b489230d2e5867f2267d0d22fa0f673c25c5cb3743c2b529c2ef46225d29ab0e

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b489230d2e5867f2267d0d22fa0f673c25c5cb3743c2b529c2ef46225d29ab0e.exe
Size

67KB
MD5

c5cda89d7f8731c91491b2c011e47626
SHA1

f3dc0ae7c737473f4cee397ea1270925bd77ea1b
SHA256

b489230d2e5867f2267d0d22fa0f673c25c5cb3743c2b529c2ef46225d29ab0e
SHA512

1f7fa0d32f1ddde5482c7a47108a95bfb340c2e22e3ba204b296a5dbbcfdcf5a10a1e4e25ec7a9e50c693f2e662dfc0976339083cc5ec672b405532424b8737b
SSDEEP

1536:rwj2J9Yvp7srLVcxQuXc1JYocUvoDvC+Ijj9RQFR/Rj:0a4v8UcfnvoD1I1eFVx

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgihop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fbaahf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifomll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hhaggp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihdldn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qfmfefni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Khbiello.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lindkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bdlfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnfaohbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmhpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fpdcag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jepjhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmjmekgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmimai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqkqhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aopemh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieagmcmq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Digehphc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aplaoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhfaddk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpdcag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibhkfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmfdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fqppci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dalofi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekimjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebimgcfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmmqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aajhndkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jafdcbge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bphqji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdaile32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	b489230d2e5867f2267d0d22fa0f673c25c5cb3743c2b529c2ef46225d29ab0e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hifmmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jojdlfeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lindkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpmcmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fechomko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nckkfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffcpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifomll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Adepji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eqkondfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgnjqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfmolc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpedeiff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfoann32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mohidbkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnalmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oaplqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfoann32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbenoi32.exe

Executes dropped EXE 64 IoCs

pid	Process
3908	Bffcpg32.exe
1196	Cdlqqcnl.exe
2420	Cndeii32.exe
416	Cnfaohbj.exe
4428	Ckjbhmad.exe
4640	Cohkokgj.exe
3872	Dnmhpg32.exe
3884	Digehphc.exe
1336	Dfnbgc32.exe
464	Ebdcld32.exe
4144	Eeelnp32.exe
4776	Ebimgcfi.exe
1248	Eblimcdf.exe
1108	Enbjad32.exe
4024	Fneggdhg.exe
4352	Fpdcag32.exe
2776	Fechomko.exe
984	Fefedmil.exe
404	Gehbjm32.exe
2480	Gfhndpol.exe
892	Gncchb32.exe
4236	Gmdcfidg.exe
2028	Geohklaa.exe
1824	Gmimai32.exe
4064	Hfaajnfb.exe
4032	Hbjoeojc.exe
2388	Hekgfj32.exe
3656	Hemdlj32.exe
4128	Hpchib32.exe
2952	Ifomll32.exe
4012	Ibhkfm32.exe
3692	Impliekg.exe
1716	Jleijb32.exe
4120	Jiiicf32.exe
3700	Jepjhg32.exe
2944	Jllokajf.exe
560	Komhll32.exe
3548	Klahfp32.exe
3580	Kgiiiidd.exe
1204	Klfaapbl.exe
1384	Kjlopc32.exe
3516	Lpfgmnfp.exe
1868	Lqkqhm32.exe
2124	Lqmmmmph.exe
1504	Lmdnbn32.exe
2428	Mqafhl32.exe
4948	Mmmqhl32.exe
4404	Mnmmboed.exe
1304	Nqmfdj32.exe
3204	Nggnadib.exe
4800	Ncnofeof.exe
4184	Nqbpojnp.exe
3256	Nmipdk32.exe
4284	Ngndaccj.exe
3744	Omnjojpo.exe
2980	Onocomdo.exe
2400	Oaplqh32.exe
1896	Omgmeigd.exe
2408	Pfoann32.exe
2364	Pmiikh32.exe
5088	Phajna32.exe
3688	Pdhkcb32.exe
3348	Pmpolgoi.exe
4240	Qjfmkk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bfmolc32.exe	Bdlfjh32.exe
File opened for modification	C:\Windows\SysWOW64\Lohqnd32.exe	Kcapicdj.exe
File opened for modification	C:\Windows\SysWOW64\Ofegni32.exe	Ojnfihmo.exe
File created	C:\Windows\SysWOW64\Ibhkfm32.exe	Ifomll32.exe
File opened for modification	C:\Windows\SysWOW64\Nqbpojnp.exe	Ncnofeof.exe
File created	C:\Windows\SysWOW64\Dkndie32.exe	Cklhcfle.exe
File opened for modification	C:\Windows\SysWOW64\Ckjbhmad.exe	Cnfaohbj.exe
File created	C:\Windows\SysWOW64\Iahgad32.exe	Ieagmcmq.exe
File created	C:\Windows\SysWOW64\Amhmnagf.dll	Jhnojl32.exe
File opened for modification	C:\Windows\SysWOW64\Kamjda32.exe	Khbiello.exe
File opened for modification	C:\Windows\SysWOW64\Dkndie32.exe	Cklhcfle.exe
File created	C:\Windows\SysWOW64\Fnalmh32.exe	Fclhpo32.exe
File created	C:\Windows\SysWOW64\Figmglee.dll	Omnjojpo.exe
File created	C:\Windows\SysWOW64\Bkgeainn.exe	Aopemh32.exe
File created	C:\Windows\SysWOW64\Fldeljei.dll	Mfpell32.exe
File opened for modification	C:\Windows\SysWOW64\Ofgdcipq.exe	Ofegni32.exe
File created	C:\Windows\SysWOW64\Ifomll32.exe	Hpchib32.exe
File opened for modification	C:\Windows\SysWOW64\Mfenglqf.exe	Mohidbkl.exe
File created	C:\Windows\SysWOW64\Ecfjqmbc.dll	Mfenglqf.exe
File created	C:\Windows\SysWOW64\Fjhmbihg.exe	Fdkdibjp.exe
File created	C:\Windows\SysWOW64\Aajhndkb.exe	Qjfmkk32.exe
File opened for modification	C:\Windows\SysWOW64\Ebifmm32.exe	Eohmkb32.exe
File created	C:\Windows\SysWOW64\Ieagmcmq.exe	Ilibdmgp.exe
File opened for modification	C:\Windows\SysWOW64\Ieagmcmq.exe	Ilibdmgp.exe
File created	C:\Windows\SysWOW64\Mdcajc32.dll	Mohidbkl.exe
File created	C:\Windows\SysWOW64\Jcggmk32.dll	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Kgiiiidd.exe	Klahfp32.exe
File created	C:\Windows\SysWOW64\Bmijpchc.dll	Qjfmkk32.exe
File opened for modification	C:\Windows\SysWOW64\Cnfaohbj.exe	Cndeii32.exe
File opened for modification	C:\Windows\SysWOW64\Ebimgcfi.exe	Eeelnp32.exe
File created	C:\Windows\SysWOW64\Lngqkhda.dll	Pdhkcb32.exe
File created	C:\Windows\SysWOW64\Odaodc32.dll	Ggkqgaol.exe
File opened for modification	C:\Windows\SysWOW64\Hbenoi32.exe	Giljfddl.exe
File created	C:\Windows\SysWOW64\Ebggoi32.dll	Bdagpnbk.exe
File opened for modification	C:\Windows\SysWOW64\Jhnojl32.exe	Ihdldn32.exe
File created	C:\Windows\SysWOW64\Klhhpb32.dll	Ofgdcipq.exe
File opened for modification	C:\Windows\SysWOW64\Gfhndpol.exe	Gehbjm32.exe
File opened for modification	C:\Windows\SysWOW64\Kgiiiidd.exe	Klahfp32.exe
File created	C:\Windows\SysWOW64\Dhhmleng.dll	Oaplqh32.exe
File opened for modification	C:\Windows\SysWOW64\Fbgbnkfm.exe	Fqgedh32.exe
File opened for modification	C:\Windows\SysWOW64\Pjcikejg.exe	Pakdbp32.exe
File opened for modification	C:\Windows\SysWOW64\Bfmolc32.exe	Bdlfjh32.exe
File opened for modification	C:\Windows\SysWOW64\Dggkipii.exe	Dpmcmf32.exe
File created	C:\Windows\SysWOW64\Olqjha32.dll	Afappe32.exe
File created	C:\Windows\SysWOW64\Kbblcj32.dll	Ebimgcfi.exe
File created	C:\Windows\SysWOW64\Hfaajnfb.exe	Gmimai32.exe
File opened for modification	C:\Windows\SysWOW64\Jleijb32.exe	Impliekg.exe
File created	C:\Windows\SysWOW64\Klahfp32.exe	Komhll32.exe
File created	C:\Windows\SysWOW64\Pfoann32.exe	Omgmeigd.exe
File created	C:\Windows\SysWOW64\Mjhjimfo.dll	Dnonkq32.exe
File created	C:\Windows\SysWOW64\Modpib32.exe	Lcmodajm.exe
File created	C:\Windows\SysWOW64\Mohidbkl.exe	Mfpell32.exe
File opened for modification	C:\Windows\SysWOW64\Kjlopc32.exe	Klfaapbl.exe
File created	C:\Windows\SysWOW64\Niojoeel.exe	Nodiqp32.exe
File created	C:\Windows\SysWOW64\Gejimf32.dll	Ofegni32.exe
File created	C:\Windows\SysWOW64\Kojkgebl.dll	Ejojljqa.exe
File created	C:\Windows\SysWOW64\Cnidqf32.dll	Fdkdibjp.exe
File created	C:\Windows\SysWOW64\Fechomko.exe	Fpdcag32.exe
File created	C:\Windows\SysWOW64\Inclga32.dll	Hhaggp32.exe
File created	C:\Windows\SysWOW64\Bkfmmb32.dll	Nfgklkoc.exe
File opened for modification	C:\Windows\SysWOW64\Adepji32.exe	Afappe32.exe
File created	C:\Windows\SysWOW64\Edoencdm.exe	Ejjaqk32.exe
File created	C:\Windows\SysWOW64\Fgnjqm32.exe	Fbaahf32.exe
File created	C:\Windows\SysWOW64\Nmipdk32.exe	Nqbpojnp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6988	6884	WerFault.exe	277

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfqhkbn.dll"	Cmpjoloh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dggkipii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbpcnkaj.dll"	Gfhndpol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekfjcc32.dll"	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlllhigk.dll"	Lmdnbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figfoijn.dll"	Mmmqhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gfhndpol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ihdldn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deaiemli.dll"	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajiqfi32.dll"	Giljfddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anbgamkp.dll"	Bagmdllg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ejojljqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fbaahf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bffcpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lippqp32.dll"	Fechomko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gehbjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Doojec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Enbjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhhmleng.dll"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aonhghjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ggkqgaol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bphqji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkopekaa.dll"	Eeelnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjcbmgnb.dll"	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkcghg32.dll"	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cndeii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eeelnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokgcbe.dll"	Onocomdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aeodmbol.dll"	Pakdbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obhehh32.dll"	Qfmfefni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lmdnbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hhaggp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Falmlm32.dll"	Ihdldn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cohkokgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhjhdagb.dll"	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hekgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eihcbonm.dll"	Pfoann32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebggoi32.dll"	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcfidb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hekgfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deocpk32.dll"	Ilfennic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eclbio32.dll"	Enopghee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbdjofbi.dll"	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcmhel32.dll"	Ibgdlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hobbfhjl.dll"	Lcmodajm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ojnfihmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fqppci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnnkgo32.dll"	Klahfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpfgmnfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpmcmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjhjimfo.dll"	Dnonkq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3908	4444	b489230d2e5867f2267d0d22fa0f673c25c5cb3743c2b529c2ef46225d29ab0e.exe	91
PID 4444 wrote to memory of 3908	4444	b489230d2e5867f2267d0d22fa0f673c25c5cb3743c2b529c2ef46225d29ab0e.exe	91
PID 4444 wrote to memory of 3908	4444	b489230d2e5867f2267d0d22fa0f673c25c5cb3743c2b529c2ef46225d29ab0e.exe	91
PID 3908 wrote to memory of 1196	3908	Bffcpg32.exe	92
PID 3908 wrote to memory of 1196	3908	Bffcpg32.exe	92
PID 3908 wrote to memory of 1196	3908	Bffcpg32.exe	92
PID 1196 wrote to memory of 2420	1196	Cdlqqcnl.exe	93
PID 1196 wrote to memory of 2420	1196	Cdlqqcnl.exe	93
PID 1196 wrote to memory of 2420	1196	Cdlqqcnl.exe	93
PID 2420 wrote to memory of 416	2420	Cndeii32.exe	94
PID 2420 wrote to memory of 416	2420	Cndeii32.exe	94
PID 2420 wrote to memory of 416	2420	Cndeii32.exe	94
PID 416 wrote to memory of 4428	416	Cnfaohbj.exe	95
PID 416 wrote to memory of 4428	416	Cnfaohbj.exe	95
PID 416 wrote to memory of 4428	416	Cnfaohbj.exe	95
PID 4428 wrote to memory of 4640	4428	Ckjbhmad.exe	96
PID 4428 wrote to memory of 4640	4428	Ckjbhmad.exe	96
PID 4428 wrote to memory of 4640	4428	Ckjbhmad.exe	96
PID 4640 wrote to memory of 3872	4640	Cohkokgj.exe	97
PID 4640 wrote to memory of 3872	4640	Cohkokgj.exe	97
PID 4640 wrote to memory of 3872	4640	Cohkokgj.exe	97
PID 3872 wrote to memory of 3884	3872	Dnmhpg32.exe	98
PID 3872 wrote to memory of 3884	3872	Dnmhpg32.exe	98
PID 3872 wrote to memory of 3884	3872	Dnmhpg32.exe	98
PID 3884 wrote to memory of 1336	3884	Digehphc.exe	99
PID 3884 wrote to memory of 1336	3884	Digehphc.exe	99
PID 3884 wrote to memory of 1336	3884	Digehphc.exe	99
PID 1336 wrote to memory of 464	1336	Dfnbgc32.exe	100
PID 1336 wrote to memory of 464	1336	Dfnbgc32.exe	100
PID 1336 wrote to memory of 464	1336	Dfnbgc32.exe	100
PID 464 wrote to memory of 4144	464	Ebdcld32.exe	101
PID 464 wrote to memory of 4144	464	Ebdcld32.exe	101
PID 464 wrote to memory of 4144	464	Ebdcld32.exe	101
PID 4144 wrote to memory of 4776	4144	Eeelnp32.exe	102
PID 4144 wrote to memory of 4776	4144	Eeelnp32.exe	102
PID 4144 wrote to memory of 4776	4144	Eeelnp32.exe	102
PID 4776 wrote to memory of 1248	4776	Ebimgcfi.exe	103
PID 4776 wrote to memory of 1248	4776	Ebimgcfi.exe	103
PID 4776 wrote to memory of 1248	4776	Ebimgcfi.exe	103
PID 1248 wrote to memory of 1108	1248	Eblimcdf.exe	104
PID 1248 wrote to memory of 1108	1248	Eblimcdf.exe	104
PID 1248 wrote to memory of 1108	1248	Eblimcdf.exe	104
PID 1108 wrote to memory of 4024	1108	Enbjad32.exe	105
PID 1108 wrote to memory of 4024	1108	Enbjad32.exe	105
PID 1108 wrote to memory of 4024	1108	Enbjad32.exe	105
PID 4024 wrote to memory of 4352	4024	Fneggdhg.exe	106
PID 4024 wrote to memory of 4352	4024	Fneggdhg.exe	106
PID 4024 wrote to memory of 4352	4024	Fneggdhg.exe	106
PID 4352 wrote to memory of 2776	4352	Fpdcag32.exe	107
PID 4352 wrote to memory of 2776	4352	Fpdcag32.exe	107
PID 4352 wrote to memory of 2776	4352	Fpdcag32.exe	107
PID 2776 wrote to memory of 984	2776	Fechomko.exe	108
PID 2776 wrote to memory of 984	2776	Fechomko.exe	108
PID 2776 wrote to memory of 984	2776	Fechomko.exe	108
PID 984 wrote to memory of 404	984	Fefedmil.exe	109
PID 984 wrote to memory of 404	984	Fefedmil.exe	109
PID 984 wrote to memory of 404	984	Fefedmil.exe	109
PID 404 wrote to memory of 2480	404	Gehbjm32.exe	110
PID 404 wrote to memory of 2480	404	Gehbjm32.exe	110
PID 404 wrote to memory of 2480	404	Gehbjm32.exe	110
PID 2480 wrote to memory of 892	2480	Gfhndpol.exe	111
PID 2480 wrote to memory of 892	2480	Gfhndpol.exe	111
PID 2480 wrote to memory of 892	2480	Gfhndpol.exe	111
PID 892 wrote to memory of 4236	892	Gncchb32.exe	112

C:\Users\Admin\AppData\Local\Temp\b489230d2e5867f2267d0d22fa0f673c25c5cb3743c2b529c2ef46225d29ab0e.exe
"C:\Users\Admin\AppData\Local\Temp\b489230d2e5867f2267d0d22fa0f673c25c5cb3743c2b529c2ef46225d29ab0e.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\Bffcpg32.exe
  C:\Windows\system32\Bffcpg32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\Cdlqqcnl.exe
    C:\Windows\system32\Cdlqqcnl.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\SysWOW64\Cndeii32.exe
      C:\Windows\system32\Cndeii32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:416
      - C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:984
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        23⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        24⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1824
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        26⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4032
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2388
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        29⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4128
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2952
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4012
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3692
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        34⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        35⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:560
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3548
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        40⤵
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1204
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        42⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3516
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1868
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        45⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1504
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        47⤵
        Executes dropped EXE
        
        PID:2428
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        49⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1304
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        51⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4184
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        54⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        55⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3744
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2980
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2400
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1896
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2408
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2364
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        62⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        64⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4240
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3900
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        67⤵
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:908
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        69⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        70⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2972
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        73⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        74⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        75⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1536
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        77⤵
        Drops file in System32 directory
        
        PID:748
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        78⤵
        Modifies registry class
        
        PID:4196
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2560
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        80⤵
        Modifies registry class
        
        PID:852
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        81⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        82⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        83⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        84⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        86⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        87⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        89⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        90⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        91⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        93⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        94⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        95⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        96⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        97⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        98⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5936
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        102⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        103⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5148
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        105⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        106⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        108⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        109⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        115⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        116⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        117⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        118⤵
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        119⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        121⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        122⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        123⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        124⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        125⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        128⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        129⤵
        Drops file in System32 directory
        
        PID:5668
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5724
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5900
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        133⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        136⤵
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        137⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        139⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        140⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        141⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        143⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        144⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6388
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6484
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6680
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        152⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        153⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        154⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        155⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        156⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7068
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        159⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        160⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Dpmcmf32.exe
        
        C:\Windows\system32\Dpmcmf32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        162⤵
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        165⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        167⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Ekimjn32.exe
        
        C:\Windows\system32\Ekimjn32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6776
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        169⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        170⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        171⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        173⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        174⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6440
        
        C:\Windows\SysWOW64\Fnalmh32.exe
        
        C:\Windows\system32\Fnalmh32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Fdkdibjp.exe
        
        C:\Windows\system32\Fdkdibjp.exe
        177⤵
        Drops file in System32 directory
        
        PID:6712
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        178⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        179⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6424
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        182⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6804
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        184⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 412
        185⤵
        Program crash
        
        PID:6988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6884 -ip 6884
1⤵
PID:6552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:7648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afhfaddk.exe

Filesize
67KB

MD5
d3792048bc96fd81eb34730465b5b176

SHA1
ac1843cdb1c3390fd06b0033264a3aa04e071f30

SHA256
44c2aab3d537c8e522b0ed0a4c4e652b74df92aaf02f3e7daca3401f2f000857

SHA512
84767e099d31ce69543f962ed6ee96335021296ebaa967a861708ba91142644eaae568d3ebc408fc4bc298f87d57b4808d7bb5c5b726049158d1f92c9f884ddb

Download Submit
C:\Windows\SysWOW64\Bffcpg32.exe

Filesize
67KB

MD5
39c0c8222c14ea8b29c2929f106fcb1c

SHA1
a831762cefa824e803642a79385bfc20a2441ae7

SHA256
908a2080157a8fb681b1beb574c9e578ccb938847f9dff5aa932fd9522a8b66f

SHA512
ba2c59d2924e62b45b7777e329cfa561b91aa4f4bb3e2a9d74235880e6f6ef87f0839a089dfd69ae91c0759eb5ba736291fcb7b23af26f9e2b9bd1679e654785

Download Submit
C:\Windows\SysWOW64\Cdlqqcnl.exe

Filesize
67KB

MD5
d6c526e2912e5e87d41af1fd54470491

SHA1
bfc3d343cc273e60e243802d96b15e5d87fd9d3c

SHA256
4445007f85bd8b63473784d0989fec1738b4e518869362caf1c84a8144672f4e

SHA512
bf89ca835e13a4d49475da57f90025102f5b4b6feacc3956ce27f8e13443ecf6e89d0d65d4bc5fa2807f0dacbbe9c2d82bfeacd1ee30395c2cd96e4f83c2854d

Download Submit
C:\Windows\SysWOW64\Ckjbhmad.exe

Filesize
67KB

MD5
150e73b059be35a7c56377884c29b15b

SHA1
d357db21e1ca5a8d7dddea3c095fb2e78f2db5e4

SHA256
2c083e2bb143f91b3e86325fb75c84c8a78a9f587c5e6e8950b07e60a1b334c0

SHA512
611ee69306d7345740d4dd1355326b6cf242da25c48fa38d8f87981a8ffea54b71c413362c9529611605e002b351fe88ef9e7fe35c80d5a543f1e9a4b6b2361a

Download Submit
C:\Windows\SysWOW64\Cndeii32.exe

Filesize
67KB

MD5
1723b0a38de744c8494160241c1142e2

SHA1
4bd3b721336335dc0577a588f2bd999898b796f6

SHA256
b0fdcc4d3386eead9c05d1676798671d96db192be7efd64fa14eaf3e3d4b757b

SHA512
696b3327cbfee28f74ee3a4b42b5e404aef5034e76ecc9f93a16934dfa394c2c04df51b723f79ea1b3e1c3a3281b62be6ee13560e866ddc8c90149a9407cbb61

Download Submit
C:\Windows\SysWOW64\Cnfaohbj.exe

Filesize
67KB

MD5
70a6fe8d6b00209ca03873d76c75be8f

SHA1
b55253e263c647b9f3fe3a8152733a62fddaa449

SHA256
01421643eeb1aed9268045c0fb9ed6603323ef0fe320514fa76f1ce275eff839

SHA512
ac39a0ec88beaae878170df518ffc28bd2ebf2c6b1d73cf853d188dd57906f85ab3c12673fb7ad6e701491876624032e39200f6b621fe5a82532fd55329c0132

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
67KB

MD5
4e2463141a6ea5140ed740aa92c766b8

SHA1
d08327004ba4a575ec34f36d9b86a7863d8b9e80

SHA256
eb939c7705e9442de7e777296812c92b4f465f73ba24a73f518c1598c5ba0883

SHA512
813dd6b44ffc52449873d04b37bcbf90d2089b1b89c5b7a2a817ac548f89416b4b0fd5400a865979fe4831a2925e3d05892908850ecc37c4bd9dbcf9e9e7cc78

Download Submit
C:\Windows\SysWOW64\Cpacqg32.exe

Filesize
67KB

MD5
09f8349e2c0efb55378e473b53b29648

SHA1
f4d5f58a83cff214a80ec14f400669e0758648be

SHA256
60b77749aaab424f0cca41d8f688fa521f4203897c2b7d3b6b3bf2004101929b

SHA512
8a03a699fa5e989436789d1cc7f14b09178247278f2f0fc7ece431460ee9d5fa04902629b0726feaee039d811a2bc12fb9e327691460c76b41bdae84ed02a666

Download Submit
C:\Windows\SysWOW64\Dfnbgc32.exe

Filesize
67KB

MD5
217f38b1c859961bf0de99dffd3cb025

SHA1
96f2e60bf253f460ebbef4c064f16dfe4a9ca419

SHA256
a063f55ab25332c447d368ec422e24d0505a221756d74feb4e5eb25c88c83a89

SHA512
4d5e750846611567e9e3f657ca99797a405c21ac8b0cf3d6001f58b9b0ab473a0f90922aea1ab4a3bd7ad0b17be716bd436be9dfd26d1c3a75fd430d72194548

Download Submit
C:\Windows\SysWOW64\Digehphc.exe

Filesize
67KB

MD5
bfa245e2dbef064488e5d4a409335ef4

SHA1
c7d5875cf34ccc86226bfcec7d4541e0ab1ff85c

SHA256
71d198384b6ecb56ae9964a50407a2f5e09ebf65f7634d11df96996604b1bb17

SHA512
98b4485eb17eadf86fe56d658c6235e101d3f2eaddbc3f13eb1b48d54863e18c4fd55ce47bfc3e248f8a5a295e04bb6de6da51f7c6c752dd3416c15e8d9bf871

Download Submit
C:\Windows\SysWOW64\Dnmhpg32.exe

Filesize
67KB

MD5
97c4e8cef9bcdda96ea8eef36bb7ab97

SHA1
419dbc8106a7aca338c3dd89cc23cbb10b882dd4

SHA256
576e14b5a710b0c146fe3ee21dfc51746ad28f97e0a0a76456254786b1049f19

SHA512
ba60c75aed39a62142a8dfdc48040da6860bf32937136de05cae0f6429d16f042a21fac8299369ffb9724932060178c3e06d889f5b10719c214217ec254ca040

Download Submit
C:\Windows\SysWOW64\Doojec32.exe

Filesize
67KB

MD5
60c036b68afae356e6dc180a4e561e02

SHA1
f3651c6146c29388b300f0eca2b9f1467635983e

SHA256
9ed6918d864097785b9270e3b30dfa41858a0e2704f8004227f7731797680cc6

SHA512
659d5cc8ecc69f6fdf97e70c92e39649fd7d664249cdf74f6ac25e7d0a913d836efe89daa9861ff52985efc67e11cb3d29714e1873f072f9a8296d9e517384a5

Download Submit
C:\Windows\SysWOW64\Ebdcld32.exe

Filesize
67KB

MD5
e4c20d34ea810ce7cc562c63e07c2477

SHA1
d3fba900a9f33731371fc38bbadbeb94984915a9

SHA256
5f0fc4f7a78561c74e903c6d7516cb520b85a6f14153580fb964c985dd5bcb99

SHA512
c4fcc79b9f41004f3c9a0386f15e8d241ddcdbfb1c7bd0fa2469e41279215eaf127245633304566207b817e29bbcaa3ec1740929ae27d7859093c3fa4612d82f

Download Submit
C:\Windows\SysWOW64\Ebimgcfi.exe

Filesize
67KB

MD5
0b613b20b1031b078af265916d7d2765

SHA1
e6ea5885d0f09b759537a6bab52dc3c363ad4df9

SHA256
9c4dc7a2fda9662f10cbb451f6cadd6361176027eb80f79c8f9362955d0c2629

SHA512
83e16abdc337edc211cb959130de09cd697a40be77e5372a1731c49c54742f0eb22573b9a401b68b3e8f7ab6e1ca06c509a1a6fea15614d334303ba4e9eafb45

Download Submit
C:\Windows\SysWOW64\Eblimcdf.exe

Filesize
67KB

MD5
3db186e24056c8e28651c95f180c7428

SHA1
9b9b4cb881d374f8610a70c7a45a172fda046bee

SHA256
582ca55cdf8d64a1eb30a521fc6b0e35bcba097f86bbf6d05e37555abe854f68

SHA512
62ff34a787cb41bc324a0fc7219ae3ada3635ef5ff88c130a4a87beba54f6252216dbb92202193e1cef64aa9c6864c6693f53f4a506935c5c97a960f84688610

Download Submit
C:\Windows\SysWOW64\Eeelnp32.exe

Filesize
67KB

MD5
c18c86cdea4eb1554aeea49bcd9dc1ce

SHA1
5e0c9ef00d8e877f54dc7202d73ab64ec2e913c4

SHA256
302ca78e1c6801c491929deaef2edcbec011d1714fbd02a14209a7fd1904d0d7

SHA512
0c36b73d79d02faa33ff271f624594796aa7e8f986744a3b687ccaf940db3220c49c8dd27994b6a84d3a1bb82cc341f432708555fadc5645da39a29a5db40947

Download Submit
C:\Windows\SysWOW64\Enbjad32.exe

Filesize
67KB

MD5
e22932322bc8a785d18dff472462c88b

SHA1
f3d676ffbab56bc1ae5d6428ce4f1cbac01ebadf

SHA256
085e0ac76ad36b381e0f0ca264c2e211c10854dbaf1d38aa5c2830a12a19ca31

SHA512
c980d2d1062a55f5b0f585ddd29ecb1bbb3b7c61a050ecdd9c04168d6e8ee454339d3c8ed30913d89c838fe279c49b8c03899a8bb5545ff53f391339530ce67a

Download Submit
C:\Windows\SysWOW64\Fechomko.exe

Filesize
67KB

MD5
e9c360b123f92bd584e179c63fd9b0cf

SHA1
d03793419198e524cd4d82de1513732bdda8cd26

SHA256
4cf2aa337dca813284a076b0fa27814458b884e30885e376eab99f7eec5f9009

SHA512
84ea4d3d07c8934b9074175f89bee8d9a74d43cd0d08a47b63b59e45e7dd375179d33ef64a4b67318cd0f5a7d132fc70430da121b923e60550ea8863745a5c3c

Download Submit
C:\Windows\SysWOW64\Fefedmil.exe

Filesize
67KB

MD5
3d495a1f45c9078a2e5a54e62e22069c

SHA1
6c5f2f6830a9243759cdd4a47aef076c605ccbe9

SHA256
f30c71cfab42c1037ccdd90b4d4ec8edbc5a424208fb720c68c9dd0b33bcaad8

SHA512
871f80d83d39da8fb40418ba3a726d60e7527fb2deb7c02212c4f887f980a414ff1055c8c52f474891ea12bce2f7d470df63b76d810e3ae4e01e8054707d5a4e

Download Submit
C:\Windows\SysWOW64\Fneggdhg.exe

Filesize
67KB

MD5
0e31ab2f035a7645e97f0ffda8eb99ed

SHA1
df1e4cbb5503efe5cddfa78bf1130ecb56787f5a

SHA256
592e6fd1c09253042c1f8790d9dc1228120949b55ae1f38741650ef700fb549e

SHA512
8728f74b8c8a5ecba0e63eb535b747263f49fbe5621ba3ee963810e39a7927e80af0ad43700fe368231a16490cd446dc44751d2ea72fc257a9c307120cfe783e

Download Submit
C:\Windows\SysWOW64\Fpdcag32.exe

Filesize
67KB

MD5
f5a3386f8fe413c9e0a43efc7fa5c08c

SHA1
88e223bacb4b7f4e95c466d3fdde20e9e70e3a7a

SHA256
bd79dc585f0bc81a92bef7df219d6615ba966398c40b0ee3145f3e01ebe613dd

SHA512
1cfa30ed2435f916cadb257a782750a889ebd58ee830c0d46ed5be2e7505c388908932bbccb695fdeb7b50f5b09be23d1d5ad100a8dd6eecb1746ed3fa39d9d8

Download Submit
C:\Windows\SysWOW64\Gbkkik32.exe

Filesize
67KB

MD5
e78b13b29c56d40053a1509f9e2c4a1a

SHA1
32ff3bc5028b503bdb236b01e81d43500e3f4b21

SHA256
f6374ae1908bd2a54add36f7412b32b59d536ac393dbee4ec919a76c8163b3e8

SHA512
b525825fca60f619d29d5ed1077d9570d93f32d5e51e9a66a7396a02800a8a89f4149a93ebde3c02d4a06eeedcf376d8beeba8771317b27829a5a03243911521

Download Submit
C:\Windows\SysWOW64\Gehbjm32.exe

Filesize
67KB

MD5
ae8a2769c7983c0fb134c31aeddb09a9

SHA1
1e6a84a3654865ea9ae87abcad4edcbd65c1d49e

SHA256
965526ab2cfde227f9ba624dbe5a30e714e02f1b40ec83f773156ed099ac462d

SHA512
bf8ca9f60d5165cdc3a4cdf3a5e7e82c178b751eb75231b85287e4e65037bc6302700bd28ee8dab2ea0bc3280f585ee21358bea86de1d04a276e2c5d2cd136b7

Download Submit
C:\Windows\SysWOW64\Geohklaa.exe

Filesize
67KB

MD5
cd9ad97be5f252beafd5c6d8b7425a08

SHA1
bebce8f685672bead7370769b07df21e3dcb7b99

SHA256
9ba90deb991e3301dae417695b4fac09124b0bd40dd57a806ab57ea87f41ac08

SHA512
e18a28a9fd6aac7018ed4915045327488ba318637494c021b12aefb2c1a8640f2d831c5c662069fb105bcb96d3a5155369a22e742eade4145ccd41cd792132d4

Download Submit
C:\Windows\SysWOW64\Gfhndpol.exe

Filesize
67KB

MD5
1ee51994899ecf2a50b0eb926bd7eb0d

SHA1
d385927a6c27a672644ca47d174ddf2fb2cb5dc0

SHA256
efca30516bdce0a02cf00a0ff827ebdf1dc265462c412966fb79f36fd1d2f04b

SHA512
91bee761390705da2ec5c80262b06162f30c39169d938b492a380ba2452021ceb111a828821908c11c4449a2b512aa5315efeb5b8ed56879b44c1ba7d642b317

Download Submit
C:\Windows\SysWOW64\Gmdcfidg.exe

Filesize
67KB

MD5
3bf9bfefbf21c300ed13e4f231135a6d

SHA1
4b9c76138f7f2072863bbb0f2c27e89ec8da95b0

SHA256
dba28f6449574049e994384ce0cbdc6811349c18579369b62155d5e5104f4162

SHA512
c560dc493c70842e027d46e83cb1ac4721b96c69aa7dda26a6a6370666e895fd2f23d3128fb262100ca308ad54fa2c31b6f173c75443877dfbce9897a34f2e73

Download Submit
C:\Windows\SysWOW64\Gmimai32.exe

Filesize
67KB

MD5
8835182d10112d3a95893c0a1175fe74

SHA1
ff9636c6dade90f36b9fec54f802fc3ba7101d8a

SHA256
a38cfc6850d3db2cf91c2e41fb493cc8f100847920d9343de7cfa0a330f3b951

SHA512
8383e66cf5bb9f7191426bd23161b5e8bf4d9b8c08eec1fb4c0f35a538535a63d0606464f464671a020545c07062ad43d6d774834ade0d8b8f1f55919f751c5f

Download Submit
C:\Windows\SysWOW64\Gncchb32.exe

Filesize
67KB

MD5
419e89a69d68e1053c7e56b53baac65a

SHA1
08f5bfe72d2eddfb9b18ac526ec91a9d91527e82

SHA256
6f88bb85af3e0e389bcb7aa20721dade8615c87298db8139eddd5d07e7e5ec9c

SHA512
1da424bf72c17257f81f43379a20eda08826f480804a51c4e33c81b3b1a9a7271fb8771abd0cafd168daa4d81beae5509db5aeb5e83db649b351f430ef4443cb

Download Submit
C:\Windows\SysWOW64\Hbenoi32.exe

Filesize
67KB

MD5
7ff0dee29089be4ed0efde2d6e0938f1

SHA1
2d892c45fd487e0c7a00d5744fef8473d3ae84fb

SHA256
5283110590641f2706876a0283b5513492fd528ae7d6884c00729928e4b855f6

SHA512
f0364b188e40240ec9d9f963c2cd22702612268c500f9d039bded864e12402f739eb1233dcec3247541d766f9bcd37189fc921f87c626e1a88082b64f4523316

Download Submit
C:\Windows\SysWOW64\Hbjoeojc.exe

Filesize
67KB

MD5
fa65e66c7898906f217fa8522fedd3bd

SHA1
1f22269c2395f8bc29d4adbfc9e5c0f84338012e

SHA256
ce24ec1aec28d2f9ea3fdea121ae9dc6d96903fd901964890378cd41fe1706d5

SHA512
d739ae225f2a8bcd939674a0e291ecd21e0cfd2fdc6c40855b3d8e8d1b3f273121de7f6d7235e5ba46a4ae361bd8b3cc3bf21c0dd217b82fc6f965f7411f83f7

Download Submit
C:\Windows\SysWOW64\Hekgfj32.exe

Filesize
67KB

MD5
a51e6055d88c82348d242c5ad7623fd8

SHA1
a482d26645941b1b5e343731e675befffe5e2da8

SHA256
fcf0e2a7fb5dda7c228772c5b5936066e8072b7cccb5e5efead1adb665de34c7

SHA512
88dc0e5457b36b61e32007c8186aae521e9f1f5dab02d3b08676c246468dfff7d7ae52fa7ca9c762fca075e0a448e7243e68c9484a5bfd1665c9b09feaa5d35c

Download Submit
C:\Windows\SysWOW64\Hemdlj32.exe

Filesize
67KB

MD5
04dc72afbb1d26fd4976416122720fff

SHA1
f2f61460590fa2078e7ead634de38642759e03c9

SHA256
5a71dfaa7e40852acbe6addee8829b9a82a370ad2e9f5221ee4c0cc5c26d2bde

SHA512
a3b5b7f896ed721a55afcbef6171ebeb6ba4f4984feb05a941c776172d7dad0bc892240ab2352e2d08934671f413615724f34951a6c3ce962e774db4b28e451e

Download Submit
C:\Windows\SysWOW64\Hfaajnfb.exe

Filesize
67KB

MD5
b2750abb0498bd4c029db5f5d6a51b6e

SHA1
969b05fb6cf766a4c563b14b352d630d19483a0c

SHA256
8f0c41fe025faa6ed14689b9c36d5ddd9e3492006c405218458fcb4ffdde4b7b

SHA512
6f79ebc6dc5beb698d525a8299031ff92a41e5feb620b289e99cb989ac9a1d59ea2e36ddf030f72afba93ea5eae089de1f1cc2e54866939a9329a20960b8beac

Download Submit
C:\Windows\SysWOW64\Hpchib32.exe

Filesize
67KB

MD5
390b665a334281cbf239f59f04073fd6

SHA1
7c69b6a22c347ab2f9098f5cbecf0937ecccc493

SHA256
4fbcff7f06e003974bb581abe607bd98eebc07e1171e3a0db7a05b80f022615e

SHA512
561a46f3b8e0c8c51b417e323c3f5a1c9bcb155e6aec123a07fa1f08ec710d32516630ebb17bfa7f135cfc8c795a404c9a1f7fdc0a869d849524963f18844ea9

Download Submit
C:\Windows\SysWOW64\Ibhkfm32.exe

Filesize
67KB

MD5
b2b4c4d40dfef88982aa04473e31f925

SHA1
ee2e549b811fe0289dea6ae339a183439f31d765

SHA256
6a866475b3d24556e284179e963fa4cd80e11d8c81ca50d45c291b417ca980c9

SHA512
b00ad3d78dc8d3d6975c41b37e11dd41f1b1c56baa081e8d5eb92005d3a049db33577633cf3ce345d78f531bff1c1f68972167b937e19c615cebaa2cdfa94d92

Download Submit
C:\Windows\SysWOW64\Ifomll32.exe

Filesize
67KB

MD5
b7ae4d49239d34bcbdc9de14dbcae564

SHA1
8d9aaea369081871e9dfbfe9c50a512b86c7a0e4

SHA256
2a5d73a3e445f2667b412ba6b9f243f224d53b6725e2c881f432e423528f19ad

SHA512
06530fba7d76c1e17bc5a1c1526a84d904f7d872a26a0ce8c077484f65d8f88418b801e93f45c9c066b144ffc6f989944c80240150d9a89d962f4edaccf01589

Download Submit
C:\Windows\SysWOW64\Impliekg.exe

Filesize
67KB

MD5
bbc8208a6f94a7a4b32259a691e14b47

SHA1
ebe3c90d47c18302da908b65dc3066f12a5c6ce9

SHA256
c0dd0796ce38f33de1688cb0dc41daee429d2bb35eaf9403cdb72b6ea7c7654c

SHA512
55905685582d449519f51578b2b880a9aa32af330d22b8b7ca1f3a92773d9d68dcd4c375196d8170371a965f2c6affd76d2c7fb1d56a2a62b8850f2a90f23c1b

Download Submit
C:\Windows\SysWOW64\Lqkqhm32.exe

Filesize
67KB

MD5
2c50ac84733784acfdd80eefa670b467

SHA1
cbcdcccede2d06129d34a81bcbc8a2715ba05e12

SHA256
25f3be01be97a332ea13dc1b7acc144ff9f1dc63cc865b14c2ad0e6aa4ff3fb6

SHA512
17513b6cbe265b09928ecd5811c1b1eb8797824a5b98fd50695644f896f2dd9a7959df8ddbf85810d4bc5e209d31d3a4c5e58a13e1b3a73711b30107ee1bbc85

Download Submit
C:\Windows\SysWOW64\Mqafhl32.exe

Filesize
67KB

MD5
0b12d88f85ddaa707fbacd6d80e2c423

SHA1
cee1d147a9987f37f373c4f409b7cb211dd3f2ad

SHA256
cd9bb9eb6aacb1c56e15d59f5dc81a610e635541241d52f62c2561fcce671ea5

SHA512
f3ce56c8b3dd21e5a758a1027146f142f58bfe266bb01ecf6b50dd1289dfdc6c56fb458f8a79ec2966a70b728bb0cf7c8d81253eb25bb5036429dde9f205e246

Download Submit
C:\Windows\SysWOW64\Nbenoa32.dll

Filesize
7KB

MD5
b1c599917f02bc90d4b196cec522c7f8

SHA1
ec9d3b0eb02aeb1b9f1baf08550120173b19b1ba

SHA256
7097ebc9dc7caa6e14d2f257fe2c4dd4713bb1a918d0af6d3e358485a619fd6b

SHA512
cf539f080efa1e87179d31e7a0b485858d7cff0f80c5e8324ba7beb9f52834e17df7e72cf9a6dc8533d77af88a6f513a6bafeb6b045835384fde5b551079d327

Download Submit
C:\Windows\SysWOW64\Nckkfp32.exe

Filesize
67KB

MD5
f20e98ec97c18836dfbdc448d5593e32

SHA1
73d31f60cd8aee1d8b799d3ec4149635699f514a

SHA256
b7663b0980a354a4c39b053dbf99e4d3557eaeb0e5f18213a6cb2ecdd6a6ffed

SHA512
2d19dbad54196cda55d9e72abb56868d130f9325009c7d2a2d3562c85b0b7f9993072cdb744ea9040737b2ea744fbd0418a041a09a2b06e04f96abc8c07ddcb1

Download Submit
C:\Windows\SysWOW64\Niojoeel.exe

Filesize
67KB

MD5
32673009ca475a70f467790dea9f94e6

SHA1
b1148838aea9f6a0557e92827e396b181ef67bc0

SHA256
fccb9652543a21878d4dcc3af07c53b935008160313ecf8973b12aaf5b1f2f3b

SHA512
a17a95f7978e7e72a7a2f815868530018c603e79f751aa8702051a589ee30f3f44ccb376557f987dc60e975911b72f4fec4cd28fec0f81939d12096e9adbbf21

Download Submit
C:\Windows\SysWOW64\Nodiqp32.exe

Filesize
67KB

MD5
ba6fb0440289778e9cd386a311204aff

SHA1
bd612a96e50a10ca312342e419bc831e5015a639

SHA256
22835b2a19746be7266ace0c222ceb70365d0c4b7c41c6e6162ed8c0b7b18a7f

SHA512
e996cac82a7e23aaf03068d598ae856eca06e5ae84bfbe41fffa84c4e645b1a1fc6999b0513bc959e243fe17fcb28b8d90df7ddc5dc33f0b7a1a74bac6f3760a

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
67KB

MD5
2809fec7172251a48b29e8df1efb8cee

SHA1
2f1206cb61d60f5703df4f564753d0423f21596c

SHA256
53881126c09f838c4545ef2c0829f3dec655b3c043f9e00ccdb0a78b418d1524

SHA512
db909458d5e5d8f78e8e5fdf9ed7002c5cf7896e4aee3cb89f8a2b9d3e005c504315ab11c43f65c1e5b04b60217ec40ba43c3c201fd93ed3eac68388e4c2d49e

Download Submit
C:\Windows\SysWOW64\Qbonoghb.exe

Filesize
67KB

MD5
d8d045b4d50290f02bd8bd210ff06cb2

SHA1
180bb6e0d119acab65e5362b95d8372f2d9b89b3

SHA256
dd55bcf0e32127d5d138ed7dd768a849be7344b76e6634d3285a12596711b17f

SHA512
b4a8650e6fad1e9d342dacc7fffe47853376e9b65c8b07838f9ba775d13ee3e8e4842b510e45014917347ea997bb131106c8cf426d15dd690376bca9165f4f75

Download Submit
memory/404-151-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/416-32-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/464-79-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/560-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/892-167-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/984-143-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1108-111-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1196-15-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1204-304-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1248-104-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1304-358-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1336-71-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1384-313-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1504-334-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1716-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1824-191-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1868-322-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1896-412-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2028-183-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2124-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2364-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2388-215-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2400-406-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2408-418-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2420-23-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2428-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2480-160-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2776-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2944-284-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2952-240-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2980-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3204-364-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3256-382-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3348-442-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3516-316-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3548-292-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3580-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3656-224-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3688-436-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3692-256-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3700-274-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3744-394-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3872-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3884-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3908-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4012-247-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4024-119-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4032-207-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4064-200-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4120-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4128-232-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4144-88-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4184-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4236-175-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4284-388-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4352-127-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4404-352-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4428-39-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4444-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4640-48-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4776-95-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4800-370-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4948-346-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5088-430-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads