5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57.exe
Size

74KB
MD5

3669bcd61cd02d322d8def20e866091a
SHA1

1f4a4f74435413c776c9fe4e28656d19fbf12f3e
SHA256

5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57
SHA512

824ca33aa22c5b7c8466a6f9c57a6c1f4bc31b71ef08af9b7b195a85d3a8fb133ba62c0742acffdaad27c7034cb77d244c30b38280be5a02b0c64a5b4508a341
SSDEEP

1536:t4UPPieto/UpRMCkFDbmo2gqOHMt9p6UnWJwRyn:t4UnietAUpRMtFbmdghHMt9gO8n

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fodeolof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjmhppqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djlddi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efpajh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcikolnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fihqmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fobiilai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjjbcbqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpgkkioa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlgdkeje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjcclf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gjlfbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbgkfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icljbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fckhdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmoliohh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcqjfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmioonpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabgaklg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdhine32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmmhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlegeemh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjjjle32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijdeiaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpojcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dphifcoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efneehef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jaimbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gfedle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kphmie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhqaefng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hippdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecphimfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcgoilpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfdida32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maohkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbgbpihg.exe

Executes dropped EXE 64 IoCs

pid	Process
3048	Ccjfgphj.exe
3204	Ceibclgn.exe
1952	Clckpf32.exe
4896	Coagla32.exe
4668	Capchmmb.exe
3084	Digkijmd.exe
2144	Dlegeemh.exe
5084	Dcopbp32.exe
4104	Dabpnlkp.exe
4932	Diihojkb.exe
3800	Dlgdkeje.exe
2692	Dofpgqji.exe
2308	Dadlclim.exe
3512	Djlddi32.exe
3328	Dljqpd32.exe
2772	Dcdimopp.exe
4772	Dhqaefng.exe
2168	Dphifcoi.exe
2984	Daifnk32.exe
1444	Djpnohej.exe
4784	Dlojkddn.exe
5016	Dchbhn32.exe
4904	Ejbkehcg.exe
1712	Epmcab32.exe
2312	Efikji32.exe
1428	Ehhgfdho.exe
3692	Ecmlcmhe.exe
4040	Ebploj32.exe
3824	Ejgdpg32.exe
3676	Eqalmafo.exe
4352	Ecphimfb.exe
4908	Efneehef.exe
1080	Elhmablc.exe
816	Eofinnkf.exe
4368	Ebeejijj.exe
1256	Efpajh32.exe
2136	Ehonfc32.exe
4900	Eoifcnid.exe
1008	Fbgbpihg.exe
1148	Fjnjqfij.exe
2068	Fhajlc32.exe
1688	Fqhbmqqg.exe
228	Fcgoilpj.exe
3112	Fbioei32.exe
4012	Fjqgff32.exe
3600	Fmocba32.exe
3332	Fomonm32.exe
3408	Fcikolnh.exe
4268	Fbllkh32.exe
2228	Fjcclf32.exe
4428	Fmapha32.exe
2352	Fopldmcl.exe
2856	Fckhdk32.exe
1980	Ffjdqg32.exe
4592	Fihqmb32.exe
880	Fobiilai.exe
5088	Fbqefhpm.exe
2260	Fjhmgeao.exe
640	Fmficqpc.exe
2776	Fodeolof.exe
380	Gbcakg32.exe
2356	Gjjjle32.exe
4796	Gimjhafg.exe
4476	Gqdbiofi.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dchbhn32.exe	Dlojkddn.exe
File opened for modification	C:\Windows\SysWOW64\Fodeolof.exe	Fmficqpc.exe
File opened for modification	C:\Windows\SysWOW64\Ccjfgphj.exe	5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57.exe
File created	C:\Windows\SysWOW64\Gmaioo32.exe	Gjclbc32.exe
File created	C:\Windows\SysWOW64\Hfachc32.exe	Hbeghene.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Maohkd32.exe
File opened for modification	C:\Windows\SysWOW64\Hfjmgdlf.exe	Gppekj32.exe
File created	C:\Windows\SysWOW64\Gmbkmemo.dll	Icjmmg32.exe
File opened for modification	C:\Windows\SysWOW64\Ecmlcmhe.exe	Ehhgfdho.exe
File created	C:\Windows\SysWOW64\Bofjdo32.dll	Fjnjqfij.exe
File opened for modification	C:\Windows\SysWOW64\Mdfofakp.exe	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Jdcpcf32.exe	Jaedgjjd.exe
File created	C:\Windows\SysWOW64\Kckbqpnj.exe	Kpmfddnf.exe
File created	C:\Windows\SysWOW64\Flfmin32.dll	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Mpolqa32.exe	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Ngcgcjnc.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Lbdfmi32.dll	Ffjdqg32.exe
File created	C:\Windows\SysWOW64\Jaimbj32.exe	Jmnaakne.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Hmioonpn.exe	Hjjbcbqj.exe
File created	C:\Windows\SysWOW64\Kbmfdgkm.dll	Kgbefoji.exe
File created	C:\Windows\SysWOW64\Fhajlc32.exe	Fjnjqfij.exe
File opened for modification	C:\Windows\SysWOW64\Gqdbiofi.exe	Gimjhafg.exe
File created	C:\Windows\SysWOW64\Lcdegnep.exe	Laciofpa.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Djpnohej.exe	Daifnk32.exe
File created	C:\Windows\SysWOW64\Inomojol.dll	Eofinnkf.exe
File created	C:\Windows\SysWOW64\Djpnohej.exe	Daifnk32.exe
File created	C:\Windows\SysWOW64\Qfiapa32.dll	Fbllkh32.exe
File opened for modification	C:\Windows\SysWOW64\Jbocea32.exe	Jpaghf32.exe
File created	C:\Windows\SysWOW64\Ceibclgn.exe	Ccjfgphj.exe
File created	C:\Windows\SysWOW64\Dcdimopp.exe	Dljqpd32.exe
File created	C:\Windows\SysWOW64\Haidklda.exe	Hmmhjm32.exe
File opened for modification	C:\Windows\SysWOW64\Dlgdkeje.exe	Diihojkb.exe
File created	C:\Windows\SysWOW64\Fcikolnh.exe	Fomonm32.exe
File created	C:\Windows\SysWOW64\Hcedaheh.exe	Haggelfd.exe
File created	C:\Windows\SysWOW64\Impepm32.exe	Ijaida32.exe
File created	C:\Windows\SysWOW64\Jpaghf32.exe	Jangmibi.exe
File created	C:\Windows\SysWOW64\Enbofg32.dll	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Kpepcedo.exe	Kmgdgjek.exe
File created	C:\Windows\SysWOW64\Kgdbkohf.exe	Kdffocib.exe
File created	C:\Windows\SysWOW64\Elhmablc.exe	Efneehef.exe
File created	C:\Windows\SysWOW64\Nphlemjl.dll	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Lklnhlfb.exe	Lcdegnep.exe
File opened for modification	C:\Windows\SysWOW64\Ceibclgn.exe	Ccjfgphj.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Capchmmb.exe	Coagla32.exe
File created	C:\Windows\SysWOW64\Hbhdmd32.exe	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Kbapjafe.exe	Kdopod32.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Ahgndd32.dll	Fjhmgeao.exe
File created	C:\Windows\SysWOW64\Qgenhgdd.dll	Fodeolof.exe
File created	C:\Windows\SysWOW64\Pglanoaq.dll	Iakaql32.exe
File opened for modification	C:\Windows\SysWOW64\Iiffen32.exe	Ijdeiaio.exe
File created	C:\Windows\SysWOW64\Ogijli32.dll	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Dphifcoi.exe	Dhqaefng.exe
File opened for modification	C:\Windows\SysWOW64\Ehhgfdho.exe	Efikji32.exe
File opened for modification	C:\Windows\SysWOW64\Kbdmpqcb.exe	Kdaldd32.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Maohkd32.exe
File created	C:\Windows\SysWOW64\Dendnoah.dll	Ipqnahgf.exe
File created	C:\Windows\SysWOW64\Gmlgol32.dll	Jpaghf32.exe
File created	C:\Windows\SysWOW64\Gmoliohh.exe	Gidphq32.exe
File created	C:\Windows\SysWOW64\Kgbefoji.exe	Kbfiep32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7016	6856	WerFault.exe	279

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ecphimfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fomonm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ijaida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Imbaemhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Icjmmg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bofjdo32.dll"	Fjnjqfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdgohg32.dll"	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hikfip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbhdmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Impoan32.dll"	Iikopmkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jingckla.dll"	5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ijdeiaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Epmcab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbkmec32.dll"	Jmpngk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Digkijmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgkkkd32.dll"	Dlegeemh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfogkh32.dll"	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbledndp.dll"	Iinlemia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dlojkddn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Efneehef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmaioo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehbccoaj.dll"	Hcqjfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opocad32.dll"	Hjolnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jmpngk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmgdgjek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdkdqfii.dll"	Dcopbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejnmepn.dll"	Ejgdpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckfliccm.dll"	Fjqgff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fopldmcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjmhppqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jokmgc32.dll"	Gqdbiofi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omfnojog.dll"	Jfdida32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djlddi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daifnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ebeejijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehonfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggipmfe.dll"	Fbioei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgenhgdd.dll"	Fodeolof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dljqpd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ejgdpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppgjkamf.dll"	Ehonfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gimjhafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbgkfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imbaemhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eilljncf.dll"	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbcfgejn.dll"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dadlclim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hfjmgdlf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 3048	1488	5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57.exe	81
PID 1488 wrote to memory of 3048	1488	5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57.exe	81
PID 1488 wrote to memory of 3048	1488	5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57.exe	81
PID 3048 wrote to memory of 3204	3048	Ccjfgphj.exe	82
PID 3048 wrote to memory of 3204	3048	Ccjfgphj.exe	82
PID 3048 wrote to memory of 3204	3048	Ccjfgphj.exe	82
PID 3204 wrote to memory of 1952	3204	Ceibclgn.exe	83
PID 3204 wrote to memory of 1952	3204	Ceibclgn.exe	83
PID 3204 wrote to memory of 1952	3204	Ceibclgn.exe	83
PID 1952 wrote to memory of 4896	1952	Clckpf32.exe	84
PID 1952 wrote to memory of 4896	1952	Clckpf32.exe	84
PID 1952 wrote to memory of 4896	1952	Clckpf32.exe	84
PID 4896 wrote to memory of 4668	4896	Coagla32.exe	85
PID 4896 wrote to memory of 4668	4896	Coagla32.exe	85
PID 4896 wrote to memory of 4668	4896	Coagla32.exe	85
PID 4668 wrote to memory of 3084	4668	Capchmmb.exe	86
PID 4668 wrote to memory of 3084	4668	Capchmmb.exe	86
PID 4668 wrote to memory of 3084	4668	Capchmmb.exe	86
PID 3084 wrote to memory of 2144	3084	Digkijmd.exe	87
PID 3084 wrote to memory of 2144	3084	Digkijmd.exe	87
PID 3084 wrote to memory of 2144	3084	Digkijmd.exe	87
PID 2144 wrote to memory of 5084	2144	Dlegeemh.exe	88
PID 2144 wrote to memory of 5084	2144	Dlegeemh.exe	88
PID 2144 wrote to memory of 5084	2144	Dlegeemh.exe	88
PID 5084 wrote to memory of 4104	5084	Dcopbp32.exe	89
PID 5084 wrote to memory of 4104	5084	Dcopbp32.exe	89
PID 5084 wrote to memory of 4104	5084	Dcopbp32.exe	89
PID 4104 wrote to memory of 4932	4104	Dabpnlkp.exe	90
PID 4104 wrote to memory of 4932	4104	Dabpnlkp.exe	90
PID 4104 wrote to memory of 4932	4104	Dabpnlkp.exe	90
PID 4932 wrote to memory of 3800	4932	Diihojkb.exe	91
PID 4932 wrote to memory of 3800	4932	Diihojkb.exe	91
PID 4932 wrote to memory of 3800	4932	Diihojkb.exe	91
PID 3800 wrote to memory of 2692	3800	Dlgdkeje.exe	92
PID 3800 wrote to memory of 2692	3800	Dlgdkeje.exe	92
PID 3800 wrote to memory of 2692	3800	Dlgdkeje.exe	92
PID 2692 wrote to memory of 2308	2692	Dofpgqji.exe	93
PID 2692 wrote to memory of 2308	2692	Dofpgqji.exe	93
PID 2692 wrote to memory of 2308	2692	Dofpgqji.exe	93
PID 2308 wrote to memory of 3512	2308	Dadlclim.exe	95
PID 2308 wrote to memory of 3512	2308	Dadlclim.exe	95
PID 2308 wrote to memory of 3512	2308	Dadlclim.exe	95
PID 3512 wrote to memory of 3328	3512	Djlddi32.exe	96
PID 3512 wrote to memory of 3328	3512	Djlddi32.exe	96
PID 3512 wrote to memory of 3328	3512	Djlddi32.exe	96
PID 3328 wrote to memory of 2772	3328	Dljqpd32.exe	97
PID 3328 wrote to memory of 2772	3328	Dljqpd32.exe	97
PID 3328 wrote to memory of 2772	3328	Dljqpd32.exe	97
PID 2772 wrote to memory of 4772	2772	Dcdimopp.exe	98
PID 2772 wrote to memory of 4772	2772	Dcdimopp.exe	98
PID 2772 wrote to memory of 4772	2772	Dcdimopp.exe	98
PID 4772 wrote to memory of 2168	4772	Dhqaefng.exe	100
PID 4772 wrote to memory of 2168	4772	Dhqaefng.exe	100
PID 4772 wrote to memory of 2168	4772	Dhqaefng.exe	100
PID 2168 wrote to memory of 2984	2168	Dphifcoi.exe	101
PID 2168 wrote to memory of 2984	2168	Dphifcoi.exe	101
PID 2168 wrote to memory of 2984	2168	Dphifcoi.exe	101
PID 2984 wrote to memory of 1444	2984	Daifnk32.exe	102
PID 2984 wrote to memory of 1444	2984	Daifnk32.exe	102
PID 2984 wrote to memory of 1444	2984	Daifnk32.exe	102
PID 1444 wrote to memory of 4784	1444	Djpnohej.exe	103
PID 1444 wrote to memory of 4784	1444	Djpnohej.exe	103
PID 1444 wrote to memory of 4784	1444	Djpnohej.exe	103
PID 4784 wrote to memory of 5016	4784	Dlojkddn.exe	104

C:\Users\Admin\AppData\Local\Temp\5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57.exe
"C:\Users\Admin\AppData\Local\Temp\5cbf4a1dc059387a2af3b83871820c2a478fae55e1009988cbecda4993b8cb57.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\Ccjfgphj.exe
  C:\Windows\system32\Ccjfgphj.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\Ceibclgn.exe
    C:\Windows\system32\Ceibclgn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Windows\SysWOW64\Clckpf32.exe
      C:\Windows\system32\Clckpf32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\SysWOW64\Coagla32.exe
        
        C:\Windows\system32\Coagla32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4896
      - C:\Windows\SysWOW64\Capchmmb.exe
        
        C:\Windows\system32\Capchmmb.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Digkijmd.exe
        
        C:\Windows\system32\Digkijmd.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Dcopbp32.exe
        
        C:\Windows\system32\Dcopbp32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\Dabpnlkp.exe
        
        C:\Windows\system32\Dabpnlkp.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Diihojkb.exe
        
        C:\Windows\system32\Diihojkb.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Dlgdkeje.exe
        
        C:\Windows\system32\Dlgdkeje.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        C:\Windows\SysWOW64\Dofpgqji.exe
        
        C:\Windows\system32\Dofpgqji.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Dadlclim.exe
        
        C:\Windows\system32\Dadlclim.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Dcdimopp.exe
        
        C:\Windows\system32\Dcdimopp.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Dchbhn32.exe
        
        C:\Windows\system32\Dchbhn32.exe
        23⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        24⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2312
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        28⤵
        Executes dropped EXE
        
        PID:3692
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        29⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Ejgdpg32.exe
        
        C:\Windows\system32\Ejgdpg32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3824
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        31⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        34⤵
        Executes dropped EXE
        
        PID:1080
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:816
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        39⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        42⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Fqhbmqqg.exe
        
        C:\Windows\system32\Fqhbmqqg.exe
        43⤵
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3112
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4012
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        47⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3332
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4268
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        52⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2352
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2856
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1980
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2260
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:640
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2776
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        62⤵
        Executes dropped EXE
        
        PID:380
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2356
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4796
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        66⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        67⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1636
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        69⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        70⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        72⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        73⤵
        Drops file in System32 directory
        
        PID:5100
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3288
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        75⤵
        Drops file in System32 directory
        
        PID:840
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4996
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        77⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        78⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        79⤵
        Drops file in System32 directory
        
        PID:4248
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        80⤵
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        81⤵
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        82⤵
        Modifies registry class
        
        PID:644
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        83⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        84⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        85⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        86⤵
        Modifies registry class
        
        PID:788
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2332
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        88⤵
        Modifies registry class
        
        PID:2012
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1368
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3976
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2292
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        92⤵
        Drops file in System32 directory
        
        PID:264
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        93⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2760
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        95⤵
        Drops file in System32 directory
        
        PID:1276
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3624
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        97⤵
        Modifies registry class
        
        PID:2908
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        98⤵
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2544
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        100⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        101⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        102⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        103⤵
        
        PID:940
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3968
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:924
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        106⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        108⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        109⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        110⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        112⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        113⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        114⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        115⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        116⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        117⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        118⤵
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        120⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        121⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        122⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        124⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        125⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        127⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        131⤵
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5220
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5292
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        134⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        135⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        138⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        139⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        140⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        145⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5932
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        149⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        151⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        152⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6056
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        154⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        155⤵
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        157⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        159⤵
        Modifies registry class
        
        PID:6176
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        160⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        161⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        162⤵
        Drops file in System32 directory
        
        PID:6304
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        163⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        164⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        165⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        167⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6560
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        171⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        172⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        175⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        176⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        177⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        179⤵
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        180⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        181⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        183⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        185⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        186⤵
        Drops file in System32 directory
        
        PID:6388
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6456
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        188⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        192⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        193⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 412
        194⤵
        Program crash
        
        PID:7016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6856 -ip 6856
1⤵
PID:6960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Capchmmb.exe

Filesize
74KB

MD5
44981117731ce23c652a69b724b11c27

SHA1
18c88777468b1615db3e152b6b8c7b5834f96f35

SHA256
7172e008d1049310bba9c4182d20e12a5a3ec2e7d7f867ad8f0bd3c4b6b493ed

SHA512
729336243526f0a10504bb5d35e0404f31763da85e0311e1eda6fea6eb8232cb048fc032646ff33f9cdf3c6d3c1a02a27a8f52855d881269145ae61ded3bce4c

Download Submit
C:\Windows\SysWOW64\Ccjfgphj.exe

Filesize
74KB

MD5
9bc356914704aae583842b05380ed744

SHA1
7ca66df6793261e63b5a0c07dc0a13428b0b47a4

SHA256
55dea7f501f8b7435b01e20fe4eb87ab6d219cae7790c073a55c6107a43c921f

SHA512
9210b2b78277835298710dc03b118af4d740f63dcf1c5778611858d75217110d6cba83146046ba46883f04e06d8ffd4b3558e3bc33ab2ee22bc5e2251ee8e1ef

Download Submit
C:\Windows\SysWOW64\Ceibclgn.exe

Filesize
74KB

MD5
751fa9ca1536ff37b00bdeaaddbda2a1

SHA1
d7739d69a16d31f3a590411a87414bae5b10ff6c

SHA256
de71b3ab28e5b00857f5ea953c19eebade6b7fbffccc0f3428451dba75d2673d

SHA512
ce2a144f02b4001c900b2ce6f4de5b3398231632ac2c32c58eaeff138b86c344e826d989fd0a0f20412931d622ef594d95b3b949399067434f4a55e6889a6f08

Download Submit
C:\Windows\SysWOW64\Clckpf32.exe

Filesize
74KB

MD5
2c5858a9369a7277b09fa7ecd61de505

SHA1
2c9592ee8f8d9d5f7ae1987d3ac2056be4759769

SHA256
aa60367032c7b845765510ada204c420c60cf52f59e1891ee7fcd70ccd90b672

SHA512
edd92bd40dbeae1ddfdde3a6d69594fe9cfc2818a9ac8ae842496b17965ce492dc90619f6eb6d8c624bd23a3559a5629cfdc5169939b4fc7c628ec8fc8330ceb

Download Submit
C:\Windows\SysWOW64\Coagla32.exe

Filesize
74KB

MD5
0f529f08282efcd5cf058769094ac949

SHA1
873fd1006133c0471d61d089e85a339d9c8a95fb

SHA256
05f2d2a8c2e751475109a737e2084b224896eaeebd083ae8803190695b44f95e

SHA512
441649a39241e043e512c711d8643b37f86f74aa7f82a48e9d3539c6cc4a70065c3533299fc8aacfb824a5562fba86a8da9ceca810e4dcf708198e8dadd31a58

Download Submit
C:\Windows\SysWOW64\Dabpnlkp.exe

Filesize
74KB

MD5
98fa4989e61c9f42f4e714fd4ddfc3e5

SHA1
d8e9e1220170407d61717fb9b5c8d2d6d47c71b7

SHA256
922a8bf6f1bd8010d40077efa936f413d189ff507ec657406569482ece75c0fa

SHA512
5b813beaa0f9ac589f24555b75223c3acdcd0539354db56f1aa50cc59c5c1ce632da168ad3a236c26754d0005d9f4e59b8b67676adc9b89924c6fe24ef77b266

Download Submit
C:\Windows\SysWOW64\Dadlclim.exe

Filesize
74KB

MD5
d92187a1d4a1fabb152fb9c8b50e21ad

SHA1
888858d511b96ca197edfb71a1579678fbd47584

SHA256
f064f11bc22746b341b649d5df8e259755f28af19d880bb3ba25662617a95bd7

SHA512
3c03bbc8ae5eb0ac8c0b87de4fdea27e7dfa5a5d71f2a603d6939bb818a9bf3c6ce3672228c7f1925197a14f217822a19ac78f88afcafc1334082c6ad55d1c63

Download Submit
C:\Windows\SysWOW64\Daifnk32.exe

Filesize
74KB

MD5
11e77dbb32e42041aa391580b5ad6c3c

SHA1
9b617f92070d9abbd54dffdfbc0824df5181d6b5

SHA256
56d42039c9fd46a0607f63c8d50bb63662efe143c7ba1c83859752be015d2fa2

SHA512
1ed80cdf9d826104d37a528cb97af903496bd2e352ad9b22751dc94159810ddbbb600b99c9c2d4251a6898a9a738baf60e4721b194a25ebf50c05b7ea9901cd5

Download Submit
C:\Windows\SysWOW64\Dcdimopp.exe

Filesize
74KB

MD5
830c53031a6b00d490648cbf3e0748fc

SHA1
ac3564382834c0fd34407728dc3cb311e100636e

SHA256
6cffa40d264c8a32a925921c4d9143cc225e04e43287a16ca701bed4fc6bd23c

SHA512
8bf3a172c395cebef708200d6185139216064fcfbc0ecb7b8a96a8d19c81c280d2e7e9f95474ae0c26d0eb04767ece182fcd5ca5f6b885c6d9a663b5fa69aa1e

Download Submit
C:\Windows\SysWOW64\Dchbhn32.exe

Filesize
74KB

MD5
90fff8ff3b1877319c7a91dd204c11c3

SHA1
eeaf7673add0e3d3f3b6dfc94c0231e9112cb170

SHA256
0877ffa13352e1910ce883f321b0932705c1edf5107dc820faf91fc3e4d9cad2

SHA512
b329a6cd6e2d131023a097c76c920f25c92762f2949d4befa0176b672a33475aeeeb6a51c83ad3fa27567fb9ba90e74bda24a88bfa940d17a587a226d8f80602

Download Submit
C:\Windows\SysWOW64\Dcopbp32.exe

Filesize
74KB

MD5
815b6676d3fb8eb1c530c9a4b4664d9f

SHA1
ea553a2f874c91ac3ff2002d3892b80ae4f4278a

SHA256
06d279bda8bdd2593b16b51e51ffd4600e7dba43d504787ecfdd06786d0315d2

SHA512
ac53630e732cf968d2e6c60af16dd52f25a69f93a4f59910fee2e670eb8862701386ce48eac55e5b30c94ddeacd0403867233e384ae607ac416f8fa9804636a7

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
74KB

MD5
fd6912d6ba634f7973175738f8e9c016

SHA1
c3d8a987508727cd1a5ad589e9b45d6da8374f46

SHA256
e17aae0c6e6ca504114ad6bbf1dd7e18808b8f72d5e8539ff022e50b61df92aa

SHA512
33f3504247c7f5d2d1135d4271989c3c853c08e31555786ade29336a1c0f4c081bc292d5184d7e779b82a5090b4a63ea083a634c21537fe67cd4140238b41153

Download Submit
C:\Windows\SysWOW64\Digkijmd.exe

Filesize
74KB

MD5
3c1caf328cf7dfccf583279d8395f75e

SHA1
9b92666d998ca5ad029bf853f87c4e3037d6faaa

SHA256
5b7cce0f260aedde2bcde4d4423bd84357267be5ac2c56476a274aae46894f3a

SHA512
1c9db945a700eb4674caec74c89913d3208aae14ec0befc51c9b40c4b27ad29c58d9f274fcdcd17873673d7b365d2fcf8f70dc381afbb97f0d4803997e598187

Download Submit
C:\Windows\SysWOW64\Diihojkb.exe

Filesize
74KB

MD5
67fc9a1bd89b25d93152d9c537697397

SHA1
18327e24dc02f8f1490da085dbb685843db07f8b

SHA256
188de338db3abba13d0738ed26be48ddd7f14e572afddb71ace2c0f4057a6e0d

SHA512
a1fd857f3e2031f54bd91585e6d86d105338387f6fc1ea6ba0d1244c826bff82fe85a0a6c2e98430b4afb7024453d1c1302eb0512696466baa33f7cbcb9e32d1

Download Submit
C:\Windows\SysWOW64\Djlddi32.exe

Filesize
74KB

MD5
6d2fa0f4d2c5ac998fdcaa379f8a8669

SHA1
26f401008a539033a070cebec8c42f155f8add24

SHA256
9198e4d8946beb7cd471c46fe7c8aa127dfed698db1a817c24c1074e051b7c9a

SHA512
b5d479d0a22a5ca6e104a73b6f57466f7dc7111c1f9c867d1f083639a0a002194276d52781de7c53d6c25208f809f4eeddd7a225256b2bf036e86e3e8f431839

Download Submit
C:\Windows\SysWOW64\Djpnohej.exe

Filesize
74KB

MD5
bc99867de8ca1b2572954d44de56da18

SHA1
1e44d7f35d72c19b03381335b31c08e9bad5f51f

SHA256
6d6f7cdda36e1b549d18055704c6fb948237d98cd317f0668bbdfd4481ec2710

SHA512
5a0e65021dfc0edf65ef196518a5d0ce96da1c497050018ad36a1a5b8ed212251950a14ce9bc6a5f4a24dfb10400cdd74ab975f4ba95be9086ce8244fda592ba

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
74KB

MD5
69f19e6bfb0c0724e4ecc67b4185dacf

SHA1
a530d767a234b86b8778a931fc1c75f549d93dfc

SHA256
6d0b29d9ff9cbbb4812e088361aaa1e2547e8f8ea80287c07b134a0b8c432a09

SHA512
af413e25f22a8b65e79ba07759a0b60f0839e6bcdae28ac06b117f7e998e9c2e3ec075e604846ca21c227326452a815ec8ceddfc8ef736b7af3fe4c9496c2af7

Download Submit
C:\Windows\SysWOW64\Dlgdkeje.exe

Filesize
74KB

MD5
95a87b33da35ab64f4ac17f9e4e1ed52

SHA1
127b0249eb3b720230e9655381ef52f131b73b24

SHA256
1a8c3e69adac908a213fce8eda393271e399d19f8bca09e4d1cff519d258df62

SHA512
63e68cb3fb729e4dd4061c9a1e00f1f339bb077d195b803e803749041072a1e3ff424a36797550226e9bad0d0713fab17bf4f3aa678aef5d7f96532e40baac42

Download Submit
C:\Windows\SysWOW64\Dljqpd32.exe

Filesize
74KB

MD5
1e1a1f6115769c8d908ce987dd84236c

SHA1
1888f25685ecaab60aa62b77c5b281bd620f8b36

SHA256
8af289295b9e671d0615cccbf8c2ef1785998d175a0937bccbc5843a8fa79a11

SHA512
88e95e25928396b698ed463f393484e031ec1e68830e46f37601a3225129b570c6025f75e462db55a5f761e3c168f5905f448584fb971989941876f1d24e1930

Download Submit
C:\Windows\SysWOW64\Dlojkddn.exe

Filesize
74KB

MD5
35c043537f43dc0c1427f798b77273a1

SHA1
3479f301a3497bd62d2fbbf0530f3759dc27fc73

SHA256
cb0ff6271360bc503f7a2b146227320d8d3b60f91a40acfd6c09aeeda6022a63

SHA512
ad61bf829023c369de4577475d029612880a17032729420161fff050d8bfb855fa219c19f6cbb13c620b04d1b3843f1785a2006b2d3db0777f39cacf9fd08ed7

Download Submit
C:\Windows\SysWOW64\Dofpgqji.exe

Filesize
74KB

MD5
889a3aa02adb21833aa5b01e7f0d3cd7

SHA1
0de4a8358749ac70dd77c1efcc0cd9e2252632ab

SHA256
39691ad6a2364790d3bc3603e3d02e683e107776746b60d28c39114bb8738302

SHA512
3f4d1ba5563441422564f7b8c0f2a3de1dad36124e5b50f2fa1aef2ffa154ed202ca78bad4bbd9bd06d8a59f5fc5df57e7ae91c672c0b76dd2ae71278a145ded

Download Submit
C:\Windows\SysWOW64\Dphifcoi.exe

Filesize
74KB

MD5
2f956ed9c9649197ffe05a6cb2d2869d

SHA1
037dc47d483a8777acd843deb5ae7a214d3efe31

SHA256
da3040b5a1b0eb9095f016fb58cb7fe3635ed3890db81dbab9b699cfd492d21a

SHA512
afb27a068baa71b095a7397139a1b3907cbe1154b30fc7479be67ccd3a8c53a1c2592878e6bb7d5fb667167ab0dfba8ecfa9eb7f4e7af0bc293b881c6af0c32c

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
74KB

MD5
ee54e2b4255a35234cbd4651799878e6

SHA1
8541299ea47c5c1c57082732cb953a1c6e1c4037

SHA256
e7dd1baaace676e8316dfcd9e2f4065e71726e43d63b4083a59b2a8734a7c0cf

SHA512
84e5e183b768a3c22918d33afa72653ad7550251f3c3c29608c13853cab6c97371af6612d35b331ec892bf92efa906c586293e79b1e56c970b6281f224964e55

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
74KB

MD5
a30f30ba03586adbc456e497d1d94b72

SHA1
999e26d07fb67efaf8a5ffbd7d5f39d3e30c6ddd

SHA256
7390b111d59c8b0249a8005c1117c5232674b50c7e370524e1300f559dfe0e6a

SHA512
60a5cd3502dabec3b611d3603b03bf64eb4878a304c68a6da6e441c86f07bc3850d47cf803f3aea4d4acc0d34b74811b44e2332b55dc9e5a8a6a8597cf95f7fc

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
74KB

MD5
bf859057a58a9732b23fc334ca398508

SHA1
f4d53b7cbcb5ea54e2bd379bb20ea99a44166ac3

SHA256
5762ef69c0f579e0bab88c7afd6842d50851145f99734f3588a1fc38d75edb62

SHA512
b17817ab91581ec971dd3fa4d205ee0036fb482644603f498476fe1780ce38305dedf1aaa5efaae970819ca890d49ff4337b73d415eccf6c4e14fb2db41533ae

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
74KB

MD5
73d5f4694a08d9dcb8dd75ac17fc7ee2

SHA1
3b501fe57f08496e2c9605a7d0609ce8614534b1

SHA256
854981dfce721983c9faff632985d72779de351f1a8a64f698e3e1c885746f86

SHA512
9f6a8bc545aad7c7acf27d910d78557459228d522b023a03a0e518880427288e4966a4e3ab17b9f77993267daaefd3c603a96fe49e1e6670e69382c69790c066

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
74KB

MD5
b56ff98f6939abc0c82aaf30313e3fa3

SHA1
46ae1652b30cd32683040b18d2cddd9e9f5f8459

SHA256
ed886a79118dc6c8c36d771798f95ce02d76f214709033150130f0f0dd76f1b1

SHA512
6b7dc366df3df1e5282471ed29689d9d1b8d240389d8da754f641bd8f8d29dec1efe9631ad53db01b5e870b43501976fb750df16b1b1e9c4db21bf7734640211

Download Submit
C:\Windows\SysWOW64\Ehhgfdho.exe

Filesize
74KB

MD5
ffaddf067755f3e415ab77cadcd9b4c4

SHA1
11c956f292e650591ee84d43a855b4b148b05506

SHA256
cf8d951072e3c8e7fd876a6b6c379623d916bccec3831d83e0e37d54a06b11b1

SHA512
49b2ef44d74e76cd0793aa8c8b375a521979142f9c73ff286f88ec1651c4c9a4ecb858476c001f3ac31f5e968b0321124780a7d218c3b02745061a12852bed8a

Download Submit
C:\Windows\SysWOW64\Ejbkehcg.exe

Filesize
74KB

MD5
589f928897978190f04c983a2be0cd43

SHA1
eaba2eec11be55946f000c54ae078f18bf4993d2

SHA256
778430c3dab0bc401d60e5f7f0f5b887c60aa5fadff63d8a0a7931d140c5f78d

SHA512
faa2315e9343bb8067f49273ed94520415ec2e6600f3ab65e1c02c2d2f52f791fa2addb85b0b2f01fc813736c5e25559c749e77ce7e3ec58853a4244868217c6

Download Submit
C:\Windows\SysWOW64\Ejgdpg32.exe

Filesize
74KB

MD5
e9934030cdb355cbbb51502ba4098fde

SHA1
87b98540de93f783b286da73ec9efed3207006d6

SHA256
a69761e511887465cfc1d76658e5b80f5ed89834a4ea0a5a26892c0f833e4fe4

SHA512
493306d2ee859e5510752028e68ba4296379452253e34aa7774f68ee495d581ceb9c5d3adf953cd25ea5551a68f31fa0958ddbee6bc84e1ee6ba22dddc0ba751

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
74KB

MD5
6f7008ca01db011f3ccc5e1a3aa23dea

SHA1
aa218f6ec7d25c1bfc0457d5cbaa730daa2bebff

SHA256
b9e46273b41672b1a365b4f65c49af14eb881f38ec739a33c3d531a308787c7e

SHA512
d3d7f1b9057f254ec2271e5bd33c05b53593278e309dc5fc10ba09b0b90b51445b0d67c97e73e3698e8ab1efa8ceb8dbe7ea6602bbf58195dcd4bb42c0cb2b54

Download Submit
C:\Windows\SysWOW64\Eqalmafo.exe

Filesize
74KB

MD5
d514d7cfe664a5ee5faa3995cec5030f

SHA1
7b7e301e748b2f24eadad9cad375013d7d218a15

SHA256
fd3582e2ff0ef0e3903f50cdcc3ef4749933fe1106f3368f8a25487fcc1d0867

SHA512
611891a1b41a97b343465a0ff82c87b829182f0f1474d7f5ddf2bfaffc49ebe359449450f788822b650babe5345306dbf16f0912cb6ea1eaad75f609f39a36f3

Download Submit
C:\Windows\SysWOW64\Fihqmb32.exe

Filesize
74KB

MD5
17fa998cbcdec01beeae2c7992c91541

SHA1
6e7d1d3824065c6aa2c483dff6a77dd5dc58da20

SHA256
1b771e150a0283b7f3eb69754a538809bc87a0215fdaa7cc551660ce17447348

SHA512
6eb008a2ab32e7705553c296de9dbce6206c34c2be9862bb2eee307ed19dc4e819694f5edabaeb25285aa4b43a56f74ffd87a72e18ad9944670489985e2caf32

Download Submit
C:\Windows\SysWOW64\Hmdedo32.exe

Filesize
74KB

MD5
4b54cb475df3e015ed85ef7f7bfd467a

SHA1
a64269b12a2867bef110f29aabf3c04195f885a0

SHA256
470d31c05b184916987fc6a1c64a4637bb81761e0736bea529cfe3916bbd2504

SHA512
e789cab67f5e8f20c6d5227973db8cd02880aa0db48b17c9fbec86bd69933c79078e5344b8c37069c74407e7cc072e26f358a2012b5c664e15cda0c418f80773

Download Submit
C:\Windows\SysWOW64\Jdcpcf32.exe

Filesize
74KB

MD5
4723d8c37421da259a4386df2fa6e5b8

SHA1
4d8f099e6fc9428f86775b6d8a61ddf3757152fb

SHA256
b5ca2b95159380a98ae52a22a82f2d3b4c69735c560e7c6587a1e1b0449b2307

SHA512
d4e9e22463dd1caa29d56cb0ea5ed5c688b2b5ba898d821fb2252e4481f4dbc6e182bd822ec5ffb66e6798ac80101e1aea48c25fb5012262674b9cedd3ebe64b

Download Submit
C:\Windows\SysWOW64\Jfifijhb.dll

Filesize
7KB

MD5
bc75239294385b024634e577393d9c52

SHA1
c19938f2c1007b5be67dbe32e61c5dde9aabd0b4

SHA256
34b71f6da5876633f64d5d6a54e89ac14a98b0b0191ee34290cb82eb4bf57c35

SHA512
9934820d2cba4ca67906cb6d24a0a50e719b23b3fe5ac9151c96f1fd848e45ab7b6ddaa6ad927e0e0e4b91187870de5f9a72c633474217b7f8a6170310476cc1

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
74KB

MD5
83818802c3d231219865489ea030b3d0

SHA1
e2764704f02d0e8c073e21c4ac939b844b0b5aa1

SHA256
ec2b01b8be7918405e65198743c8a229459b61fc0c15808d4c3f67d3c52835bc

SHA512
b7e4b6b49a7ea4318cd9037ea8036c7e57e49cf0cc55e3565a80cffd4dbe5ed924e185361d5f48ff3f9263b09e0c86d624901a774281c8d210cb545a8f1e7485

Download Submit
C:\Windows\SysWOW64\Lijdhiaa.exe

Filesize
74KB

MD5
9ab8d68cb7f860fa86a84cea6535ddad

SHA1
71166568b93d1847646f64842bcb071e9752ce80

SHA256
9d6bdb02e66a5c411297bfe47b58cd6db81b30843d344db8e6b391363e0c00cd

SHA512
afb5571f238572859cddc857b3ab9d68e98a2c548d2c499e085082673732882c15bab388b3a6ae197a199c6a65aea06ae272ba3e5773edb1dd5f81bc902c205a

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
74KB

MD5
5ed50915bd927b44da17c232f9ea79bb

SHA1
75f60b199d2fe51fba5b110cd6b72b777c3dadae

SHA256
4e95a83db693fa2c02134a094143fb3b16398c19328213d85c3efd9ef4d573ad

SHA512
621d728f8e0702296711b244bc431728e68af30647372dfd572ee6b0dc017d2f5d68da5858accf46a52a60ea88adc59d9e3026d07295951f2406bd2400b6235c

Download Submit
memory/228-322-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/380-430-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/640-418-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/644-552-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/788-580-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/816-268-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/840-508-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/880-400-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1008-298-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1080-266-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1148-309-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1256-285-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1428-208-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1444-160-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1488-544-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1488-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1636-470-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1688-320-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1712-192-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1952-565-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1952-24-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1980-388-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1988-530-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2012-599-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2052-484-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2060-478-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2068-312-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2136-290-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2144-598-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2144-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2160-566-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2168-144-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2228-364-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2260-417-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2308-108-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2312-200-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2332-591-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2352-376-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2356-441-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2392-472-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2652-494-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2692-100-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2740-577-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2772-127-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2776-428-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2856-382-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2984-152-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3048-551-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3048-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3084-48-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3084-586-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3112-332-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3196-465-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3204-16-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3204-562-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3288-506-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3328-120-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3332-348-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3408-356-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3512-112-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3600-340-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3676-244-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3692-220-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3768-454-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3800-92-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3824-232-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4012-338-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4040-228-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4104-76-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4248-532-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4268-361-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4352-247-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4368-278-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4428-370-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4476-452-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4592-394-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4668-44-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4668-579-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4772-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4780-520-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4784-167-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4796-446-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4880-541-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4896-32-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4896-576-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4900-296-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4904-188-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4908-256-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4932-80-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4996-514-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5016-175-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5052-563-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5084-67-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5088-410-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5100-496-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5104-545-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads