fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060.exe
Size

340KB
MD5

0ef6b5658162fe026f0b58ad8392e8f5
SHA1

9664fd9ad5c9ed81b619f0a25a247e56c341921f
SHA256

fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060
SHA512

18035009725d2415c940da15a417cf0aadef6f8b5f2f22b8a45ebb66822c39386ab94d219248ca6adb59f6e7ef2bc47199d3b44299f138d53a06f09647bb8c2d
SSDEEP

6144:bh8lCCCCCCc5zIyedZwlNPjLs+H8rtMsQBJyJyymeH:ECCCCCCc2yGZwlNPjLYRMsXJvmeH

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbgkfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpeepnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpklpkio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipckgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipckgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffggkgmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjhmgeao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbjhlfhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpjqhgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clnadfbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecdbdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmocba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Denlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbqefhpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hihicplj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcidfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbhmdbnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chgoogfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcdimopp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cekohk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gameonno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjhmgeao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Camfbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpofpdgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmocba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjmgdlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebbidj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmmocpjk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpbaqj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlegeemh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doccaall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eoapbo32.exe

Executes dropped EXE 64 IoCs

pid	Process
32	Cedihl32.exe
64	Clnadfbp.exe
548	Cchiaqjm.exe
3516	Chebighd.exe
268	Cpljkdig.exe
3872	Camfbm32.exe
3376	Chgoogfa.exe
4556	Cpofpdgd.exe
4564	Cekohk32.exe
4760	Dlegeemh.exe
3632	Doccaall.exe
1004	Denlnk32.exe
376	Dhlhjf32.exe
2852	Dcalgo32.exe
2128	Djlddi32.exe
432	Dljqpd32.exe
2336	Dcdimopp.exe
2944	Dhqaefng.exe
1856	Dokjbp32.exe
2752	Daifnk32.exe
3764	Dhcnke32.exe
2976	Dpjflb32.exe
2836	Ehekqe32.exe
4972	Elagacbk.exe
4780	Eckonn32.exe
4048	Ehhgfdho.exe
2152	Eoapbo32.exe
4180	Ebploj32.exe
4300	Eodlho32.exe
1076	Ebbidj32.exe
4988	Ehlaaddj.exe
820	Elhmablc.exe
4932	Ejlmkgkl.exe
1556	Emjjgbjp.exe
3064	Eqfeha32.exe
3892	Ecdbdl32.exe
5108	Ffbnph32.exe
4768	Fmmfmbhn.exe
1684	Fokbim32.exe
4976	Fcgoilpj.exe
4996	Fmocba32.exe
2016	Fcikolnh.exe
1616	Ffggkgmk.exe
4840	Fopldmcl.exe
3900	Fbnhphbp.exe
4016	Fihqmb32.exe
1888	Fbqefhpm.exe
1720	Fjhmgeao.exe
3728	Fijmbb32.exe
3604	Fodeolof.exe
2120	Gimjhafg.exe
5116	Gogbdl32.exe
4416	Gjlfbd32.exe
4388	Gmkbnp32.exe
644	Goiojk32.exe
1768	Gbgkfg32.exe
3052	Gmmocpjk.exe
1208	Gpklpkio.exe
4772	Gbjhlfhb.exe
4168	Gidphq32.exe
4700	Gcidfi32.exe
3636	Gbldaffp.exe
2284	Gjclbc32.exe
3384	Gameonno.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kibnhjgj.exe	Kkpnlm32.exe
File created	C:\Windows\SysWOW64\Mgekbljc.exe	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Nddkgonp.exe
File opened for modification	C:\Windows\SysWOW64\Fmmfmbhn.exe	Ffbnph32.exe
File opened for modification	C:\Windows\SysWOW64\Fcgoilpj.exe	Fokbim32.exe
File created	C:\Windows\SysWOW64\Lbdfmi32.dll	Fbnhphbp.exe
File opened for modification	C:\Windows\SysWOW64\Habnjm32.exe	Hfljmdjc.exe
File opened for modification	C:\Windows\SysWOW64\Haggelfd.exe	Hippdo32.exe
File created	C:\Windows\SysWOW64\Fkindkmi.dll	Doccaall.exe
File opened for modification	C:\Windows\SysWOW64\Gpklpkio.exe	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Fnelfilp.dll	Maohkd32.exe
File created	C:\Windows\SysWOW64\Mjjmog32.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Nkklocjg.dll	Elagacbk.exe
File created	C:\Windows\SysWOW64\Oijnep32.dll	Ecdbdl32.exe
File created	C:\Windows\SysWOW64\Dadofijl.dll	Gmkbnp32.exe
File created	C:\Windows\SysWOW64\Hbeghene.exe	Hadkpm32.exe
File opened for modification	C:\Windows\SysWOW64\Ldmlpbbj.exe	Laopdgcg.exe
File opened for modification	C:\Windows\SysWOW64\Hfcpncdk.exe	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Ikjmhmfd.dll	Ibojncfj.exe
File created	C:\Windows\SysWOW64\Jbmfoa32.exe	Jfffjqdf.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Himcoo32.exe	Hfofbd32.exe
File opened for modification	C:\Windows\SysWOW64\Iiffen32.exe	Ifhiib32.exe
File created	C:\Windows\SysWOW64\Ipckgh32.exe	Ibojncfj.exe
File created	C:\Windows\SysWOW64\Cekohk32.exe	Cpofpdgd.exe
File created	C:\Windows\SysWOW64\Mhollf32.dll	Dhqaefng.exe
File created	C:\Windows\SysWOW64\Npgpaojg.dll	Dhcnke32.exe
File created	C:\Windows\SysWOW64\Ocdehlgh.dll	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Ggdddife.dll	Gpklpkio.exe
File opened for modification	C:\Windows\SysWOW64\Jpgdbg32.exe	Ifopiajn.exe
File created	C:\Windows\SysWOW64\Kmegbjgn.exe	Jfkoeppq.exe
File created	C:\Windows\SysWOW64\Jjcfkp32.dll	Hadkpm32.exe
File created	C:\Windows\SysWOW64\Ibagcc32.exe	Ipckgh32.exe
File created	C:\Windows\SysWOW64\Mkpgck32.exe	Mgekbljc.exe
File opened for modification	C:\Windows\SysWOW64\Elhmablc.exe	Ehlaaddj.exe
File created	C:\Windows\SysWOW64\Honckk32.dll	Hfljmdjc.exe
File opened for modification	C:\Windows\SysWOW64\Kgmlkp32.exe	Kmegbjgn.exe
File opened for modification	C:\Windows\SysWOW64\Lcmofolg.exe	Ldkojb32.exe
File opened for modification	C:\Windows\SysWOW64\Hippdo32.exe	Hbeghene.exe
File opened for modification	C:\Windows\SysWOW64\Hcedaheh.exe	Haggelfd.exe
File created	C:\Windows\SysWOW64\Icgqggce.exe	Haidklda.exe
File created	C:\Windows\SysWOW64\Baefid32.dll	Lnepih32.exe
File opened for modification	C:\Windows\SysWOW64\Maohkd32.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Mpaifalo.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Ibccic32.exe	Idacmfkj.exe
File opened for modification	C:\Windows\SysWOW64\Lpfijcfl.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Fopfdhej.dll	fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060.exe
File created	C:\Windows\SysWOW64\Gbjgbh32.dll	Ebploj32.exe
File created	C:\Windows\SysWOW64\Mepgghma.dll	Gimjhafg.exe
File created	C:\Windows\SysWOW64\Dempmq32.dll	Iakaql32.exe
File opened for modification	C:\Windows\SysWOW64\Nddkgonp.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Lihoogdd.dll	Ifmcdblq.exe
File created	C:\Windows\SysWOW64\Kgmlkp32.exe	Kmegbjgn.exe
File opened for modification	C:\Windows\SysWOW64\Mnlfigcc.exe	Laefdf32.exe
File created	C:\Windows\SysWOW64\Ofnpim32.dll	Cpljkdig.exe
File created	C:\Windows\SysWOW64\Bbopfj32.dll	Dcdimopp.exe
File created	C:\Windows\SysWOW64\Fagmapfi.dll	Elhmablc.exe
File created	C:\Windows\SysWOW64\Emjjgbjp.exe	Ejlmkgkl.exe
File opened for modification	C:\Windows\SysWOW64\Gimjhafg.exe	Fodeolof.exe
File created	C:\Windows\SysWOW64\Fhpdhp32.dll	Maaepd32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6644	6432	WerFault.exe	267

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdkhlo32.dll"	Gjclbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifopiajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbhnnj32.dll"	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfffjqdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmlnpc32.dll"	Chgoogfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doccaall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eoapbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdigkkd.dll"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plbehnol.dll"	Cekohk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfjmgdlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jplmmfmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcidfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aodldljj.dll"	Clnadfbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqfeha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfjmgdlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckegia32.dll"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maohkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmmocpjk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcifkp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bheenp32.dll"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihoogdd.dll"	Ifmcdblq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eceakm32.dll"	Dcalgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpjflb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcgoilpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbplof32.dll"	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baefid32.dll"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbopfj32.dll"	Dcdimopp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehekqe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfofbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpfjejo.dll"	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oedbld32.dll"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khkchobp.dll"	Cchiaqjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebploj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifhiib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laopdgcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chebighd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chgoogfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcalgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Liekmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daifnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipmack32.dll"	Ibccic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oijnep32.dll"	Ecdbdl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anjekdho.dll"	Jbhmdbnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeecjqkd.dll"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dofqcl32.dll"	Fokbim32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 32	4352	fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060.exe	87
PID 4352 wrote to memory of 32	4352	fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060.exe	87
PID 4352 wrote to memory of 32	4352	fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060.exe	87
PID 32 wrote to memory of 64	32	Cedihl32.exe	88
PID 32 wrote to memory of 64	32	Cedihl32.exe	88
PID 32 wrote to memory of 64	32	Cedihl32.exe	88
PID 64 wrote to memory of 548	64	Clnadfbp.exe	89
PID 64 wrote to memory of 548	64	Clnadfbp.exe	89
PID 64 wrote to memory of 548	64	Clnadfbp.exe	89
PID 548 wrote to memory of 3516	548	Cchiaqjm.exe	91
PID 548 wrote to memory of 3516	548	Cchiaqjm.exe	91
PID 548 wrote to memory of 3516	548	Cchiaqjm.exe	91
PID 3516 wrote to memory of 268	3516	Chebighd.exe	92
PID 3516 wrote to memory of 268	3516	Chebighd.exe	92
PID 3516 wrote to memory of 268	3516	Chebighd.exe	92
PID 268 wrote to memory of 3872	268	Cpljkdig.exe	93
PID 268 wrote to memory of 3872	268	Cpljkdig.exe	93
PID 268 wrote to memory of 3872	268	Cpljkdig.exe	93
PID 3872 wrote to memory of 3376	3872	Camfbm32.exe	94
PID 3872 wrote to memory of 3376	3872	Camfbm32.exe	94
PID 3872 wrote to memory of 3376	3872	Camfbm32.exe	94
PID 3376 wrote to memory of 4556	3376	Chgoogfa.exe	95
PID 3376 wrote to memory of 4556	3376	Chgoogfa.exe	95
PID 3376 wrote to memory of 4556	3376	Chgoogfa.exe	95
PID 4556 wrote to memory of 4564	4556	Cpofpdgd.exe	96
PID 4556 wrote to memory of 4564	4556	Cpofpdgd.exe	96
PID 4556 wrote to memory of 4564	4556	Cpofpdgd.exe	96
PID 4564 wrote to memory of 4760	4564	Cekohk32.exe	97
PID 4564 wrote to memory of 4760	4564	Cekohk32.exe	97
PID 4564 wrote to memory of 4760	4564	Cekohk32.exe	97
PID 4760 wrote to memory of 3632	4760	Dlegeemh.exe	98
PID 4760 wrote to memory of 3632	4760	Dlegeemh.exe	98
PID 4760 wrote to memory of 3632	4760	Dlegeemh.exe	98
PID 3632 wrote to memory of 1004	3632	Doccaall.exe	99
PID 3632 wrote to memory of 1004	3632	Doccaall.exe	99
PID 3632 wrote to memory of 1004	3632	Doccaall.exe	99
PID 1004 wrote to memory of 376	1004	Denlnk32.exe	100
PID 1004 wrote to memory of 376	1004	Denlnk32.exe	100
PID 1004 wrote to memory of 376	1004	Denlnk32.exe	100
PID 376 wrote to memory of 2852	376	Dhlhjf32.exe	101
PID 376 wrote to memory of 2852	376	Dhlhjf32.exe	101
PID 376 wrote to memory of 2852	376	Dhlhjf32.exe	101
PID 2852 wrote to memory of 2128	2852	Dcalgo32.exe	102
PID 2852 wrote to memory of 2128	2852	Dcalgo32.exe	102
PID 2852 wrote to memory of 2128	2852	Dcalgo32.exe	102
PID 2128 wrote to memory of 432	2128	Djlddi32.exe	103
PID 2128 wrote to memory of 432	2128	Djlddi32.exe	103
PID 2128 wrote to memory of 432	2128	Djlddi32.exe	103
PID 432 wrote to memory of 2336	432	Dljqpd32.exe	104
PID 432 wrote to memory of 2336	432	Dljqpd32.exe	104
PID 432 wrote to memory of 2336	432	Dljqpd32.exe	104
PID 2336 wrote to memory of 2944	2336	Dcdimopp.exe	105
PID 2336 wrote to memory of 2944	2336	Dcdimopp.exe	105
PID 2336 wrote to memory of 2944	2336	Dcdimopp.exe	105
PID 2944 wrote to memory of 1856	2944	Dhqaefng.exe	106
PID 2944 wrote to memory of 1856	2944	Dhqaefng.exe	106
PID 2944 wrote to memory of 1856	2944	Dhqaefng.exe	106
PID 1856 wrote to memory of 2752	1856	Dokjbp32.exe	107
PID 1856 wrote to memory of 2752	1856	Dokjbp32.exe	107
PID 1856 wrote to memory of 2752	1856	Dokjbp32.exe	107
PID 2752 wrote to memory of 3764	2752	Daifnk32.exe	108
PID 2752 wrote to memory of 3764	2752	Daifnk32.exe	108
PID 2752 wrote to memory of 3764	2752	Daifnk32.exe	108
PID 3764 wrote to memory of 2976	3764	Dhcnke32.exe	109

C:\Users\Admin\AppData\Local\Temp\fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060.exe
"C:\Users\Admin\AppData\Local\Temp\fad31dda2f16a06b5adf3111a2ed9cbad2460a06884ef1f6b732e337e1126060.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\Cedihl32.exe
  C:\Windows\system32\Cedihl32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:32
- - C:\Windows\SysWOW64\Clnadfbp.exe
    C:\Windows\system32\Clnadfbp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\Windows\SysWOW64\Cchiaqjm.exe
      C:\Windows\system32\Cchiaqjm.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\Windows\SysWOW64\Chebighd.exe
        
        C:\Windows\system32\Chebighd.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3516
      - C:\Windows\SysWOW64\Cpljkdig.exe
        
        C:\Windows\system32\Cpljkdig.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:268
        
        C:\Windows\SysWOW64\Camfbm32.exe
        
        C:\Windows\system32\Camfbm32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Chgoogfa.exe
        
        C:\Windows\system32\Chgoogfa.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SysWOW64\Cpofpdgd.exe
        
        C:\Windows\system32\Cpofpdgd.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Cekohk32.exe
        
        C:\Windows\system32\Cekohk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Doccaall.exe
        
        C:\Windows\system32\Doccaall.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Denlnk32.exe
        
        C:\Windows\system32\Denlnk32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Dhlhjf32.exe
        
        C:\Windows\system32\Dhlhjf32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\SysWOW64\Dcdimopp.exe
        
        C:\Windows\system32\Dcdimopp.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\SysWOW64\Dokjbp32.exe
        
        C:\Windows\system32\Dokjbp32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2976
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2836
        
        C:\Windows\SysWOW64\Elagacbk.exe
        
        C:\Windows\system32\Elagacbk.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4972
        
        C:\Windows\SysWOW64\Eckonn32.exe
        
        C:\Windows\system32\Eckonn32.exe
        26⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        27⤵
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\Eoapbo32.exe
        
        C:\Windows\system32\Eoapbo32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2152
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4180
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        30⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1076
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4988
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:820
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4932
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        35⤵
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5108
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        39⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4976
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        43⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        45⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        47⤵
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        50⤵
        Executes dropped EXE
        
        PID:3728
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3604
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2120
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        53⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        54⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4388
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        56⤵
        Executes dropped EXE
        
        PID:644
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1768
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1208
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3636
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2284
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1676
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1508
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1560
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2104
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        70⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        71⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:552
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:628
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        74⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        75⤵
        Drops file in System32 directory
        
        PID:2876
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        76⤵
        Drops file in System32 directory
        
        PID:3480
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        77⤵
        Drops file in System32 directory
        
        PID:1900
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        78⤵
        Drops file in System32 directory
        
        PID:2724
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:956
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        80⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        81⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        82⤵
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        83⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        84⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        85⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3648
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4740
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        88⤵
        
        PID:536
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        89⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        90⤵
        Drops file in System32 directory
        
        PID:2548
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        92⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3504
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        94⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        95⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        96⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        97⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        99⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        102⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        104⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        107⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        108⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        110⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        111⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        112⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        113⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        114⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6052
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        116⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        117⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        118⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        124⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        125⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        128⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        129⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        130⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        132⤵
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5356
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        135⤵
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        136⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        137⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        139⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        141⤵
        
        PID:248
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        142⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        144⤵
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        145⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        146⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        147⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        148⤵
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        150⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        151⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        152⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        153⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        154⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        155⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        156⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        158⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6444
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6656
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        164⤵
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        165⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        166⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        167⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7000
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        172⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        173⤵
        Drops file in System32 directory
        
        PID:7148
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        174⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        175⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        176⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        177⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 416
        178⤵
        Program crash
        
        PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6432 -ip 6432
1⤵
PID:6604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Camfbm32.exe

Filesize
340KB

MD5
fd6c2fed47496e5884a6ca1ec523f688

SHA1
f781ccbab64cc5761ebe73a8a1d2783d81904487

SHA256
aff015abdc756b06dbbcc7c60733ef8bf92b594d5323718a3161557ef3ad443b

SHA512
f02871118c1470681e56abba1a9c0f0400c1a3e4fdd80543d30d5ab3fcbb35d98e4b1b2c8926b3fac772ebc9401f4ba300fc4067b9f5fab1d770499574fd83ca

Download Submit
C:\Windows\SysWOW64\Cchiaqjm.exe

Filesize
340KB

MD5
a40a27e30b77506603314fe750cc5374

SHA1
957da966317f198d3715666de7bcdea148dc5255

SHA256
9f974f131825c26861d5d182b1b2df00da0fb28f1ca5addf8e6bb019cc0bcd34

SHA512
014640cd08880b6bffecc727b82652e4a40aff265ecd6b28fcc7e981ff7a5bce44162f26daf1e44a2a665ca5beedd9ae82c070486ec43fb24c4c4a25c1ee9254

Download Submit
C:\Windows\SysWOW64\Cedihl32.exe

Filesize
340KB

MD5
14ce60432e59c84f92d59f84f71511ce

SHA1
d3997986e1afbb1cebdcb74b8ebe51b59188b187

SHA256
baf5db54b74216d51ef2911a44200013dfc5bffebf132aa675b54c3cc1d56ee2

SHA512
580f11977d78ff4dc8fa02519dc61ec3d700a6a6cfa3e1c1034b9c06511ef547b49b34d0bca551a3cf9e8a2debc14df8bc99958e88ea4d2f0cccd3f2390947ad

Download Submit
C:\Windows\SysWOW64\Cekohk32.exe

Filesize
340KB

MD5
53e6d2122f80a2006955d4d1d75c73d9

SHA1
9b97dec62a005195e8e2fbd9a02ad42a82a3b7aa

SHA256
8cac26ca9229c8e8c8321227840fc4a13986da032b9b57fc193b5348dafc63a8

SHA512
945a435bd9f4989634eeaa87498ca67f0f4cc95496042744369895e2c0155b861b47121bef9abb142d99897c074ac558987e6caa66b7a3c1183c4b201199675c

Download Submit
C:\Windows\SysWOW64\Chebighd.exe

Filesize
340KB

MD5
4084f72c50d0a735e4ba71e22e837c04

SHA1
16b5392dc6bd9e88dabae4a383078b2499287752

SHA256
260ac93ddc5a398d68e653d1e6d04a1283fb78206228a62820bb0946faf3f40b

SHA512
5db5b7303c1650524f5c2fd36490ba398a51ea362a64a9ddcfa172de7bf598a6ba22bca95cb0d511acdd761f01cffcbed56fbdc934bfe3c8c3fac96f8d0c0782

Download Submit
C:\Windows\SysWOW64\Chgoogfa.exe

Filesize
340KB

MD5
d35d940032d73a335444ed2ad3c71177

SHA1
a6fb571d9d95fa67cc9299d9496bdad729508b3c

SHA256
8fb4937db15de8f5ac1c759b387dcae1d1af49e8119566b5b2d06f0f5b85d61a

SHA512
07be50542f9c080f454b598440042354a83a73432f4f18fc7607019931c57287039debf8b6f6639fb043bd08eda7e27b58efe632fe9f5dc392b777e4d977b5d5

Download Submit
C:\Windows\SysWOW64\Clnadfbp.exe

Filesize
340KB

MD5
a7f107d01889027161376750b37a86fe

SHA1
b9981cc3479c061d59d4a9b6559e70c4697df050

SHA256
ec7b39c941223c2c35783024106063c817216874c656f64a5fb549f2295ee434

SHA512
1ce6d48bd9d33e8225ca00b365cbeefa94be5d2b2617a65b3451abed6ce258d65e8fb94b68b3138885ce77e24ec0f3a7dbbbedf78b81f97c40759bf1ab774ae6

Download Submit
C:\Windows\SysWOW64\Cpljkdig.exe

Filesize
340KB

MD5
2dccf5c6e851f106aea6b51d0736a351

SHA1
1e4a4f4295391bf4f1d7a3c5606d0cc03169e5d0

SHA256
a3089e6bebcb0631141babcaab15663d2845a28ad87613e76e9be965b6d84317

SHA512
12202ee4d4f2695ba5fdfd9e07c7e2ae60f5eb85a127bccc2cf48cbd7498bb1615c2cb2197d76e62c462628312cde27ccb33159d82db2b9f712908c1e03ab8a2

Download Submit
C:\Windows\SysWOW64\Cpofpdgd.exe

Filesize
340KB

MD5
b70029079adafa0bb18ce18d773b5ade

SHA1
34483c98fb4d9873ffed3a638977ab2053c74cfc

SHA256
7e7ccb45b22b2916722bff2a59ef67d3b11a21e082e897ae9890087a605d59f2

SHA512
d0b09b186d74c08b38a6f0f40a8a73efad8458e7a9d9f37ef912f07ed7bdd89fa144ce50b493d0ff94c8412bf6866ad2ecf58462668d55f9f3b951d538d0f55b

Download Submit
C:\Windows\SysWOW64\Daifnk32.exe

Filesize
340KB

MD5
1ce88e23403c0c1a2d08ec7e924e2786

SHA1
c718082b245b3b0e327a21f810b5cd80b8972d90

SHA256
31e8b9dac1c5a974661ef12c790de16bc8dd85be1b0acad9998fc3423eeeb44b

SHA512
fcabd210d8e4b4e11bb356ff61e0b45c00787a6658863ab9f6731a28f3c9aa3ecacc46b939872ef50956ed3ebbffdde2e09c2bf30cdb63d6602a493020526b39

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
340KB

MD5
1e1eaa4dfbcf79c27337de3205b8524e

SHA1
ae98648753f12aab0671caac0df8215bbf771791

SHA256
0aa873fa0f888c04c8ab23849d8c22c831356ddadecca2c0d30ee5e2366246c8

SHA512
78b1f3e8209dc71498afe302b6cdd77083f9db54200a452bb2547755e0ad3af62f3f931b297916a2141d49da419a78e17fe48cceb3e2dd9147e8650783ca76b8

Download Submit
C:\Windows\SysWOW64\Dcdimopp.exe

Filesize
340KB

MD5
11f7a412b95eba28d09b4fd6443cb60c

SHA1
29edc0868e8e9d14014f5a2e9cd1bb4b172d14c8

SHA256
9d26c3dc5fde6946e00390eeea46b9d8d8bca31ca2ad2a29eb76f4ea7951f166

SHA512
4e23683d6c5d9ee784cbcea895a54530524f85949a3e4fc5d5943908df08f98304c106edde6e7259a8348384ebb6279e444c62710e013331149e478fc4a47b60

Download Submit
C:\Windows\SysWOW64\Denlnk32.exe

Filesize
340KB

MD5
cfacee0e6e0d200f8740dd669f4d1632

SHA1
bc90d47de0c68d9e12f51a1627d067ae20c167e0

SHA256
8d3dcd9b2587305a10d5e5c8cf4106071ae17d782d1bc995f152ba2902542f9f

SHA512
bf6596ecc3d5e90b73acddcbd9660d67270f866037425862e2e79709b2e4e58c8501cb120ae563a91c9e2dc13dbd7e2b208ff35e3f656f4315bb4b889211f941

Download Submit
C:\Windows\SysWOW64\Dhcnke32.exe

Filesize
340KB

MD5
a31ee14025acf5982cced663c05d99ae

SHA1
db77f02fb6119d7127571fed3a01efc029aa331f

SHA256
dbbfc8344319bc1968af05398e4fcbbb620b34e09f0912c14048ea1e57754b2d

SHA512
b17b87a5d39c81f1c7b2d255411e9be9ba881b475d308b58eafc1587723f41015b504f80c0566f37034739ecaa6b1f01efe98ec759358ea96fdedb720d388d6d

Download Submit
C:\Windows\SysWOW64\Dhlhjf32.exe

Filesize
340KB

MD5
5d993c14525eea34577d6a644a5e6ca2

SHA1
55d63f3490c9f1dc0e62d79e971a475d263f247c

SHA256
aa03b7974c0c126b8b9241e1752e2e75c3088cc97fd037fbf9def0ba498c409a

SHA512
2463d2bd53027275719af24fb69e2fc3231354a798e0012862d8bc29b5c36562e0c8519964dcf146737b29987814ac27fe45c39e04dc79003ccca61b9c0b504d

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
340KB

MD5
ccced10ce40a85b3e214daf28cc21f8a

SHA1
1505ac58134958a80bc91847ce4a592a5d52bf66

SHA256
d07f0084f7d57fdeeef8a5815880cd2aa269febea1a8a50026b1b69634459956

SHA512
c9f1fbd3f4e41a47976e9a3e00cd242774e1dbf44335ef65c7725ca1e9f4cd61d5d3a972d2b311bfe929bd5a6aad330dd21ddda4ea2d351203294305f5d47c31

Download Submit
C:\Windows\SysWOW64\Djlddi32.exe

Filesize
340KB

MD5
4e9f60e8f7dc0c934e59dd709084124e

SHA1
cce82b1a26404369b288151aef2c21ba7befd700

SHA256
9f99b7ca65fe266240ef52d3af5f5b305f868057a367df7a5906d8f60e956012

SHA512
b670d66f23b79635a7a9235ddadfe690416ba571e76b8a00c43adc236fb83d99bfe36fde56dc0595612a00a322374977b2464ee1c9db786f4a7841dee2301545

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
340KB

MD5
99ffb3710015601eefa211baabbffd1e

SHA1
36926d6cb3be33dc92192a2a88fea35b18c74bf3

SHA256
4574b87a5d21a1e900a59a38d9f7e31f1747962ea93d8fc713527e9287808ff7

SHA512
74686bf25ef7471d54d996baea630ab811a4369ba03a1ca984ab7d2e4859722c0933ee6d5178076201686f2d77f969121d42cc76671b706dae324857dc532bf9

Download Submit
C:\Windows\SysWOW64\Dljqpd32.exe

Filesize
340KB

MD5
e2afdd26141d10ce0d5126d904b09332

SHA1
c59dc33a0f65639b95f7fbdaa88de59901d26fe6

SHA256
8a9d9fbe0c94b68da53cab3518f9ad2a7f4b31cd928dd9f754d6c834737c89d8

SHA512
7d2b64a4aa5045f7699eb76c732f7038f892fa911c12536987a46f1d1442f9c729737b577703d430ebb2e5387f3cc53a6699d2e10352a28adebc6f9a2d41d518

Download Submit
C:\Windows\SysWOW64\Doccaall.exe

Filesize
340KB

MD5
5507793207cf31f897ab3ae27bda3fba

SHA1
2afdaf889417f6f9044d30bf9ee7717a7d14d28c

SHA256
69c2f54f89b2fb025ec60413c12216c60764eaa516bf3b9ce1197c534a378f9c

SHA512
ad6a47739d050f37f7d4ca041dc2b35d3259cb66f7342493c4ce2be63063e40ee49bb27ed0821726b03d6b3c0e959fc45f0dc937814fe1fdf7963e4169992b5a

Download Submit
C:\Windows\SysWOW64\Dokjbp32.exe

Filesize
340KB

MD5
96ad2d714d15e9fcc633bcfa1c94f4b4

SHA1
3b6b7b47dc6f01cad98c27b2efccc2ce15447b9d

SHA256
8d27e34618c14d316a7757c04034f8be7008de664fbc9903aad4e80d845dc67b

SHA512
8ed90d32428da00f5fc5b4f931801a3553d3be4ba086bbb1bd822f5000b97bbc3815e039496cc24f33727cc8154849c07fe98a59365dfefd30dc2197ee2db7dd

Download Submit
C:\Windows\SysWOW64\Dpjflb32.exe

Filesize
340KB

MD5
a7f57531304be7390c83604380d5f3b5

SHA1
031b27f6ada38586a221c46611f7e2b8177b9354

SHA256
b5c7a55f73e4d659cddfecb3653fccccd3af37c41f5605353d312f3503478490

SHA512
f7d0cc3673ddd9b86729d6f0f50658795002b96ffdacb3e951d9f2045be4a4efe1f7eb0d8f5a18c176e159ce7da7873616b9f9241e34851e5491fdd1cff0c916

Download Submit
C:\Windows\SysWOW64\Ebbidj32.exe

Filesize
340KB

MD5
c72db24ae79dd3176a0b5073b3e9b40b

SHA1
c5b37969ef084e4e373b2a26b5fe0669a774e141

SHA256
ad775a121e66b135928831188e052edd9f795d4951741ad98bce5e05f8f8f009

SHA512
a870dfe9a5b8c33470895cf29f2188345d8fca6369d14a55e5cc88ee387d34ea03ba84f2743f4390f3d5340c9f67444e956fefc44a617c28e93fb1fda55be400

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
340KB

MD5
0a065c18d2ea5c3124d2d9285743f8ed

SHA1
b9563b25c6f3788b383aa27e6fd56042200f848a

SHA256
87a50fed60d533cb9230e9b9bceb2e40439c8d7ff587f04a9c8e63054d2640f6

SHA512
2edd74f7c1819ad9df5f96d01331e61bf1ec96dd0f6f952b893f0971217f528a495e7e89d8e00351e6f88511f992718cd1a5b58042611c45d19438e6ed2c03b7

Download Submit
C:\Windows\SysWOW64\Eckonn32.exe

Filesize
340KB

MD5
21c600e8f503b50b2306348f29ebd97f

SHA1
7f46f58f3be904077c49ae8acd3a8e9b4df2c13e

SHA256
a4a21612a82429ad53ccb0a9846ff2ab0255cc846a2418cbeccccafa039c0873

SHA512
96bfdc5175abc9d43c69ba9fce3a414d8be71dd13b8db3e5db66c31d9417e199d971137d82916eff44f1928586b5f1a37721c7285f7dd70e7ee8d342670c7091

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
340KB

MD5
f7accf4592a33ea0517a3787ab6403b9

SHA1
e54f076acbbfcf455da1b0edd23a7ba4dae14dbc

SHA256
c8eaa9c4e661319a316d738c05728e0428bb9d3102533eb16f209684aece3aac

SHA512
3d8324b699e74f33fef37630df4584432797bde7e3db9433c20b0a2adfc3e4a2507755e68b085b0fa46448a25159457906eb5c8bb25b112b993b5836e4db401c

Download Submit
C:\Windows\SysWOW64\Ehhgfdho.exe

Filesize
340KB

MD5
0f3b01e09878c1b621e075da4069a8f5

SHA1
ee94fcbdfb43caeda2557e1b033b5db2faed9ff2

SHA256
771fc0aa505f692a57c5c24746d766981f3eb26371f61b3aec500da15c97be7b

SHA512
07f4e69bbb260e3c7850b5503be721a9cd984fb173bd29d788216fed811b316b9810cdbfd92903ea7376a376b01ac0cc11adcc4abec243d3d7677b31cc747486

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
340KB

MD5
ec98dca647e9c848e40241739d071c7b

SHA1
0d343b1346abdbd719367f09f7a75286f88efe5b

SHA256
9c444b3013bb70d1e4f663685f67f1240b7028189494589773adffc22e6fc6fe

SHA512
e82a2a60528959ee6c51b5965e72954f1368f9e0ec93349ee0a6ca3829230386b10ffa268562d7d8d91d9fcf315384d5d1661ec6f15dced374124407acf2626b

Download Submit
C:\Windows\SysWOW64\Elagacbk.exe

Filesize
340KB

MD5
a1f4f3d6bb6309eafe73267ffaeeb0b3

SHA1
cf6e538470e4540de2dabe7e61a8a4caee39cc47

SHA256
d34e9ff01500aad1ae6ed627b4c1fe0832dc0cd13688fc0c6c496d5b425fdd89

SHA512
b5b899a254c3876a1ed031a7ea7c966bfb0ab15496a0f166665a0bfa220dc550a9ec09de9a2f862111b5361799f0bdb09b391b031fcfbe9f1cea3d0a82d642a8

Download Submit
C:\Windows\SysWOW64\Elhmablc.exe

Filesize
340KB

MD5
fa3318034fe283331e82ecefe45cc208

SHA1
eb228f783d9deec120852de9bd7a1e0a8447588f

SHA256
a49ee8437457ccc54f398d0370adcd45cad0eeb74381370e61c487783163c6c8

SHA512
30790546f50f8e288f71e2de6ef80d6bf3d98c981cb107475e07ffdd2360520344662a958f56417e5fdfcfdf53841ed78e35e0a6bb481f39f680330cbf686406

Download Submit
C:\Windows\SysWOW64\Eoapbo32.exe

Filesize
340KB

MD5
e131e0155442a20567c4c474c652ba27

SHA1
11d96f3068cc40417737170416fcb82beb3f47ed

SHA256
9ad44488712833124d61fcca6a4f249cb3e36b0c6f8f2ee69cb9c156f5ee3131

SHA512
ad8fb879cf270d006a41a4e43729f1950853a0bd2918b2128a4b4a559e96e8587f66ec18b2cab0656b7a0462ee0d8fe37975f5af52db38c85fc388d49f378e2b

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
340KB

MD5
2eba66284e20176da00a6f75692d3857

SHA1
804010c02b71fc5084e1af975346438e99ca4a25

SHA256
1ca00bb63cffa2d286b44091027a4b58b4040129927493aa996faacff1041d5d

SHA512
c99ad2bbf3af76aeb730d2971e4b6816a8747abcec6ddb2bc1449bb67cf2bcff0208f76f9d8c2922fcbb396888354d0a0883ac65f3b2d50d8b59398f2b9602aa

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
340KB

MD5
0906a1de9fcde5cddbeea94fa1e07725

SHA1
7b3ebdbd698cb2b8f5c74217360acb67abea5d39

SHA256
6a7bf1b3bf9330fc2cf9450e53cf60c9a1fc22bcd4dbf10ed12e257088c18304

SHA512
fab35ea5313a299ef114cec7a52cb8d1c179eb3d806eda0d351dd34bca37d3595e2d6a94a4ae53f39b7e974e44f19cd33d7ab9fd9d75f3b80d4588c249ec7bd1

Download Submit
memory/32-9-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/64-16-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/268-41-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/376-105-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/432-133-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/548-24-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/644-395-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/820-257-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1004-97-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1076-240-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1208-413-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1556-269-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1616-323-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1684-299-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1720-353-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1768-405-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1856-153-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1888-351-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2016-321-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2120-371-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2128-125-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2152-217-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2336-137-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2752-165-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2836-189-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2852-113-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2944-145-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2976-176-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3052-408-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3064-275-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3376-61-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3516-33-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3604-365-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3632-89-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3636-437-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3728-359-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3764-173-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3872-49-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3892-281-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3900-339-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4016-341-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4048-209-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4168-425-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4180-225-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4300-233-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4352-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4352-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4388-389-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4416-387-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4556-65-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4564-73-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4700-431-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4760-81-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4768-297-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4772-419-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4780-201-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4840-334-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4932-267-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4972-193-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4976-305-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4988-249-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4996-315-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5108-287-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5116-377-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads