c79d3f0e58b0d2cac6899bb7793b8771f2e187a6242bf7cc3808195e8984d02f

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0deac05b73fa1a5d07018ebc0eb98c83.exe
Size

95KB
MD5

0deac05b73fa1a5d07018ebc0eb98c83
SHA1

6e37ad02ffb799d5a916f4b9ae45dff69d542ca5
SHA256

c79d3f0e58b0d2cac6899bb7793b8771f2e187a6242bf7cc3808195e8984d02f
SHA512

23081be4550cf9cfcfac9dfae9981a6e168a1d27b494b4c470fbc9249a3b63c084c2b167c29e4bee71ced2cb414ebbd10154f51d4c1b83faaaffabf6d34ced88
SSDEEP

1536:eqYvL05hhQ+tyAg20R/GOif6sPLhUFvlrhtSV5FoB+PQpwRQroRVRoRch1dROrwI:gDuhhQQy3/GT6gLhmvtSVjPQWeUTWM18

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibmmhdhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icljbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifmcdblq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhqaefng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dllmfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ffbnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqfooodg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcedaheh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imbaemhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dllmfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdhine32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqalmafo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcnejk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hapaemll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipnalhii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imdnklfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabgaklg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbenqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jigollag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eqalmafo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hihicplj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcalgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dokjbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ehonfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hikfip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibmmhdhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifjfnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eodlho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Imdnklfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmkbnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmmocpjk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icgqggce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpojcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emjjgbjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbcakg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmhfhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbjhlfhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmmhjm32.exe

Executes dropped EXE 64 IoCs

pid	Process
1300	Dcalgo32.exe
4268	Dephckaf.exe
2376	Dpemacql.exe
5080	Debeijoc.exe
4316	Dhqaefng.exe
4968	Dllmfd32.exe
2392	Dokjbp32.exe
1148	Daifnk32.exe
1076	Dfdbojmq.exe
5068	Dpjflb32.exe
1728	Dchbhn32.exe
3716	Ehekqe32.exe
4904	Epmcab32.exe
3964	Ebnoikqb.exe
4576	Efikji32.exe
3032	Ehhgfdho.exe
1928	Ecmlcmhe.exe
3532	Eqalmafo.exe
1520	Eodlho32.exe
4332	Ejjqeg32.exe
2416	Elhmablc.exe
436	Ecbenm32.exe
3256	Efpajh32.exe
3168	Ehonfc32.exe
840	Emjjgbjp.exe
4700	Fbgbpihg.exe
5104	Ffbnph32.exe
1648	Fhajlc32.exe
4072	Fokbim32.exe
1856	Ffekegon.exe
4132	Ficgacna.exe
3288	Fomonm32.exe
4980	Ffggkgmk.exe
3488	Fifdgblo.exe
1568	Fopldmcl.exe
3436	Ffjdqg32.exe
1444	Fihqmb32.exe
4712	Fcnejk32.exe
4040	Fjhmgeao.exe
5100	Fmficqpc.exe
2176	Fodeolof.exe
4448	Gbcakg32.exe
4216	Gjjjle32.exe
2824	Gmhfhp32.exe
2112	Gogbdl32.exe
3752	Gbenqg32.exe
3780	Gjlfbd32.exe
1108	Gmkbnp32.exe
1808	Gqfooodg.exe
1848	Gfcgge32.exe
5004	Gjocgdkg.exe
4600	Gmmocpjk.exe
4456	Gbjhlfhb.exe
648	Gidphq32.exe
3756	Gpnhekgl.exe
4496	Gbldaffp.exe
4608	Gjclbc32.exe
4008	Gifmnpnl.exe
2464	Gppekj32.exe
4452	Hclakimb.exe
3632	Hihicplj.exe
2140	Hapaemll.exe
4436	Hcnnaikp.exe
3484	Hjhfnccl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jfhbppbc.exe	Jpojcf32.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nddkgonp.exe
File opened for modification	C:\Windows\SysWOW64\Nggqoj32.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Fgpjnm32.dll	0deac05b73fa1a5d07018ebc0eb98c83.exe
File created	C:\Windows\SysWOW64\Ddomph32.dll	Dhqaefng.exe
File created	C:\Windows\SysWOW64\Odhibo32.dll	Gjocgdkg.exe
File opened for modification	C:\Windows\SysWOW64\Jjmhppqd.exe	Jbfpobpb.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Qbplof32.dll	Gbldaffp.exe
File created	C:\Windows\SysWOW64\Ecppdbpl.dll	Jmbklj32.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Chkede32.dll	Epmcab32.exe
File created	C:\Windows\SysWOW64\Oddfqf32.dll	Gmkbnp32.exe
File created	C:\Windows\SysWOW64\Adakia32.dll	Hclakimb.exe
File created	C:\Windows\SysWOW64\Ggpfjejo.dll	Jfhbppbc.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Dcalgo32.exe	0deac05b73fa1a5d07018ebc0eb98c83.exe
File created	C:\Windows\SysWOW64\Kpmkpqcp.dll	Daifnk32.exe
File created	C:\Windows\SysWOW64\Denfkg32.dll	Hbckbepg.exe
File opened for modification	C:\Windows\SysWOW64\Idacmfkj.exe	Iabgaklg.exe
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Dokjbp32.exe	Dllmfd32.exe
File created	C:\Windows\SysWOW64\Ebnoikqb.exe	Epmcab32.exe
File opened for modification	C:\Windows\SysWOW64\Ffggkgmk.exe	Fomonm32.exe
File opened for modification	C:\Windows\SysWOW64\Gppekj32.exe	Gifmnpnl.exe
File created	C:\Windows\SysWOW64\Iffmccbi.exe	Icgqggce.exe
File created	C:\Windows\SysWOW64\Anmklllo.dll	Jdhine32.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Majopeii.exe
File created	C:\Windows\SysWOW64\Aaqnkb32.dll	Ibojncfj.exe
File created	C:\Windows\SysWOW64\Kpepcedo.exe	Kacphh32.exe
File created	C:\Windows\SysWOW64\Mghpbg32.dll	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Ajgblndm.dll	Kkkdan32.exe
File opened for modification	C:\Windows\SysWOW64\Elhmablc.exe	Ejjqeg32.exe
File created	C:\Windows\SysWOW64\Ffjdqg32.exe	Fopldmcl.exe
File created	C:\Windows\SysWOW64\Ggdddife.dll	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Hihicplj.exe	Hclakimb.exe
File created	C:\Windows\SysWOW64\Fojkiimn.dll	Icljbg32.exe
File created	C:\Windows\SysWOW64\Ibccic32.exe	Idacmfkj.exe
File opened for modification	C:\Windows\SysWOW64\Kpepcedo.exe	Kacphh32.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Fhajlc32.exe	Ffbnph32.exe
File created	C:\Windows\SysWOW64\Impepm32.exe	Iffmccbi.exe
File created	C:\Windows\SysWOW64\Jbocea32.exe	Jdmcidam.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Ncgkcl32.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Jdmaid32.dll	Ejjqeg32.exe
File created	C:\Windows\SysWOW64\Hpgkkioa.exe	Hjjbcbqj.exe
File opened for modification	C:\Windows\SysWOW64\Hibljoco.exe	Hjolnb32.exe
File created	C:\Windows\SysWOW64\Jjmhppqd.exe	Jbfpobpb.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Flfmin32.dll	Mahbje32.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Dcalgo32.exe	0deac05b73fa1a5d07018ebc0eb98c83.exe
File created	C:\Windows\SysWOW64\Hjhfnccl.exe	Hcnnaikp.exe
File opened for modification	C:\Windows\SysWOW64\Kmegbjgn.exe	Jkfkfohj.exe
File created	C:\Windows\SysWOW64\Kkihknfg.exe	Kpccnefa.exe
File opened for modification	C:\Windows\SysWOW64\Lcpllo32.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Fhpdhp32.dll	Mpdelajl.exe
File opened for modification	C:\Windows\SysWOW64\Efpajh32.exe	Ecbenm32.exe
File opened for modification	C:\Windows\SysWOW64\Jbocea32.exe	Jdmcidam.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6676	7140	WerFault.exe	286

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfdbojmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmeid32.dll"	Hippdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghmfdf32.dll"	Jibeql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Njljefql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ffbnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fhajlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fcnejk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkageheh.dll"	Hpgkkioa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fojkiimn.dll"	Icljbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gfcgge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldobbkdk.dll"	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdihi32.dll"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbnpm32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ehekqe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eddbig32.dll"	Iapjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgkocp32.dll"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ehhgfdho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ifopiajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpckhigh.dll"	Gjjjle32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iiffen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Imgkql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpqnnk32.dll"	Iabgaklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ehhgfdho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Elhmablc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fihqmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbcakg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kacphh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpfihl32.dll"	Idofhfmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcplce32.dll"	Ffggkgmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mahbje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epmjjbbj.dll"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoodnhmi.dll"	Ehhgfdho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hpgkkioa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiaohfpc.dll"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jibeql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmkbnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ecbenm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fbgbpihg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hjhfnccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmhfhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gidphq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hccglh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jbfpobpb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Efpajh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnohlokp.dll"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ficgacna.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1300	4536	0deac05b73fa1a5d07018ebc0eb98c83.exe	88
PID 4536 wrote to memory of 1300	4536	0deac05b73fa1a5d07018ebc0eb98c83.exe	88
PID 4536 wrote to memory of 1300	4536	0deac05b73fa1a5d07018ebc0eb98c83.exe	88
PID 1300 wrote to memory of 4268	1300	Dcalgo32.exe	89
PID 1300 wrote to memory of 4268	1300	Dcalgo32.exe	89
PID 1300 wrote to memory of 4268	1300	Dcalgo32.exe	89
PID 4268 wrote to memory of 2376	4268	Dephckaf.exe	90
PID 4268 wrote to memory of 2376	4268	Dephckaf.exe	90
PID 4268 wrote to memory of 2376	4268	Dephckaf.exe	90
PID 2376 wrote to memory of 5080	2376	Dpemacql.exe	91
PID 2376 wrote to memory of 5080	2376	Dpemacql.exe	91
PID 2376 wrote to memory of 5080	2376	Dpemacql.exe	91
PID 5080 wrote to memory of 4316	5080	Debeijoc.exe	92
PID 5080 wrote to memory of 4316	5080	Debeijoc.exe	92
PID 5080 wrote to memory of 4316	5080	Debeijoc.exe	92
PID 4316 wrote to memory of 4968	4316	Dhqaefng.exe	93
PID 4316 wrote to memory of 4968	4316	Dhqaefng.exe	93
PID 4316 wrote to memory of 4968	4316	Dhqaefng.exe	93
PID 4968 wrote to memory of 2392	4968	Dllmfd32.exe	94
PID 4968 wrote to memory of 2392	4968	Dllmfd32.exe	94
PID 4968 wrote to memory of 2392	4968	Dllmfd32.exe	94
PID 2392 wrote to memory of 1148	2392	Dokjbp32.exe	95
PID 2392 wrote to memory of 1148	2392	Dokjbp32.exe	95
PID 2392 wrote to memory of 1148	2392	Dokjbp32.exe	95
PID 1148 wrote to memory of 1076	1148	Daifnk32.exe	96
PID 1148 wrote to memory of 1076	1148	Daifnk32.exe	96
PID 1148 wrote to memory of 1076	1148	Daifnk32.exe	96
PID 1076 wrote to memory of 5068	1076	Dfdbojmq.exe	97
PID 1076 wrote to memory of 5068	1076	Dfdbojmq.exe	97
PID 1076 wrote to memory of 5068	1076	Dfdbojmq.exe	97
PID 5068 wrote to memory of 1728	5068	Dpjflb32.exe	98
PID 5068 wrote to memory of 1728	5068	Dpjflb32.exe	98
PID 5068 wrote to memory of 1728	5068	Dpjflb32.exe	98
PID 1728 wrote to memory of 3716	1728	Dchbhn32.exe	100
PID 1728 wrote to memory of 3716	1728	Dchbhn32.exe	100
PID 1728 wrote to memory of 3716	1728	Dchbhn32.exe	100
PID 3716 wrote to memory of 4904	3716	Ehekqe32.exe	101
PID 3716 wrote to memory of 4904	3716	Ehekqe32.exe	101
PID 3716 wrote to memory of 4904	3716	Ehekqe32.exe	101
PID 4904 wrote to memory of 3964	4904	Epmcab32.exe	102
PID 4904 wrote to memory of 3964	4904	Epmcab32.exe	102
PID 4904 wrote to memory of 3964	4904	Epmcab32.exe	102
PID 3964 wrote to memory of 4576	3964	Ebnoikqb.exe	103
PID 3964 wrote to memory of 4576	3964	Ebnoikqb.exe	103
PID 3964 wrote to memory of 4576	3964	Ebnoikqb.exe	103
PID 4576 wrote to memory of 3032	4576	Efikji32.exe	104
PID 4576 wrote to memory of 3032	4576	Efikji32.exe	104
PID 4576 wrote to memory of 3032	4576	Efikji32.exe	104
PID 3032 wrote to memory of 1928	3032	Ehhgfdho.exe	105
PID 3032 wrote to memory of 1928	3032	Ehhgfdho.exe	105
PID 3032 wrote to memory of 1928	3032	Ehhgfdho.exe	105
PID 1928 wrote to memory of 3532	1928	Ecmlcmhe.exe	107
PID 1928 wrote to memory of 3532	1928	Ecmlcmhe.exe	107
PID 1928 wrote to memory of 3532	1928	Ecmlcmhe.exe	107
PID 3532 wrote to memory of 1520	3532	Eqalmafo.exe	108
PID 3532 wrote to memory of 1520	3532	Eqalmafo.exe	108
PID 3532 wrote to memory of 1520	3532	Eqalmafo.exe	108
PID 1520 wrote to memory of 4332	1520	Eodlho32.exe	109
PID 1520 wrote to memory of 4332	1520	Eodlho32.exe	109
PID 1520 wrote to memory of 4332	1520	Eodlho32.exe	109
PID 4332 wrote to memory of 2416	4332	Ejjqeg32.exe	110
PID 4332 wrote to memory of 2416	4332	Ejjqeg32.exe	110
PID 4332 wrote to memory of 2416	4332	Ejjqeg32.exe	110
PID 2416 wrote to memory of 436	2416	Elhmablc.exe	111

C:\Users\Admin\AppData\Local\Temp\0deac05b73fa1a5d07018ebc0eb98c83.exe
"C:\Users\Admin\AppData\Local\Temp\0deac05b73fa1a5d07018ebc0eb98c83.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\Dcalgo32.exe
  C:\Windows\system32\Dcalgo32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\Dephckaf.exe
    C:\Windows\system32\Dephckaf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\SysWOW64\Dpemacql.exe
      C:\Windows\system32\Dpemacql.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5080
      - C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\SysWOW64\Dllmfd32.exe
        
        C:\Windows\system32\Dllmfd32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Dokjbp32.exe
        
        C:\Windows\system32\Dokjbp32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\SysWOW64\Dfdbojmq.exe
        
        C:\Windows\system32\Dfdbojmq.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Dchbhn32.exe
        
        C:\Windows\system32\Dchbhn32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3256
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3168
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1648
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        30⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        31⤵
        Executes dropped EXE
        
        PID:1856
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4132
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3288
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        35⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1568
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        37⤵
        Executes dropped EXE
        
        PID:3436
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        40⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        41⤵
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        42⤵
        Executes dropped EXE
        
        PID:2176
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        46⤵
        Executes dropped EXE
        
        PID:2112
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        48⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1108
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1808
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1848
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5004
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4600
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:648
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        56⤵
        Executes dropped EXE
        
        PID:3756
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        58⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4008
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        60⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4452
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2140
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4436
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2724
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        67⤵
        Drops file in System32 directory
        
        PID:1672
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        68⤵
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        69⤵
        Modifies registry class
        
        PID:3028
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        70⤵
        Modifies registry class
        
        PID:2500
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        71⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        72⤵
        Modifies registry class
        
        PID:4528
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        73⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        74⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3600
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        76⤵
        Drops file in System32 directory
        
        PID:2752
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        77⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2276
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        79⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1872
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        81⤵
        Drops file in System32 directory
        
        PID:5096
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        82⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4060
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4180
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        85⤵
        Modifies registry class
        
        PID:1180
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1816
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        87⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3460
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        89⤵
        Drops file in System32 directory
        
        PID:368
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:960
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4828
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        92⤵
        Modifies registry class
        
        PID:1460
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        93⤵
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        94⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        96⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        97⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        100⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        101⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        102⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        103⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        105⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        106⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        107⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        108⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        109⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        111⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        113⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        115⤵
        Drops file in System32 directory
        
        PID:6048
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        116⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2192
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        119⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        120⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        121⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        122⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        123⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        124⤵
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        126⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        127⤵
        Modifies registry class
        
        PID:5848
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        128⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        129⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        130⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5136
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        132⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5364
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        134⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        136⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        138⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        139⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        141⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        142⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        143⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        144⤵
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6072
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        146⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        147⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        148⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        149⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        150⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6232
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        154⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        155⤵
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        156⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        158⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        159⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        160⤵
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        161⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        163⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        165⤵
        Drops file in System32 directory
        
        PID:6824
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6868
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        167⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        168⤵
        Drops file in System32 directory
        
        PID:6952
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        169⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        170⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        172⤵
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        173⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        176⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        177⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        179⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6840
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        184⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        185⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        186⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6400
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        188⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        189⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6804
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        191⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        192⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        193⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 420
        194⤵
        Program crash
        
        PID:6676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7140 -ip 7140
1⤵
PID:6452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bbopfj32.dll

Filesize
7KB

MD5
bbf7c4ad9dd29f12e15adc9894cc8f79

SHA1
1183bdd6d9365cb924f029b130ca5d8737eb0197

SHA256
1c8f44c180cb6919519192b20d28113e2d55018c36bdb5016847ec2e0a166046

SHA512
74881b79f84b179a183cd192a4af01a8af4d2485b66e6fdf8a57fa64ad1d414762110d7f1ebb6f5302e2f75ec4f6e03e32bea25143d2978f5f8f7676b18e9af8

Download Submit
C:\Windows\SysWOW64\Daifnk32.exe

Filesize
95KB

MD5
8a5087e383ee3da2adf4d6e8c4f70828

SHA1
e10dbba3a283c47fa00f296b393914e6dbd9711e

SHA256
54fd2ce99363601f339f7db09f1b0d9d21a538ac17a2fff7114590cd436c58f2

SHA512
2e3a5a2c6c65e55b2fa704aba2aa0bdb0d45f45ffa8f5ba604785eda09c49a98b0cf574838b36a2a47fd7202e8a291951d92143b6ce90e5e820582a48cf9d221

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
95KB

MD5
137e83fcc5f68680a1c11b7dbcb9ab10

SHA1
7efbd86728fc217f426b7ffe2f421619adaa4891

SHA256
3935427182c1573af87453ded36d03f67ce4ad72fa5f52d22eb06cdfbba02954

SHA512
81085eb5475e08a3dbcb6aa89b86096f79d60aa1f54fc8e6486bd0766e46aa6fa958724abb0a6c987e028aac4747820b4b0c66ae6b4a9552b18b0542b281678b

Download Submit
C:\Windows\SysWOW64\Dchbhn32.exe

Filesize
95KB

MD5
488ed45e92b876211482a5d6e5f50838

SHA1
eb5aff3bba9f83514b8619df0338465efdaf9fb6

SHA256
e4781e1371c0a6a56105414102560bd8ccf854087776ad867dada295e1f9f2f6

SHA512
9d27ab0e579d8415e6d6f09e5a93a5fc507e0f98cc10f239c4f79f58626c293cf5eb42dbe53c83bd60e44f5c7aba0d73a09dff9e3ada6d90c8b904bca2f70833

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
95KB

MD5
f79269ba8cc06c8a242a480fdbf895fb

SHA1
bd49e76ec311635dd9f35222e1fa3c3c90ae9b39

SHA256
fb7167b4608a85705c60b7f0a3d6a3afd51a32fcac4bee19756b83bc4bda09d0

SHA512
1f49145c69c48e14a609ebd96f3940fb7e7dc6fcab8e1aba75e16ae058eaed1c06adce68f3131897fae4975c19d78c430f81af68662e7a157dc6b5d89b526a17

Download Submit
C:\Windows\SysWOW64\Dephckaf.exe

Filesize
95KB

MD5
62d5988c368ecec5d0034a515340dac0

SHA1
25e48c2625af4d7a10d8245bb89876930b0f5f31

SHA256
7b221a3e11c81ce43bca7139fd8739f834a0e52c12ad7ca1e6484d3b3af965ce

SHA512
0a477e554689389c8b0306984421a7c3bbced7c903639ddbf7b2a3b077db5d26d74cab68486ac9d76259bb8a6819f2bee20de14ed7016634d2783431ce557c7b

Download Submit
C:\Windows\SysWOW64\Dfdbojmq.exe

Filesize
95KB

MD5
ddccbc9a8ee0aa8d92cdee04ecde0052

SHA1
a8a2be0c0154903b2449cfde5320f5d82a299e7c

SHA256
02ece10cb8afac9b8d4dc011239754888b65bc3547f60b2c1995ec9425c60c55

SHA512
d461efca27730790ff885fadce1667625338045c60e9c3baed373aa397da04f0ac869465ce3deffcdc5a5569e626e2f5dc8415826e3a074bd05b41ff37839f45

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
95KB

MD5
e5098dd5979bbd406b9d88f3acd0b4a0

SHA1
239a70726cbf5e7c67eced8dfa890e9ac2799fdf

SHA256
ff59d7d10ce9ad77f77e01736c3efddf5423344f0c3b7f5918700ec427420b50

SHA512
928e88857760adecd0f6cfb0d1b2ad0ae3b59fd6b46d631861d6cf97b9788633bd7157073734b1148938358f49a9098eaa8389c4fa5ce67c551ec47d0225595f

Download Submit
C:\Windows\SysWOW64\Dllmfd32.exe

Filesize
95KB

MD5
7a952bec184b20a2b58a7694e72924b3

SHA1
25eda9818a086a82c16cd9ce60fe48b61da62ca7

SHA256
34b4eeb3ad16642de7d64933262038decc3284b144a9bb8a1b386b39451d0525

SHA512
0212d3a4207a7cd315a77077ed279c812476e5b0e1460887e110d237c7e5917b43ee2ec16f789414af6d577edd673c3c6af120c2be4794fefc4590427a3308da

Download Submit
C:\Windows\SysWOW64\Dokjbp32.exe

Filesize
95KB

MD5
30a091d78e120ca0499b9b7c8a9b6bd1

SHA1
50007cfec73b44e941b1c56ac68e8717cf9ec571

SHA256
f42509b9ad814ee163ff2b97437944421a49daed817de5f124f437cf9118bac8

SHA512
db7655d366ce5e964ac54dd108f43615b08e648eca6dd05fca0be6d9d1836697b7cc97df6b4a623910e0906cfb11c0aeed5bcc706173ea1f90f78aa0521d24c2

Download Submit
C:\Windows\SysWOW64\Dpemacql.exe

Filesize
95KB

MD5
2e203aa21e6f1bff46fce416c1a7b887

SHA1
ac7b8846dc6ff2cdbd8e75e3504fa1f1e11909fc

SHA256
6600ec18a60d1c26fef7247538b6f866a2ecd44efdce0c49a2e831e093372477

SHA512
fc2e8f120ab7cd4cb37902e2c9eabcc37c79d00feaed387c730ca80a1324b9dea08d837846dd47ecaddeaaede3062d59b4a2b52a3801c60dfdadb96b8fb03b29

Download Submit
C:\Windows\SysWOW64\Dpjflb32.exe

Filesize
95KB

MD5
7ffc4454f8c491234a28782227978a0d

SHA1
96ca4723686b048d9d6390d84f92d2af511676c1

SHA256
d163756ec09bb68cee10cba401f1e347fd8cc69295c690ce769ca5b2a42eb525

SHA512
c0a9c629266b05fcb9c39f24b95a732502322d4edc7bdadead330c8be3a11afdbc9621397a12150564c00c211413a94a10783c60c47006f795b3d01ad1002d12

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
95KB

MD5
3c5b95b7ccdbef1dd998490c71ee5ec3

SHA1
2d8ace4c188325bfdcd8184635150ee22549672d

SHA256
15e639a6403d4abc89fa77bea55e7a435737e0fea9701ed892416f4944e48128

SHA512
26138f873b20537a7024f05ad3c4deb74c370bd1bfeddb6e9f67f6dea027710025643ec7ef458d47eea72ae4d6ad54af34544a89435d4b54387e04c209525dfc

Download Submit
C:\Windows\SysWOW64\Ecbenm32.exe

Filesize
95KB

MD5
e9b865a2b9248526646ca7425b2a27a5

SHA1
5f50d3e805bbb13576d49bb98728ca74f2d0c0de

SHA256
ed340fbfe00e28a9cedf37eb79a97438e3884ffea298e7aebcaec54d83a57aff

SHA512
7e702aa5e15f07c35d1e625e24704d3a1ff8268c637f65f31cd66815fab21a29193e83797a9f12dd2decb5510588bb5f5f65339c0748eef2e0061f95886725bd

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
95KB

MD5
da4708bf670b722ea94c148d08369bc0

SHA1
59ae6d915316b4ad7429236929b93ccefe886816

SHA256
22a1255dd6ca655ec60077f884d3ef7276b064cd9db98af3c8a4c989a27f4d7f

SHA512
ed424848f243038622f72272211f590bd2e07039681f83606aebe9f9d1694a793b99de905d09d5ab29913afc4f507a16f0862ef8dfddec382a7f0621d65013d2

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
95KB

MD5
b36ca94ea8f62f77dc14e7673c86fbff

SHA1
9ea804678f1856b38db20fd66a00ce5b1386e631

SHA256
3ad65f020c740fae2a0a186b531899ed6ab4a67cae5393499820bba9f587042b

SHA512
b6934a956d3a9206c430bfdbe7fb3d5dfbb15e1b8b0099df09d59ed5533021af6b7f717b9b1afc7cc1cd31fdd51f6e3b9cfbba97434f704e6fbccead941d0b67

Download Submit
C:\Windows\SysWOW64\Efpajh32.exe

Filesize
95KB

MD5
462ce360a7357acf7f2856c9a8cc43ee

SHA1
9c37e95c74d4f89fc106be982c19caa82946df14

SHA256
1b30ee404c03a1301f2367569bbc83aceb5efa497acdbc73a08beaf8730810b0

SHA512
1dd04e40d26174b298764eeda03153062801d8d0f5f8ce54d1cccb6ccea0572dee879ad918c510064c47dcd5d92b336aceef1039959a2fdbedad60870ade273b

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
95KB

MD5
8f6a0605ea5e62ade6020b6952b72743

SHA1
f1b85f0fd23205b63e980cdd438fd48be7a49cd9

SHA256
665d216d5924611142559e988a1cd1c9973e7461415270495e685233a6f05283

SHA512
c7f6f346cd45bc8db1d611d50cf73b4aca2ae612aa6f55b9b663f0033598278b042a5f846fa3cfb4de2525cca35db6496ab9898f1d6923a8ad33737c24dd88f4

Download Submit
C:\Windows\SysWOW64\Ehhgfdho.exe

Filesize
95KB

MD5
81521a9a590a2ab76df1f3db1d12a817

SHA1
49cb04847967385c1b06c69321866980c9a3ebac

SHA256
0f60bf215acc4ceab61562f4f47dd7b93c10694b29bd36adc379ac7d9b027087

SHA512
dd82e3e16c37be1052a57b350b0b9d18880fd52b7ec3267a0c03498d0cd23833b67a8f0ff92fc9c358980ecdc498c70871e1672beba82a9a142f1f183ab0f43a

Download Submit
C:\Windows\SysWOW64\Ehonfc32.exe

Filesize
95KB

MD5
78e3c9cc61794ef9c068e82cb75d3904

SHA1
24cdc7ea14ae8832675321348ae50d8ecf8c6833

SHA256
46226f715aed3ce38942f8bdcd7208bc94e6d0f648d364f43c2c977217cb63e6

SHA512
9e69bf9f86f3d6770036556f8cc2c78c9d8d3114e34d086b420664c3c9aa05475e059f19ec21567d8a34d18c7013b875f149443e6c64541ddf981b3fb21c145f

Download Submit
C:\Windows\SysWOW64\Ejjqeg32.exe

Filesize
95KB

MD5
7c01bc2ed35fc6286c027082a82ba184

SHA1
315fbaa319c719dec20b78e57d43877dd9f180bc

SHA256
6c7ec668c77b97a225233e28ce18a5c97460187d10ed00c11bada787f60ad699

SHA512
ed8793d303de5ab45f05419519c424cdb464c672d4a9aaf7e16a5a5181cb92b7433217bffa7de396b0ec0c168e3057afb2cc4042b1af2110b105e4c31fda6a36

Download Submit
C:\Windows\SysWOW64\Elhmablc.exe

Filesize
95KB

MD5
abb4fd56389072a01f805f50c1ca07a6

SHA1
752470f8ecd279e37b6145dea8bd59256bf50352

SHA256
27ef3769f983aa895d8195a41e30b0e2dca414af510fedae5eb4c983c8c308c2

SHA512
d02ddd81d45db459c7af2908bfeff92c75e5adca327e808645930fe5ba7381978d26663d7a74624b667e6c21159bf722d0292368656722cf4fce7cafce34df93

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
95KB

MD5
59d42c129ee3865d00e00d32ccf344a8

SHA1
ba5d98fd73e304fea0f031eaba80614159952337

SHA256
e32168cbfde5470586f309d817f9b4b19d62e5cf53955a0c2cb1dcd5fc715983

SHA512
e988770f9e7e96d7b165d4595191595c7bc07d8cb930f68965458b726a4c409debdde95436d5beeb6ef3021757eab05f466df37020580b22beb85ed83d3f697f

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
95KB

MD5
5842c0f8feef16e00b0121d9681a2ac4

SHA1
35b73356177680c26d3bce4d5b98e081eba6c270

SHA256
3bf8a51f0c7a33c356254f94b1f7031827f3ccb8ed429cc2d065d253bda39675

SHA512
cf26d55e40102da9321039be835594d0e8fb8b67dfd096789399eabb6a17adf80110982c58a8bf551e461d233363d9eb5adc6445e3746d6846da65b56320c508

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
95KB

MD5
63c1e6224aca15fa315c803f481973ab

SHA1
f82c1749873cbdd83aed67dd7d18e59e2e138f96

SHA256
b4525b1356a7df39cb30dd14a8a13466968363293f2b089c3ab26ff2e24e6359

SHA512
ae24604f9b9c899e0a7e286883d7a9d2051d8012ab3edf4e7cc207a779d0d796f4919c0e68bf9c9fc9c0b59a182aa215214a0e1c651d5b0d0f6e09a13a114123

Download Submit
C:\Windows\SysWOW64\Eqalmafo.exe

Filesize
95KB

MD5
23a088d3c24551dbba2a959c1048a69c

SHA1
f1273e7420e37878e5f6ef34894445577827a7de

SHA256
57355a0a8988502970b42adf997d660ba49f7c87b10e523e9da3111ab73f886d

SHA512
e3f284bb0d5e0fee0b2cf1b79665ab4bafa3729c2aa20910f8cb1059c0d6fa7558379f05e5b51a5ea003a3b85f20764726ac336b78a2908189c942111abda344

Download Submit
C:\Windows\SysWOW64\Fbgbpihg.exe

Filesize
95KB

MD5
7edc0ae8ac53eb93261b055339dd1a54

SHA1
8b497920d46353087ff54677e840d86bf126d0fa

SHA256
b6b22430baa3cfdd6f84efd1d3d941dccb2e047a16786bec0e86bc314098727c

SHA512
9c92ba8ba1ceec5bb2a94449f9e3a0cf593cf8ad08864217ee2a8cf043f81aa22ab10e24d73dc0370ddc44c310fdb1123af7b6fe30fa30674e5a45225d64cd19

Download Submit
C:\Windows\SysWOW64\Ffbnph32.exe

Filesize
95KB

MD5
a53a25c821038906962434bd794f7d7a

SHA1
e10de1d8a53f82ab2eb02c7f5d0aef9a08342455

SHA256
d69937120bc41584f0300025a1a7e5b2708fbf0416c4b2348a27dcb19e5e68f0

SHA512
0530c273b349809dbf7631c64cf13fb36e4077bba3f5b7378758e301408f4b0adc6bea2fa3cf6624fd58a8f7e1db3b55b25bcaf48472ff0d843f85dfaf2a0b83

Download Submit
C:\Windows\SysWOW64\Ffekegon.exe

Filesize
95KB

MD5
aac5e39cbac6a43c6ceb19a986593487

SHA1
2c6f69d76abc986c461127bd7c2a1347a6f9cbf7

SHA256
e852121cc19dc5effadfea2c349b2f60ce50682683ffa415e3f3a7cd06bdbecf

SHA512
003e5b3f1c7a64e23b1a814bbaa2c7f70d457e3cd107f52d7f7757c54c7b4f4e3cdfb9c3bb44ee71ccfb0d2cc02a4a45eb20778863347feabb286358d4603f42

Download Submit
C:\Windows\SysWOW64\Fhajlc32.exe

Filesize
95KB

MD5
8079dec892f8fce0344954eef5039b37

SHA1
f6b3ac272778d431ba54a00a5b681e0e901f3c3b

SHA256
5356ebb046714dedfb677caf623c9e84061c4b2694ed8addc0b3c5fba42741bc

SHA512
f90f8987c5241283bdc360f8cf66dd0ed97a1fd80620800260ad70b17955916e118d83666cb440c3cf5f389055012cd640d57dfb0521919f2cd5b428100860f4

Download Submit
C:\Windows\SysWOW64\Ficgacna.exe

Filesize
95KB

MD5
92f810c7896669368ec34527877feac8

SHA1
7244b12651c62c93d574495ed609aa31c1759747

SHA256
b827e7f895ef09a514b4f58efe2df6304f1b187f1aed14b75f0c710b9675947c

SHA512
b81147c0d838f1c4f01c9a709ce07a5ed9ececd4b3145beaec3f7b3f85121e884f968f5953d4e91b6efcb8b30a80ee8d23ea92645c63752cf107bd42472b021a

Download Submit
C:\Windows\SysWOW64\Fokbim32.exe

Filesize
95KB

MD5
60d2cb334df2659ad8e8692e0b9978f8

SHA1
b867aeda4602b1a5647bbb48540c9e17bcf1388d

SHA256
b5f25c7089c0065b2e0ad306bcfd6b2c14366df9832c6bbafcf6c90a89486780

SHA512
108375bd819f8ed9e8bcca9299175e748e1b2b149de2a6d642473539416665fc58387642cd9fae0015090dd538334dd310b8b8c68f1cd2d089f0437b30189d7d

Download Submit
C:\Windows\SysWOW64\Fomonm32.exe

Filesize
95KB

MD5
b8f2e9f5cffb7ca3ab43ecc276585424

SHA1
55408c6545d626426b34757b4d42a89eca29ead5

SHA256
8bddf3e0fdd2e0017b2329434b9dd76a6848033c85957b96b5e9aa9ef765a534

SHA512
b6604f52364ccf42c1316b8b1e100cfedef2fdf4b2fc37e36d7fbf1020e67acedd1d854a31ddf95b196f04b7e77dcecc2317007b7d50caa6c028e810e9f719ae

Download Submit
C:\Windows\SysWOW64\Gidphq32.exe

Filesize
95KB

MD5
10bf6d23d092c99813b68c3dcb26a79f

SHA1
2546479a8d1e41f161aa7172e36cbd9bdabaa8f5

SHA256
04d83f796c2a284e5f53081fb3ea0210f3c2743d5903801f77b4fb87da42b16c

SHA512
64fbccfcb568174cd19a5ad0bef7fe41f72a8c40f053f03c483731b572c896bdcc4944b5cec10eb62ef2fd8df8ca7bd13feec64d6a42203cb297b189e48cf21d

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
95KB

MD5
772a452820a853874e4d4b2a78375926

SHA1
91d59816e5403aeaba71d0006b1166989decbca3

SHA256
084fd0dfa9e5785d55bcd44f4e51611ba83a2c71d8e9639b50406047ea0c3d5f

SHA512
ecd43772b5554d10eaf164093de6a90754bb7d29aacf687632d00a11cf0ff79d65aa8a7f4d00f4ad926961b49f75edfe95d5756b9a8224e511051a05dd1bdf0d

Download Submit
memory/436-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/840-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/840-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1076-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1076-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1148-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1148-167-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1300-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1300-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1444-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1520-251-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1520-159-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1568-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1648-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1728-206-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1728-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1856-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1928-234-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1928-142-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2176-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2376-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2376-107-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2392-60-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2416-176-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2416-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2824-351-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3032-140-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3168-207-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3256-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3288-336-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3288-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3436-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3488-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3488-352-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3532-156-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3716-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3964-124-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4040-314-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4072-313-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4072-243-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4132-266-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4216-349-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4268-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4268-98-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4316-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4316-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4332-174-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4448-338-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4536-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4536-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4576-133-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4700-222-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-307-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4904-122-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4968-47-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4968-150-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-344-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5068-87-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5080-115-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5080-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5100-320-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5104-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5104-300-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads