fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171.exe
Size

96KB
MD5

2c2c52d8263bfc1546540cb99b8c33fa
SHA1

3bdc680ac81b28dd5517a8f4770c8e788f8b29f7
SHA256

fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171
SHA512

af1a102ae4a59887e5d2ca43ff338cfb30ce6275b480e62b8d117d10d0eb3f8270b86f8d72f1328a23ab212733ee60d525f7915692e6eb0ac298e1c1e10939f7
SSDEEP

1536:xIpubaTHnb2nzLWmUw0tnbTQxKZ2Lk1dPXuhiTMuZXGTIVefVDkryyAyqX:xIoub2nzLWPtwKSadPXuhuXGQmVDeCyW

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmdedo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcqjfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipldfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kinemkko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iffmccbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdffocib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmkbnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbapjafe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iiibkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kinemkko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbldaffp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiibkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jagqlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gppekj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjhfnccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcekkjcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfcgge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iinlemia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmnaakne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcnnaikp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjpeepnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkfkfohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmaioo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpojcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifmcdblq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Giacca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpgkkioa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjjbcbqj.exe

Executes dropped EXE 64 IoCs

pid	Process
4012	Gqdbiofi.exe
60	Gbenqg32.exe
4292	Gjlfbd32.exe
1028	Gmkbnp32.exe
4064	Gcekkjcj.exe
3916	Gfcgge32.exe
1972	Giacca32.exe
4156	Gqikdn32.exe
4092	Gcggpj32.exe
3008	Gfedle32.exe
4040	Gidphq32.exe
4684	Gqkhjn32.exe
4404	Gbldaffp.exe
852	Gjclbc32.exe
4480	Gmaioo32.exe
2180	Gppekj32.exe
952	Hboagf32.exe
1608	Hjfihc32.exe
1044	Hmdedo32.exe
4964	Hcnnaikp.exe
4824	Hjhfnccl.exe
3896	Hmfbjnbp.exe
4036	Hcqjfh32.exe
4448	Hjjbcbqj.exe
32	Hpgkkioa.exe
2976	Hbeghene.exe
2804	Hmklen32.exe
740	Hpihai32.exe
3392	Hbhdmd32.exe
4312	Hjolnb32.exe
4420	Hmmhjm32.exe
2664	Ipldfi32.exe
2812	Iffmccbi.exe
1512	Ibmmhdhm.exe
3068	Ijdeiaio.exe
3120	Imbaemhc.exe
3048	Ipqnahgf.exe
2824	Iiibkn32.exe
2780	Imdnklfp.exe
4740	Ipckgh32.exe
2684	Ifmcdblq.exe
2124	Imgkql32.exe
1288	Idacmfkj.exe
3716	Ibccic32.exe
4776	Iinlemia.exe
3116	Jaedgjjd.exe
2788	Jbfpobpb.exe
3180	Jagqlj32.exe
2288	Jbhmdbnp.exe
5044	Jjpeepnb.exe
3664	Jmnaakne.exe
5020	Jaimbj32.exe
3232	Jfffjqdf.exe
1924	Jpojcf32.exe
3012	Jfhbppbc.exe
2116	Jmbklj32.exe
1252	Jbocea32.exe
2796	Jkfkfohj.exe
2112	Kbapjafe.exe
3332	Kkihknfg.exe
1728	Kacphh32.exe
2676	Kdaldd32.exe
1788	Kgphpo32.exe
3412	Kinemkko.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lgabcngj.dll	Hboagf32.exe
File created	C:\Windows\SysWOW64\Ppmeid32.dll	Hbeghene.exe
File opened for modification	C:\Windows\SysWOW64\Imgkql32.exe	Ifmcdblq.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Gfcgge32.exe	Gcekkjcj.exe
File opened for modification	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Olmeac32.dll	Jaimbj32.exe
File created	C:\Windows\SysWOW64\Gcggpj32.exe	Gqikdn32.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Oeahce32.dll	Gcekkjcj.exe
File opened for modification	C:\Windows\SysWOW64\Gppekj32.exe	Gmaioo32.exe
File opened for modification	C:\Windows\SysWOW64\Hbeghene.exe	Hpgkkioa.exe
File created	C:\Windows\SysWOW64\Jagqlj32.exe	Jbfpobpb.exe
File created	C:\Windows\SysWOW64\Jifkeoll.dll	Lalcng32.exe
File opened for modification	C:\Windows\SysWOW64\Lgikfn32.exe	Ldkojb32.exe
File created	C:\Windows\SysWOW64\Fhpdhp32.dll	Mnfipekh.exe
File opened for modification	C:\Windows\SysWOW64\Gqikdn32.exe	Giacca32.exe
File created	C:\Windows\SysWOW64\Hjhfnccl.exe	Hcnnaikp.exe
File created	C:\Windows\SysWOW64\Hmfbjnbp.exe	Hjhfnccl.exe
File created	C:\Windows\SysWOW64\Ekmihm32.dll	Iiibkn32.exe
File opened for modification	C:\Windows\SysWOW64\Jbhmdbnp.exe	Jagqlj32.exe
File opened for modification	C:\Windows\SysWOW64\Hcnnaikp.exe	Hmdedo32.exe
File created	C:\Windows\SysWOW64\Hjfihc32.exe	Hboagf32.exe
File created	C:\Windows\SysWOW64\Nqjfoc32.dll	Kdaldd32.exe
File created	C:\Windows\SysWOW64\Bgcomh32.dll	Lpcmec32.exe
File created	C:\Windows\SysWOW64\Ginahd32.dll	fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171.exe
File created	C:\Windows\SysWOW64\Lppbjjia.dll	Lddbqa32.exe
File created	C:\Windows\SysWOW64\Odegmceb.dll	Mamleegg.exe
File created	C:\Windows\SysWOW64\Mlilmlna.dll	Imbaemhc.exe
File created	C:\Windows\SysWOW64\Gbajhpfb.dll	Gidphq32.exe
File opened for modification	C:\Windows\SysWOW64\Gmaioo32.exe	Gjclbc32.exe
File created	C:\Windows\SysWOW64\Mbgaem32.dll	Hjjbcbqj.exe
File created	C:\Windows\SysWOW64\Ncldlbah.dll	Ibccic32.exe
File created	C:\Windows\SysWOW64\Ljnnch32.exe	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Bkmdbdbp.dll	Gfcgge32.exe
File created	C:\Windows\SysWOW64\Ikjmhmfd.dll	Imdnklfp.exe
File opened for modification	C:\Windows\SysWOW64\Jaedgjjd.exe	Iinlemia.exe
File created	C:\Windows\SysWOW64\Jbfpobpb.exe	Jaedgjjd.exe
File created	C:\Windows\SysWOW64\Kdffocib.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Ldaeka32.exe	Laciofpa.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Dkfpkkqa.dll	Gjclbc32.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Kkihknfg.exe	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Oimhnoch.dll	Kibnhjgj.exe
File opened for modification	C:\Windows\SysWOW64\Kpmfddnf.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Ebaqkk32.dll	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Iffmccbi.exe	Ipldfi32.exe
File opened for modification	C:\Windows\SysWOW64\Kbapjafe.exe	Jkfkfohj.exe
File created	C:\Windows\SysWOW64\Bnckcnhb.dll	Kacphh32.exe
File created	C:\Windows\SysWOW64\Kgdbkohf.exe	Kdffocib.exe
File created	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Imppcc32.dll	Kgfoan32.exe
File created	C:\Windows\SysWOW64\Lijdhiaa.exe	Lgkhlnbn.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Omfnojog.dll	Jjpeepnb.exe
File opened for modification	C:\Windows\SysWOW64\Iffmccbi.exe	Ipldfi32.exe
File opened for modification	C:\Windows\SysWOW64\Ijdeiaio.exe	Ibmmhdhm.exe
File opened for modification	C:\Windows\SysWOW64\Ipckgh32.exe	Imdnklfp.exe
File created	C:\Windows\SysWOW64\Mcklgm32.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nbkhfc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5136	5996	WerFault.exe	210

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdknoa32.dll"	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpgkkioa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbocea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpgeph32.dll"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Giacca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqkhjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbldaffp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imgkql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jagqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbhmdbnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omfnojog.dll"	Jjpeepnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imppcc32.dll"	Kgfoan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emhmioko.dll"	Gqikdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpihai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmbkmemo.dll"	Iffmccbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbcjkf32.dll"	Jpojcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idacmfkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcekkjcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfcgge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Giacca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpkqnp32.dll"	Gqkhjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibmmhdhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnkdikig.dll"	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjclbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgabcngj.dll"	Hboagf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdiihjon.dll"	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjfihc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bclgpkgk.dll"	Ifmcdblq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fogjfmfe.dll"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmaioo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjjbcbqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hefffnbk.dll"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjolnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imbaemhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iiibkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iinlemia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpdobeck.dll"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgengpmj.dll"	Mjeddggd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4012	2224	fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171.exe	84
PID 2224 wrote to memory of 4012	2224	fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171.exe	84
PID 2224 wrote to memory of 4012	2224	fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171.exe	84
PID 4012 wrote to memory of 60	4012	Gqdbiofi.exe	85
PID 4012 wrote to memory of 60	4012	Gqdbiofi.exe	85
PID 4012 wrote to memory of 60	4012	Gqdbiofi.exe	85
PID 60 wrote to memory of 4292	60	Gbenqg32.exe	86
PID 60 wrote to memory of 4292	60	Gbenqg32.exe	86
PID 60 wrote to memory of 4292	60	Gbenqg32.exe	86
PID 4292 wrote to memory of 1028	4292	Gjlfbd32.exe	87
PID 4292 wrote to memory of 1028	4292	Gjlfbd32.exe	87
PID 4292 wrote to memory of 1028	4292	Gjlfbd32.exe	87
PID 1028 wrote to memory of 4064	1028	Gmkbnp32.exe	88
PID 1028 wrote to memory of 4064	1028	Gmkbnp32.exe	88
PID 1028 wrote to memory of 4064	1028	Gmkbnp32.exe	88
PID 4064 wrote to memory of 3916	4064	Gcekkjcj.exe	89
PID 4064 wrote to memory of 3916	4064	Gcekkjcj.exe	89
PID 4064 wrote to memory of 3916	4064	Gcekkjcj.exe	89
PID 3916 wrote to memory of 1972	3916	Gfcgge32.exe	90
PID 3916 wrote to memory of 1972	3916	Gfcgge32.exe	90
PID 3916 wrote to memory of 1972	3916	Gfcgge32.exe	90
PID 1972 wrote to memory of 4156	1972	Giacca32.exe	91
PID 1972 wrote to memory of 4156	1972	Giacca32.exe	91
PID 1972 wrote to memory of 4156	1972	Giacca32.exe	91
PID 4156 wrote to memory of 4092	4156	Gqikdn32.exe	92
PID 4156 wrote to memory of 4092	4156	Gqikdn32.exe	92
PID 4156 wrote to memory of 4092	4156	Gqikdn32.exe	92
PID 4092 wrote to memory of 3008	4092	Gcggpj32.exe	93
PID 4092 wrote to memory of 3008	4092	Gcggpj32.exe	93
PID 4092 wrote to memory of 3008	4092	Gcggpj32.exe	93
PID 3008 wrote to memory of 4040	3008	Gfedle32.exe	94
PID 3008 wrote to memory of 4040	3008	Gfedle32.exe	94
PID 3008 wrote to memory of 4040	3008	Gfedle32.exe	94
PID 4040 wrote to memory of 4684	4040	Gidphq32.exe	95
PID 4040 wrote to memory of 4684	4040	Gidphq32.exe	95
PID 4040 wrote to memory of 4684	4040	Gidphq32.exe	95
PID 4684 wrote to memory of 4404	4684	Gqkhjn32.exe	96
PID 4684 wrote to memory of 4404	4684	Gqkhjn32.exe	96
PID 4684 wrote to memory of 4404	4684	Gqkhjn32.exe	96
PID 4404 wrote to memory of 852	4404	Gbldaffp.exe	97
PID 4404 wrote to memory of 852	4404	Gbldaffp.exe	97
PID 4404 wrote to memory of 852	4404	Gbldaffp.exe	97
PID 852 wrote to memory of 4480	852	Gjclbc32.exe	98
PID 852 wrote to memory of 4480	852	Gjclbc32.exe	98
PID 852 wrote to memory of 4480	852	Gjclbc32.exe	98
PID 4480 wrote to memory of 2180	4480	Gmaioo32.exe	99
PID 4480 wrote to memory of 2180	4480	Gmaioo32.exe	99
PID 4480 wrote to memory of 2180	4480	Gmaioo32.exe	99
PID 2180 wrote to memory of 952	2180	Gppekj32.exe	100
PID 2180 wrote to memory of 952	2180	Gppekj32.exe	100
PID 2180 wrote to memory of 952	2180	Gppekj32.exe	100
PID 952 wrote to memory of 1608	952	Hboagf32.exe	101
PID 952 wrote to memory of 1608	952	Hboagf32.exe	101
PID 952 wrote to memory of 1608	952	Hboagf32.exe	101
PID 1608 wrote to memory of 1044	1608	Hjfihc32.exe	102
PID 1608 wrote to memory of 1044	1608	Hjfihc32.exe	102
PID 1608 wrote to memory of 1044	1608	Hjfihc32.exe	102
PID 1044 wrote to memory of 4964	1044	Hmdedo32.exe	103
PID 1044 wrote to memory of 4964	1044	Hmdedo32.exe	103
PID 1044 wrote to memory of 4964	1044	Hmdedo32.exe	103
PID 4964 wrote to memory of 4824	4964	Hcnnaikp.exe	104
PID 4964 wrote to memory of 4824	4964	Hcnnaikp.exe	104
PID 4964 wrote to memory of 4824	4964	Hcnnaikp.exe	104
PID 4824 wrote to memory of 3896	4824	Hjhfnccl.exe	105

C:\Users\Admin\AppData\Local\Temp\fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171.exe
"C:\Users\Admin\AppData\Local\Temp\fbab146ddfb2233bdcbc320061525ce4e2ac46cd3940b0e298607579cc2e3171.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\Gqdbiofi.exe
  C:\Windows\system32\Gqdbiofi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\SysWOW64\Gbenqg32.exe
    C:\Windows\system32\Gbenqg32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Windows\SysWOW64\Gjlfbd32.exe
      C:\Windows\system32\Gjlfbd32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1028
      - C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        23⤵
        Executes dropped EXE
        
        PID:3896
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:32
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2976
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        28⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:740
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        30⤵
        Executes dropped EXE
        
        PID:3392
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        32⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2664
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2812
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1512
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        36⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        38⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2780
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        41⤵
        Executes dropped EXE
        
        PID:4740
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1288
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3716
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3116
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5020
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3232
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        56⤵
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2116
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1252
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2796
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        61⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1728
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2676
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1788
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3412
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4364
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3104
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4112
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        70⤵
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        71⤵
        Drops file in System32 directory
        
        PID:1424
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        73⤵
        Drops file in System32 directory
        
        PID:2716
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        74⤵
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        75⤵
        Drops file in System32 directory
        
        PID:3948
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1276
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1016
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1536
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        81⤵
        Modifies registry class
        
        PID:3580
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3876
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5056
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4864
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:748
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        89⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2208
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4624
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:384
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        97⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2000
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4940
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        100⤵
        Drops file in System32 directory
        
        PID:1396
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2060
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3096
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        103⤵
        Modifies registry class
        
        PID:528
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        104⤵
        Drops file in System32 directory
        
        PID:1392
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        105⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1196
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        111⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        113⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        114⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        116⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        118⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        120⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        121⤵
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        122⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        124⤵
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        125⤵
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        126⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 400
        127⤵
        Program crash
        
        PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5996 -ip 5996
1⤵
PID:6096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Gbenqg32.exe

Filesize
96KB

MD5
fc6e54324f00f147c4879b3cd1fa61c0

SHA1
bddff0553a339628294ab5f97e8edca143b06f30

SHA256
989e5fd4c12691648686bfae3f90a452751a363204ce78da404d664dfe886379

SHA512
088bda2e4cd0d7bbc0dac23863024ebe7014130882e76812db872ff01c13114416c66125e97b00726c9ec6d94740c08183c65b5ad2aa0742a4b18d9a8a91a3b7

Download Submit
C:\Windows\SysWOW64\Gbldaffp.exe

Filesize
96KB

MD5
a219e375a8b1d88b8c8d050a787b47dc

SHA1
49f3d80578f4a1e2275132db7108ea11094b4db0

SHA256
5fa8508ddc3063642fcefedde2bcd406985b197b62bd072409048b1e3a5cf2da

SHA512
c4d1f61650644352d3316148a886e4d32fdfd1f23f6b3992df54d01af4f4e06e8d772bc3462fa99cfb914daa29c4a30b1039360ca231a02cc285332e6da3be19

Download Submit
C:\Windows\SysWOW64\Gcekkjcj.exe

Filesize
96KB

MD5
582f894b09d85da1bdf9faeb1887dc46

SHA1
73f485c3ff59ed3419948a4351b3f82aa01981c2

SHA256
89ff79c7c39df2e5d68cc289dc876c3cb470eab5a2690806489ce01661e3b1a7

SHA512
568400355ea1bb7863c82b3c290eb9a5338ae228ecc81fce499359ef464884627e04b7c38e81565fcc731a67d2ea38f5a9e21eadd6b9f028aaa9154c3a99126d

Download Submit
C:\Windows\SysWOW64\Gcggpj32.exe

Filesize
96KB

MD5
b5da58bd8228b78d5d219bc5cb7e32d4

SHA1
d48d82da1c6dc5972e416a6b7e61b75cecf49a5f

SHA256
e3f76859931d7f227d1e5d7e45670d4e97093d8c41664b57cba39d2ab0b2b892

SHA512
f857bffb49cdabe218202964c37d438cff5a19c07ebd1eaca297552740e2f648a57040d989706cca4904acdd0ebdba485cb4195e4548014d52d237f2e9cd46cb

Download Submit
C:\Windows\SysWOW64\Gfcgge32.exe

Filesize
96KB

MD5
4a689f98199ce1907da0a1971c59cc42

SHA1
e7f122d3a2b1546f693bbd75f9b5c485eb4c7798

SHA256
81ea96bb24c8b2d00e0883e42cc585918d26acfdb4fd7dd0ec6aeae9781fceb6

SHA512
ff071eede6ab2d4aa78f68b1fbd755341b4f42105d6ea2c4b3c64ab57ff0548e92ea18f1bf1c02af0b0e0ff9a381861839fc62f1bf05d945884ea01306560241

Download Submit
C:\Windows\SysWOW64\Gfedle32.exe

Filesize
96KB

MD5
361fdc84d56380e3b64f78d949024de5

SHA1
6fc0092fe1a400ba88250cc60bd4b24587277779

SHA256
6b19953ffa83a17609cfbb0abb7a7db491996c1bc9b4d6438ed862cc4cb43866

SHA512
1ccf5bfcd04ef794959c4452c2fc980ef74517d64139c9baf7c54ecd0f88e4c33b16757cd707bf2de29aa007eaa53bc1d61f3a0bd66824e6978f2d896ae2c238

Download Submit
C:\Windows\SysWOW64\Giacca32.exe

Filesize
96KB

MD5
fb24f84a7501b6bc628184b6ccae865c

SHA1
24db8a188df48ac08d37d35a2088956e5372ce80

SHA256
a918aaf18ddaecfcd6ddf1f79f338e2ecd3fde1b12aa22b487bea23579aa6dec

SHA512
4e40cddec0625804495ced886afb1289521a1ddbcfeca87837c1a3192082d82ad1e23d7f80e1a48c5404698609b0f55f95e60d75aac562ad7aec23137d0da413

Download Submit
C:\Windows\SysWOW64\Gidphq32.exe

Filesize
96KB

MD5
50f5d04d2f58d36b1b69e1757cc38d14

SHA1
bf1b920ed1da96eff96b2ef06f52c1a66441031c

SHA256
0344affd1267e53f1f27a99762e26323f3064daad0bf297d216a39468fee28f4

SHA512
d4447152f03b099d156a84def4dca2f8bd6867afe3df4ec54615ba5c2196bff447ae3c5ebd8ee688c3aa9a45a57ca68ab2e0ea1cd1d57d5586c1563eb9182a3c

Download Submit
C:\Windows\SysWOW64\Gjclbc32.exe

Filesize
96KB

MD5
578dc5bdc29ab4e622309d6ee5bf39ad

SHA1
add15855fccd6c77e8936263fb14dd02d145aed5

SHA256
f27fc2d2bec9b955605dea36ba1ae26d4830e35560670e1d6bb0510f1755ce13

SHA512
73a417a7eee3ef9be1a65e4f2392440ee6617af8cfc931dffbb0eb9cbc2ef2ce24ef62995e5875b219e6acfa27f2f60a654a3100779acb08d0b67018e084c7c8

Download Submit
C:\Windows\SysWOW64\Gjlfbd32.exe

Filesize
96KB

MD5
fc0b7d0908ada5a5e8d4e75a82d61688

SHA1
2b18fead587186da977806cafb2c06b95c51d3c8

SHA256
69947c170f38dc860354674f2dbb85e5239fd1fa27536a4053bc10d39ce56ccd

SHA512
999469a0a7d649c129e2297e0c6cbd6981837b154b996951f6c8f471a8414a615044571f0731b5df9bede0222c9ddba44cd355eeebab48d713964706ec143323

Download Submit
C:\Windows\SysWOW64\Gmaioo32.exe

Filesize
96KB

MD5
a3176cbb76021643632b09896a30fac1

SHA1
0e951ea730c3ed3266d04ab70a6d8a15b9dcbabf

SHA256
9c0db6ca368c47d086eb3b615197357e3d92aac9e530008c8b8aedddfdd1f5bd

SHA512
359226ff7adfc6927173ddd503f42f6e2e709071a05f1b4f83cfe41a91466d987009f9ae864852aee9b7a9fbce9133f6d25c5baf5bb361dd8e90c4ee993bc368

Download Submit
C:\Windows\SysWOW64\Gmkbnp32.exe

Filesize
96KB

MD5
51c3f2448feed6e453779dd8cc5d94c4

SHA1
93b149cc7db5ce18c8c9ef7d478735e2e2051183

SHA256
53a8f38a37d9539c28c46e48c283a051ae7bcc4d1ffd153a88373e3040de51ed

SHA512
e0a43f86cdb1801ef2ef460527bd31e497bef309b9f9d42d3433e2c8e06f521780d4de5add1ff4197b6e22dc99369ca8f94530b06910b542ab7cc617256f2302

Download Submit
C:\Windows\SysWOW64\Gppekj32.exe

Filesize
96KB

MD5
9d6f5b1c72349e319de4fe46a3a34ca3

SHA1
d548a15887e6b59454e1ba5c93f8e4af070b6db3

SHA256
810869d35e6c6b253a08b0fcdd0664230a20a231701833141a9b7ad2c42dd2d6

SHA512
4629f05a6a5991d0a09b0a8d6d8421e871013c5a97499c85c926791242db5f4b6b4a72c680c25f5b114296b9a202f39e898a311505b01eb8708929c216eb9c03

Download Submit
C:\Windows\SysWOW64\Gqdbiofi.exe

Filesize
96KB

MD5
65394dde407265ae2253505f96d3663b

SHA1
52afe2629ae6e4e22bcde44493c655c87bc10cd4

SHA256
8292e9bf7ce1cc6988866d63c94d1389e97d2723360c58d7737ccf2c1c21522d

SHA512
d8d5a3e1bbba6c8a73dbf556383554d4017105e95ff25c7d3da4f87c6d2b051724cdb8dfff80e856c177ad278277773a1e71db6921db98ca90a84c765f7ba6bd

Download Submit
C:\Windows\SysWOW64\Gqikdn32.exe

Filesize
96KB

MD5
9169b294d8162af9c8db2c88427c37e5

SHA1
ac19567ea107f35cf1abbe56a75b0cbf0c5d6135

SHA256
13126e391f7a8c4df9765e1fc6b4ecee535ff92e562be20bd9ffd09596273e08

SHA512
26e111c7501d26dac3aa24ba8512033c14871cf1fcee0a8ea359ea0bd511778269b6f312bab4258993534726aacf48965a893d85995ec11c201e5f72ab9317f7

Download Submit
C:\Windows\SysWOW64\Gqkhjn32.exe

Filesize
96KB

MD5
1fde6c9cc12ebc5ee654858881db3b05

SHA1
3bb519ad79cccf8454cd27a36b9fcd7d6ef41465

SHA256
42cd5a8630c307ced55d7504af2190273b2092c7fa47afc7c6d0a1d551477ff8

SHA512
e29e5ca17a0a0c41224dc13a66d93169c11f62400fdf467ecb440b5639c39f8bca0bc560f0e39e6f4ff2096ac740e74b91738feeb151b95ebabbd08b1c65aec8

Download Submit
C:\Windows\SysWOW64\Hbeghene.exe

Filesize
96KB

MD5
ed52b0f29756ca6476d8431895f81082

SHA1
be816919c080dab46598664af49bfa88d269318f

SHA256
6358372442c13ae13ae2c908dbe5df017a5219f218dd19c49471b4546a03c44d

SHA512
92205ac82e8abef9666a0136ea4eaed44da8456619d2d3e4f4b09e5713f4c8a7a821ff4037681ad4ce331b6cc64b3ea2befc11157c784b4b5f855533fd2b3570

Download Submit
C:\Windows\SysWOW64\Hbhdmd32.exe

Filesize
96KB

MD5
eb99822a134eeffff864b8c356c6bfca

SHA1
d528c1f3ae9dfd1fb86795d13113ecb2e8a19734

SHA256
79dc587edc86e7219de3bc12723e7af82410a7d348f34722707c2d13152eb11f

SHA512
689d6e7b4d823953d4d8e7276f706394eaed8832bef32155d2b8a0002a98ccf7fc5b04117b88ae096f0461d1e444e4716ee2f6d5fdf757359d3472f4dbdd464e

Download Submit
C:\Windows\SysWOW64\Hboagf32.exe

Filesize
96KB

MD5
8f32a5d78938c4be5da5696e2ddf66cc

SHA1
12b93be42f133e39d7c57a43991ef9ad0f9640d4

SHA256
3bd53ca90601928b0721f14df0ff4785d9f35fd2d785e6343839cacb18371340

SHA512
bf9609cd5e9fceff60c4dbd73f0cda1f9dd6b7b01e75424a254266fd4935c80b8f5b0e80162babef730204b5dfa024492ec0d31e7498c59d3946c05ef26ab614

Download Submit
C:\Windows\SysWOW64\Hcnnaikp.exe

Filesize
96KB

MD5
7e99e0b6684221b2caf982109468d27b

SHA1
f39294053f867cfc2537a01909cfa3aabad4692e

SHA256
2bf6a3a2e896db561e402db070fdb5029711e1385970512b13a947e235639d3d

SHA512
a917ca9dbbf43ac64ededd4b9113772eb32688fc14d033cc5085bece4b9c0a59b0e9fbd949cbe3c050fd4c7fc0d3ef7f1629b60b7bc4cce3e84eb5bbe75ecf75

Download Submit
C:\Windows\SysWOW64\Hcqjfh32.exe

Filesize
96KB

MD5
0b722fd11048ccbd7d78846133207a22

SHA1
3db8cba06f45454dd445edd0ed02dafc7373d15d

SHA256
f44877fdeacedb2d84c45b691b0e41cd2fc099b5f727d09c1deadbd9b7ecb773

SHA512
a038101dedef0387dabecd1090439725b64ca82c33957944db60c8c78ed138b56da5c5a34a9aea0303a3fc86357b68d7316c744c267f336b47cc634f499e1bb7

Download Submit
C:\Windows\SysWOW64\Hjfihc32.exe

Filesize
96KB

MD5
819f63019182073d079e733923cd2e7e

SHA1
16a50946b324b51e5c8461f4e7b67719b5bfc087

SHA256
b34c4518c12690ca59a579539f444e5aa3d5d3f8e5583213c640b4c092ddc236

SHA512
75f9c42b56dc892f4fa92d175f11c5e574747beef590b0a9914edc09266d74dcb28f559b114d12f4cd0d6d6433f8256a1b80dd56290b41c597bf4d8a911070d0

Download Submit
C:\Windows\SysWOW64\Hjhfnccl.exe

Filesize
96KB

MD5
418bf56865c628d15f2990c3d73dc243

SHA1
f911443a97e518943294e40ef5b6036cbf6b7922

SHA256
33886673c4923503c993c807612744bd00f7627f912834505dfb194fb22b7bab

SHA512
1a9663b6f55a6e70af9c6e8276e12596444855e5828d4c7b99671e68c5d03784ec842383d984f2258b0371c65a7ac0cd6d37844fe31b340c4e4f7bd2127c40aa

Download Submit
C:\Windows\SysWOW64\Hjjbcbqj.exe

Filesize
96KB

MD5
73716e83c774be7d5105c149c4f5ec9d

SHA1
ad6025c5260b0b8813a65e002431a428444377c3

SHA256
dc4d17873e0463333fc30243ae6575a907755f7f49ce543611bfa95036523dab

SHA512
c6e735022ef5e480d61357873e5b22fb533ced30df463e682b3e708146e25e020de83be25a05803264afc57da7422a2c340da0762ad100ecd52e09199fab2e79

Download Submit
C:\Windows\SysWOW64\Hjolnb32.exe

Filesize
96KB

MD5
061a4a7c60def3129081cd5e3c7d0d0a

SHA1
38f97986dd58f364826c2662de3c8d75179207bc

SHA256
87c8dc8bcc59f2f79964f68aaef5bb43e58f3b3e10d5d4167b62e98c53b28fae

SHA512
cbf89ab414bdaa44f472f947c5e55ada311b3003f6832a9641ab4dd80f55935550c7ca12cdf22d29c46fb9b8dfe17becf65b86f56169d826ee25b92c5c860875

Download Submit
C:\Windows\SysWOW64\Hmdedo32.exe

Filesize
96KB

MD5
83d61430cb67a11cdc8f7a1c7a9ddbd7

SHA1
f343f4dbdd142ef9a773dfc125b1a7e295bb829b

SHA256
dc715fc3a878547c52730499cb5bb8cc0b907dabe0d42a24bf5d896d4e50c4cb

SHA512
cd240d5a0b162850ae27d8e7040fcd9cb99420cfe9df4aed2d590b2fa012ac161a68e437a58b323596f8d916b39a7c6e8e17f864fa76d044da66180ab9f43b11

Download Submit
C:\Windows\SysWOW64\Hmfbjnbp.exe

Filesize
96KB

MD5
ed112cabae8cabed6d1c50384c590848

SHA1
f8d0abbcf717b069bc1084d4945a655d13a814a4

SHA256
c5a3e251c6a84946c62104b080fc0558dbd025b2cd6f731aa6cd9e9f5e578b5a

SHA512
cd68dc419878f992ba5d81a7b090840af46588a9c2a780378516f3aa0d9ebb1eedf92b21f1e6fded1b8b3ebc7c015f530a5e0575462362ceb79a37ec8ab87003

Download Submit
C:\Windows\SysWOW64\Hmklen32.exe

Filesize
96KB

MD5
fbee1bbf3af9722927f67f59dceada04

SHA1
f4a82bec9bdbbd5cee22f2b81e06a4c1615fe47f

SHA256
7d0b1334a5349fa3ad3f72d2fbeec3f9b5cc9dd7ff743cf31a62dd1322b9a7e0

SHA512
04258775ecde6b38bc271748c1c0560556f63a1aba84dd6cca6d761dac5a40a6ad0ee9dabcbe1c334e85c5c0fcfda0543be536de8cdb7e3652f928ea3fb1cc78

Download Submit
C:\Windows\SysWOW64\Hmmhjm32.exe

Filesize
96KB

MD5
f6028699a2ad3ca3d2ea939043c81df4

SHA1
236b04618ba229ebcaed7889d6d8c3ce9882e7b4

SHA256
d5600ce87f2679812d0841044bb18d93fa79d5db196a3d04b99e2c6fa83489be

SHA512
6f4a97e7479fd97df67fdd869c53390161e11ecde08be49cd02bfc6193255844f85d96e307b8b0ec943fdb0c8cb9f4bfb8a4193c84817e5aee22f40390e90bc2

Download Submit
C:\Windows\SysWOW64\Hpgkkioa.exe

Filesize
96KB

MD5
b1dff3cd4b03f31748d0430cd0ee0926

SHA1
d84638108f51b7096eb95a0465e47e8beb95608f

SHA256
61577ac5a74d40d73b29a395bd88603652d8f1799f5a4dde93c47bf5a27bdcc5

SHA512
b192c18abe5c3c0dc1e8d5c12ff73e0130430b6bf159444bd9e9c3394928d71363c6a4c7973fc7f2e7000d93a8d94d1f55832687b6f921196e6040d8489d4204

Download Submit
C:\Windows\SysWOW64\Hpihai32.exe

Filesize
96KB

MD5
36efc8947be99fa176b08b0884c4128b

SHA1
a2a447391e13a6815cecb92b88871a2278895bb6

SHA256
8b4b8d023d0d8a795b63e82eb9864d0e7137d55a7042ae4fd017349414e63fbe

SHA512
97e48a027242357669e2a5831df5a9ea9f41c0dbfa80d3958402b507b8a5773a1c3bb84b359ed3ce31fa8d0809503d3a8d05689ce3a8e73f4a3b8fb3a1da9dcc

Download Submit
C:\Windows\SysWOW64\Ipldfi32.exe

Filesize
96KB

MD5
3e7487a4a14dd279429a18279d70bd0e

SHA1
fb4975a17caaa632335a0bb253a571cc0980aaf7

SHA256
5f1b45edb9e168002cd08b09c2c20b4f7eb62b3727e2927d13b68bf56910b6f3

SHA512
4fe2dbd224f67e5714274f414e94abfda2997574c3c0b39d65c7773d90bbc3b4ce19d4721a6b74d4141efc41ac3b8ac71cf206366435a9baf0ad076c9f7e8f98

Download Submit
C:\Windows\SysWOW64\Jaedgjjd.exe

Filesize
96KB

MD5
158895964c19392a9c799b5205ec492c

SHA1
cc0167b5e2a558889e5c4dbae4f36935da8b631c

SHA256
53235b2d871391d86836ab72daccd3bfa0b580c51afbeaf69ff48c74c8305f29

SHA512
ceeca448a31f32488307441671ee0129848d275b94419df887a3166e87b5e6a857595b96c254f923e32dc01d76a9e80e4fee31578bf542992a38a49cccc3490d

Download Submit
C:\Windows\SysWOW64\Jkfkfohj.exe

Filesize
96KB

MD5
0fc50afa293a52e0d39e38bf8f355057

SHA1
1cf93978847561cdb03225f69f39d779c4cbfa4e

SHA256
73ed25b3de4a771edc52930255bb0bccf1357d478248d194852fae0200545567

SHA512
3651d412a5483d68b9ea1c4e7f9dcf3d4c8f602c43e320bf1b449230fc3251ac74f9932c03402e0411bba0cd2c029451ec7932d3869c80c70c65323a2c4bfdc4

Download Submit
C:\Windows\SysWOW64\Jpojcf32.exe

Filesize
96KB

MD5
d5591af323fda46ebb6fb3966d108bb3

SHA1
bad6b04c298cd95fc9c82518cdf537b613f54539

SHA256
668bbb471a955e899ed23ab5be7050b84aed6fd6f1f48c0fbd60b77a0d46e9e9

SHA512
9bd70478c3da8e9339bc2cdcdbe4811d6ffcfc4e7f103672101a5030634f84f19611f7696361687778d26c9e98bcda76028a3ae047e1cd6968a82e0c38360068

Download Submit
C:\Windows\SysWOW64\Kkihknfg.exe

Filesize
64KB

MD5
6095b0cfd91b5886ad80b3a106bcf2d4

SHA1
f4b4c27a72628257bed849a344b542accb8a7129

SHA256
618769e92b0f7cbb3c89ec3d5affab5eb8b16da9cddf26dc299e874f10228a92

SHA512
37a5fea4d8103212627b178f3dc3b711e593727c419b483b5d5ac6d0298491f43bfd6ca25cbe5027224a1e945d1c479840e2d64bd498137e91feba1e997ab765

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
96KB

MD5
9752b039bf8489a393a6dd8cee4a7308

SHA1
4f2ab1b5d7254c354d5a9e93fc4bee47fe54c524

SHA256
55d0dee21ae9e0e13c846bb78a8c9482c1638eefeb9702c00e54304d64d7f817

SHA512
fc0c0cf515db48ebb9a8c79f4a445e558555f7e94bc9b65bcd3399c84cbab00900af914a6b8564a3111990812f4ebd155a13d8a4b8bc56c4c53e3c33f91f9498

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
96KB

MD5
17c1d6d0b64d902ce386a0374a7039d7

SHA1
926d84757f1208923f2a2316c681b8f24c63a9c8

SHA256
fe185b0df9865151f751c4e1b6a40d2fd32e5f46d078b4875b80bf19d9349f11

SHA512
35914d503d02c65dce0050367150d5515d1131588204e8c97ebb2d85c96de40429cf2c1de78f80353ce085702a1f7bd111b22ce66099e469c826d3d218c4ec75

Download Submit
C:\Windows\SysWOW64\Nqiogp32.exe

Filesize
96KB

MD5
f653a1bbc30522def456a7780e8ace95

SHA1
a657eac8fea0767ac0c683bf84ac9167d7c48c7a

SHA256
c0c0399ea4c656371a6bdbd8acba0a853a99a471767d7af29437c7ce0f6114df

SHA512
ecd97bf54fa1ebafa92fcf0db86e82de4b0dacb05ec66f32e85176d954f15eeaa6a7a764a8ef43a0538044c5e2bd71c613e4e2233cd92736cb967b37bfd871a5

Download Submit
memory/32-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/60-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/740-230-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/852-117-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/952-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1028-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1044-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1252-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1288-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1512-273-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1608-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1728-433-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1924-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1972-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2112-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2116-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2124-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2180-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2224-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2224-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2664-261-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2676-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2684-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2788-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2796-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2804-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2812-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2824-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2976-208-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3012-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3048-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3068-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3116-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3120-285-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3180-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3232-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3332-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3392-237-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3664-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3716-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3896-179-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3916-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4012-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4036-189-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4040-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4064-45-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4092-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4156-65-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4292-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4312-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4404-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4420-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4448-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4480-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4684-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4740-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4776-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4824-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4964-160-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5020-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5044-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads