85460998c7c3c2bb78c6640c6d758e23e05dc78e28d72c964edc05c49427dd71

Analysis

max time kernel
136s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

85460998c7c3c2bb78c6640c6d758e23e05dc78e28d72c964edc05c49427dd71.exe
Size

90KB
MD5

c581a6f259a2928c63e9934eb68daf01
SHA1

f8ef25d8f51f957db7bb6c7d9f5596ed661b3092
SHA256

85460998c7c3c2bb78c6640c6d758e23e05dc78e28d72c964edc05c49427dd71
SHA512

57a49c336f85af10bb1607665bb51496f423e0d0a4b55ec7bf14c467c05ebfe387bd5c8baa46ea4496102fd62898f2386d39948e0c067f88bfd136643b6daa70
SSDEEP

1536:/OaA+nQKaT9ci3cZSdk2Bc3Z+TJ/rX5JwG+eu/Ub0VkVNK:/7nPEcgzB0+TRXoG3u/Ub0+NK

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecmlcmhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ejjqeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fobiilai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iikopmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kgmlkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnocof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpihai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iiffen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipegmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmioonpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaljgidl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jangmibi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehekqe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmocba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idofhfmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijkljp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaloa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hjhfnccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efpajh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhajlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjqgff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcnejk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efikji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ecmlcmhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fifdgblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcnejk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbhdmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Elccfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejjqeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjapmdid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoifcnid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hihicplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmfbjnbp.exe

Executes dropped EXE 64 IoCs

pid	Process
4496	Dchbhn32.exe
680	Dakbckbe.exe
2692	Ejbkehcg.exe
4724	Ehekqe32.exe
4876	Epmcab32.exe
1412	Eckonn32.exe
4952	Efikji32.exe
1600	Ehhgfdho.exe
3604	Elccfc32.exe
1588	Ecmlcmhe.exe
3100	Eflhoigi.exe
4856	Ejgdpg32.exe
4548	Eleplc32.exe
1728	Eodlho32.exe
2360	Ebbidj32.exe
2672	Ejjqeg32.exe
1156	Eqciba32.exe
544	Ebeejijj.exe
2744	Efpajh32.exe
4768	Emjjgbjp.exe
3124	Eoifcnid.exe
2760	Ffbnph32.exe
2296	Fhajlc32.exe
1456	Fokbim32.exe
1528	Fbioei32.exe
4828	Fjqgff32.exe
1568	Fmocba32.exe
5104	Fomonm32.exe
1192	Fifdgblo.exe
1784	Fqmlhpla.exe
3420	Fbnhphbp.exe
764	Ffjdqg32.exe
4016	Fihqmb32.exe
4320	Fobiilai.exe
4988	Fcnejk32.exe
3224	Fjhmgeao.exe
2156	Gcpapkgp.exe
4296	Gfnnlffc.exe
4872	Gimjhafg.exe
5076	Gqdbiofi.exe
732	Gcbnejem.exe
3928	Gfqjafdq.exe
3700	Gmkbnp32.exe
3216	Gcekkjcj.exe
4064	Gfcgge32.exe
3708	Giacca32.exe
2340	Gqikdn32.exe
4780	Gbjhlfhb.exe
2368	Gjapmdid.exe
4848	Gmoliohh.exe
3320	Gcidfi32.exe
4688	Gfhqbe32.exe
3552	Hclakimb.exe
3316	Hfjmgdlf.exe
2504	Hihicplj.exe
3172	Hapaemll.exe
1160	Hjhfnccl.exe
4608	Hmfbjnbp.exe
3752	Hpenfjad.exe
1688	Hbckbepg.exe
2108	Hjjbcbqj.exe
4976	Hmioonpn.exe
756	Hccglh32.exe
4476	Hfachc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eflhoigi.exe	Ecmlcmhe.exe
File created	C:\Windows\SysWOW64\Lcnodhch.dll	Iidipnal.exe
File created	C:\Windows\SysWOW64\Lmqgnhmp.exe	Kkbkamnl.exe
File opened for modification	C:\Windows\SysWOW64\Mjjmog32.exe	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Elccfc32.exe	Ehhgfdho.exe
File opened for modification	C:\Windows\SysWOW64\Hfachc32.exe	Hccglh32.exe
File created	C:\Windows\SysWOW64\Hehifldd.dll	Kdopod32.exe
File opened for modification	C:\Windows\SysWOW64\Kkpnlm32.exe	Kcifkp32.exe
File created	C:\Windows\SysWOW64\Nkklocjg.dll	Epmcab32.exe
File created	C:\Windows\SysWOW64\Kijjfe32.dll	Hmfbjnbp.exe
File created	C:\Windows\SysWOW64\Ibjqcd32.exe	Ipldfi32.exe
File created	C:\Windows\SysWOW64\Kbmebabl.dll	Iiffen32.exe
File created	C:\Windows\SysWOW64\Imihfl32.exe	Ijkljp32.exe
File opened for modification	C:\Windows\SysWOW64\Jagqlj32.exe	Jiphkm32.exe
File created	C:\Windows\SysWOW64\Jigollag.exe	Jkdnpo32.exe
File opened for modification	C:\Windows\SysWOW64\Nklfoi32.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Diefokle.dll	Gcidfi32.exe
File opened for modification	C:\Windows\SysWOW64\Ffjdqg32.exe	Fbnhphbp.exe
File created	C:\Windows\SysWOW64\Ginahd32.dll	Gimjhafg.exe
File opened for modification	C:\Windows\SysWOW64\Icjmmg32.exe	Iakaql32.exe
File opened for modification	C:\Windows\SysWOW64\Jbkjjblm.exe	Jaimbj32.exe
File opened for modification	C:\Windows\SysWOW64\Eqciba32.exe	Ejjqeg32.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Kpjjod32.exe	Kipabjil.exe
File created	C:\Windows\SysWOW64\Ghiqbiae.dll	Kpjjod32.exe
File created	C:\Windows\SysWOW64\Lihoogdd.dll	Ifmcdblq.exe
File created	C:\Windows\SysWOW64\Kdopod32.exe	Kaqcbi32.exe
File opened for modification	C:\Windows\SysWOW64\Kdopod32.exe	Kaqcbi32.exe
File opened for modification	C:\Windows\SysWOW64\Kphmie32.exe	Kmjqmi32.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lcgblncm.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mcnhmm32.exe
File opened for modification	C:\Windows\SysWOW64\Gcekkjcj.exe	Gmkbnp32.exe
File created	C:\Windows\SysWOW64\Dngdgf32.dll	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Kphmie32.exe	Kmjqmi32.exe
File opened for modification	C:\Windows\SysWOW64\Jaljgidl.exe	Jmpngk32.exe
File created	C:\Windows\SysWOW64\Iljnde32.dll	Jkfkfohj.exe
File opened for modification	C:\Windows\SysWOW64\Efpajh32.exe	Ebeejijj.exe
File created	C:\Windows\SysWOW64\Jkdnpo32.exe	Jdjfcecp.exe
File created	C:\Windows\SysWOW64\Milgab32.dll	Kdcijcke.exe
File created	C:\Windows\SysWOW64\Bgllgqcp.dll	Jagqlj32.exe
File opened for modification	C:\Windows\SysWOW64\Hpenfjad.exe	Hmfbjnbp.exe
File opened for modification	C:\Windows\SysWOW64\Hjolnb32.exe	Hbhdmd32.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lkgdml32.exe
File opened for modification	C:\Windows\SysWOW64\Lklnhlfb.exe	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Lfhilofo.dll	Eodlho32.exe
File opened for modification	C:\Windows\SysWOW64\Fihqmb32.exe	Ffjdqg32.exe
File opened for modification	C:\Windows\SysWOW64\Hbckbepg.exe	Hpenfjad.exe
File created	C:\Windows\SysWOW64\Denfkg32.dll	Hbckbepg.exe
File created	C:\Windows\SysWOW64\Ggcjqj32.dll	Jiphkm32.exe
File created	C:\Windows\SysWOW64\Joamagmq.dll	Kipabjil.exe
File created	C:\Windows\SysWOW64\Kmdigkkd.dll	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Hfdcbdnc.dll	Eflhoigi.exe
File created	C:\Windows\SysWOW64\Hdgpjm32.dll	Ipldfi32.exe
File opened for modification	C:\Windows\SysWOW64\Eleplc32.exe	Ejgdpg32.exe
File created	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Njcpee32.exe
File created	C:\Windows\SysWOW64\Ifhmhq32.dll	Hfachc32.exe
File created	C:\Windows\SysWOW64\Omfnojog.dll	Jjpeepnb.exe
File opened for modification	C:\Windows\SysWOW64\Jangmibi.exe	Jigollag.exe
File created	C:\Windows\SysWOW64\Plilol32.dll	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Mnocof32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6960	4676	WerFault.exe	280

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfachc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnapla32.dll"	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eodlho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iidipnal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enbofg32.dll"	Kgmlkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgcifj32.dll"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibjjh32.dll"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pglanoaq.dll"	Iakaql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjpeepnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbocjjm.dll"	Giacca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkklocjg.dll"	Epmcab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcod32.dll"	Jmnaakne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Elccfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ejjqeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejkjg32.dll"	Hjhfnccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbkjjblm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmfdgkm.dll"	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codhke32.dll"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggdddife.dll"	Gqikdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggcjqj32.dll"	Jiphkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hofddb32.dll"	Fbnhphbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aiagblgj.dll"	Dakbckbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ejgdpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jaimbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eilljncf.dll"	Jfkoeppq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbnhphbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiaohfpc.dll"	Idofhfmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kgmlkp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kflflhfg.dll"	Iikopmkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jaimbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fphbondi.dll"	Ehhgfdho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eleplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmnaakne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bidjkmlh.dll"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjebnamp.dll"	Ejgdpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdgohg32.dll"	Fcnejk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeecjqkd.dll"	Kcifkp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcpapkgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcekkjcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecaoggc.dll"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ebeejijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmihaj32.dll"	Efpajh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4496	1484	85460998c7c3c2bb78c6640c6d758e23e05dc78e28d72c964edc05c49427dd71.exe	84
PID 1484 wrote to memory of 4496	1484	85460998c7c3c2bb78c6640c6d758e23e05dc78e28d72c964edc05c49427dd71.exe	84
PID 1484 wrote to memory of 4496	1484	85460998c7c3c2bb78c6640c6d758e23e05dc78e28d72c964edc05c49427dd71.exe	84
PID 4496 wrote to memory of 680	4496	Dchbhn32.exe	85
PID 4496 wrote to memory of 680	4496	Dchbhn32.exe	85
PID 4496 wrote to memory of 680	4496	Dchbhn32.exe	85
PID 680 wrote to memory of 2692	680	Dakbckbe.exe	86
PID 680 wrote to memory of 2692	680	Dakbckbe.exe	86
PID 680 wrote to memory of 2692	680	Dakbckbe.exe	86
PID 2692 wrote to memory of 4724	2692	Ejbkehcg.exe	87
PID 2692 wrote to memory of 4724	2692	Ejbkehcg.exe	87
PID 2692 wrote to memory of 4724	2692	Ejbkehcg.exe	87
PID 4724 wrote to memory of 4876	4724	Ehekqe32.exe	88
PID 4724 wrote to memory of 4876	4724	Ehekqe32.exe	88
PID 4724 wrote to memory of 4876	4724	Ehekqe32.exe	88
PID 4876 wrote to memory of 1412	4876	Epmcab32.exe	89
PID 4876 wrote to memory of 1412	4876	Epmcab32.exe	89
PID 4876 wrote to memory of 1412	4876	Epmcab32.exe	89
PID 1412 wrote to memory of 4952	1412	Eckonn32.exe	90
PID 1412 wrote to memory of 4952	1412	Eckonn32.exe	90
PID 1412 wrote to memory of 4952	1412	Eckonn32.exe	90
PID 4952 wrote to memory of 1600	4952	Efikji32.exe	91
PID 4952 wrote to memory of 1600	4952	Efikji32.exe	91
PID 4952 wrote to memory of 1600	4952	Efikji32.exe	91
PID 1600 wrote to memory of 3604	1600	Ehhgfdho.exe	92
PID 1600 wrote to memory of 3604	1600	Ehhgfdho.exe	92
PID 1600 wrote to memory of 3604	1600	Ehhgfdho.exe	92
PID 3604 wrote to memory of 1588	3604	Elccfc32.exe	93
PID 3604 wrote to memory of 1588	3604	Elccfc32.exe	93
PID 3604 wrote to memory of 1588	3604	Elccfc32.exe	93
PID 1588 wrote to memory of 3100	1588	Ecmlcmhe.exe	94
PID 1588 wrote to memory of 3100	1588	Ecmlcmhe.exe	94
PID 1588 wrote to memory of 3100	1588	Ecmlcmhe.exe	94
PID 3100 wrote to memory of 4856	3100	Eflhoigi.exe	95
PID 3100 wrote to memory of 4856	3100	Eflhoigi.exe	95
PID 3100 wrote to memory of 4856	3100	Eflhoigi.exe	95
PID 4856 wrote to memory of 4548	4856	Ejgdpg32.exe	96
PID 4856 wrote to memory of 4548	4856	Ejgdpg32.exe	96
PID 4856 wrote to memory of 4548	4856	Ejgdpg32.exe	96
PID 4548 wrote to memory of 1728	4548	Eleplc32.exe	97
PID 4548 wrote to memory of 1728	4548	Eleplc32.exe	97
PID 4548 wrote to memory of 1728	4548	Eleplc32.exe	97
PID 1728 wrote to memory of 2360	1728	Eodlho32.exe	98
PID 1728 wrote to memory of 2360	1728	Eodlho32.exe	98
PID 1728 wrote to memory of 2360	1728	Eodlho32.exe	98
PID 2360 wrote to memory of 2672	2360	Ebbidj32.exe	99
PID 2360 wrote to memory of 2672	2360	Ebbidj32.exe	99
PID 2360 wrote to memory of 2672	2360	Ebbidj32.exe	99
PID 2672 wrote to memory of 1156	2672	Ejjqeg32.exe	100
PID 2672 wrote to memory of 1156	2672	Ejjqeg32.exe	100
PID 2672 wrote to memory of 1156	2672	Ejjqeg32.exe	100
PID 1156 wrote to memory of 544	1156	Eqciba32.exe	101
PID 1156 wrote to memory of 544	1156	Eqciba32.exe	101
PID 1156 wrote to memory of 544	1156	Eqciba32.exe	101
PID 544 wrote to memory of 2744	544	Ebeejijj.exe	102
PID 544 wrote to memory of 2744	544	Ebeejijj.exe	102
PID 544 wrote to memory of 2744	544	Ebeejijj.exe	102
PID 2744 wrote to memory of 4768	2744	Efpajh32.exe	103
PID 2744 wrote to memory of 4768	2744	Efpajh32.exe	103
PID 2744 wrote to memory of 4768	2744	Efpajh32.exe	103
PID 4768 wrote to memory of 3124	4768	Emjjgbjp.exe	104
PID 4768 wrote to memory of 3124	4768	Emjjgbjp.exe	104
PID 4768 wrote to memory of 3124	4768	Emjjgbjp.exe	104
PID 3124 wrote to memory of 2760	3124	Eoifcnid.exe	105

C:\Users\Admin\AppData\Local\Temp\85460998c7c3c2bb78c6640c6d758e23e05dc78e28d72c964edc05c49427dd71.exe
"C:\Users\Admin\AppData\Local\Temp\85460998c7c3c2bb78c6640c6d758e23e05dc78e28d72c964edc05c49427dd71.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\Dchbhn32.exe
  C:\Windows\system32\Dchbhn32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\Dakbckbe.exe
    C:\Windows\system32\Dakbckbe.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Windows\SysWOW64\Ejbkehcg.exe
      C:\Windows\system32\Ejbkehcg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4724
      - C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Eckonn32.exe
        
        C:\Windows\system32\Eckonn32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Ejgdpg32.exe
        
        C:\Windows\system32\Ejgdpg32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        23⤵
        Executes dropped EXE
        
        PID:2760
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        25⤵
        Executes dropped EXE
        
        PID:1456
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        26⤵
        Executes dropped EXE
        
        PID:1528
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        29⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        31⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:764
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        34⤵
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4988
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        37⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        39⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4872
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        41⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        42⤵
        Executes dropped EXE
        
        PID:732
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        43⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3700
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3216
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        46⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3708
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2368
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        51⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3320
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        53⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        54⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        55⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        57⤵
        Executes dropped EXE
        
        PID:3172
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4608
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3752
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1688
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        62⤵
        Executes dropped EXE
        
        PID:2108
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:756
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        66⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        67⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4820
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2604
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        70⤵
        Modifies registry class
        
        PID:3116
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        71⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        72⤵
        Drops file in System32 directory
        
        PID:1220
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        73⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1800
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        76⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        77⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        78⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3032
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        80⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        81⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        82⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        83⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        85⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        88⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        90⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        95⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        97⤵
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        99⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        100⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        101⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        102⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6080
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        104⤵
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        106⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        108⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        109⤵
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        110⤵
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        111⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        115⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        116⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        117⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5136
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5288
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        121⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        122⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5772
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        124⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        125⤵
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        126⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        128⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        129⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        131⤵
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        132⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        133⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5364
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        135⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        136⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        138⤵
        Drops file in System32 directory
        
        PID:6164
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        139⤵
        Drops file in System32 directory
        
        PID:6208
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        140⤵
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        141⤵
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        142⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        143⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        144⤵
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        145⤵
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6516
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        147⤵
        Modifies registry class
        
        PID:6556
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        148⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        152⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6832
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6868
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6916
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6968
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7080
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        159⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        160⤵
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        161⤵
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        163⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6436
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        165⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        166⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        167⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6860
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        170⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        171⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        172⤵
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        173⤵
        Drops file in System32 directory
        
        PID:5092
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        175⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        177⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        178⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        179⤵
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        181⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        182⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        185⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        186⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7128
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        188⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 420
        189⤵
        Program crash
        
        PID:6960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4676 -ip 4676
1⤵
PID:6848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dakbckbe.exe

Filesize
90KB

MD5
858d8e141e2f7a412e6af4a0c5b95d2e

SHA1
303c6bd407babbc7f23286bb886900af7b8ba600

SHA256
c8000e8ca82b87087a4d7643f57b44fe5a8affbc42531581a094a42806545ed4

SHA512
f9025f1026e4ba7015b17e90ae3b13c17e0a8389d7ad38ef37e1f255a251d30ac35a32ac684d18b181346e83a06bf8e148f57b326fb721c0f6a851862b15280a

Download Submit
C:\Windows\SysWOW64\Dchbhn32.exe

Filesize
90KB

MD5
5215b9d26edbab1edbffc3e49616a7ab

SHA1
f7aa8518748472cec2b67521dfa3ad9efe8b190f

SHA256
ce79dc1fd8deb8e2b552784a634ddc2c0cdb9ad9781e5b43d84722b8805d0692

SHA512
386686e4bf4e23d6631cbed61e178711c9650eb9a2ca5d1935e5746d852900fdaf7968e6d70c77823a5b330eb7d1b91f6189936f964b72ce1057bd0c393c06bc

Download Submit
C:\Windows\SysWOW64\Ebbidj32.exe

Filesize
90KB

MD5
71dbff93af4981745eff7563ba14d7a5

SHA1
ffc471ecd8eaeb041d295ec716a870fe40bd9074

SHA256
3bd4e1b3c3eeb12c0d8e450c8afeac16392c973bc46cf799d4e4be2a9cb1628c

SHA512
073cacb7b47610e9ab37e76a413823a550ef62becd52ecfe9817ee72c596d9c32800f3f9b6c38527581d211774a24d8900614fcacd0d6aa54b0c5b2b8e2124f4

Download Submit
C:\Windows\SysWOW64\Ebeejijj.exe

Filesize
90KB

MD5
f1244c362ffb9c4377de80f4a0a8c367

SHA1
6a250258321012d688bea947173c3ccdbb214f75

SHA256
cb228ed407d31b3158cd6c10af54899c56690fd72173c865bdd9d4d90d8cd7ae

SHA512
c3ae946294aeec98d1565c5b4223cca44f779bd26d644ca95cdf41ec392f3899ffda7b767fe0425a7bd45da76d6d6f676cc9a8396316ec0b6d161bdfa44fcf7e

Download Submit
C:\Windows\SysWOW64\Eckonn32.exe

Filesize
90KB

MD5
c9bbfced70f46f37c1f55bab6c78b1ca

SHA1
94e869b5d30421909f124f60e235dd97e8d268f2

SHA256
f6cecad149c4a40ed073dc382c5ad56be79f9b615e6678c68907c020aa51c201

SHA512
b73feb6891cd2b4216d52a9ed3b05a4b69abf8461692ff5d61f3d11ed095fff5e9c033e897ad1d5efcef12d4e74d4a76ceb3c6c30d45ce7ebd37dd8cb928e00b

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
90KB

MD5
709caa6683b460a0cace5ac87179af7c

SHA1
b85966b5cfd516047a6ca8f029093de7e22389c7

SHA256
9408020db82d518c8ba7ded1b8419d7fe4a711e5d05df4efa217e9bdcbcdfd93

SHA512
c003ee2baf6f5116f4ccb5f5b7dc33ceb60b4507942baa98438ead87ad305bb7f51230f82bee03cafe9afa2e3b13409f415800967d30ff63eccf5cb9db70aa78

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
90KB

MD5
6b9e9dfb083bdc11393aa18272bdf97f

SHA1
a5f1339c8c0c04337cfa80575edd94761335705c

SHA256
f7a11c28afe7a4a9344136a8861e63ad5ceb4febc744f0dd19a645340d608774

SHA512
04051175dde755eea0ac6dc1d57baa4bca4541d9295aea68fdc56add0dcce2e054c578efccb219ca24750ade20461e14e2b5f654ba1bb46a507afc39929afe1e

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
90KB

MD5
f20184d4b01c7620ce7fc24a8f13a557

SHA1
9cee758e4e23cd959bf67be2a9eed357cf969353

SHA256
7b7362942b1cda941a9304ee81ab0ba8cbb33854ba0d469d6e10d80ed84ca32f

SHA512
d3398ece53ba03b0020ff0671a81439c585e07a3460a13cd3da4feaaae955aac9b30484cb6945c632923a803619b0eebc12a7054501e19584a374d0b0fc03fcc

Download Submit
C:\Windows\SysWOW64\Efpajh32.exe

Filesize
90KB

MD5
3f48796a7aebfc7b0583f1a3f013b11f

SHA1
01a55268475b630fc4bb6aee09c0d7a653e4508c

SHA256
2772dc4aaf5f0c3d2cc95508f1e9f8a50445a65e76b4724191959cfce1bba954

SHA512
4638bc6fcb9b0cf9247e6d5d184f9f69ba63ac2bfa202a046e237a155d3a52d9fcc15b63007e0b21877f4f784115d97ac5934ff45e4e65329a96dc923314b684

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
90KB

MD5
538b55c970def7b06ae57d6dda147b7c

SHA1
80a821567eb42a3949b53c7ae1c2072af7f0ca42

SHA256
87f3515da2bd415c9a79dc1924c36fd0484093fc8394598f9134678afed55996

SHA512
af3fd4482d86d05894f90855c06533f54c81251f0d6e57af3900f901d14ba6490c67dd576777d392fcf66f3af64fb1e043e8dd2123babf98f990db1e1a328412

Download Submit
C:\Windows\SysWOW64\Ehhgfdho.exe

Filesize
90KB

MD5
c7d8b78b84f090285ad2edc9c32c079d

SHA1
bbc56eed1989dd5459bd1514436f62df6e867de0

SHA256
9d15e84c8cf1f2c5ddac957d45a92f772b286dec9faef37eb7cbf434d5b50af2

SHA512
96ac7ad09bf197b893a9b618e7d84bf41af2ad21fa215591d7a7d8071718a200022b8f10c2707fcf9675aac88d55848f5ba6eaaaafe5a2657ea32123e8ff7cdc

Download Submit
C:\Windows\SysWOW64\Ejbkehcg.exe

Filesize
90KB

MD5
1fbaf179e2efbf236505922a0b41b564

SHA1
4e9a6ed1368560fb8700cc52ad9a4ba6af703c18

SHA256
76fab37bbf739aa06e31975445836f45d4be51df9764b175e33a98f0e8b66d8e

SHA512
0b188144aa824e9363de10faeec428f6b0cf8a441b00d5fb3d017fde2619e82e7422d76311fb3091ba1dd1ddf9e4cbde94803a12559ef5b63deced8f4caf4d2c

Download Submit
C:\Windows\SysWOW64\Ejgdpg32.exe

Filesize
90KB

MD5
fc217f246be9c16ee047db179e0b14aa

SHA1
e5e8b814f4506bf1dbd3e77c171e4ef13f196097

SHA256
eab1622a5de5f4c0ff9f9da4349668727ab9f144c7f5c8dd1503f5133799d8b4

SHA512
29137a4a9665b4e353443ba189dd678dfef7b5c07ce60a634853fc4e2498c773ad0954f78d90787c272040f821d1eb3f8999964c9572244d5d39ab0bfde79b0e

Download Submit
C:\Windows\SysWOW64\Ejjqeg32.exe

Filesize
90KB

MD5
8be661d2269ad9cb37e7803156915e51

SHA1
a7a75f708f8ce6dd8540bbce6afb40e80aff2001

SHA256
4a3e8a64b8f1d70ea82947337610744b56ad6c9680399740eb2dc129df79caae

SHA512
5efedf3faecb3ffaf7fb4ac4bd32bd71803068fc20ca2f0041d8325af4f8bf89f5cbe65a6e4be84247f25b9b344f8bcb28b9001d19b87999966aa5485808a6cc

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
90KB

MD5
dfc338c19be21c20e6b61981bf715119

SHA1
6e85114d0e3446c23ba1bdffdfd45157f3b108ac

SHA256
5d45d7e19d4e9e14648ceec147eca873c4833cbbdddeba5740ebe8634195ad0f

SHA512
f9f071c6ce6bf92b6384a2cdfeb117c8ac27b202b139b7f2b809a0768119ddd9d8e3a75bf991871ce22bed578865996817078333526b2072bab7395117c631bf

Download Submit
C:\Windows\SysWOW64\Eleplc32.exe

Filesize
90KB

MD5
2d6ff6d0db1611b8285cb5f692939970

SHA1
864470fdd15e499965752e736477d1a048056848

SHA256
7301a617de2f9451e880ddc88c4d1355fe9b5976eb6a9452b95b394b459bbd3d

SHA512
a361c986d7e4c8fd423e195d59a5270788ae43c3729cea0e74f579d5c2e35ef69490c7864856de3f35ecfeee29608c30e6a14792975a74e9a0a097b811afe954

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
90KB

MD5
f3fcb8e5fbc0ea9055ee04d2ecbfb5ba

SHA1
3279a36b59a357f1696c081f463a6aa1c9914f67

SHA256
f99ee82c08a62bc1696adc0a27b19aa7adae040650937195259e846d90c37f48

SHA512
77a40e985edd6f9833fada2a930f02f93b52036d11f7e399f30769a2f12deaf448a32ee67b874865b6f1e6b717484f029e318968df195c5e7970fa02d53390d5

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
90KB

MD5
4df9bf278f7e59c28ece961d35ab7472

SHA1
a85552b54257c61c640da7c2212728fe3e8b53fd

SHA256
2cf5cd707dd93d6f0d1cfabf3d3098e2494e67e266483398e9e00a5e934d29ee

SHA512
b95ee2f46e86b5b89deda27b538fa8aad1dd9394c6774628d0d1ed768ce87b05be26c6bfd6e796f5289ad9c99acc0dfba3d8caecc54d84844453f51a45b1dea2

Download Submit
C:\Windows\SysWOW64\Eoifcnid.exe

Filesize
90KB

MD5
f1e5ee93ffd0f99a0fe24d5452cb3d57

SHA1
24e6168f3e076e84983ceab7265da8fceb3405d7

SHA256
11988efc2e8ae42db09727764de3e4ba1948bb5c532f9cdb110502b0b720baae

SHA512
2fb4e4645f618a33243ceeb08b8ea4fcbd052bbffb675557feb185ba00dfa34b8d27b6b5cd70b4e43ddc777915346ce7e3f08a06e2f0b7f0d645fca7f56b8eee

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
90KB

MD5
16d5ea4ae48050f6cc8c9d567af1aa00

SHA1
6789c030d9f5787c6200d5b474d11dca11ec7f8d

SHA256
fbab4ab9b4b9d0e1682d90c537568f27b8df227ff439c4b75b3c27bd22c39075

SHA512
f1539b91b72230d8b40df74acda228c9ad51024f0d68afaccb4f5d046b3267758d8b741b64edb4f08262fd1911e6738263295eacf903c5fa2dbc09e527bcfe81

Download Submit
C:\Windows\SysWOW64\Eqciba32.exe

Filesize
90KB

MD5
7f1bbc7b4032d55df43f18b2c86f0434

SHA1
d5e09534136ad88977b959013b455471f10e0b67

SHA256
981a5497e717826f8cc23ec1c74f81ed1a5df65709dead4ed01d2ae3bf6f5625

SHA512
a914f30fa2e0270b8cd40c8e9affbbd086b47ef24b170481758d22ea48c36d6becb9cb4c6aa8442f2eaa5e3f1e52915f9bc4d301469144851092230b5d0f1c6f

Download Submit
C:\Windows\SysWOW64\Fbioei32.exe

Filesize
90KB

MD5
14ba56fcff32e45d13e674dc8eaa1f4c

SHA1
a7b89cab6ac293a1dc9a1e4e9e7a7d92ded7a835

SHA256
b0e9305a4ee3d4a858e5c4cd4156568a6b27467cf10ef21aebfa83c3245c5390

SHA512
acc4e76ea05b91c8b30feea4745692f0b51b419a3827b8429aad96eb82467a24c94cc89c3031ac6bdfbdc10cdba571afd579e7cffb6df1e69ee2f4d30be48d6a

Download Submit
C:\Windows\SysWOW64\Fbnhphbp.exe

Filesize
90KB

MD5
065ba9f71488b20797f7d4f6cd51800a

SHA1
7b65b1fa6d9f9ef596f2521d4717c1c8bed6b2c4

SHA256
f59a4c1a2f407f32e2602ed5e7d05d8a007a252969bb7aefc5238b425cb55207

SHA512
e888323b4aa9dd78b19ef5f49ff88a85a88dff2fd5fc0c23a65acd4be5a28fa73b068299c9b80bd18ee1dbbc357910353a15a9fe7e6215226ba6965c5467d7d4

Download Submit
C:\Windows\SysWOW64\Ffbnph32.exe

Filesize
90KB

MD5
8fd0db3f3a2a99fa5d756db18969ec43

SHA1
42e7703766c1fca83d26e21ad98ea6d261daac5d

SHA256
0dff4bc48e004fee4e172ceaac5091dd268ff30629c1b18eca6ff3c099adf4b2

SHA512
c626d624750b64dddd67357af6f89cbe9e8a7d219aca0baafdd394617ccd568b64b93efdb1900c5bb845ca1963a5bf10597ea50b7db98389a5e6a4b4ce89dc5b

Download Submit
C:\Windows\SysWOW64\Ffjdqg32.exe

Filesize
90KB

MD5
1c1fed0319504b9938937b89cef00772

SHA1
0d532423cce5426332504dbd63602742442a21b5

SHA256
268864a66aa6f7619cd2af04a096f935424bb7f3dd17b8a0adb8d31807f29124

SHA512
8515aed783f2156a8f1b01fa7dca2702a5a8a8855d5e34243a1556e9f8900b55b2d2421f67f6ad5404ff0b3960a90b59a459c67f8416eaa3c81764fdd4496264

Download Submit
C:\Windows\SysWOW64\Fhajlc32.exe

Filesize
90KB

MD5
8577f9d5f5d11a2164e63d412b21244e

SHA1
71bc91beb9fe922a5d25ce21bc3063d1b167393e

SHA256
d596b3d9d1e0a3696c0ff39cbf92106c870ff218b01e1fbf2a356ccb63441591

SHA512
d6341f9745ca6362087ef776e327e0325050104ce7b2f8a5a3a704daa90f4d5ff37fcf2f976b069059b88ffbbd34cbb2108bfe0b12b830790a4913e1a354139b

Download Submit
C:\Windows\SysWOW64\Fifdgblo.exe

Filesize
90KB

MD5
23770864f15e680ed59fc282eb3084ac

SHA1
ebfc217752b4914c4ac4acd5069bce5ff63c71a1

SHA256
f1f7df161453da0e4134c9ee9c161a8024be3b5b1d2b7d5b217c9e8f91cfff8d

SHA512
672546acd27eddfe61517641c27b5f479a9fff2c1facf9ecbbef8d58b3eecb818835c0cb7f684ac6c390d82ea4b4424ef9666c84a5adab8dd3c3caadbb538852

Download Submit
C:\Windows\SysWOW64\Fjqgff32.exe

Filesize
90KB

MD5
50b71a6566e5db7919b00dab6b0a5e50

SHA1
5d615a980fee82bbea09369ed74429f721c5bd6b

SHA256
d72fed852e9a320fafa375ccb3c8864ee1626a3d07057b848f014b52e8be14eb

SHA512
6553ce1be4ac15d05392637089ba4533ccafca19fae89d6b23cb8d04090426f4a4543818cc59f2a3cd026fac0357b88dc7940e0da85b0d99bccac0d7927f5ed0

Download Submit
C:\Windows\SysWOW64\Fmocba32.exe

Filesize
90KB

MD5
2c9144e567e2e63a282c387bf8ced05d

SHA1
7df865f43b8e146da1e3144903b6a9e5de7d4432

SHA256
d0882384cb62e2b9eb742e22141aac46430f09a80e3c3e6ff9bea5c3a04f990e

SHA512
7a8d5de4c6617d6245802f2ec1b0511fb59651c4ca470cb199074e5fc00ff0c84853d63e79e2149a284d115bd63f3fb0773b675917db588451e08c4d234ed7ff

Download Submit
C:\Windows\SysWOW64\Fokbim32.exe

Filesize
90KB

MD5
a11e63076084130906b70e3f4622ce65

SHA1
d9ab1001b1a1c32db21ec451d5fc75a4999b5996

SHA256
3454b0960cc5b83a45be655a12a26c467fae952ee31034d51a01d0cb69d9045c

SHA512
9db61592784641a7920d829dfad0450de8ea01d4a866a210dd52c2f9c24c2369029d71474198865902423d7436c260a905df751353eb61994a1967940f671823

Download Submit
C:\Windows\SysWOW64\Fomonm32.exe

Filesize
90KB

MD5
8aac2a4734448a8d0aec0f6edd361e32

SHA1
535d534e40186153ea4ef29d542424a56740c2cd

SHA256
b14f62a181b85bbb6e6539d4ced3884c4ae166ba2abc2dd6a79e11b9d11793ca

SHA512
efb727c8f8d57ed62e8b1987f9a6c9aef46e87e70c90fd6a285a54f6eda1dcfbdb25acfc9337f75c4747c063fca17055c7d55d9f07d151a789efb125b26c5b79

Download Submit
C:\Windows\SysWOW64\Fqmlhpla.exe

Filesize
90KB

MD5
85eae761aa44f5296a2e7f823f3809b9

SHA1
5adb84047b3fb57d9b0e5a813d772cfde84c54e5

SHA256
5fd07affb0c3b6437577137fae6fc0cb65f77502dfcaa340770828f5f39fbb48

SHA512
208ebf80207a2090116f2c0ba46982d0b844cebc50d4ae627d0a4d49234819293fad794821539d1224fc19786cf071c2c265d3e8400e545fb2b3053fc301539a

Download Submit
C:\Windows\SysWOW64\Iifpphha.dll

Filesize
7KB

MD5
b57c080020fae32def55c080cb5058b1

SHA1
d14a719415dfd2d19cc7020d8d6f14d9dab2f873

SHA256
d8773caa951670c2aa9b27d36919f3c6a7a78f2d609db822ddd05c4fbafd51ac

SHA512
4c41e610ba9c619f3aa028259708050a8721b5da16a527f9d9bc61ff1084558f7e2f10b5d12046501b3af1729415660f79de99ca055bd1922af51bf551dfc39c

Download Submit
C:\Windows\SysWOW64\Jbhmdbnp.exe

Filesize
90KB

MD5
faa1b9fad8d8c078ba5a9da4de58c71f

SHA1
0c18a024fde672ca7d1e55cda085735d2a128a56

SHA256
d16e5d5d49d6780818bef83232b126b604f0426b0cb9a7b267642414bfe7ae49

SHA512
1bae2149368616fd87aae7c95b3b005160dde3408c04c4a8c80a18b1dbe45b9897c08fa6ab0c3918d3b1bf178aec4c83ef6fb66cf39869d689a550a124c712e0

Download Submit
C:\Windows\SysWOW64\Nkjjij32.exe

Filesize
90KB

MD5
d297dff56a6b92b8c8a67454052fed14

SHA1
416b0b55d6daf479c6e4f7fd6d8288a720894cba

SHA256
c3a91d87f15bbbfee7ba7a7dfa04bcb8793728e9352c083a02eb31379fb73b29

SHA512
73604beda778134593a8a76cd4e4e7a424ed449a6b96fb2b1f279fbce10bffd6e226fe14f09ba332e13989187c79f9db4c539e0a57346f369d6fb8357f631051

Download Submit
memory/544-144-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/680-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/732-310-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/756-442-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/764-260-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1156-135-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1160-406-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1192-232-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1412-48-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1456-192-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1484-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1528-204-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1568-216-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1588-80-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1600-68-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-424-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1728-111-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1784-240-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2108-434-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2156-286-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2296-184-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2340-346-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2360-120-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2368-358-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2504-394-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2672-127-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2692-24-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2744-151-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2760-176-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3100-88-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3124-167-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3172-400-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3216-328-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3224-280-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3316-392-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3320-370-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3420-248-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3552-386-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3604-72-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3700-322-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3708-344-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3752-418-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3928-320-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4016-262-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4064-334-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4296-292-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4320-272-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4496-8-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4548-104-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4608-412-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4688-376-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4724-32-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4768-160-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4780-352-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4828-208-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4848-364-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4856-96-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4872-302-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4876-40-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4952-60-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4976-436-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4988-274-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5076-308-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/5104-223-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads