38eaefdbb90e1f8c3981d3236d20a53ebd04f074c082db7e50d8e54ae7e3e749e905498a93618f7c13ce371a17e1728c2beefec4076af032c30acc
SSDEEP 3072:BiT2AtLnGUOx9U36FvksohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:BiSAtTMvksohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pcbdcf32.exe

Path C:\Windows\SysWOW64\Pcbdcf32.exe
Size 136KB
SHA256 f297ac1c3e1636ab7f216a2a73c32edc5e8fc5757dc8713d59d29c347d279116
MD5 ab133beaeef18ac0d996b4ba84ca2be0
SHA1 a6970171e245f91a8cf6a5ca173260ad828d7a04
SHA512 3ae7f68b1504e6bca9b9de4cb929acf3f02bd6c00e839cb36f40b96fa493348f109c820dadf690bca6886687e5c39a8db65f477a165bbb418a467f0c6e9c2d78
SSDEEP 3072:FQQfjV2RBoK1lQ20Z+sohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:FQa2QgM+sohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pcegclgp.exe

Path C:\Windows\SysWOW64\Pcegclgp.exe
Size 136KB
SHA256 08ba65aa0dc5dfb511f5af3dd5fcc05d4cf7ba1773b82b41101033b598dbccba
MD5 f0fbdfaf4338b61411be162b8b8977d7
SHA1 06fbf177f5534f337a0138f7958225194e9a0851
SHA512 6d07e5f09654e76b1d14cd2c1b6737232b686a27b1f7cc4eec7d76ff46ae9032190232bd3873bff6e0ad27b3a65513cfae2362fdd59b9d19ceaf60b4b9fdba01
SSDEEP 3072:/HnoRzyHSWW71dQ/sohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:vn+tm/sohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Piceflpi.exe

Path C:\Windows\SysWOW64\Piceflpi.exe
Size 136KB
SHA256 a604f76efe17908a3cc352b1554f82710292b8e141d682a76de56b87d3c94c13
MD5 c96baa0851a354b493240f89934d335b
SHA1 bcf7ac5a95dd8ce8596408fa6c0ff9436462ce4c
SHA512 948a8153f53d8ad85e7ac8e646eee3c44e0ba34642bc1ee752c2ad001e79eb9643c69db02cf277880f875fafc4be4b61a71f431d7f6eaee1f85d65c31d5ef1fd
SSDEEP 3072:GcxLsKXps+mYPya6fpsohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:dxLswpYYPOpsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qfjcep32.exe

Path C:\Windows\SysWOW64\Qfjcep32.exe
Size 136KB
SHA256 84c5bad8a5fef3906c19e5ed1e22385ac8e20e2de95bb165526c1ecdcda6a72c
MD5 89fce0041085ba6bf66f162dd4cdd8fa
SHA1 4ef6c37d1255787e3fc68ec373fd37a6fd568af6
SHA512 40c10370a8131930867eaaa3d65ecf6759bb97c4b6cba00f1b4b6a645794e9eccaea4f70fbda0d71c50420507a9354d6f81bbac189f7425004a437a78bb42e9f
SSDEEP 3072:8WDMOXR6fKPl2psohLwdNbw+Y92xQuohLwdNbw5bxH0zVWccA:HjEfWMpsohxd2Quohdbd0zscj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-34-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/232-279-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/316-383-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/416-308-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/452-289-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/556-218-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/556-435-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/684-411-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/732-317-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/980-310-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/980-82-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/996-287-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1096-194-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1096-428-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1128-335-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1132-265-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1176-466-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1264-49-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1264-286-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1280-382-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1280-146-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1396-351-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1420-1-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1420-8-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1420-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1428-364-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1448-303-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1528-267-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1528-25-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1572-389-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2100-451-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2116-137-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2116-377-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2124-129-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2124-370-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2128-170-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2128-405-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2140-161-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2140-398-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2212-441-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2212-234-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2224-301-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2224-73-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2232-330-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2232-97-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2296-357-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2352-422-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2356-105-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2356-337-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2384-263-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2384-17-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2436-10-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2436-250-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2616-296-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2616-65-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2796-375-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2820-338-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2836-203-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2836-433-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2868-402-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3028-185-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3028-427-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3064-475-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3252-459-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3288-323-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3288-90-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3376-424-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3448-412-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3464-458-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3464-252-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3624-482-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3796-272-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3800-243-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3800-445-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3872-344-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3872-113-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4016-442-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4092-311-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4172-294-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4172-57-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4364-226-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4364-437-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4420-281-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4420-42-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4472-392-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4480-363-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4480-121-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4700-210-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4700-434-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4780-426-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4780-178-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4888-345-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4948-328-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5052-274-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5056-385-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5056-153-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads