3fe4528f4ca9b5de910f152d1107c2cbc854e86aae98fb8301977a38a1b823c9

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fe4528f4ca9b5de910f152d1107c2cbc854e86aae98fb8301977a38a1b823c9.exe
Size

198KB
MD5

06bc19453d36910dd6431e82f4e196ae
SHA1

08de0ff72d8ba4cfc997b780b6877fe7380fe77e
SHA256

3fe4528f4ca9b5de910f152d1107c2cbc854e86aae98fb8301977a38a1b823c9
SHA512

0671bbbe5821967de99112aa6539bb78703e90cfa09820bd89ce4e3c63ff25afcc64d569f76c066f2b6829295368a47fa0d96bb78993d82af2dce1b8555a2427
SSDEEP

3072:yqR7U3TPe+krqTmmRclsuik14Sp+7H7wWkqrifbdB7dYk1Bx8DpsV6OzrCIwfE:yquPHhTSsuiKBOHhkym/89bKws

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lllcen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldjhpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfankifm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgddhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oncofm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nloiakho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgmngglp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfcbjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojjolnaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmdkch32.exe

Executes dropped EXE 64 IoCs

pid	Process
5044	Imfdff32.exe
4880	Icplcpgo.exe
4404	Jfoiokfb.exe
1596	Jimekgff.exe
2460	Jlkagbej.exe
2232	Jcbihpel.exe
3152	Jfaedkdp.exe
2052	Jioaqfcc.exe
1664	Jlnnmb32.exe
812	Jcefno32.exe
556	Jfcbjk32.exe
4856	Jianff32.exe
2192	Jmmjgejj.exe
1412	Jlpkba32.exe
4068	Jcgbco32.exe
3596	Jidklf32.exe
3396	Jeklag32.exe
3352	Jlednamo.exe
2592	Kboljk32.exe
2360	Kmdqgd32.exe
1004	Klgqcqkl.exe
3780	Kbaipkbi.exe
4572	Kmfmmcbo.exe
4760	Kpeiioac.exe
1128	Kfoafi32.exe
4368	Klljnp32.exe
4024	Kfankifm.exe
1840	Kmkfhc32.exe
4972	Kpjcdn32.exe
2164	Kbhoqj32.exe
1604	Kibgmdcn.exe
1608	Kplpjn32.exe
3932	Leihbeib.exe
4108	Lpnlpnih.exe
2188	Ldjhpl32.exe
3864	Lfhdlh32.exe
4608	Lmbmibhb.exe
3536	Ldleel32.exe
3980	Lenamdem.exe
2280	Lmdina32.exe
1108	Lpcfkm32.exe
1332	Lbabgh32.exe
864	Lgmngglp.exe
3956	Lmgfda32.exe
668	Lpebpm32.exe
512	Lgokmgjm.exe
3732	Lingibiq.exe
3052	Lllcen32.exe
516	Mbfkbhpa.exe
2500	Medgncoe.exe
1468	Mlopkm32.exe
4516	Mchhggno.exe
4916	Mgddhf32.exe
3284	Mplhql32.exe
3220	Mgfqmfde.exe
976	Mmpijp32.exe
3548	Mdjagjco.exe
1624	Mmbfpp32.exe
2372	Mpablkhc.exe
3188	Mgkjhe32.exe
3840	Mnebeogl.exe
1252	Npcoakfp.exe
4320	Nepgjaeg.exe
4752	Nngokoej.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Imfdff32.exe	3fe4528f4ca9b5de910f152d1107c2cbc854e86aae98fb8301977a38a1b823c9.exe
File opened for modification	C:\Windows\SysWOW64\Mdjagjco.exe	Mmpijp32.exe
File opened for modification	C:\Windows\SysWOW64\Nphhmj32.exe	Njnpppkn.exe
File opened for modification	C:\Windows\SysWOW64\Nloiakho.exe	Nnlhfn32.exe
File opened for modification	C:\Windows\SysWOW64\Nckndeni.exe	Ndhmhh32.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	Ageolo32.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Ckmllpik.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Jekpanpa.dll	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Neeqea32.exe	Ncfdie32.exe
File opened for modification	C:\Windows\SysWOW64\Pmoahijl.exe	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Elogmm32.dll	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Lmgfda32.exe	Lgmngglp.exe
File created	C:\Windows\SysWOW64\Hjgaigfg.dll	Ndfqbhia.exe
File opened for modification	C:\Windows\SysWOW64\Oncofm32.exe	Ogifjcdp.exe
File opened for modification	C:\Windows\SysWOW64\Bmbplc32.exe	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Mplhql32.exe	Mgddhf32.exe
File opened for modification	C:\Windows\SysWOW64\Npfkgjdn.exe	Nngokoej.exe
File created	C:\Windows\SysWOW64\Ndfqbhia.exe	Nloiakho.exe
File created	C:\Windows\SysWOW64\Naekcf32.dll	Ojllan32.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Bmemac32.exe	Bnbmefbg.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Ngpccdlj.exe	Npfkgjdn.exe
File created	C:\Windows\SysWOW64\Hmmblqfc.dll	Pdmpje32.exe
File opened for modification	C:\Windows\SysWOW64\Acqimo32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Pjcbnbmg.dll	Nckndeni.exe
File opened for modification	C:\Windows\SysWOW64\Pclgkb32.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Ojllan32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Olmeci32.exe	Ojoign32.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Ahioknai.dll	Ngpccdlj.exe
File created	C:\Windows\SysWOW64\Gmdkpdef.dll	Olmeci32.exe
File opened for modification	C:\Windows\SysWOW64\Qddfkd32.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Kbhoqj32.exe	Kpjcdn32.exe
File created	C:\Windows\SysWOW64\Nhgaocmg.dll	Kbhoqj32.exe
File created	C:\Windows\SysWOW64\Efhaoapj.dll	Lmbmibhb.exe
File created	C:\Windows\SysWOW64\Beapme32.dll	Opdghh32.exe
File created	C:\Windows\SysWOW64\Lnlden32.dll	Pjjhbl32.exe
File created	C:\Windows\SysWOW64\Jcbihpel.exe	Jlkagbej.exe
File opened for modification	C:\Windows\SysWOW64\Ojllan32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Caebma32.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Icplcpgo.exe	Imfdff32.exe
File opened for modification	C:\Windows\SysWOW64\Kfoafi32.exe	Kpeiioac.exe
File created	C:\Windows\SysWOW64\Kqgmgehp.dll	Mmbfpp32.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Jfcbjk32.exe	Jcefno32.exe
File opened for modification	C:\Windows\SysWOW64\Mbfkbhpa.exe	Lllcen32.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Bganhm32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	6928	WerFault.exe	290

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jianff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npcoakfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhoilahe.dll"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jidklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkfcej32.dll"	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfbgbeai.dll"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijfjal32.dll"	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lffnijnj.dll"	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlkagbej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbjac32.dll"	Kpjcdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odkjng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Leihbeib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlfofiig.dll"	Ncfdie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mchhggno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Canidb32.dll"	Kfankifm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olmeci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flakmgga.dll"	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjddiqoc.dll"	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnonbk32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 5044	3988	3fe4528f4ca9b5de910f152d1107c2cbc854e86aae98fb8301977a38a1b823c9.exe	89
PID 3988 wrote to memory of 5044	3988	3fe4528f4ca9b5de910f152d1107c2cbc854e86aae98fb8301977a38a1b823c9.exe	89
PID 3988 wrote to memory of 5044	3988	3fe4528f4ca9b5de910f152d1107c2cbc854e86aae98fb8301977a38a1b823c9.exe	89
PID 5044 wrote to memory of 4880	5044	Imfdff32.exe	90
PID 5044 wrote to memory of 4880	5044	Imfdff32.exe	90
PID 5044 wrote to memory of 4880	5044	Imfdff32.exe	90
PID 4880 wrote to memory of 4404	4880	Icplcpgo.exe	91
PID 4880 wrote to memory of 4404	4880	Icplcpgo.exe	91
PID 4880 wrote to memory of 4404	4880	Icplcpgo.exe	91
PID 4404 wrote to memory of 1596	4404	Jfoiokfb.exe	92
PID 4404 wrote to memory of 1596	4404	Jfoiokfb.exe	92
PID 4404 wrote to memory of 1596	4404	Jfoiokfb.exe	92
PID 1596 wrote to memory of 2460	1596	Jimekgff.exe	93
PID 1596 wrote to memory of 2460	1596	Jimekgff.exe	93
PID 1596 wrote to memory of 2460	1596	Jimekgff.exe	93
PID 2460 wrote to memory of 2232	2460	Jlkagbej.exe	94
PID 2460 wrote to memory of 2232	2460	Jlkagbej.exe	94
PID 2460 wrote to memory of 2232	2460	Jlkagbej.exe	94
PID 2232 wrote to memory of 3152	2232	Jcbihpel.exe	95
PID 2232 wrote to memory of 3152	2232	Jcbihpel.exe	95
PID 2232 wrote to memory of 3152	2232	Jcbihpel.exe	95
PID 3152 wrote to memory of 2052	3152	Jfaedkdp.exe	96
PID 3152 wrote to memory of 2052	3152	Jfaedkdp.exe	96
PID 3152 wrote to memory of 2052	3152	Jfaedkdp.exe	96
PID 2052 wrote to memory of 1664	2052	Jioaqfcc.exe	97
PID 2052 wrote to memory of 1664	2052	Jioaqfcc.exe	97
PID 2052 wrote to memory of 1664	2052	Jioaqfcc.exe	97
PID 1664 wrote to memory of 812	1664	Jlnnmb32.exe	98
PID 1664 wrote to memory of 812	1664	Jlnnmb32.exe	98
PID 1664 wrote to memory of 812	1664	Jlnnmb32.exe	98
PID 812 wrote to memory of 556	812	Jcefno32.exe	99
PID 812 wrote to memory of 556	812	Jcefno32.exe	99
PID 812 wrote to memory of 556	812	Jcefno32.exe	99
PID 556 wrote to memory of 4856	556	Jfcbjk32.exe	100
PID 556 wrote to memory of 4856	556	Jfcbjk32.exe	100
PID 556 wrote to memory of 4856	556	Jfcbjk32.exe	100
PID 4856 wrote to memory of 2192	4856	Jianff32.exe	101
PID 4856 wrote to memory of 2192	4856	Jianff32.exe	101
PID 4856 wrote to memory of 2192	4856	Jianff32.exe	101
PID 2192 wrote to memory of 1412	2192	Jmmjgejj.exe	102
PID 2192 wrote to memory of 1412	2192	Jmmjgejj.exe	102
PID 2192 wrote to memory of 1412	2192	Jmmjgejj.exe	102
PID 1412 wrote to memory of 4068	1412	Jlpkba32.exe	103
PID 1412 wrote to memory of 4068	1412	Jlpkba32.exe	103
PID 1412 wrote to memory of 4068	1412	Jlpkba32.exe	103
PID 4068 wrote to memory of 3596	4068	Jcgbco32.exe	104
PID 4068 wrote to memory of 3596	4068	Jcgbco32.exe	104
PID 4068 wrote to memory of 3596	4068	Jcgbco32.exe	104
PID 3596 wrote to memory of 3396	3596	Jidklf32.exe	105
PID 3596 wrote to memory of 3396	3596	Jidklf32.exe	105
PID 3596 wrote to memory of 3396	3596	Jidklf32.exe	105
PID 3396 wrote to memory of 3352	3396	Jeklag32.exe	106
PID 3396 wrote to memory of 3352	3396	Jeklag32.exe	106
PID 3396 wrote to memory of 3352	3396	Jeklag32.exe	106
PID 3352 wrote to memory of 2592	3352	Jlednamo.exe	107
PID 3352 wrote to memory of 2592	3352	Jlednamo.exe	107
PID 3352 wrote to memory of 2592	3352	Jlednamo.exe	107
PID 2592 wrote to memory of 2360	2592	Kboljk32.exe	108
PID 2592 wrote to memory of 2360	2592	Kboljk32.exe	108
PID 2592 wrote to memory of 2360	2592	Kboljk32.exe	108
PID 2360 wrote to memory of 1004	2360	Kmdqgd32.exe	109
PID 2360 wrote to memory of 1004	2360	Kmdqgd32.exe	109
PID 2360 wrote to memory of 1004	2360	Kmdqgd32.exe	109
PID 1004 wrote to memory of 3780	1004	Klgqcqkl.exe	111

C:\Users\Admin\AppData\Local\Temp\3fe4528f4ca9b5de910f152d1107c2cbc854e86aae98fb8301977a38a1b823c9.exe
"C:\Users\Admin\AppData\Local\Temp\3fe4528f4ca9b5de910f152d1107c2cbc854e86aae98fb8301977a38a1b823c9.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\Imfdff32.exe
  C:\Windows\system32\Imfdff32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\Icplcpgo.exe
    C:\Windows\system32\Icplcpgo.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\SysWOW64\Jfoiokfb.exe
      C:\Windows\system32\Jfoiokfb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
      - C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        23⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        24⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4760
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1128
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4024
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2164
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        32⤵
        Executes dropped EXE
        
        PID:1604
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        33⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        35⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        37⤵
        Executes dropped EXE
        
        PID:3864
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3980
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        41⤵
        Executes dropped EXE
        
        PID:2280
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        42⤵
        Executes dropped EXE
        
        PID:1108
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        43⤵
        Executes dropped EXE
        
        PID:1332
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:864
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        45⤵
        Executes dropped EXE
        
        PID:3956
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:668
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:512
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        48⤵
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:516
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2500
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        52⤵
        Executes dropped EXE
        
        PID:1468
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4916
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        56⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:976
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        58⤵
        Executes dropped EXE
        
        PID:3548
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2372
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        61⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        62⤵
        Executes dropped EXE
        
        PID:3840
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1252
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        64⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4752
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        66⤵
        Drops file in System32 directory
        
        PID:4292
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        67⤵
        Drops file in System32 directory
        
        PID:5056
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        68⤵
        Drops file in System32 directory
        
        PID:2340
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3504
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        71⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        72⤵
        Drops file in System32 directory
        
        PID:2720
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        75⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        76⤵
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        77⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5280
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        81⤵
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        82⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5400
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5440
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        85⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        87⤵
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        89⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        90⤵
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        92⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        93⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        95⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        96⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        97⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        98⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        100⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3348
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        102⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5260
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        104⤵
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        106⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5540
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5632
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5792
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        112⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        115⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        116⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        118⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        119⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        120⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        121⤵
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5724
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        123⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        124⤵
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        125⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        126⤵
        Drops file in System32 directory
        
        PID:412
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        127⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        128⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        129⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        130⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        132⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        136⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        137⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        138⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        139⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        140⤵
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        143⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6344
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6388
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        147⤵
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        149⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        150⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        151⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        152⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        153⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        154⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        155⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6848
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        158⤵
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        159⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        160⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7068
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        164⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        165⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6244
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        172⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        174⤵
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        175⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        176⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        177⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        178⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7128
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        180⤵
        Drops file in System32 directory
        
        PID:6188
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        181⤵
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        183⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        184⤵
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6756
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        187⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        188⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        190⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        192⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        194⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        195⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        196⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        197⤵
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        198⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6408
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        200⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6928 -s 228
        201⤵
        Program crash
        
        PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6928 -ip 6928
1⤵
PID:6656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ceehho32.exe

Filesize
198KB

MD5
8a3c0512e6d37245560ae3866d9cbdf4

SHA1
a00162de3cfb5b8328b644c70f27a5f65c7cbe45

SHA256
4ddd5a71cd7a8bf0feac62542bff605a801da3017b4ec1a5cddce811106bf303

SHA512
a26c469fe9000bbfaa6c3da52694b6d524bdd429aaa3f81a8bbec7cdc5f806a55e0706a9cd5b7fd3b58e9574e61cd0467bc37be0d1dcd4c085210e0e2e0e6f29

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
198KB

MD5
3d84a5c3cd82c6abc3c3d3320eb877ec

SHA1
ee840a7b912bbc8e435cc16bc0213ae2790e6fc4

SHA256
3e0b47ac4214b43ade89f2b418cefcda3c518292cc37d43a4535f9057c7b7363

SHA512
41966f3d65ccb286e4795ae68d8d7b7f0ae8c6e1b9eaf0ed5acf76696e0ec2f82b7a47258ae7ae6ab3f88391c4767932a8e8e0a36b213758d6dd5240ca945d5a

Download Submit
C:\Windows\SysWOW64\Gcbifaej.dll

Filesize
7KB

MD5
2199b879a0d196a67881750532bc1ae1

SHA1
3da516ba1b28a2fa69dbd620c4b27ee732eaee4d

SHA256
f73085bd2d04418e6eb1c4063ad6fb2231fe1b22e2c2efb2bb04201bc4a7d546

SHA512
8d7e8055ad17a848a71cb328eff70c2c6073c8cae77f6f7a8bd1cd25002ea86fd88f7b5621b27069187729f6d74ecf087c09f65dccd57c1c4c34345c3a84f7d0

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
198KB

MD5
446b303b4ba29b5bccbc70b8b898a053

SHA1
2dfde00de0ea4affaca9241d2b3fa56ba3d524cd

SHA256
02662a99c94ca6494caa16405c02cb9def441d912ebf24099fbb3e1e43840d5f

SHA512
931b1f02ffafa3488da7ba65344b733bdfb80e2103b34a94eec6cb37c24a9a7c17625cd92fbf4cee84469c2d8ea0f342b8c504f9840fa2b544dbe6e76c0fe11a

Download Submit
C:\Windows\SysWOW64\Imfdff32.exe

Filesize
198KB

MD5
daf8771d643769101a702cfaf5b5b418

SHA1
f4505f5a51a7317f58d63b801c5c0d65a323f128

SHA256
a16618191a57897d949043749833e6f5f0f14f745cfa308000b94e457df2391d

SHA512
95838122e92e7064c0ad0344d572220f1118980a02fc9f8a33beb313fcc34d762f118e21c007e34e3f7495acb7836702c0f73bc6ce0f83196f9f762cff333394

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
198KB

MD5
5ced07b2e9abd2d6d3f295d3ebd97db0

SHA1
a84ff7ffa007cb70d17e43aa132dbeb73744845f

SHA256
9abdf536f544b956439febfc7432d1d21b191f20acbf6a7da811f860b3a4199d

SHA512
a32966f3f12db531516838652b1dfe413e8a699ef90449f0298affe2994bb34ff181ebecbe323846e75938941ae669d100e134b4bff0d81a7d20b36e5afb33ba

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
198KB

MD5
9c68094fd091c59ec3025092da80ba1f

SHA1
c2cb29e7fec5d97a161afd75ba5e3ee9e5429546

SHA256
4765134a8f29caf718e7b635b66fdf038023ec61f3f7a4368732236b9b0bc1a0

SHA512
ff1ef88bbfb3685ce710641d1e024fbc225f95971a4d62168ac83fa0b2011bc34fb6f33249af7ebb982b0d6cf0ef29b46d86a3ddb26adc9520ef90f9a52035fd

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
198KB

MD5
8999f1beb97c5d842691c8d8fb071889

SHA1
ed168e8b76327c173f9924f0e4239f85d2136191

SHA256
c7f083c2744866b807aa8147fb5d1726d65516a17539a89b6128a2d50e9bb085

SHA512
08bd21ff7b03c6f976582510fc7752b2787b3fa1dfe771f67acafda36e788060c380f8e1303ef943b6d4b453b075c188b116fb0e542af07e3db7e578674d1b52

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
198KB

MD5
884663cb17ca54bcc6865f32e0b4b0ee

SHA1
b77f4024f7f3fce0ee122346fa3d71452830f8d4

SHA256
31f77130796c36efb6558f2fa5685eccf825298378e13b3fb5938dfd28410533

SHA512
4c7656fde8e6b0c3f71a17abc4aba118f769581a67d262c1d812fa86bbdc28ac5a7c8bf8f6d6b7c7ee482ebe8d43af355e219741e70f8f909d028b60afea2055

Download Submit
C:\Windows\SysWOW64\Jfaedkdp.exe

Filesize
198KB

MD5
6ff40b115b4b085f4afec4fba0af1d17

SHA1
e72f7474f8a268dbe048e5ca533cb8d5c8545f97

SHA256
bbd355d44d9c0e56363383b3b1df8d2460528396b352fbf0adfcd160079ff722

SHA512
1b3630f86555f06fb6d27ba2b5aa900bd990867c00409f90f52913e11d519a347a9671c196ac105b5c04e719c3b3dfef07cd6aeaf0abc5e10e0c9b05e20a0823

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
198KB

MD5
8b531c258259401b34bd6576617d1b18

SHA1
57a5cece4c9a395ca429a38df2e5bceb5c5ab80e

SHA256
6d9e21e49183d0628628cea517a04c5e3d13b050f2bf6afc1b51d25cf67f1d6e

SHA512
3c194b77a3b6a3b7b08d99ad6bc81907738a435dc1ca279cb3d5a1c8416556cc2f99b09e4d0b33d684b56769a216e5784a2d7452dafa053914ee35f432411ad5

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
198KB

MD5
ba021b83467f1601f6c6da83f51b3f0c

SHA1
3d278068eb246baf8ccbbdf1ec0c9e585b86e1b4

SHA256
834533ecc7e4a9a4aa546d2310c230abd796671b3a07cf9ae4668a216757048a

SHA512
abfc0cfb82693b07a1a151021a7282730f7245b92ab3fd87218c03a2513840ab0bdc706a955858576f10962b8b48531289a60516705ee33ea300f464ac0b4bff

Download Submit
C:\Windows\SysWOW64\Jianff32.exe

Filesize
198KB

MD5
a6d666b1c1393e66c8bc392811f28718

SHA1
9668bc43f99173c2fa3e785bd22ce5da7df2159f

SHA256
d9e087c23fc52fd7f865601491e0cb053e1aaa56142b3f645a758879000f411d

SHA512
2473da4bc2f31df47e7472201c3e7937f25a162692d85604b789000fb6371ebc232667f5b322528ba9fd050dc0bc4d5b59bcd6274cf6633eb99c0178e9827da8

Download Submit
C:\Windows\SysWOW64\Jidklf32.exe

Filesize
198KB

MD5
91be3fdf45f9c1ff98b16254aa8c51f0

SHA1
d9384e7276e035a07b4a32105b2ead104dd40cd8

SHA256
29b911fb5f9cc16c4cc43fbd6cf5705f4002db3990f58097f0d5b0142f958eff

SHA512
9aead35310306f4bb17610a115ba1a95da7a905baad7e415f7fa8cb4a1db12050a95c1c70b318628f7b885dfe90a1e7fc02594bde8b5ee349098a5df6f8a24b3

Download Submit
C:\Windows\SysWOW64\Jimekgff.exe

Filesize
198KB

MD5
8a53426161d7ad55f73eaaf76c8ae7a3

SHA1
317552bc65bcfcbfba65f1a938d007922e534afc

SHA256
9435f0825adb10b93d59fdeb01738f384afe09c042460d06a83a0318feb3eb25

SHA512
0cddf887c4b13b10a2273e6d9210075d6548be4def85e4042a8592521352946afdc63d7271528c01c57da5f2016e310fb5330a6b5b99e18f404ace7d23d90928

Download Submit
C:\Windows\SysWOW64\Jioaqfcc.exe

Filesize
198KB

MD5
627f17649cd47d40f01db5d54d75b3b0

SHA1
73d75e6faf6dfaf81264ddff988cbe1be5e572b1

SHA256
79c77ae3608e7dd0d15e610f244ecbbf36c06a2512253517eb0d98b98332d5f8

SHA512
385d9b3634de3ca84257833058de6d98aa9031bfcc22cb7d5dd8abcf3553cfd98e45add936d329eaacae7134843ee4c37b93bc1afa9b80bcaa5a3cd77079073d

Download Submit
C:\Windows\SysWOW64\Jlednamo.exe

Filesize
198KB

MD5
91c282bc1c7e9fa61bfa3da5bdf8a769

SHA1
cee8b04e69a3cce59e567d26f8e1bbd10e1435e9

SHA256
e2dde830c2ef104f38118c251e8d151624f08bc7b130c93fafd4895e375c451b

SHA512
8f82f546fb8435eb707388ba6b02b2c9b662780659b6d6d8e067529b1f88d7dce5f199b0345ef6dc488db9d28d9177bd058521f545907e189d991e8fa5ce3889

Download Submit
C:\Windows\SysWOW64\Jlkagbej.exe

Filesize
198KB

MD5
f60a92f96aafd16e62c1f06b3259dc10

SHA1
45058d03ee138f4f194fccd086a8bba546bac8da

SHA256
02f2cdfe68a8ceadacecbb4563fa801961c3694fa3bfa9733925cfc073e277c2

SHA512
e3b574efaa8f9396e494ae8bbc4584ef74eaa4aa901eb2c577d20b181782c91a4fc7ec7180cd6bce85f8c92b72e2d1fbe14fdcada0ba278050b965f43a2c132b

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
198KB

MD5
be9e283d59737946026ca6909b32952a

SHA1
70c574d26bf8bad8b9ec17cee841da4b4c482994

SHA256
c026c24213aba22d24bf77947468c54785ddf0e246de4bc112dbd51007040ba4

SHA512
0580f995b26599ee6b29bf515f9ca10f6109b750373ea8020652c7d8b4fdb657f0279996564bd93eb6505da065e66f091429d80025c2e37ea244fa57e4a84aea

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
198KB

MD5
7c3c8fbac56ad9573b3771ac3259f565

SHA1
d00a7f66b3ce1ae43b26e5d5a23cda5bf627c20f

SHA256
abefa05da876a69ae6a63fabf395db34f9d6a3d9030ca25a668adcf35d394818

SHA512
ea2f8b6f506f516df29b9e82b1992cca5f50f39ff7e22fe769ad961e7b8b449ade7d5397c999bb1f68c7f8e79ce4fc7593e747dfd3806774bbcea99688a7fddb

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
198KB

MD5
4f42ab543c4054b689cee39576b41096

SHA1
629f58b35424bfee6d00f0e8031a4f626724cd56

SHA256
705367ffe4c296b81d180170ffb151f97d73c88c21f05b49ba6f0ace57d08dbb

SHA512
8d7ae22e375ca385aa56ee2582741e6b52fffcc0b61fb6660486a79899784de17e8cd8c7edc2d7039f9018794689c3af69719eea93b790e049c42885fe982944

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
198KB

MD5
19d9a4ccbbdf460a745f2884fcd3546a

SHA1
8ecfb68808546b4e26479a0a6eab987df12ef6d9

SHA256
93258e56d06afef88b753d581513b8986e2f79f8ef7558e74afe8d27c64e5914

SHA512
9c527458b00280dc7726be985c38653b47de45e10af777b7ecdf69e01aee9f86560c62c11fd68428ef6c04dce2fd0d967a58dc4e6d7317d6299a97ef9b57bb73

Download Submit
C:\Windows\SysWOW64\Kbhoqj32.exe

Filesize
198KB

MD5
2d9077fcb4a022c2f7f20c20c4903ec3

SHA1
57b9f8b10f8b45429eef67c1fd3fa337bcd15c1b

SHA256
53907521f2406047f7d9a94ffd82125f773d3de5b35a19f20ebe0347fa389bb9

SHA512
bf81299640e17d75a99db01de93fd210f9208da2324da8bb5c1d52d86bdfe78cb5522cae8721f5dfa494b8baa31a34526dc4aab45d615aef2f94e22723b1ac7c

Download Submit
C:\Windows\SysWOW64\Kboljk32.exe

Filesize
198KB

MD5
a52e1d4855e50bd9613ecc05d1f66e11

SHA1
dc3d1db5581fc63de642fe6e5f40e51c9db93753

SHA256
39974b076755d0770ad7d0bd419c564057ee1107bab0821bc1cd4c45f95de279

SHA512
5caa2ad6b434a481c299dedaa6b6764f0c673db96c688e5d0e484700a9d895bb0bd567a905401d1bcd5e4db8ee5545803ee88dd50ab9e22416a4f29ebe99f51c

Download Submit
C:\Windows\SysWOW64\Kfankifm.exe

Filesize
198KB

MD5
a37b938ac0b7d79200c04337b0801bdd

SHA1
6afe4d54a6672aa724858acadcb9993198988e3f

SHA256
e0424d553c231d7420672011f6189437dc6a220c4684b3dadfe54786a61ff677

SHA512
9bc1993366dde9054fab77205a4b746c981145b1db9c71478eee01800bc4195f4943e00da03da0ed8ccedc74faa56e0076ed91b2a26da08446aaf21376bcb982

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
198KB

MD5
74995ee6ac03565e7171e996371c1e84

SHA1
ecfa5c8d8cd0305292158d138f1869eef0a3fe8a

SHA256
ac64c5adb2eb5b7357d00882ad935995b0a41b83c04da21ba38628b0c095be4e

SHA512
885b9e51bb942f21c501909056c36738c82ecdb7292ea3c7ecc3ff43c534cadaa338a0023336b0080ae275ffaacf9b5934a0d809ee167c66c82f896c31d9ef1e

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
198KB

MD5
c152dc3764d9537c3c79580d760ba964

SHA1
3b6f12573c88cec5d2a2cd87347baa05457d174c

SHA256
6f1e2d9e42b85bb60431b574a85093197c10d3a5c4375cbd18aa4da01d2c5a1d

SHA512
198758f2cdcfc8fa9f979cf8cefd4109a505a9b9f598bcae71149e9f6ea40fa8a3151279f73bd186ade9d1a3367bdd4b86c107278034ea8ff1c0b7f64c325727

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
198KB

MD5
f96a70fd335a072cf8e75005d6a4026d

SHA1
20f8a91f7159bfcc5d336ea4e4ce64ec6293ad8d

SHA256
84585508ef92cad0d0b567b02f45669c1c8d80695a1609256878cde5dbc59d56

SHA512
99c9c0eeb501683186938ecd2e4f7d12f4869d61c95db810df7e682928f1c07264742ea4be7c8e505962c449ec391b2ad99e8b2416e5932b64f1147fa5513aa2

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
198KB

MD5
0bd2351e30926c8a6667f3bb539e70e3

SHA1
d2d72e10a699f1905a9a4890c8befb5f05ef5448

SHA256
1a9a214bcfecbce878a02d2a671938248ba3cf16024118bfee629cbeb3c4b00b

SHA512
86b363a756468f0166c595d10258dccf742a628c90b02b33c38275f4de3acdda87eca03004392fb70ef73500d891fc7e9785b55aa3091a6665daffbf7b9c77cf

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
198KB

MD5
526694ded6b7261e39e3c5358de08d28

SHA1
2aaff5bf218a28639f7a4030c9edfa1e228190e3

SHA256
07190a9eb3963b44d5031dacc658391b3f38baecf35f784756925be084ee9bd3

SHA512
96119e4b14a9b6900b1012dc8a2bfdad5a16c18b178d1d07af142bfcdf7ac3862174887b192b4e0699d09b08a40fc7428b439ac3deeb62d7c6aa0816376da2c3

Download Submit
C:\Windows\SysWOW64\Kmfmmcbo.exe

Filesize
198KB

MD5
2b6b003a69145bdfc94e3d423bef624f

SHA1
e8372590823afaac46c49b92f98e041ef066a4cb

SHA256
bf9f4a37775a407f94842bfa3f8209ea9f100794e480d00291608e15330f8f31

SHA512
459a28f3b2b3888439ef55fde418d23f3594a600de8f80d9aabbd2e822481a2b5a5f5e65bf9dfd0af484d715062e9d318d90b3e6fa9bda57a780ffddad20001a

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
198KB

MD5
065d269e2dffad34ac642158753daace

SHA1
5b05822e8863344b9086e90964c80cdb470e1d08

SHA256
d0e339d0bb67199a14f40057baf29848314f7a1a28b5cc0ecee362e3b699340c

SHA512
6e9cae539ddac8995ec76d37ab8222730445c2aedc7b3c723946bbf25a088704aad38d63a64f610db0043aa9eef1c9e98ccade4889fb17f14098d1eb90cd207e

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
198KB

MD5
1c35cb9cadd6294868cf0c0b96e58c8d

SHA1
c51f2cd4018f3d69e13ddf6425c016fc49f4372b

SHA256
5cc83bfbfd162f7fb9b13cc9c2145761a64437fa477665297bdbd6a5f5c3d68f

SHA512
513e8243332620e53940a513ca7bae1cf171af98a87358684e1e9594bba912bf6a08af766490b59fbf6b01d2423fd14b52c2bd67bdebaa77e709f673568c6ca4

Download Submit
C:\Windows\SysWOW64\Kpeiioac.exe

Filesize
198KB

MD5
ae2e8dda247938a2157a10d5db0c8ce8

SHA1
6dc7123bc24e02a6cc2efbf65d121943d186f72c

SHA256
2cdaca01bc6ca3cacc27e7f5ff8874769a3de1b33a5ca24b1b081c3d7c123589

SHA512
7182488f9707fad0bea8db833af365ebe0a316cb2ef460bbd2711e4c89295d259c4ca65f14886cb5baaf3a6bacda164887d7b856b11d3579671b1933650e4368

Download Submit
C:\Windows\SysWOW64\Kpjcdn32.exe

Filesize
198KB

MD5
6d9b9e30dd31faba17d897da05142d26

SHA1
05de5be93a85bd554b985c9607053b7942df9e33

SHA256
c30a39654612afee5a6587630c569dcf9d8324ecc1f021e78a6b9e6f86464e31

SHA512
e6a59ff4f29897a118a4aa2bb69964e74ea2030e1b2ee77500e942789f086867a9805aff699a9618a54f5991369e9b8e0b26d9e04089b00557c692f086eb36a3

Download Submit
C:\Windows\SysWOW64\Kplpjn32.exe

Filesize
198KB

MD5
12407a8bc20172f36c6ff38d73101af3

SHA1
c082654bbdefef16b0bf98d1c833385b7a1c8110

SHA256
cdd00bf2831e2ca2464fecbb8a88e85e23aa36dd591e4d325f856d46ca85e7a0

SHA512
c4b75e0ad1d2448003bd759db3240be7c725edf675f40577d79ef0eee5ce13eef21f20b9359efcc263ad53f8513e3e26c92cbc479769ca2265b6fbe69f553610

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
198KB

MD5
0230031dd43b3731469fca95160048c6

SHA1
353c871091015e815636400ff8532718b90ff307

SHA256
6b3c48a7f9ca21e5e1d74ef2cab8d54eaa9f6848709236027a74e1d3c011ef40

SHA512
4009dcc6cd28fa47e71e7bad2d5048a358c2e39bb096132ce571ef4a6ce793c875a6b82ed03c78b1b5441ad9f77e4b89b08b42cdb020245b9aaa2d48cbdc109b

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
198KB

MD5
c4be64c3f11c3ac381d23fc12a14a6e0

SHA1
66126455cdad7de3c73619e55209e6eebfb1e511

SHA256
e8ca898312c2963748988050ffbe883a2129815d4f93a2d81c93a313cdc8341c

SHA512
10c9835199467027950dfa255778ee5fb588c57feb1cb7b3411b268be84e3982d1acd59441b8158b7accc2030d09b3c6af0f89759723c102de52ab6ccdb97c97

Download Submit
C:\Windows\SysWOW64\Nnneknob.exe

Filesize
198KB

MD5
780ca4905c9ef68868517fa6cfb1c143

SHA1
5b4a63e9969881d7030c62fc9e9a3b2335418306

SHA256
98a1ff545ad925c048c455d9f3d49a58c249d5ebd35ef64a10ca7785f3fc9a91

SHA512
ea76d86c8eef8d6cd0c14a4820cd76e550d056adf62e1ef7774dfbb9cdb02fcf86ad4b4ada21c72440b969e8b61f3cf65c28d884e50e6c7eecfc039d30f80d63

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
198KB

MD5
46e7ade397ecafa22cbdf8c01b967d5f

SHA1
b4c93e72d45c466dd0056bad5b9d41a20745b9ef

SHA256
e7289929b848202ac4295e020a72215d4c71d18677574fc4dc9d6186b4814600

SHA512
eb662410d6b30f4ea01309e6a372d76e52c90269ba7b2280afdb0c4487a6a6dcdfbe77e80815c9ffc6055cfeb9620d0be0a7a0ba639b0290a14bd03f2aedec79

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
198KB

MD5
f0c7b32c3e6cd1db801c32cf546c6af5

SHA1
e5e0b1e87488b45e82b2efe20ff1de0b8b033caf

SHA256
c0be57b6a54408d03ca20747331e1bf04562e3da76ec4b989e39173a0eff2cba

SHA512
7fd9d46e2a12ddd4699ad078f3882f33f52d687ef99c18469fde7215cfe53b7c4ffbeb56c6e95bd00e224ba6fe4522accaa58f9f22d34ee8ff77aabb070b539f

Download Submit
memory/512-342-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/516-358-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/556-114-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/668-334-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/812-94-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/864-322-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/976-400-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1004-168-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1108-314-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1128-200-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1252-436-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1332-320-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1412-124-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1468-370-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1596-32-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1604-248-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1608-256-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1624-412-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1664-83-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1840-223-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2052-71-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2164-239-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2188-274-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2192-118-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2232-52-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2280-304-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2360-160-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2372-418-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2460-45-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2500-368-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2592-151-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3052-352-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3152-67-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3188-425-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3220-394-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3284-388-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3352-144-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3396-140-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3536-292-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3548-406-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3596-127-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3732-346-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3780-175-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3840-430-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3864-283-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3932-262-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3956-328-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3980-298-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3988-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4024-215-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4068-126-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4108-273-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4320-442-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4368-208-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4404-24-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4516-380-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4572-188-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4608-286-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4760-192-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4856-109-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4880-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4916-382-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4972-231-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5044-12-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads