7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe
Size

1.2MB
MD5

2ab5b5299f5df4408ca6690f0e1d7bb4
SHA1

c1db32bd97c29e52645f18794a282fab2b9d53d4
SHA256

7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560
SHA512

607786f1ba611e7f1726b84784bd52244cf075db1de31731ddba5e9c26b86ebc122c73aaa958130efe7ddc77decdc5601e7e65f7de01287dda65d0f6405e3ccf
SSDEEP

12288:9QtKYlFiWZCXwpnsKvNA+XTvZHWuEo3oWiQ4ca:9vYlFiWZpsKv2EvZHp3oWiQ4ca

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jblpek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojjolnaq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gohhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gododflk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flnlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffimfqgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaedkdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lebkhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gicinj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmnldp32.exe

Executes dropped EXE 64 IoCs

pid	Process
5092	Ekjfcipa.exe
1652	Fafkecel.exe
2664	Fdgdgnbm.exe
4728	Flnlhk32.exe
2080	Ffimfqgm.exe
1184	Gododflk.exe
2184	Gkkojgao.exe
2376	Gohhpe32.exe
1856	Gicinj32.exe
4340	Hopnqdan.exe
3504	Hbpgbo32.exe
2392	Hcpclbfa.exe
3500	Hkmefd32.exe
4016	Ikpaldog.exe
3264	Ikbnacmd.exe
3064	Imakkfdg.exe
4252	Iihkpg32.exe
3696	Jfoiokfb.exe
2940	Jfaedkdp.exe
1684	Jlnnmb32.exe
3012	Jbjcolha.exe
4732	Jblpek32.exe
3548	Jcllonma.exe
4240	Kbaipkbi.exe
2000	Kbceejpf.exe
4848	Klljnp32.exe
800	Kibgmdcn.exe
3664	Lpnlpnih.exe
1696	Ldleel32.exe
4880	Lpcfkm32.exe
3312	Lebkhc32.exe
2936	Mipcob32.exe
3824	Mmnldp32.exe
4404	Mplhql32.exe
2496	Meiaib32.exe
4524	Mmpijp32.exe
952	Mdjagjco.exe
4908	Mgimcebb.exe
2200	Mcpnhfhf.exe
412	Menjdbgj.exe
4448	Ndokbi32.exe
4592	Ngmgne32.exe
3248	Nilcjp32.exe
4420	Ndaggimg.exe
4868	Ncfdie32.exe
1372	Neeqea32.exe
4472	Nloiakho.exe
3488	Ncianepl.exe
840	Npmagine.exe
2640	Nggjdc32.exe
3156	Odkjng32.exe
704	Oncofm32.exe
4088	Odmgcgbi.exe
4216	Ojjolnaq.exe
4668	Odocigqg.exe
1976	Ognpebpj.exe
2428	Onhhamgg.exe
3948	Ogpmjb32.exe
1048	Oddmdf32.exe
3204	Ogbipa32.exe
4260	Pmoahijl.exe
2272	Pgefeajb.exe
2876	Pmannhhj.exe
2484	Pclgkb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pgefeajb.exe	Pmoahijl.exe
File opened for modification	C:\Windows\SysWOW64\Acjclpcf.exe	Ampkof32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Pmidog32.exe	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Oncofm32.exe	Odkjng32.exe
File created	C:\Windows\SysWOW64\Oddmdf32.exe	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Jgbcdnbb.dll	Gohhpe32.exe
File created	C:\Windows\SysWOW64\Jlnnmb32.exe	Jfaedkdp.exe
File created	C:\Windows\SysWOW64\Gjeieojj.dll	Lpcfkm32.exe
File created	C:\Windows\SysWOW64\Maghgl32.dll	Amddjegd.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Jfaedkdp.exe	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Ojjolnaq.exe
File created	C:\Windows\SysWOW64\Amddjegd.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Mdjagjco.exe	Mmpijp32.exe
File opened for modification	C:\Windows\SysWOW64\Odmgcgbi.exe	Oncofm32.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Mipcob32.exe	Lebkhc32.exe
File created	C:\Windows\SysWOW64\Pnakhkol.exe	Pclgkb32.exe
File opened for modification	C:\Windows\SysWOW64\Pnakhkol.exe	Pclgkb32.exe
File opened for modification	C:\Windows\SysWOW64\Ncfdie32.exe	Ndaggimg.exe
File created	C:\Windows\SysWOW64\Cihmlb32.dll	Ndaggimg.exe
File opened for modification	C:\Windows\SysWOW64\Onhhamgg.exe	Ognpebpj.exe
File opened for modification	C:\Windows\SysWOW64\Ogpmjb32.exe	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Pdkcde32.exe	Pnakhkol.exe
File opened for modification	C:\Windows\SysWOW64\Gkkojgao.exe	Gododflk.exe
File created	C:\Windows\SysWOW64\Flakmgga.dll	Iihkpg32.exe
File created	C:\Windows\SysWOW64\Jbjcolha.exe	Jlnnmb32.exe
File created	C:\Windows\SysWOW64\Lqnjfo32.dll	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Clbcapmm.dll	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Ghngib32.dll	Pnakhkol.exe
File opened for modification	C:\Windows\SysWOW64\Gohhpe32.exe	Gkkojgao.exe
File created	C:\Windows\SysWOW64\Klljnp32.exe	Kbceejpf.exe
File opened for modification	C:\Windows\SysWOW64\Lpcfkm32.exe	Ldleel32.exe
File created	C:\Windows\SysWOW64\Hmcjlfqa.dll	Ampkof32.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Afoeiklb.exe	Aabmqd32.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Fafkecel.exe	Ekjfcipa.exe
File created	C:\Windows\SysWOW64\Kbaipkbi.exe	Jcllonma.exe
File created	C:\Windows\SysWOW64\Knfoif32.dll	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Jcllonma.exe	Jblpek32.exe
File created	C:\Windows\SysWOW64\Bagcnd32.dll	Lebkhc32.exe
File created	C:\Windows\SysWOW64\Agocgbni.dll	Ndokbi32.exe
File created	C:\Windows\SysWOW64\Bebblb32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Chncif32.dll	7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe
File created	C:\Windows\SysWOW64\Qmmnjfnl.exe	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Imakkfdg.exe	Ikbnacmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5180	4108	WerFault.exe	200

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifndpaoq.dll"	Neeqea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flakmgga.dll"	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nodfmh32.dll"	Mplhql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hopnqdan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbpgbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqdeld32.dll"	Kbceejpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhgaocmg.dll"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fafkecel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmannhhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhaomhld.dll"	Jcllonma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncfdie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaheeaan.dll"	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojjolnaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbmhofmq.dll"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amhpcomb.dll"	Ldleel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gohhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odgdacjh.dll"	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cihmlb32.dll"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onliio32.dll"	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajckij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flnlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agocgbni.dll"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjdgn32.dll"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghngib32.dll"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffimfqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmlihfed.dll"	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlfofiig.dll"	Ncfdie32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 5092	4792	7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe	81
PID 4792 wrote to memory of 5092	4792	7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe	81
PID 4792 wrote to memory of 5092	4792	7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe	81
PID 5092 wrote to memory of 1652	5092	Ekjfcipa.exe	82
PID 5092 wrote to memory of 1652	5092	Ekjfcipa.exe	82
PID 5092 wrote to memory of 1652	5092	Ekjfcipa.exe	82
PID 1652 wrote to memory of 2664	1652	Fafkecel.exe	83
PID 1652 wrote to memory of 2664	1652	Fafkecel.exe	83
PID 1652 wrote to memory of 2664	1652	Fafkecel.exe	83
PID 2664 wrote to memory of 4728	2664	Fdgdgnbm.exe	84
PID 2664 wrote to memory of 4728	2664	Fdgdgnbm.exe	84
PID 2664 wrote to memory of 4728	2664	Fdgdgnbm.exe	84
PID 4728 wrote to memory of 2080	4728	Flnlhk32.exe	85
PID 4728 wrote to memory of 2080	4728	Flnlhk32.exe	85
PID 4728 wrote to memory of 2080	4728	Flnlhk32.exe	85
PID 2080 wrote to memory of 1184	2080	Ffimfqgm.exe	86
PID 2080 wrote to memory of 1184	2080	Ffimfqgm.exe	86
PID 2080 wrote to memory of 1184	2080	Ffimfqgm.exe	86
PID 1184 wrote to memory of 2184	1184	Gododflk.exe	87
PID 1184 wrote to memory of 2184	1184	Gododflk.exe	87
PID 1184 wrote to memory of 2184	1184	Gododflk.exe	87
PID 2184 wrote to memory of 2376	2184	Gkkojgao.exe	88
PID 2184 wrote to memory of 2376	2184	Gkkojgao.exe	88
PID 2184 wrote to memory of 2376	2184	Gkkojgao.exe	88
PID 2376 wrote to memory of 1856	2376	Gohhpe32.exe	89
PID 2376 wrote to memory of 1856	2376	Gohhpe32.exe	89
PID 2376 wrote to memory of 1856	2376	Gohhpe32.exe	89
PID 1856 wrote to memory of 4340	1856	Gicinj32.exe	90
PID 1856 wrote to memory of 4340	1856	Gicinj32.exe	90
PID 1856 wrote to memory of 4340	1856	Gicinj32.exe	90
PID 4340 wrote to memory of 3504	4340	Hopnqdan.exe	91
PID 4340 wrote to memory of 3504	4340	Hopnqdan.exe	91
PID 4340 wrote to memory of 3504	4340	Hopnqdan.exe	91
PID 3504 wrote to memory of 2392	3504	Hbpgbo32.exe	92
PID 3504 wrote to memory of 2392	3504	Hbpgbo32.exe	92
PID 3504 wrote to memory of 2392	3504	Hbpgbo32.exe	92
PID 2392 wrote to memory of 3500	2392	Hcpclbfa.exe	93
PID 2392 wrote to memory of 3500	2392	Hcpclbfa.exe	93
PID 2392 wrote to memory of 3500	2392	Hcpclbfa.exe	93
PID 3500 wrote to memory of 4016	3500	Hkmefd32.exe	94
PID 3500 wrote to memory of 4016	3500	Hkmefd32.exe	94
PID 3500 wrote to memory of 4016	3500	Hkmefd32.exe	94
PID 4016 wrote to memory of 3264	4016	Ikpaldog.exe	95
PID 4016 wrote to memory of 3264	4016	Ikpaldog.exe	95
PID 4016 wrote to memory of 3264	4016	Ikpaldog.exe	95
PID 3264 wrote to memory of 3064	3264	Ikbnacmd.exe	96
PID 3264 wrote to memory of 3064	3264	Ikbnacmd.exe	96
PID 3264 wrote to memory of 3064	3264	Ikbnacmd.exe	96
PID 3064 wrote to memory of 4252	3064	Imakkfdg.exe	97
PID 3064 wrote to memory of 4252	3064	Imakkfdg.exe	97
PID 3064 wrote to memory of 4252	3064	Imakkfdg.exe	97
PID 4252 wrote to memory of 3696	4252	Iihkpg32.exe	98
PID 4252 wrote to memory of 3696	4252	Iihkpg32.exe	98
PID 4252 wrote to memory of 3696	4252	Iihkpg32.exe	98
PID 3696 wrote to memory of 2940	3696	Jfoiokfb.exe	99
PID 3696 wrote to memory of 2940	3696	Jfoiokfb.exe	99
PID 3696 wrote to memory of 2940	3696	Jfoiokfb.exe	99
PID 2940 wrote to memory of 1684	2940	Jfaedkdp.exe	100
PID 2940 wrote to memory of 1684	2940	Jfaedkdp.exe	100
PID 2940 wrote to memory of 1684	2940	Jfaedkdp.exe	100
PID 1684 wrote to memory of 3012	1684	Jlnnmb32.exe	101
PID 1684 wrote to memory of 3012	1684	Jlnnmb32.exe	101
PID 1684 wrote to memory of 3012	1684	Jlnnmb32.exe	101
PID 3012 wrote to memory of 4732	3012	Jbjcolha.exe	102

C:\Users\Admin\AppData\Local\Temp\7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe
"C:\Users\Admin\AppData\Local\Temp\7d0cd390ff25d37692fc99133ca67e16a7bbe5e44a685879ac9139d051f28560.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\Ekjfcipa.exe
  C:\Windows\system32\Ekjfcipa.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\Fafkecel.exe
    C:\Windows\system32\Fafkecel.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\Fdgdgnbm.exe
      C:\Windows\system32\Fdgdgnbm.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2664
    - - C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4728
      - C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4732
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3548
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        25⤵
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2000
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4848
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:800
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1696
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4880
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3312
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        33⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2496
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:952
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2200
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:412
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        44⤵
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1372
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4472
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        49⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        50⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2640
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3156
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:704
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4088
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        56⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2428
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3948
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        60⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        61⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4260
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2876
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2484
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3556
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        68⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4076
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        71⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        72⤵
        Drops file in System32 directory
        
        PID:2772
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1172
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        74⤵
        Drops file in System32 directory
        
        PID:4392
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:908
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1364
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1628
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        78⤵
        Drops file in System32 directory
        
        PID:4680
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        79⤵
        Modifies registry class
        
        PID:2164
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3580
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4512
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4104
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        84⤵
        Drops file in System32 directory
        
        PID:1964
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        85⤵
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        86⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        87⤵
        Drops file in System32 directory
        
        PID:4544
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4600
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3876
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        91⤵
        Drops file in System32 directory
        
        PID:4304
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        92⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2148
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3588
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4228
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        96⤵
        Drops file in System32 directory
        
        PID:3584
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        97⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        100⤵
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        101⤵
        Drops file in System32 directory
        
        PID:2708
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1804
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        103⤵
        Drops file in System32 directory
        
        PID:4324
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        104⤵
        Drops file in System32 directory
        
        PID:4000
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3456
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        106⤵
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1772
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        108⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2828
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        110⤵
        Drops file in System32 directory
        
        PID:3636
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        111⤵
        Modifies registry class
        
        PID:712
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        112⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3532
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        115⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2408
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        118⤵
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        119⤵
        Modifies registry class
        
        PID:1636
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        121⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 404
        122⤵
        Program crash
        
        PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4108 -ip 4108
1⤵
PID:5152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
1.2MB

MD5
243dd449ba154da0244f0856f36edb4f

SHA1
da85eca2ef97dc2172c827bbf566f580d1f71f07

SHA256
1f2984cba78375b299df7fa6d6532813ef5a2fe7ce9bbaf5b76c77ce486ed005

SHA512
864624bca9e71af3a2609283061ca73e697578c0b6511cfc70c02f98f37dfba45f5ffa8fdc4de7c90c50aa1cf02013b782707b390cced0b3dcd41ef7d728eb39

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
1.2MB

MD5
254a04848fe5dfe6f1c567203b1531d3

SHA1
e972520cc3ac0b7361f943bc65ae7ed16603b150

SHA256
724ebc02966a068bc7d8b95887477a7f1a8d45e0f2922dea6a1640c4b617bb3e

SHA512
494b13ef4769cfc96de246f3abb45d920a6766a5320fbac80ff85479bc1aaf8a505a0ed0386472ec8248ec8a65aaa3f33e10eab3db54a07646a2e313c572211a

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
1.2MB

MD5
7c77402009b699c1e11416a4a5407833

SHA1
e08a843132f5a57fc482a0cda872c510b8bc7270

SHA256
d143c99ab3b320dfb7b6f4f63499eccee7cae8af487692d80f79f29962fe885f

SHA512
28d310617fe0da3a4944e7c68cfe6e9991deea1b7308fe5f9383783966a4c6aeb93442a73f652e0e1c1eab01a1b40353561806bf39f961d8ce6f3ce0fcefa4b4

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
1.2MB

MD5
aab09377b1431bc41865ed098e2f0652

SHA1
8123e416545fee10b2550df1ecc4508a2ed867d8

SHA256
fba588276af15491636f02a81e9fec50c4fa4e0b1fcdd4e2988b7520f38c7821

SHA512
4827469d968ca88037157476178c2f91542f25e9c2a83dc44d5031ff8491938fa600db4cf49fcd3a279135af6b5c39e6a0b6489c641b4356a5a5ccd45695d137

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
1.2MB

MD5
290a8cb8917e6b4ee84dc51f83fc31f0

SHA1
c0ecfa58a775e83d4c77a91a2fed769a43a49d9f

SHA256
372df6604733220f067749fb337a673672abe931fa8c0af55fbae8af2bef64c2

SHA512
12549ef860ff5862759fc191ef9593fa7d61a3480ec4747fb68cdb3ae7c84d2c9c458f0a6713955436fc63323dac528238489f5a1b4a13295685fb2294f7ea47

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
1.2MB

MD5
fe01735bae70829ed9fa01b8686b1c47

SHA1
2e2a561a863ae7b8cd996cafee9b9fc2d9d9bec6

SHA256
e4afa395312fa38b80e588f8b874bde04297372485deeb5317a20375648ce63f

SHA512
eff1c6ea144079eccacde294c76390ac4c520310f87da4dd716e009229cc6f33366df96ea89dccce54c9252882d14329635b022a9070ad67783127408744075f

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
1.2MB

MD5
4d53a4c97e9c70cd6fc853f62375d951

SHA1
7f4971f318dcabf87a8c9647e876bda0081a3db6

SHA256
33433d203d2dfa24902e48aca470a33530402a3eac3162fba33c15921bbf9cd8

SHA512
be1523063b6787d5066f7e45e9fe9c2fa1db1db085a836bd0720425a969739d0cd7533330280a5ed6fd1f6fff5678ef79a6006cc8d21c4964b5bc61a783a2a82

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
1.2MB

MD5
d73c97978b485e3c8f286386ac3f46a8

SHA1
a079b0e31da4912a013cc9611b009a4c7c3d0486

SHA256
bca39908fb06067726c6c037195dfd416fb9d293c8a9b50cca039c0e07882f7b

SHA512
0fbe439ed76bc9d65e35e10ce1d74e3cacebd7722231d27a94263cec6c1bb72ff0687e98a5bb24acc9bcafbe7b8680e96c28a554e73c5554137660d5a507d004

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
1.2MB

MD5
c0f9f7dd56f07597e7d98bcbe179dfd2

SHA1
b6f08994299f0c974c0bede8af970e1d7f03e058

SHA256
0d2f3195ed4d3ffed89d0bcb5e868328c982db1b07e8dfc114477e3ca5442592

SHA512
a33b277440a123afedb13d668cc998314df3dca1f1545e32ddf5fc82aac2519de6e6330af0ec6c6bc695b36ccb4e26ab3cdc7585eb2f5ddf8065330160643650

Download Submit
C:\Windows\SysWOW64\Ekjfcipa.exe

Filesize
1.2MB

MD5
4d5c8197c29d54ee4d06f58a551dbe22

SHA1
ec5d4737710aabb2cbd1d8ed6d913fbc2e6b76bd

SHA256
73404d875904bff014b7ca13f2a3d261482f53fa39e6da0aadc679dcd7b1c97e

SHA512
650116d78973382aa3a6b97227c66fa49f12e68aa2de2a6445e58b0f2f2897216e3757afadc20cc8cad24c5f1482889052d1156d0fc9b03351eb7f274ff5a59f

Download Submit
C:\Windows\SysWOW64\Fafkecel.exe

Filesize
1.2MB

MD5
be8f2082dde84211408dc47152749971

SHA1
df625ce8b1d35af6620a76719a933e2248227336

SHA256
e1905e84df7df853ba736496caa13ef237dd74ed2b4ce034bf72c41368f0b84b

SHA512
1a76e1d60956e395a60810d95441d531d4db767c6379c414b4b4b27988f8d4afd533c43355c0d53d4718ab31c82e1271c16b1f1650bf272db8fde8f37054d447

Download Submit
C:\Windows\SysWOW64\Fdgdgnbm.exe

Filesize
1.2MB

MD5
3d15efc16650d305b88f9ce92bad69c4

SHA1
0787d7071a8f8fa12d8b543577e397dd9c8538a1

SHA256
f08e20bb3fe90fcfbf45142c89cb136a562c6cdd5340d14041f33f8b53227ef6

SHA512
969d542dfd43d18453cb04528ca589cae10373f84248d5d6679d2b722f0275149fd933005617fde8bd87f7e106eeafb5d99168ce814709f81127c45fc7525f6f

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
1.2MB

MD5
4bafcfefe87325eb973ff4cab0fb22a6

SHA1
da82c5fe4e2d247e84f90c74f314e36bf8c4d36b

SHA256
bab65f89841d78f72b7c1e73f9d659262abf9843130ba993ee8fd0341d41e217

SHA512
bd644d4b4eede46fb1c15fde91e82d7690c38209d31ebc339f76476ba35613252ebc5268ffee8f3628c53554b3c3b1281106cf97ecd5b2bd031d0cc9ac1ba27c

Download Submit
C:\Windows\SysWOW64\Flnlhk32.exe

Filesize
1.2MB

MD5
c1c93a7971fca5e0a79e52b5be3ff1c8

SHA1
4c1c86c31616deb7da3096f4b7bc932e6b2d49d9

SHA256
175541a9601d78504fc2127148443a67c84934b75510c602cca46adcba7ac90b

SHA512
5ddb9e1a7fe7cfc26d999ca5cfd85fb7f0b1221a30e0d2c8b9f9f5cd4ce93fca110d37a4846e4bd6781e25e9a2b6e78dc5a1ccb3e6fcd10fea6cc5c46afdbd06

Download Submit
C:\Windows\SysWOW64\Gicinj32.exe

Filesize
1.2MB

MD5
ac123f94a183da9f843ba5c6e2d78740

SHA1
1b3ac4190874a1a592588f38aa71aa935663fcb6

SHA256
1303d25ff5045b84a9ce1d5ff8136c0468fd86a3af414044e40b86e7c5226942

SHA512
bc6e19fc6951d4b8a3c2c2f84894a342950a4b8d239e1b4dc9a91f6cd78037151699b40745b8b076874235b8cc04ad4020c204b891df630e74e00a4996aa2939

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
1.2MB

MD5
6be91a6f0723435f40e6f1f03a71cfee

SHA1
d1bf803d10a3754dd828a1afb3ad35870476ccd7

SHA256
e236346976b8e02860a8b14fcda07155bd29320612c23d85a6353b7718a19fff

SHA512
f29df4bb29001aeb159d8efb5e23a600109205efb5f3ee87158b18b662cd5cd08303ecbac20d24bc8c46a4db73cc94e78b24a6a9a7bc619212885d0994b3d8ce

Download Submit
C:\Windows\SysWOW64\Gododflk.exe

Filesize
1.2MB

MD5
ff64cc35fa0becb11b571ab4970d457b

SHA1
012fcca93d5d4ee8d3b7766806ff12e35f7f5d45

SHA256
3285b837439bce516779d3e89906ff284ea2d666203c38c4a5af3c04afdc9ef2

SHA512
4f575811cde7faea7a1a862e13e2b24d628eeb50683b5d4bb613ed3c6d83b6829a1ae147f161c5e908abc358e72eb6de23e0051e945523369e54a3cf3904233b

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
1.2MB

MD5
3db70b838646f53c3f46b0f5c27efa1c

SHA1
a2c6f3e40ba0328a061cf05da0e8e55581fd6385

SHA256
b33a86cbfafdeb66f17399626f51db2eb7c9b28c4d28909dff56461be88c900c

SHA512
3a7944b437a65eb2c4d68ebf2053a138aeb5beadfac1f3f4f4a23547404f9b1e2ba0cdd9dfbca7b6acd403ac2b4baff0b75bac48fecf4790ec04e390a5eec7e3

Download Submit
C:\Windows\SysWOW64\Hbpgbo32.exe

Filesize
1.2MB

MD5
03850b24d74ba73e0cac4c152d1e9438

SHA1
6ad17f22c860d5f5ffe5531a0f8dc761058a34aa

SHA256
8bb41e1a43c10d06c2f97ec164d6ae1f447a0c0259c85d0f6a17237d6f4d6a29

SHA512
179467be6da2e40d752edf63507d891148132547fe8a6971234d9b62f3e518e2dd5d0b60603d04cf35a64254020fbc4c97b7769cdfe181f8df20fd953ca7af39

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
1.2MB

MD5
77a276965655ac82ade16fdc298e59b7

SHA1
b5afa4b6160d6fcdbdb4006fe83fce25cb161cae

SHA256
d8c17b2fcd83b4ccccaee5975856e4c4574678efe203aea1abbe1d8a29bb0477

SHA512
7a818cd2a36464dedf53f71253949c3cbc1c2c1f24798791f7fec10eb90acc180ef6e111cfd9962e23433f207548582b0f241c6ac01b2a29ebb0b365be520c0c

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
1.2MB

MD5
2d24a4c68e2c2de4840c10dbf25e350c

SHA1
ae32532c9273bb5b6e7c675d73949be8ad1e7c2c

SHA256
6ff270215eefbc52909e42299a6bc0fc144311bd1dbb95e14071f26f1a380259

SHA512
df0a0fc3f638ea4b2996a34c6d38c03f0e7b290d75656b1382791b6c3cbdcb3fe1740e1e59cdba9a6f17e445823ada9fc9cb32bab3a0efb77224d3e3d42ba25d

Download Submit
C:\Windows\SysWOW64\Hopnqdan.exe

Filesize
1.2MB

MD5
b7da41d5084225e2631728f59e70babf

SHA1
034220081f358e86a5c40ccfea98820ba8108d1e

SHA256
af0260fe8f8a05de260328aa576b8be9f2cf35bc767fde84efd5215364925da0

SHA512
d8efd4852bb019c6321fe74f3b191d49e324ac8a762fe5498e9332bb2eff1adf5daf62346a16cb56d6fa07040eda1c06cd7e2ec09deb31ac268c2aaeb36177f6

Download Submit
C:\Windows\SysWOW64\Iihkpg32.exe

Filesize
1.2MB

MD5
3e275a9f34434c72d63818d02b6d8ba5

SHA1
5fdb13249b7f7b6942ce96cf44f7758f6cfcf561

SHA256
02b883d6797346d277286383b22f30b1aa2634f5622185384f0d1a1ffffd49be

SHA512
96833e662ce5ed812565155dd7fc9baae16447c535562c6593e04537f4dd504cd3329c5fe52d3821d09f321c9e7df22708351b4dfca1bd7485c0eacf8025634d

Download Submit
C:\Windows\SysWOW64\Ikbnacmd.exe

Filesize
1.2MB

MD5
465d3f63a6a849844e867d7fd4a8f13e

SHA1
66ced49e5b215d2fcb2d07c79c437994c4de9e24

SHA256
bff370ed8c6972ec7b0f09e5dfc99f88160c8d6c7d758f6e094ef6c63cd0a407

SHA512
970237af4d12c927b722d3b303b67b917500b35d8e381538b0d7bd2db1b50fa660f7fe17c261945cbd802577a879c505138d4d225b7e1b9f150d46080996e824

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
1.2MB

MD5
2909f60ea68d3057d60217145dc375bc

SHA1
b7c8d9d2a2865ffd9e67a647d254ab7530da3d42

SHA256
b101a29e38ae9dbba360df8e0a58dcef4c721219cc8173fab7090855daeb32be

SHA512
08a5fa619a01712117a841feff744cabedca06204aec16800a94f1f598fb8d4a7c25bdb26c8c16f09877d959a592618c182789dec204b0394d8d7e44f76fc364

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
1.2MB

MD5
8fdf6810960ab9b6268b622d08d79cd0

SHA1
a1cc1119b2fddeaba883a77b6c6eab2cd267a091

SHA256
c98d8cbb3bd7aaa28c8ef1266dd527fceef291daf8cd1ca0ca306eef4e78f6aa

SHA512
d6810a05e1c854c3885694f033cea3c3fbc3202947ea64b295615a232bed1826c915f10fa43627e3158c41b5641323ed8c2488c8845eba4343069b1a0d6a929c

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
1.2MB

MD5
be8f791a72299185b435894b11ff1aa6

SHA1
48551bef0bf36c14bba78b1ff296e982c522f5d9

SHA256
bec76d321d2922e6116d4e03ead7a0530b8a066a46aad7f0caebfaf92e67cfcf

SHA512
d75a27cf3b09e11463117ada6580de885fd824186fca4c80d2051a79da1610cfec182cf6be8bc6a6929684491682843975382efb4d26c96075417426ffa0ddee

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
1.2MB

MD5
7a518226aed3b56e76c9ae0cd82fb29a

SHA1
e7cebe75005b7a1db0fe54d16238c6f3aec3d06d

SHA256
5f5e6d164a14adbc39943a1edf867e09c0c33aabc1c8308047322bcfee5704fe

SHA512
aebf36643a02eac18c30e59e22c4b603264c656e2fe495ce82641e8e12bd1ad83e3ccee24cfec29a2f7c527653075849070096b4215c7fa8c0d9d71090f06be8

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
1.2MB

MD5
c5ac437fa8de802ea4fc0226b4a221fb

SHA1
3111ab745ee47d6a37477b03b5994c6f1fe2ee28

SHA256
f7a19c39a6f41fa10f352048357174fd25d7e7a1e14a12d192b6832926e139b1

SHA512
216e0ce5c68960a66682346e7800220c7d722cb4b3ff4b5fe0fb758386b980cc37ae97785ca75c4ee469989550ddf8fc6040018f90a0fbe0e41464ffabdc2c7d

Download Submit
C:\Windows\SysWOW64\Jfaedkdp.exe

Filesize
1.2MB

MD5
bc4d6eb8e06fbc5d5fbbf216a109f3c8

SHA1
3e677d454015bc4bfcdca73c5c8667ad34976c9d

SHA256
6c8d9d91e7ec966e8cbf7c375b53d816e73c44ce0796edcc066457d6b580e45d

SHA512
06bb1c6fff81bb93fb36e6410fbc44034aa198935486b907800630d7055563d84472f3c367eb19bbb149c7d897ccd02bd5b442da8b595a872d7dc969fcd0f1c9

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
1.2MB

MD5
e49911a30505d1c6c26029deccb0bfc0

SHA1
278e4b5ac15e22952c6b0cb3366584deeb242fcf

SHA256
6c834ffae49a1208dbb3ef010e738a85fdb1efbaeba84a2a13d76074da0e56da

SHA512
2cb36b7c1abeadfc79a84b3f234ae897edc9c63ccb39f684e7edce02f54c32561d892f08387943181c7fb071a4d772c0f112d0c39aac4bea5996056651192a2c

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
1.2MB

MD5
a1e9ce7d31fab153593d288104dd9e85

SHA1
5f09379355a3f2529138ad4960a60b9cdb4522fe

SHA256
b5abe66a72a5e94d666564fb9c3ee24dfb081dcee06a52170b2a8d459a2c6748

SHA512
4bd3da3f6972e202c9d9cd5ec3478ddb8171f4873d558e7df345563adc2368ba358cea216818114835ba202e18c4b31f82df2b0d7ae1b6c194be88fa20c6c32f

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
1.2MB

MD5
aa44683ead412fd7fb1012921b964c12

SHA1
3e7162c5c3d82afe038d51a51270a1269b072984

SHA256
fbb137ec4ac1b474644cc1040274f0af24af5c2f2663bd3803d8b3d078c8b026

SHA512
424ccaa1c23b7f843123c2b22b95b38bbe33c672a564b995e66e5313a4c07a49b48b38a29215a8af3d953cb7d457bb16bbbcfb3d757198d663a2aa24ecb02748

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
1.2MB

MD5
c5bdffff4db8abb3c6000571140977e4

SHA1
535050cb01fb2629d7f52a9784fb5586d1ba51fd

SHA256
ef45bb54694978a0ec6e70848bbf02c55482e75d76b53d61af81a8273653d5a7

SHA512
42e475d89a7036fedab8dbf54f543697d4dae60d4a0314678c2490038d5b79c554ab51665a2029b2ae6cd4e85d436d49b68a8d996460a86b12cd1b1605898c34

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
640KB

MD5
170f6d43fdc176f5e89983b94fd6f1ec

SHA1
55dd9a9ca0a5f04a4d9dc168c2a419ac55332238

SHA256
4f6489cf688f163f866740ad3c94db51a4c931e143597d744ede423aeeb6d01e

SHA512
b62ec49257a96b3a0b666a80d5628d0946cf039d8fd1ffe6456edc29cc744d4be7f17af71974851b70dbdd04f9f878e7498b0c95ffd6e1f3fd221b10cadd18ea

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
1.2MB

MD5
6b2f9712e87b2713a5a39b42b3f28afd

SHA1
84ac909203168fb35440c3b8de6d72048038b76e

SHA256
b539e036222fe4b6506caf784dfceb382155018da5faa09a5ddd07137846c507

SHA512
2d9107f32f050fd74a07216a7c02d19e8a0a2e072516af1ef22a3d1c798c48061947c34970b2b84054c65ba9c5264b594137af24e5040b5e280792454974e6f0

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
1.2MB

MD5
c28c0c06391e79cdb223c64cd84a8cdc

SHA1
207cf8fc5607fab451c71f7c82cc34cc7bba7a5c

SHA256
7aca65a267ac2a72f589dc0b12c9eab413a31b3efdfea00a21dbb7de0b7865f0

SHA512
d5693dd660c6fb7e339921912f4ccc1bfd90b1d6a9b1abfd305cb2339f7ca91fa6cbf47438fc7e4a2a941cafd24c5b4c2a101ca2787f76585ba9ff893b15a3d7

Download Submit
C:\Windows\SysWOW64\Ldleel32.exe

Filesize
1.2MB

MD5
8c9b207d80973faf220a2cebd8082d7c

SHA1
b7387c0c061ad7388cf4555362c1d098f258041c

SHA256
8603f3fbe2a9359164229d14ad7d45fb59165c961434bdad3b6a70f7a14995d7

SHA512
8a6154f4abfcfc97adf0d83197e90a4326e82ff1c63879ccecaa6cfef1a68f5fcb86466f8be1f2ae899c96ae44a69aaaa54561792be58bb18a83f6c7503acd48

Download Submit
C:\Windows\SysWOW64\Lebkhc32.exe

Filesize
1.2MB

MD5
4b65625fb4a89108e884cbe3154db456

SHA1
ee54daf4eaf5e6449a103157d3b749ea577e20ee

SHA256
ad7acf1403eef223840966f0ec4f6b619dffdc237d510afa509b7d415fc223d8

SHA512
34c7fbdccf531cd92586e674ff5d53f6088ba582aaa532b7519fd277a64f0a087e02cfb645d71551ae82eddaaa07645efe143fb0756d9a84efbc61d744eaf5e4

Download Submit
C:\Windows\SysWOW64\Lpcfkm32.exe

Filesize
1.2MB

MD5
2e069ae85e7b2d4ff27d12d60e6256f4

SHA1
f0ce55c05dd8a340155b5f62185e436f9a3a8e3b

SHA256
42a4a8f85bdc5fbb500466a5a35026d1d8bc1d8f6a69b836f2ed172f21362447

SHA512
4e96d9e382819a6d31331771e231186afc82d7d9db8cdf3fc8f54a45d94194f96b470dec56872f5fe293765ff8258c4aeccacdd9d92a6e378af686d7c57652fb

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
1.2MB

MD5
2dfdda72b5c5fecc3cce8a7a941617a4

SHA1
4993b390e0f40950c89f27967f0e3e9a3cba6ed4

SHA256
cf7325b65cb0c824adc0f695aba0ff9391385a6f1df81853feec27c8c4b11565

SHA512
ddf8294515ff6b6b74b4159511d71352b3c7a1ba43cd01163df3ad6c5992e84f9539799d449f8f9334fdba3c7fc035ba6b059896bfd3f81d246096db05e782f8

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
1.2MB

MD5
7aaa7e093a5716668f2cdbe6a854cac6

SHA1
d23f25160e4b8ca0b2f9268668ef5f8de0de9ec8

SHA256
fa0352cae1a09eba3fb8b727b5126b95a441c33fac08b2b6eacc05f52472d0bf

SHA512
90b56ab7ad7358b4f50d86b26a0a3ff60d1fb94d73923e3eb05f45d3089c4be7bbb2eac8bb811c00db8cac3dde416d5baa199151251b48e3939ff5c935c10b2e

Download Submit
C:\Windows\SysWOW64\Mipcob32.exe

Filesize
1.2MB

MD5
3827610c2f9c290ea89d82b0bfd87a5a

SHA1
5cc59acb2406fdc610b1ee14fdbd560358c77400

SHA256
66c245a9692c696bc31fab9e39419e142694cc3bb27c16c0e52dfe7a1e98b490

SHA512
45590a16e246f2564ebacf7b3231fc41df5fbb7e12162fb5ee29e37d25d7b964c2efec7179537e4f369024aa4299703bcdb9b13c6cc25b30fd8e86940b3bfe9c

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
1.2MB

MD5
51a811e7dfe3299c15c6d795bc675415

SHA1
b878d805aaf2eb1c6f40aa2dd20e299c607a9413

SHA256
f72bf7b17abef4ee7764e68e8514715cb5abf2c03230ffef1896ed5f46599bc1

SHA512
f4ba544d8b0ae768b240799e424e2a7b7be52183e4e0b858e1f614c4ce228763a44d687cd06f6e72081fcedd5e7b52d203f2dc8761d4fb67d9935c9d7085de1a

Download Submit
C:\Windows\SysWOW64\Ndaggimg.exe

Filesize
1.2MB

MD5
b3d3c6fc2830d69259452f6996de78e1

SHA1
3799c49445527f043c3f3d0dbfba817a614097d1

SHA256
1a2889c426881b058640b15de529d18856039f3caa2cd2fc9e376c4ca230933f

SHA512
f75ec63735d0ae02b780c5358c0f6e9cbed34b9664cf8f653651ccfb1726cbc0aa5390770eb4f71102a8b0990231b7f3fcc23f11a7d0bbbd236545d2fa5eb527

Download Submit
C:\Windows\SysWOW64\Nggjdc32.exe

Filesize
1.2MB

MD5
6b8d0cf60eebafd8336f7c31ae5e3848

SHA1
1eb8f0104804158226b6cd51fbbdd27fcfbb25c0

SHA256
d0632a25174ad8bd1ecf26a25690e3a21a29886857799d679086424788e074dd

SHA512
580610a4f77754bf00ee124d5dd5fe0938603fae2e3661496dfad1849c970de5ed945b6932d8724b20b98592a5e081eb441897a7de2ae33e6e03c3dcd69663b2

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
128KB

MD5
ff27ab0885fa768aa5f4cbcf4c1f317d

SHA1
05715da54cb2e02e47e1ef2c310f38c2cbf13a32

SHA256
db17c20b21e810455cc79c45c6637df8c49dca6d11f849ff7c5f2e0878584e95

SHA512
ad4f2c1776042272af308cf53f2c51260d00d790e73554aa8a7e0bfcc67841edff2d2a03c421f8a82d142d308551c8e19682f5f7baa87742338583c291d03f98

Download Submit
C:\Windows\SysWOW64\Ogpmjb32.exe

Filesize
1.2MB

MD5
672bfb054bf5acc80f2ef96848a7a1a6

SHA1
b3307344d8f9dc9b78f340211778bd871c91302a

SHA256
bbdf33106018e0d53b9f0f9b11f5868628b5308b2951adc06d67754d43c9a5c6

SHA512
fd77dc67fa998451c013e5f593533a615d519a2875612e891390f3aee00469d1e91e5fddf88f670d19b0eb1d9df4be7b9fc8e863a9688d01918b5d28df1b54ac

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
1.2MB

MD5
048ef4b8e5ff42f3d8e1b2ad96813bbe

SHA1
e4f2f4faf1566f757576c59e6d8b65a0203d8ce1

SHA256
1a722e8e5341268590f81547ac9a12d721b9fd785cb46fb1c8708fb6a95e3740

SHA512
009d3855fc0609958b016722c38584f95f7ddc6db76fbeea9a198b8cfbaffd6e277430d78e5c084133f0a582bba9bb52691ece4b17e9bbc5b4185cce8e3b9f3f

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
1.2MB

MD5
293c30addf99273ce357103b04580ef5

SHA1
5fbde04fdcf9cea3db6e1da30f6ec981d99e9154

SHA256
e1eac5ec4c05b6e8e83dd3aac65e51651f7975493d7d21d304f3ca62d157fd39

SHA512
a6e49e00a44323024c50cd5b6183d74e030174314ab9572071c2f3ef8ae3007df9c0ef927606a370e95678b6dfedcef5448144d1a9d37ae6c341734cf48a40e9

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
1.2MB

MD5
9ca81250f5e29b6eeefc1f7d6791db88

SHA1
6b95caca1826a07f93be76829e09cedbc30925f8

SHA256
aee484c6b9cdde3a9235738e14c11ab74c13df4ba41f9b6d29cdf3b45967e767

SHA512
78bf299d2019e03edd2ba73ecc196c7906fe9374e6e633bd663da8c1ea5e989121ccad3cba7e4e77ee85185d800367b6c8c54bc4a5718b044fc2eb1310f885f4

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
1.2MB

MD5
a831b0373787e171dc304132586dbc1d

SHA1
912e5ea79aad249934980b584d08e62f3b653069

SHA256
426816731d23af46a3d9bbd41c3a362f7071c96f7eecc42baa74bc5385e8eaba

SHA512
8ccc89e5befef0108828ae97ead71638742d2611b08181dfbc7cbf3eaa5ea1b9270d1c36c4955fc271e60c393e2dccff1e10364ea22213b121a84365041758ee

Download Submit
memory/412-305-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/704-377-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/800-216-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/840-359-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/908-509-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/952-287-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1048-419-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1172-501-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1184-48-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1184-586-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1364-515-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1372-341-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1508-580-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1628-526-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1652-559-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1652-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1684-160-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1696-232-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1856-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1964-566-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1976-401-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2000-200-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2080-41-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2080-579-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2100-485-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2120-479-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2164-533-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2184-593-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2184-57-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2200-299-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2272-437-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2376-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2392-96-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2428-407-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2484-449-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-275-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2640-365-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2664-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2772-491-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2876-443-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2936-256-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2940-152-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3012-168-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3064-128-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3156-371-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3160-467-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3204-425-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3248-323-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3264-120-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3312-248-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3376-462-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3488-353-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3500-104-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3504-89-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3548-184-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3556-455-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3580-541-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3664-224-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3696-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3824-265-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3948-413-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4016-113-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4076-477-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4088-383-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4104-554-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4216-389-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4240-192-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4252-137-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4260-431-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4340-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4392-503-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4404-269-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4420-329-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4448-315-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4472-347-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4512-546-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4524-281-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4544-587-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4592-317-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4600-594-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4632-560-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4668-397-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4680-528-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4728-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4728-576-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4732-176-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4792-539-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4792-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4792-6-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4800-578-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4848-208-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4868-335-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4880-240-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4908-293-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5092-552-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5092-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads