0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404.exe
Size

395KB
MD5

fddefe0509ea23aad23e98961b1125dc
SHA1

0d32ce7aff90af01ebba0fd016170ddf713ecdcc
SHA256

0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404
SHA512

fcfcbb85f2bac9d56b4e4abe9e2477a78c75f640dd7c8d6112a2ff5e9f03c973afbd3593f8ddadd6af3170f308291c00cda9054fea58118325384c357aff9302
SSDEEP

6144:9v87MRfnYis4y70u4HXs4yr0u490u4Ds4yvW8lM:xfe4O0dHc4i0d90dA4X

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apjdikqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgihop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkhgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieagmcmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jahqiaeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klndfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbphglbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkphhgfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keifdpif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mablfnne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmpjoloh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkgillpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aimogakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iondqhpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbnnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkbgjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdmaoahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkhgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkofga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lomjicei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edihdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edihdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nblolm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfihbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqgojmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmdkcnie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfjjpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofjqihnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pplhhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qapnmopa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aiplmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebaplnie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enhifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpdennml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keifdpif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qikbaaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adjjeieh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkgillpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfmfefni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqgojmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekgqennl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgeenfog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geoapenf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jldbpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojcpdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfmfefni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekljpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acccdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgfbbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcclncbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqmhqapg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofjqihnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplhhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhdbhifj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhdcmp32.exe

Executes dropped EXE 64 IoCs

pid	Process
4392	Apaadpng.exe
4540	Bhmbqm32.exe
4832	Bhpofl32.exe
2760	Bkphhgfc.exe
2556	Conanfli.exe
772	Cpbjkn32.exe
5416	Cpdgqmnb.exe
5424	Cdbpgl32.exe
5776	Dpiplm32.exe
5320	Dgeenfog.exe
628	Dhdbhifj.exe
3144	Dkekjdck.exe
644	Dkhgod32.exe
5912	Ebaplnie.exe
5892	Ebdlangb.exe
5992	Eqiibjlj.exe
5500	Enmjlojd.exe
2188	Ekajec32.exe
2512	Eiekog32.exe
2068	Figgdg32.exe
4528	Foclgq32.exe
948	Filapfbo.exe
5800	Fqgedh32.exe
5400	Fbgbnkfm.exe
4012	Fkofga32.exe
2964	Gnpphljo.exe
4892	Geoapenf.exe
6032	Gpdennml.exe
1280	Geanfelc.exe
1164	Hpioin32.exe
3936	Hhdcmp32.exe
4568	Hehdfdek.exe
1720	Hemmac32.exe
5176	Ieagmcmq.exe
4388	Iojkeh32.exe
4788	Iiopca32.exe
3392	Iolhkh32.exe
3532	Iondqhpl.exe
2856	Jhgiim32.exe
3816	Jldbpl32.exe
784	Jhkbdmbg.exe
1704	Jhnojl32.exe
3128	Jeapcq32.exe
5084	Jahqiaeb.exe
1712	Klndfj32.exe
4468	Kefiopki.exe
4088	Keifdpif.exe
4420	Klbnajqc.exe
2220	Khiofk32.exe
5280	Kemooo32.exe
2484	Klggli32.exe
3504	Lhnhajba.exe
5612	Lcclncbh.exe
1964	Laiipofp.exe
5344	Lomjicei.exe
4476	Llcghg32.exe
2196	Mjggal32.exe
2088	Mablfnne.exe
3400	Mhldbh32.exe
5988	Mcaipa32.exe
5472	Mljmhflh.exe
2180	Mlljnf32.exe
5880	Mbibfm32.exe
5492	Nblolm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pknjieep.dll	Ckpamabg.exe
File created	C:\Windows\SysWOW64\Apaadpng.exe	0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404.exe
File created	C:\Windows\SysWOW64\Bfcjjj32.dll	Dgeenfog.exe
File opened for modification	C:\Windows\SysWOW64\Nfihbk32.exe	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Lnpckhnk.dll	Nqoloc32.exe
File created	C:\Windows\SysWOW64\Deiljq32.dll	Bmbnnn32.exe
File created	C:\Windows\SysWOW64\Ojidbohn.dll	Eqiibjlj.exe
File created	C:\Windows\SysWOW64\Kngmnjok.dll	Qfjjpf32.exe
File created	C:\Windows\SysWOW64\Leeigm32.dll	Qfmfefni.exe
File opened for modification	C:\Windows\SysWOW64\Adjjeieh.exe	Ampaho32.exe
File opened for modification	C:\Windows\SysWOW64\Fkofga32.exe	Fbgbnkfm.exe
File created	C:\Windows\SysWOW64\Laiipofp.exe	Lcclncbh.exe
File created	C:\Windows\SysWOW64\Dmjmekgn.exe	Dgpeha32.exe
File opened for modification	C:\Windows\SysWOW64\Enmjlojd.exe	Eqiibjlj.exe
File created	C:\Windows\SysWOW64\Gillppii.dll	Geanfelc.exe
File opened for modification	C:\Windows\SysWOW64\Figgdg32.exe	Eiekog32.exe
File created	C:\Windows\SysWOW64\Fkofga32.exe	Fbgbnkfm.exe
File opened for modification	C:\Windows\SysWOW64\Nqaiecjd.exe	Nbphglbe.exe
File created	C:\Windows\SysWOW64\Ddmhhd32.exe	Dncpkjoc.exe
File created	C:\Windows\SysWOW64\Eqiibjlj.exe	Ebdlangb.exe
File created	C:\Windows\SysWOW64\Jcggmk32.dll	Fnjocf32.exe
File opened for modification	C:\Windows\SysWOW64\Foclgq32.exe	Figgdg32.exe
File created	C:\Windows\SysWOW64\Fefmmcgh.dll	Ommceclc.exe
File created	C:\Windows\SysWOW64\Ldbhiiol.dll	Bdlfjh32.exe
File opened for modification	C:\Windows\SysWOW64\Fqfojblo.exe	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Pplhhm32.exe	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Qikbaaml.exe	Qfmfefni.exe
File created	C:\Windows\SysWOW64\Aimogakj.exe	Acqgojmb.exe
File created	C:\Windows\SysWOW64\Adjjeieh.exe	Ampaho32.exe
File created	C:\Windows\SysWOW64\Lhlgjo32.dll	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Gddgpqbe.exe	Fnjocf32.exe
File opened for modification	C:\Windows\SysWOW64\Egnajocq.exe	Epdime32.exe
File opened for modification	C:\Windows\SysWOW64\Ekljpm32.exe	Epffbd32.exe
File created	C:\Windows\SysWOW64\Conanfli.exe	Bkphhgfc.exe
File opened for modification	C:\Windows\SysWOW64\Nqfbpb32.exe	Ncbafoge.exe
File opened for modification	C:\Windows\SysWOW64\Acqgojmb.exe	Qikbaaml.exe
File created	C:\Windows\SysWOW64\Bpedeiff.exe	Bpcgpihi.exe
File created	C:\Windows\SysWOW64\Ogajpp32.dll	Cgfbbb32.exe
File created	C:\Windows\SysWOW64\Fnjocf32.exe	Fgqgfl32.exe
File created	C:\Windows\SysWOW64\Qdhlclpe.dll	Jahqiaeb.exe
File created	C:\Windows\SysWOW64\Lcclncbh.exe	Lhnhajba.exe
File created	C:\Windows\SysWOW64\Mhldbh32.exe	Mablfnne.exe
File opened for modification	C:\Windows\SysWOW64\Bpedeiff.exe	Bpcgpihi.exe
File created	C:\Windows\SysWOW64\Nblolm32.exe	Mbibfm32.exe
File created	C:\Windows\SysWOW64\Knaodd32.dll	Aimogakj.exe
File opened for modification	C:\Windows\SysWOW64\Ddmhhd32.exe	Dncpkjoc.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bhmbqm32.exe
File opened for modification	C:\Windows\SysWOW64\Conanfli.exe	Bkphhgfc.exe
File created	C:\Windows\SysWOW64\Kpjbdk32.dll	Dhdbhifj.exe
File created	C:\Windows\SysWOW64\Ddlnnc32.dll	Hehdfdek.exe
File opened for modification	C:\Windows\SysWOW64\Cajjjk32.exe	Ckpamabg.exe
File created	C:\Windows\SysWOW64\Ekljpm32.exe	Epffbd32.exe
File created	C:\Windows\SysWOW64\Enmjlojd.exe	Eqiibjlj.exe
File created	C:\Windows\SysWOW64\Ekajec32.exe	Enmjlojd.exe
File created	C:\Windows\SysWOW64\Fqgedh32.exe	Filapfbo.exe
File created	C:\Windows\SysWOW64\Fkaokcqj.dll	Mablfnne.exe
File created	C:\Windows\SysWOW64\Aehojk32.dll	Enlcahgh.exe
File created	C:\Windows\SysWOW64\Eacdhhjj.dll	Edihdb32.exe
File created	C:\Windows\SysWOW64\Pjllddpj.dll	Apaadpng.exe
File created	C:\Windows\SysWOW64\Mgfhfd32.dll	Khiofk32.exe
File created	C:\Windows\SysWOW64\Ajhapb32.dll	Nblolm32.exe
File opened for modification	C:\Windows\SysWOW64\Epffbd32.exe	Enhifi32.exe
File created	C:\Windows\SysWOW64\Nqmojd32.exe	Nblolm32.exe
File created	C:\Windows\SysWOW64\Ldicpljn.dll	Fjmfmh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7000	6904	WerFault.exe	239

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfbjkg32.dll"	Adjjeieh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdlfjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkgillpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhdbhifj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Figgdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbgbnkfm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iolhkh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obgohklm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dncpkjoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apjdikqd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enlcahgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknmplfo.dll"	Oiccje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdpnda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqgedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edfknb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekgliip.dll"	Cpdgqmnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccegpn32.dll"	Ekajec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcidlo32.dll"	Cajjjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnjocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkaokcqj.dll"	Mablfnne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Falmlm32.dll"	Jhkbdmbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emkbpmep.dll"	Ncbafoge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgeqca32.dll"	Eiekog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnpckhnk.dll"	Nqoloc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccmcgcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcibca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekljpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enopghee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjnlmph.dll"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpcgpihi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnhpfk32.dll"	Dncpkjoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idkobdie.dll"	Klbnajqc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laiipofp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddmhhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgilho32.dll"	Epffbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncbafoge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqfojblo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqgedh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Geoapenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddlnnc32.dll"	Hehdfdek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deiljq32.dll"	Bmbnnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpdgqmnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iiopca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mbibfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekajec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcclncbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pplhhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckpamabg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogajpp32.dll"	Cgfbbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgjjlakk.dll"	Edfknb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iondqhpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebdlangb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enmjlojd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iffahdpm.dll"	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geoapenf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 4392	3544	0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404.exe	91
PID 3544 wrote to memory of 4392	3544	0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404.exe	91
PID 3544 wrote to memory of 4392	3544	0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404.exe	91
PID 4392 wrote to memory of 4540	4392	Apaadpng.exe	92
PID 4392 wrote to memory of 4540	4392	Apaadpng.exe	92
PID 4392 wrote to memory of 4540	4392	Apaadpng.exe	92
PID 4540 wrote to memory of 4832	4540	Bhmbqm32.exe	93
PID 4540 wrote to memory of 4832	4540	Bhmbqm32.exe	93
PID 4540 wrote to memory of 4832	4540	Bhmbqm32.exe	93
PID 4832 wrote to memory of 2760	4832	Bhpofl32.exe	94
PID 4832 wrote to memory of 2760	4832	Bhpofl32.exe	94
PID 4832 wrote to memory of 2760	4832	Bhpofl32.exe	94
PID 2760 wrote to memory of 2556	2760	Bkphhgfc.exe	95
PID 2760 wrote to memory of 2556	2760	Bkphhgfc.exe	95
PID 2760 wrote to memory of 2556	2760	Bkphhgfc.exe	95
PID 2556 wrote to memory of 772	2556	Conanfli.exe	96
PID 2556 wrote to memory of 772	2556	Conanfli.exe	96
PID 2556 wrote to memory of 772	2556	Conanfli.exe	96
PID 772 wrote to memory of 5416	772	Cpbjkn32.exe	97
PID 772 wrote to memory of 5416	772	Cpbjkn32.exe	97
PID 772 wrote to memory of 5416	772	Cpbjkn32.exe	97
PID 5416 wrote to memory of 5424	5416	Cpdgqmnb.exe	98
PID 5416 wrote to memory of 5424	5416	Cpdgqmnb.exe	98
PID 5416 wrote to memory of 5424	5416	Cpdgqmnb.exe	98
PID 5424 wrote to memory of 5776	5424	Cdbpgl32.exe	99
PID 5424 wrote to memory of 5776	5424	Cdbpgl32.exe	99
PID 5424 wrote to memory of 5776	5424	Cdbpgl32.exe	99
PID 5776 wrote to memory of 5320	5776	Dpiplm32.exe	100
PID 5776 wrote to memory of 5320	5776	Dpiplm32.exe	100
PID 5776 wrote to memory of 5320	5776	Dpiplm32.exe	100
PID 5320 wrote to memory of 628	5320	Dgeenfog.exe	101
PID 5320 wrote to memory of 628	5320	Dgeenfog.exe	101
PID 5320 wrote to memory of 628	5320	Dgeenfog.exe	101
PID 628 wrote to memory of 3144	628	Dhdbhifj.exe	102
PID 628 wrote to memory of 3144	628	Dhdbhifj.exe	102
PID 628 wrote to memory of 3144	628	Dhdbhifj.exe	102
PID 3144 wrote to memory of 644	3144	Dkekjdck.exe	103
PID 3144 wrote to memory of 644	3144	Dkekjdck.exe	103
PID 3144 wrote to memory of 644	3144	Dkekjdck.exe	103
PID 644 wrote to memory of 5912	644	Dkhgod32.exe	104
PID 644 wrote to memory of 5912	644	Dkhgod32.exe	104
PID 644 wrote to memory of 5912	644	Dkhgod32.exe	104
PID 5912 wrote to memory of 5892	5912	Ebaplnie.exe	105
PID 5912 wrote to memory of 5892	5912	Ebaplnie.exe	105
PID 5912 wrote to memory of 5892	5912	Ebaplnie.exe	105
PID 5892 wrote to memory of 5992	5892	Ebdlangb.exe	106
PID 5892 wrote to memory of 5992	5892	Ebdlangb.exe	106
PID 5892 wrote to memory of 5992	5892	Ebdlangb.exe	106
PID 5992 wrote to memory of 5500	5992	Eqiibjlj.exe	107
PID 5992 wrote to memory of 5500	5992	Eqiibjlj.exe	107
PID 5992 wrote to memory of 5500	5992	Eqiibjlj.exe	107
PID 5500 wrote to memory of 2188	5500	Enmjlojd.exe	108
PID 5500 wrote to memory of 2188	5500	Enmjlojd.exe	108
PID 5500 wrote to memory of 2188	5500	Enmjlojd.exe	108
PID 2188 wrote to memory of 2512	2188	Ekajec32.exe	109
PID 2188 wrote to memory of 2512	2188	Ekajec32.exe	109
PID 2188 wrote to memory of 2512	2188	Ekajec32.exe	109
PID 2512 wrote to memory of 2068	2512	Eiekog32.exe	110
PID 2512 wrote to memory of 2068	2512	Eiekog32.exe	110
PID 2512 wrote to memory of 2068	2512	Eiekog32.exe	110
PID 2068 wrote to memory of 4528	2068	Figgdg32.exe	111
PID 2068 wrote to memory of 4528	2068	Figgdg32.exe	111
PID 2068 wrote to memory of 4528	2068	Figgdg32.exe	111
PID 4528 wrote to memory of 948	4528	Foclgq32.exe	112

C:\Users\Admin\AppData\Local\Temp\0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404.exe
"C:\Users\Admin\AppData\Local\Temp\0dd730090bf713ff64df51794d5686938b3da63c69bc0dc64ed7fef8dc833404.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\Apaadpng.exe
  C:\Windows\system32\Apaadpng.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\Bhmbqm32.exe
    C:\Windows\system32\Bhmbqm32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\SysWOW64\Bhpofl32.exe
      C:\Windows\system32\Bhpofl32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2760
      - C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5416
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5424
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5776
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5320
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5892
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5992
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5500
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:948
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        27⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4892
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:6032
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1280
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        31⤵
        Executes dropped EXE
        
        PID:1164
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        34⤵
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5176
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        36⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3392
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3532
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        40⤵
        Executes dropped EXE
        
        PID:2856
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3816
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:784
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        43⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        44⤵
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5084
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        47⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        51⤵
        Executes dropped EXE
        
        PID:5280
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        52⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3504
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1964
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5344
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        57⤵
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        58⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2088
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        60⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        61⤵
        Executes dropped EXE
        
        PID:5988
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        62⤵
        Executes dropped EXE
        
        PID:5472
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4192
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1936
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:216
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        70⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        71⤵
        Modifies registry class
        
        PID:2008
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        72⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        74⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        75⤵
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        76⤵
        Drops file in System32 directory
        
        PID:820
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        77⤵
        Modifies registry class
        
        PID:1416
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        78⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4440
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1380
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5060
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        82⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        83⤵
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        84⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        86⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        87⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3384
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5844
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:368
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2244
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2600
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3124
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        97⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        98⤵
        Drops file in System32 directory
        
        PID:6004
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:924
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1860
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3288
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        103⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3496
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        104⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        105⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        106⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1492
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        107⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        110⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        111⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        112⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        113⤵
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        114⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        115⤵
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        117⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5508
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        119⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        120⤵
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1016
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        122⤵
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        123⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        125⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        127⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6164
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        129⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Edfknb32.exe
        
        C:\Windows\system32\Edfknb32.exe
        130⤵
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6340
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        133⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        134⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        135⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        136⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6544
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        139⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        140⤵
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        145⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 400
        146⤵
        Program crash
        
        PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6904 -ip 6904
1⤵
PID:6976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Apaadpng.exe

Filesize
395KB

MD5
87c9b4df2fb50a51705284fec4f97d5e

SHA1
d9b11b6301fc1cf62c6e0b184497f055e32b43ab

SHA256
3510065ee4d5aa902b47a06f15a7323ba3350c73d85bd77ddb09f611fe9fcacf

SHA512
8ba80ceb8477c540ab3b6baad4e0f64ee99e12a535484d4c3ed8cbbbedfb97db7cb4ef12b3644506233dd869246fb6a5915b17e31613f57b81cbed9cfc9b95da

Download Submit
C:\Windows\SysWOW64\Bhmbqm32.exe

Filesize
395KB

MD5
5f1379118d414025ef42adb0fed2de7c

SHA1
b1d0103e05c6a831fe4ba05368e77b74aebda10e

SHA256
9ebf5abf257ad16f1c7d60cd0e84b26e236f1e525fcaebe90e2292d94f076c99

SHA512
15e96fa9e13de105a3551a9bc76e0cced9708e39072a8cd049f8ff8f3ded8d5f6e2e5af39eeaa65c0ebcdac69ca43da0b455dd176e818a0f32ebdf13e8250167

Download Submit
C:\Windows\SysWOW64\Bhpofl32.exe

Filesize
395KB

MD5
ab7fae65001306bd2048bdca56ac9235

SHA1
e61cfff9f4d8fd0972a103542b6394f18936f32a

SHA256
abdd507dad94ca0c56948f916a9a31054aca1a63a6c5f64d617c4b6d94beec55

SHA512
1150211915e1c4eb9762ac975422f0cafed08cc6ba12e361cb6d982338b4047c8dfd03bd82752c7e21978e384e9ca3bf1f89f1d33d114e8dc94ebd74f741512d

Download Submit
C:\Windows\SysWOW64\Cdbpgl32.exe

Filesize
395KB

MD5
98fbdda3fdf9b31eeed6f86a392aaa82

SHA1
84cb3d0ec9be85d54ff068c738f73e909b1a0d05

SHA256
c32e8de07d0a71adf77aacad3837199a8f4ebc1ff9ef6754061539eb93f8d1d9

SHA512
a869ae5379a4c89def996c031cbe548525ee45c61f8a86f3712fbcb4b8cbc8a81fdcbf463eac05e75bcd54c8f19db7d804270ec60ca2a9aea1923d59d8d6b791

Download Submit
C:\Windows\SysWOW64\Conanfli.exe

Filesize
395KB

MD5
3c41772d794393e36b3a43dd37d9730b

SHA1
e5e70417bd191b6dcaa2ad0b0260b03c66d650a7

SHA256
2704d0e5d9aad92b279e3b111e7a84815d8411aa65d8effdbadeeec01582c4c6

SHA512
753ce7e8201f0d75cd89927428dee41a604d0c32e9836b8d162a143bd1f7211dcf1576d6aad113191f42bd4b0437712ccf6ac1735ac2631a00ef477c7032f143

Download Submit
C:\Windows\SysWOW64\Conanfli.exe

Filesize
395KB

MD5
9a683622ad474a9f7b3293bf59de2ebb

SHA1
b217517e6bc669e70ed21c5e7b2ab6e98ea7e2f6

SHA256
2d25b79f679583ea2c658b2b5b0c1617c77c677e8f1a9f58aefe3b44b4fb356d

SHA512
48f1a17886b9c78a6922686536eb9c493c5dfd05f1a1595a33e473ad0c27895125b4a9e31abbecf2f7942570783a7f3a566b8e2a36002af38ebaf2bbd95adde6

Download Submit
C:\Windows\SysWOW64\Cpbjkn32.exe

Filesize
395KB

MD5
3c2ad9bec23f89da4d35b4efa5a510be

SHA1
1d1271d9457577d7f4f4e6116cdea0a5028cdf82

SHA256
3cbd821ce55b00a623d98d96ba859717e2a4eb190accfba30a9d108a54890389

SHA512
f2044db48743d01845789253530f65932bd337755f3dcc50b25f0cab2dbf5d18045b19e9fba954ad64f55fe3938c1b5981f6835ace439f1fa00d1942408263dc

Download Submit
C:\Windows\SysWOW64\Cpdgqmnb.exe

Filesize
395KB

MD5
410d55f8102c2022823e3b3e96c3a9c1

SHA1
fa03a7e7d283e1e048dbf9c4e758adbc326da46e

SHA256
ee110cb4831007edfb9a60ec3a3d725684e553ca74c8b5dd3f5d27cc0b9c2206

SHA512
e79934ffa07e0a94e59abf3fd73ed276ff065694b101428effb49fd3d0b62a34ef562cee8a34a9f741cc10c4cdfe7867f0b5d72fbb0721bdbe2ff08358778606

Download Submit
C:\Windows\SysWOW64\Dhdbhifj.exe

Filesize
395KB

MD5
b1569fc85166e91b7c092c47248d49ee

SHA1
e75d6ec078282daf599d5d77cdf5b76093ac5068

SHA256
1905b40ac83b18a6d0f6aceeda0167a0f17edfef456c8f115b429ac13f37a714

SHA512
979756b3bae6c1acbc9f4f613271871dd8584d3f7ad451694ea828746cfaa67b7d87b87c50f674ba153db3f1f7f63cf3a691bbf3ae6f6a2fb5d41e3b119bce8d

Download Submit
C:\Windows\SysWOW64\Dhdbhifj.exe

Filesize
395KB

MD5
f0f864f243405c8053f84e36f6aab9d6

SHA1
8688836ff7ad65ff8bf3a2026823308b94aa62e7

SHA256
69115b8edda63b56806ba9e8092e8d5da9c7ff9ec7839fafd2f1192088eaa166

SHA512
427278b7c2f16d960b29721348f91aef04ca671a76186f437c5c9ab5f4f8181d9617863de9de1acfdd9cc216a2df1e3093f8f07285fb6fbdc028258e382bc424

Download Submit
C:\Windows\SysWOW64\Dkekjdck.exe

Filesize
395KB

MD5
c7142c40e34465032a9a2b5126e111b6

SHA1
01db7d7f856eb660212331645dfe73972b5f16b8

SHA256
2c01c35798f3654abae8bff61ce439798cf6f89a6bf95b0dfc207665c4984ef4

SHA512
0c54e078b3bb5583fca5872c0f94730d2e7af8c1bbd6d2205382cf913aeaca2b287fd429c303021e3ab552bb99a1ae2a78417ea8ddd31491097f97aeec57d830

Download Submit
C:\Windows\SysWOW64\Dkhgod32.exe

Filesize
395KB

MD5
d62baac3595e1dfcba3fff251e12853c

SHA1
e89a833388b7e62f6ed4820028eb3d7ed03db85c

SHA256
b311d8aea370673363bd547b7d1bc8915aa32784dce83a9fc87ae727e75b061d

SHA512
88995690af6861872293afd42a1147b8600f9208e507a51694b4d6a6afc065f3f1ef9059fd3aa5ea3baf16aca33681a7e9d5c081735cd46351bbbc0926676625

Download Submit
C:\Windows\SysWOW64\Dpiplm32.exe

Filesize
395KB

MD5
d7f0b9620dc213d77416594f8f79abe8

SHA1
5a7eb4eec9c59a182459b52cc0a2777f835a027e

SHA256
dbe6d5f01ce5ed4a176b0179f911eb8eec26a43d1060644d4e2a8ac9a2db9413

SHA512
38044c8d42137d8499f8db3b5c5bf2e0edac5d3964211d2067542d064d81b8d675dad6fbace06bbb3473eb510739165dc193522baba519bd450540a1696773e4

Download Submit
C:\Windows\SysWOW64\Ebaplnie.exe

Filesize
395KB

MD5
40a94bfb98df5bd6f5618844b17ffe46

SHA1
f38cba293c9369a14dc7d802fee25e8843b9f8cd

SHA256
c7a96cfc1722b548542f70424072bd44de850baa49706ae006cb376feccd0c89

SHA512
272c7445d1bd19c6536bfff7d3bc7f5ff19cc8d36f5fe7c9818cea126b19beac75689a2fac8c19df73119d8a68aa13f832b015bb92425a4d20788f21cf99dd03

Download Submit
C:\Windows\SysWOW64\Ebdlangb.exe

Filesize
395KB

MD5
e00d146cd7c3fb0d8428eb01da491d7c

SHA1
e0f03772589ab4a15bbc4ae032b222d4e88bc190

SHA256
a42c76e0037394807e29c6505099d535f8361402c2d171a2419e0003d74a7215

SHA512
7bf03964884c4593276af45c59cda06ad5e3fb6ace663bf87728dc97e113dbc2f50607cfba51030ef24aa01a264a2315c986815743943a4c9634219e211b9c7a

Download Submit
C:\Windows\SysWOW64\Eiekog32.exe

Filesize
395KB

MD5
3e747c2becbb2599cb2747994a1d70b4

SHA1
f6721d5c2fa53b4ab01aae0a076f4d4cf2e661dc

SHA256
fd8223a036a1fa016e3aecc477693600b6c2e88ca14aacd175ffcd2d3797ed12

SHA512
d5938707bdf1da73bdc1a4a6563636229170c101d5032fa8b06722d27f7edc8462458a8806e92ffe2b914d773d0b379db049d12e421ca4ed6d850224f662c932

Download Submit
C:\Windows\SysWOW64\Ekajec32.exe

Filesize
395KB

MD5
be8c092f1e2ee7ee273e878a5f5c63a8

SHA1
3b66455bf099bf19ee5d65689e00fa80105c660e

SHA256
4ac8e3c1e18c469108c0c5929d454fe5048b8f6ee9e366e9ced90a7c1aa0f65b

SHA512
4450eab8a273be67a221ace3e2721dcb7551dacf0ca3746fd89e470bb2c28e8a18d876afad81ea225aa55414731f92ae0eafccfc91a23100815e922de06a4755

Download Submit
C:\Windows\SysWOW64\Enmjlojd.exe

Filesize
395KB

MD5
423518486f223eecd3f6a4962ce1a5a7

SHA1
cab3d88698c031e1bc5ec7cfcbd2623f2d2142e4

SHA256
21bf0016c2eb6feafcf34d7f3b7a58df7b30c8995a1578f25891256fc8f86ddd

SHA512
8b65228d2384629b665243172b30aac685502f611493dc6fd05aa1f11fa5ec0f9c308eae5cd943546df232a86478347c4cdc8eb5d5276de698864010e3172f98

Download Submit
C:\Windows\SysWOW64\Eqiibjlj.exe

Filesize
395KB

MD5
57f923fdb145f13168f2df3d129a36c7

SHA1
a4ddf165759aef5cc3ebe4432559d0a6e95ea044

SHA256
8b3b969b3e68e61cd12e50cf041268be55e2b9370edc49e205d815570e12a2f8

SHA512
8acc3b39245bebd580b1668d1751b7a8e0777bc3cabddd66e118e36032e6f5f8004e702554011555bdd9f9edc61b33cccbfcbbcfba326d045d0c6ed6188859d9

Download Submit
C:\Windows\SysWOW64\Fbgbnkfm.exe

Filesize
395KB

MD5
3bea74a66d7eb25de3e313c0ff8091d9

SHA1
00ac59d8cadb8fa9a941716b242345cf7c281b52

SHA256
217edc8ed0cca1c7ada7fc2f4b87e3cf6422d6f37c001397ae41dd8614bbf189

SHA512
b1c8ec62e0d6c65494dfad04faef0fc3945c0af0b29c34666a2c53e517a832b8927c36593e3dfc16573ceacfdcc5a21a6b621265c290714127764ce429d89ca9

Download Submit
C:\Windows\SysWOW64\Figgdg32.exe

Filesize
192KB

MD5
362d4181579d86be30c7d8a0f8edb13e

SHA1
8f4d925d13a7c671fe2086b4407f92da670b98a7

SHA256
21466d136bc568f6e5a8c2557afd087b20b2934d1a3a9a24d24ceb95491b02a4

SHA512
c011da6da1ab92d8346c3b1c4f52d0107868454607cadc67269e11d3ac28c9f0124cd9faf2a99da3bddb268ab09206c9910a559dcf760c8c8eca05234428e6e0

Download Submit
C:\Windows\SysWOW64\Figgdg32.exe

Filesize
395KB

MD5
61e570cbed4a9797b5b12cc5dac50e61

SHA1
0e79a46f90c4ecfc83ad844a56bc17ec17ce0af3

SHA256
e54355804ac9b49a6defdae92a9bc0836cd74c86158846ca7b5330b9bc2f1589

SHA512
8e18518a573fe8f27b286703c11643a19068f4e0316d28ceb1d46ed3c0d6f418d57af092cbe9b194f671e6e583699a752ea7fafec7ef6e50adb5ea21d1fad221

Download Submit
C:\Windows\SysWOW64\Filapfbo.exe

Filesize
395KB

MD5
99b53257ee1abc8753368b64b8a83ae0

SHA1
80ae34fbc0f70be425e3a9c4bbb57f2d009bfac1

SHA256
89857f3d55066b011d5aa249b264d79ec31cf3116aafae1268cde8757d33139d

SHA512
7e9ac1efc6a59f84a9cb753d8eef14e0b53ae0111d9709c40557b79bf48e90913661f1aac65496795452e7b85ccb18e6cc4c0cecce552fa0f60229035c316399

Download Submit
C:\Windows\SysWOW64\Fkofga32.exe

Filesize
395KB

MD5
e0c2b4d4cd182ccf086040785f9ec490

SHA1
bec07c68c36ef981f0e0099c56566f5d8598c5e4

SHA256
690d08909d1f5d5c3da39f7ad7192b38d92f1fd19e49c6a5aa73b280a8d4ecd3

SHA512
94237fe2acef28e2f672d4bf55ad8d7246896db491868af8769b654a450a04d956e54da1e2d77ca01274220832d240fcdf947d80f28d2b2293040e4caa3b4d4d

Download Submit
C:\Windows\SysWOW64\Foclgq32.exe

Filesize
395KB

MD5
4e2f85817b8f2c32d9a687208ef1bb60

SHA1
04ae134e38e58ff385f06d224c19685a2812190d

SHA256
83b1c902aacb5f3d8290dd87291e3969b8378ba2a4d985965121598844b63cb0

SHA512
ee314024ee4ce0e1ce49af662b9a5eff764626fae1a8ea16a08cd1b929b96e65c76cbba4a47330dae898cef93023a11d5ffc7d91f4e64d71c8e168947ee0e63c

Download Submit
C:\Windows\SysWOW64\Fqgedh32.exe

Filesize
395KB

MD5
e931399af620c4aa6007727056a5301f

SHA1
e165f3d4bc277a2492996c4bb48550dde7ce7d18

SHA256
52a2e97f58b9465ba7f75fa2171250aa6eedfabeeeb3ebf4caa6baff95c7e2ce

SHA512
fb46da9aeaa53961a8557dd5ef14651502654feca93410399a7c164275bd162e8f1b965eedcc31b33c28d4584289aed275d742926e46e5b6900e20e06da441f3

Download Submit
C:\Windows\SysWOW64\Geanfelc.exe

Filesize
192KB

MD5
7a850ba13818136d7856339cb9d74d86

SHA1
6bdc1f188689444638f9fd48d59ec574906419d9

SHA256
1bc9b16b1bb3952d7ed77557be5126f973d4993363007e9983f6bfab33ab3ed5

SHA512
a178a39454d8a11964ba991594dbfbc1b490073a083b35d17c322f74f1c84e66f7b0fec94da4c1ef767e221d9f1f703e88edf187d467a9689093ed8ee480a0a0

Download Submit
C:\Windows\SysWOW64\Geanfelc.exe

Filesize
395KB

MD5
f200dfd63c62429ca68702114b20097f

SHA1
509d5ecae1b6f0bcb74f461ad5c453abcec3bba8

SHA256
4ce8939a7d2023c26cec36485d92bbcbbf1424e810721583f7a05f6da680e1b3

SHA512
8a2f433b562bcbdbf60d673feedb5d6bcb627c87c868c1c2768ae202085a48eb251a2aa086aa991abed0c0e0a5267475ccc8bbec696cd9b6980a25d3bb53411c

Download Submit
C:\Windows\SysWOW64\Geoapenf.exe

Filesize
395KB

MD5
d53de3f3d40b9828785908c41fe6664e

SHA1
4ea56fe21d17d4acc0e402e171b5eb4e410a2c37

SHA256
6e313702a4f1b7474c7c1fdfbc058d797c142ae2f4bac705aaa0057c91c39436

SHA512
61293bdf11c1496c8fdf5f4be4c28385d84f38ebdd911d0478094e2d09f44d2d771e5472fcd5781d9179947e3280f2e1b2452441ec4c0929f9f60491885c0a3a

Download Submit
C:\Windows\SysWOW64\Gnpphljo.exe

Filesize
395KB

MD5
4ad436cfa9e8f96ffbd965c9aeab7780

SHA1
3946f4c4d13e5524a89a6106d710013b0fbd365b

SHA256
fb5754d8a3b62e6f89b7323c602a987495db3de0ea73f8225bc95e57aa680117

SHA512
0fc97c713a83f477f967ce0817e91ce5533ea86f567a81edbe702f1e4a249c92c3f2062d52e10ca5dac10c1dbd476a6a3077572aa43fcc959865b2c2ffd1e6a7

Download Submit
C:\Windows\SysWOW64\Gpdennml.exe

Filesize
395KB

MD5
75c05a93accd6651d436d9015969bff3

SHA1
cfeb06e8a0904bf4191ce5706a942dd64dfa4cae

SHA256
0a28bf4de7fc851f602c35306cd880be172bbb4a1130956c6d6033bc74858ae2

SHA512
40b28f1de1d0e599f015803b79ad848583d4a5376f1cd2358ecdceff6b26620073b633fd548f33abc482955b059bc2b6190e94cbb9b7416dc0ab6f827f9db792

Download Submit
C:\Windows\SysWOW64\Hehdfdek.exe

Filesize
395KB

MD5
2ebd18d3fcae0b61eecc2e1f276a7c0d

SHA1
92f2beca64201b8916f74f93846b3a6e32b0bc48

SHA256
18fc6e55c68371ca41bbd546a721be32c3cbf89943602275ac97759f54d0e6c4

SHA512
ae32821e2a78f31be972812770b33cbbae8d4db2961e6a4eafd8852236bd2f25562e55ab99243adf50139cfe3ca1c3261fcc9d115604e928b552c0be7fb6d13d

Download Submit
C:\Windows\SysWOW64\Hhdcmp32.exe

Filesize
395KB

MD5
934116317956ffc2c1e7a729de845888

SHA1
91ef4838a37e6a6b52c0b38cfab91c90f26f86ee

SHA256
d482ee5697ca524f64a53147329793f0c14dd3db9bd7f8c24a5c46dfaf5fb9f2

SHA512
a97996f61afa35e85ec1fdc180f1e696e255bb6f23395869bbdac2ee41d0303acc693b00c501062d69e4dbd5ec8a0ba2b91935ec82c62258c237044041e6b406

Download Submit
C:\Windows\SysWOW64\Hpioin32.exe

Filesize
395KB

MD5
e491fbfb8a304dad8b7f98b7ba889431

SHA1
8ecc7e6c10977312a11ea7c9370102015eb772b5

SHA256
2a943d00bb37e2fca96cf31037f7332df88636d8db9ac40ccb8688ce6bd497d0

SHA512
aada8c8df17bd4a75d9f93681063e06190ad359e2d0a498f173754264bdb76781ca8b0dacd341bd0b8ee1040224823a679d5834046860fc0ce23cbe53ce3a690

Download Submit
C:\Windows\SysWOW64\Iiopca32.exe

Filesize
395KB

MD5
8ef126cb0b97752c769ed4f6c3474995

SHA1
7fc93591dc5708d9be89b422b2b8a7c3d4921029

SHA256
ccf61a1a2e0e8d4476cdd8f177d8ba3d72bca7b6efe4e3e35e2e53db8f660377

SHA512
142145f88e9508880fc1f0365b218a04e8b6d8cd3e9d10637622d8d548acb99d4447673c306ab0f82e5ed047213b4a83fc88c6e04914a5183d9f0c1969f71e90

Download Submit
C:\Windows\SysWOW64\Mbibfm32.exe

Filesize
384KB

MD5
d4552a301ef3a220de113cec54959351

SHA1
86f410ae6e22ffa74d922562a5d4cedfd3f2ff4f

SHA256
458a0e4dcd503ba44f897702587e20385d1065511d5c72dcc86cfda15cf58df7

SHA512
eccc03ff7f39b197a8fc6ca58528e83028a934c1dca4cd0a369c4e2ac9f5f90fd0438ea80e4450995a36ba80433455344133ff0507020b765f855e602d52df3d

Download Submit
C:\Windows\SysWOW64\Nqmojd32.exe

Filesize
395KB

MD5
088dcea8cc7d1bcb03d8bd92d1a3b5bc

SHA1
d65f31de72f4bb37cd951ebdd4d291eebe05d5a2

SHA256
1f89594c5b53dfc5a6eb6fc1074fbb0f3bd30e351d76b25c5b4c20635cd4c66d

SHA512
525f3567536ee0dabea87b5f0c0d1834881eb592fbeb98819f9f4fb26b71724db2113923f2407967fb270db06eaf206aeedbaf89710eeec6919a64e548f3b904

Download Submit
memory/628-87-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/644-104-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/772-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/784-311-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/948-176-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1164-241-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1280-232-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1704-317-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1712-335-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1720-263-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1964-393-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2068-159-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2088-413-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2180-437-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2188-144-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2196-407-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2220-359-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2484-371-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2512-152-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2556-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2760-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2856-299-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2964-208-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3128-323-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3144-95-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3392-287-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3400-419-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3504-377-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3532-293-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3544-0-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3816-305-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3936-249-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4012-200-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4088-347-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4388-275-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4392-7-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4420-353-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4468-341-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4476-401-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4528-168-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4540-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4568-257-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4788-281-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4832-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4892-216-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5084-329-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5176-269-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5280-369-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5320-79-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5344-395-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5400-196-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5416-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5424-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5472-435-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5500-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5612-387-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5776-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5800-184-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5880-443-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5892-120-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5912-112-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5988-429-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5992-127-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/6032-225-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads