09cc8d4c4cd1cb4d5085a4a8c3ff662e6ed5683a378dc3ab72c384d0bb0a7dcb

Analysis

max time kernel
128s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09cc8d4c4cd1cb4d5085a4a8c3ff662e6ed5683a378dc3ab72c384d0bb0a7dcb.exe
Size

144KB
MD5

f5aff9c1a01ed27934a638137626e50f
SHA1

e7ca00e2616559d9548830d9b5bfeaf2783ba5e4
SHA256

09cc8d4c4cd1cb4d5085a4a8c3ff662e6ed5683a378dc3ab72c384d0bb0a7dcb
SHA512

4c4aed814e36f0187bb4e5973c9c8c4e9b66fbd0f8555ce7a4086dcbdda4052f1a48265a321a9a2b75c376dc269252cc6d1cde0da677b88fdceafc89344e0d2a
SSDEEP

3072:6jnR58UwiVOUqvaI9eyMpwoTRBmDRGGurhUXvBj2QE2HegPL:uL+iVDCm7U5j2QE2+gT

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbkkik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcdeeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mlhqcgnk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nfnamjhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblmgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nciopppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpccmhdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhqcgnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcpnhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnphoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lomjicei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfpell32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihbponja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjnnbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gihpkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlikkkhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljbnfleo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njljch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geanfelc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncpeaoih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfenglqf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaqhjggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hifmmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iefphb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjggal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ihbponja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlgoek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjidgkog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obgohklm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ommceclc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jbojlfdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Piocecgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jafdcbge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kekbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kefiopki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lomjicei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mablfnne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbbajjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Noblkqca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geoapenf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kidben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljdkll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nciopppp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gihpkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hiacacpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibgdlg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iacngdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhplpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ommceclc.exe

Executes dropped EXE 64 IoCs

pid	Process
4452	Gbiockdj.exe
4604	Gegkpf32.exe
3704	Ggfglb32.exe
1668	Gbkkik32.exe
4680	Gghdaa32.exe
832	Gaqhjggp.exe
4704	Gihpkd32.exe
1652	Gpaihooo.exe
3428	Geoapenf.exe
556	Glhimp32.exe
1388	Gbbajjlp.exe
428	Geanfelc.exe
1656	Hioflcbj.exe
4156	Hlmchoan.exe
3164	Hiacacpg.exe
768	Halhfe32.exe
3888	Hnphoj32.exe
3000	Hifmmb32.exe
2928	Hemmac32.exe
4084	Iacngdgj.exe
2424	Ipdndloi.exe
880	Iafkld32.exe
3336	Iojkeh32.exe
3536	Ihbponja.exe
2948	Ibgdlg32.exe
4240	Iefphb32.exe
2428	Ipkdek32.exe
3680	Jidinqpb.exe
2588	Jblmgf32.exe
1040	Jhifomdj.exe
3584	Jbojlfdp.exe
1256	Jlgoek32.exe
3736	Jpbjfjci.exe
3876	Jlikkkhn.exe
3936	Johggfha.exe
1912	Jafdcbge.exe
468	Jhplpl32.exe
1548	Kedlip32.exe
1604	Kpiqfima.exe
540	Kefiopki.exe
4672	Koonge32.exe
1796	Kidben32.exe
1592	Kpnjah32.exe
1588	Kekbjo32.exe
1036	Khiofk32.exe
3136	Kocgbend.exe
4508	Kemooo32.exe
2932	Kpccmhdg.exe
1004	Lepleocn.exe
3864	Lhnhajba.exe
2988	Lebijnak.exe
1576	Lllagh32.exe
2604	Ljpaqmgb.exe
4444	Lomjicei.exe
4072	Ljbnfleo.exe
3108	Lckboblp.exe
3796	Ljdkll32.exe
2996	Llcghg32.exe
1544	Lcmodajm.exe
1148	Mjggal32.exe
3504	Mledmg32.exe
1048	Mablfnne.exe
4464	Mjidgkog.exe
4524	Mlhqcgnk.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pcgdhkem.exe	Pjoppf32.exe
File created	C:\Windows\SysWOW64\Oipgkfab.dll	Mcaipa32.exe
File created	C:\Windows\SysWOW64\Fbbnpn32.dll	Mpeiie32.exe
File created	C:\Windows\SysWOW64\Mdcajc32.dll	Mlljnf32.exe
File opened for modification	C:\Windows\SysWOW64\Ncmhko32.exe	Noblkqca.exe
File opened for modification	C:\Windows\SysWOW64\Obgohklm.exe	Ocdnln32.exe
File created	C:\Windows\SysWOW64\Noblkqca.exe	Nmcpoedn.exe
File created	C:\Windows\SysWOW64\Maenpfhk.dll	Ocgkan32.exe
File created	C:\Windows\SysWOW64\Ihbponja.exe	Iojkeh32.exe
File created	C:\Windows\SysWOW64\Dbkqqe32.dll	Jhifomdj.exe
File created	C:\Windows\SysWOW64\Jicchk32.dll	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Nqobhgmh.dll	Mqjbddpl.exe
File created	C:\Windows\SysWOW64\Ghcfpl32.dll	Njbgmjgl.exe
File opened for modification	C:\Windows\SysWOW64\Gbiockdj.exe	09cc8d4c4cd1cb4d5085a4a8c3ff662e6ed5683a378dc3ab72c384d0bb0a7dcb.exe
File opened for modification	C:\Windows\SysWOW64\Pbhgoh32.exe	Piocecgj.exe
File opened for modification	C:\Windows\SysWOW64\Omalpc32.exe	Oonlfo32.exe
File created	C:\Windows\SysWOW64\Pimfpc32.exe	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Pbhgoh32.exe	Piocecgj.exe
File created	C:\Windows\SysWOW64\Foniaq32.dll	Lepleocn.exe
File created	C:\Windows\SysWOW64\Mlhqcgnk.exe	Mjidgkog.exe
File opened for modification	C:\Windows\SysWOW64\Mqjbddpl.exe	Mfenglqf.exe
File created	C:\Windows\SysWOW64\Nhhdnf32.exe	Nfihbk32.exe
File opened for modification	C:\Windows\SysWOW64\Ommceclc.exe	Ojnfihmo.exe
File opened for modification	C:\Windows\SysWOW64\Iafkld32.exe	Ipdndloi.exe
File created	C:\Windows\SysWOW64\Kafkmp32.dll	Jbojlfdp.exe
File created	C:\Windows\SysWOW64\Hiciojhd.dll	Kidben32.exe
File created	C:\Windows\SysWOW64\Eeclnmik.dll	Lhnhajba.exe
File opened for modification	C:\Windows\SysWOW64\Lcmodajm.exe	Llcghg32.exe
File created	C:\Windows\SysWOW64\Gghdaa32.exe	Gbkkik32.exe
File created	C:\Windows\SysWOW64\Llcghg32.exe	Ljdkll32.exe
File opened for modification	C:\Windows\SysWOW64\Nqcejcha.exe	Nfnamjhk.exe
File created	C:\Windows\SysWOW64\Ojnfihmo.exe	Obgohklm.exe
File opened for modification	C:\Windows\SysWOW64\Ljpaqmgb.exe	Lllagh32.exe
File opened for modification	C:\Windows\SysWOW64\Ljbnfleo.exe	Lomjicei.exe
File created	C:\Windows\SysWOW64\Ilnjmilq.dll	Mcdeeq32.exe
File created	C:\Windows\SysWOW64\Gpaihooo.exe	Gihpkd32.exe
File created	C:\Windows\SysWOW64\Haclqq32.dll	Gihpkd32.exe
File created	C:\Windows\SysWOW64\Geoapenf.exe	Gpaihooo.exe
File opened for modification	C:\Windows\SysWOW64\Halhfe32.exe	Hiacacpg.exe
File created	C:\Windows\SysWOW64\Ffdihjbp.dll	Hemmac32.exe
File created	C:\Windows\SysWOW64\Ofegni32.exe	Ocgkan32.exe
File opened for modification	C:\Windows\SysWOW64\Ppgomnai.exe	Pimfpc32.exe
File created	C:\Windows\SysWOW64\Kofljo32.dll	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Nfnamjhk.exe	Ncpeaoih.exe
File created	C:\Windows\SysWOW64\Cknmplfo.dll	Omopjcjp.exe
File created	C:\Windows\SysWOW64\Pcpnhl32.exe	Ojhiogdd.exe
File opened for modification	C:\Windows\SysWOW64\Jidinqpb.exe	Ipkdek32.exe
File created	C:\Windows\SysWOW64\Kpnjah32.exe	Kidben32.exe
File created	C:\Windows\SysWOW64\Kocgbend.exe	Khiofk32.exe
File opened for modification	C:\Windows\SysWOW64\Lhnhajba.exe	Lepleocn.exe
File created	C:\Windows\SysWOW64\Mpeiie32.exe	Mfpell32.exe
File created	C:\Windows\SysWOW64\Mqjbddpl.exe	Mfenglqf.exe
File created	C:\Windows\SysWOW64\Qckcba32.dll	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Fckjejfe.dll	Ggfglb32.exe
File created	C:\Windows\SysWOW64\Hlmchoan.exe	Hioflcbj.exe
File opened for modification	C:\Windows\SysWOW64\Hifmmb32.exe	Hnphoj32.exe
File opened for modification	C:\Windows\SysWOW64\Hemmac32.exe	Hifmmb32.exe
File created	C:\Windows\SysWOW64\Jhplpl32.exe	Jafdcbge.exe
File created	C:\Windows\SysWOW64\Lbfecjhc.dll	Gpaihooo.exe
File created	C:\Windows\SysWOW64\Jblmgf32.exe	Jidinqpb.exe
File created	C:\Windows\SysWOW64\Khiofk32.exe	Kekbjo32.exe
File created	C:\Windows\SysWOW64\Omopjcjp.exe	Ofegni32.exe
File created	C:\Windows\SysWOW64\Pififb32.exe	Pfhmjf32.exe
File created	C:\Windows\SysWOW64\Coppbe32.dll	Geanfelc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5016	5768	WerFault.exe	204

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fckjejfe.dll"	Ggfglb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mlljnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdockf32.dll"	Njljch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Obgohklm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaaklfpn.dll"	Pfhmjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jafdcbge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pabcflhd.dll"	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caecnh32.dll"	Mledmg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mablfnne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ockdmmoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajdggc32.dll"	Hlmchoan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haclqq32.dll"	Gihpkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kafkmp32.dll"	Jbojlfdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcmodajm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfhmjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ggfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpbjfjci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejhfdb32.dll"	Kpiqfima.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocdnln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flinad32.dll"	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkffgpdd.dll"	Kedlip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpifjj32.dll"	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjphcf32.dll"	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klhhpb32.dll"	Ockdmmoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Halhfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enalem32.dll"	Ibgdlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjnnbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gipbmd32.dll"	Ncpeaoih.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocgkan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coppbe32.dll"	Geanfelc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clmmco32.dll"	Iacngdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foniaq32.dll"	Lepleocn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lomjicei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nfnamjhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gpaihooo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Halhfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jblmgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ocdnln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hioflcbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Glhimp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjjkejin.dll"	Jlikkkhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghcfpl32.dll"	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Geoapenf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ipkdek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Khiofk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mledmg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iacngdgj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 4452	760	09cc8d4c4cd1cb4d5085a4a8c3ff662e6ed5683a378dc3ab72c384d0bb0a7dcb.exe	89
PID 760 wrote to memory of 4452	760	09cc8d4c4cd1cb4d5085a4a8c3ff662e6ed5683a378dc3ab72c384d0bb0a7dcb.exe	89
PID 760 wrote to memory of 4452	760	09cc8d4c4cd1cb4d5085a4a8c3ff662e6ed5683a378dc3ab72c384d0bb0a7dcb.exe	89
PID 4452 wrote to memory of 4604	4452	Gbiockdj.exe	90
PID 4452 wrote to memory of 4604	4452	Gbiockdj.exe	90
PID 4452 wrote to memory of 4604	4452	Gbiockdj.exe	90
PID 4604 wrote to memory of 3704	4604	Gegkpf32.exe	91
PID 4604 wrote to memory of 3704	4604	Gegkpf32.exe	91
PID 4604 wrote to memory of 3704	4604	Gegkpf32.exe	91
PID 3704 wrote to memory of 1668	3704	Ggfglb32.exe	93
PID 3704 wrote to memory of 1668	3704	Ggfglb32.exe	93
PID 3704 wrote to memory of 1668	3704	Ggfglb32.exe	93
PID 1668 wrote to memory of 4680	1668	Gbkkik32.exe	94
PID 1668 wrote to memory of 4680	1668	Gbkkik32.exe	94
PID 1668 wrote to memory of 4680	1668	Gbkkik32.exe	94
PID 4680 wrote to memory of 832	4680	Gghdaa32.exe	95
PID 4680 wrote to memory of 832	4680	Gghdaa32.exe	95
PID 4680 wrote to memory of 832	4680	Gghdaa32.exe	95
PID 832 wrote to memory of 4704	832	Gaqhjggp.exe	97
PID 832 wrote to memory of 4704	832	Gaqhjggp.exe	97
PID 832 wrote to memory of 4704	832	Gaqhjggp.exe	97
PID 4704 wrote to memory of 1652	4704	Gihpkd32.exe	98
PID 4704 wrote to memory of 1652	4704	Gihpkd32.exe	98
PID 4704 wrote to memory of 1652	4704	Gihpkd32.exe	98
PID 1652 wrote to memory of 3428	1652	Gpaihooo.exe	99
PID 1652 wrote to memory of 3428	1652	Gpaihooo.exe	99
PID 1652 wrote to memory of 3428	1652	Gpaihooo.exe	99
PID 3428 wrote to memory of 556	3428	Geoapenf.exe	100
PID 3428 wrote to memory of 556	3428	Geoapenf.exe	100
PID 3428 wrote to memory of 556	3428	Geoapenf.exe	100
PID 556 wrote to memory of 1388	556	Glhimp32.exe	101
PID 556 wrote to memory of 1388	556	Glhimp32.exe	101
PID 556 wrote to memory of 1388	556	Glhimp32.exe	101
PID 1388 wrote to memory of 428	1388	Gbbajjlp.exe	102
PID 1388 wrote to memory of 428	1388	Gbbajjlp.exe	102
PID 1388 wrote to memory of 428	1388	Gbbajjlp.exe	102
PID 428 wrote to memory of 1656	428	Geanfelc.exe	104
PID 428 wrote to memory of 1656	428	Geanfelc.exe	104
PID 428 wrote to memory of 1656	428	Geanfelc.exe	104
PID 1656 wrote to memory of 4156	1656	Hioflcbj.exe	105
PID 1656 wrote to memory of 4156	1656	Hioflcbj.exe	105
PID 1656 wrote to memory of 4156	1656	Hioflcbj.exe	105
PID 4156 wrote to memory of 3164	4156	Hlmchoan.exe	106
PID 4156 wrote to memory of 3164	4156	Hlmchoan.exe	106
PID 4156 wrote to memory of 3164	4156	Hlmchoan.exe	106
PID 3164 wrote to memory of 768	3164	Hiacacpg.exe	107
PID 3164 wrote to memory of 768	3164	Hiacacpg.exe	107
PID 3164 wrote to memory of 768	3164	Hiacacpg.exe	107
PID 768 wrote to memory of 3888	768	Halhfe32.exe	108
PID 768 wrote to memory of 3888	768	Halhfe32.exe	108
PID 768 wrote to memory of 3888	768	Halhfe32.exe	108
PID 3888 wrote to memory of 3000	3888	Hnphoj32.exe	109
PID 3888 wrote to memory of 3000	3888	Hnphoj32.exe	109
PID 3888 wrote to memory of 3000	3888	Hnphoj32.exe	109
PID 3000 wrote to memory of 2928	3000	Hifmmb32.exe	110
PID 3000 wrote to memory of 2928	3000	Hifmmb32.exe	110
PID 3000 wrote to memory of 2928	3000	Hifmmb32.exe	110
PID 2928 wrote to memory of 4084	2928	Hemmac32.exe	111
PID 2928 wrote to memory of 4084	2928	Hemmac32.exe	111
PID 2928 wrote to memory of 4084	2928	Hemmac32.exe	111
PID 4084 wrote to memory of 2424	4084	Iacngdgj.exe	112
PID 4084 wrote to memory of 2424	4084	Iacngdgj.exe	112
PID 4084 wrote to memory of 2424	4084	Iacngdgj.exe	112
PID 2424 wrote to memory of 880	2424	Ipdndloi.exe	113

C:\Users\Admin\AppData\Local\Temp\09cc8d4c4cd1cb4d5085a4a8c3ff662e6ed5683a378dc3ab72c384d0bb0a7dcb.exe
"C:\Users\Admin\AppData\Local\Temp\09cc8d4c4cd1cb4d5085a4a8c3ff662e6ed5683a378dc3ab72c384d0bb0a7dcb.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\Gbiockdj.exe
  C:\Windows\system32\Gbiockdj.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\Gegkpf32.exe
    C:\Windows\system32\Gegkpf32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\SysWOW64\Ggfglb32.exe
      C:\Windows\system32\Ggfglb32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1668
      - C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        23⤵
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3336
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2948
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2428
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3680
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2588
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1040
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3876
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        36⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:468
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1604
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        42⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1796
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1588
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        47⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        48⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1004
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3864
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2988
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1576
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2604
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3796
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1544
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3504
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1048
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        68⤵
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        76⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        77⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        78⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        79⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        80⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        82⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5848
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        86⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        87⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        89⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5200
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        95⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        98⤵
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        99⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        100⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        101⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        102⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3716
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        104⤵
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        107⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        109⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        110⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        111⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        113⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 412
        114⤵
        Program crash
        
        PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,5019894817651309870,579021928995875068,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
1⤵
PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5768 -ip 5768
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Fkdjqkoj.dll

Filesize
7KB

MD5
fa0926f38ff9f92247b30de1cda47825

SHA1
0a45570fc2d73fe8d9357a09829705e804ca52f6

SHA256
efd78b5b5277ce3dff4db819a3232831fc91d63d60fbc3ef6ce9848d2fac453f

SHA512
a87f7a8c20023385a570aaec609b1f64f90599ff0ed48a0b77305c3117f867542c835a118291419fa222c9e17a8e8664deed420834ecbcd50a26b86a34d12b45

Download Submit
C:\Windows\SysWOW64\Gaqhjggp.exe

Filesize
144KB

MD5
50dbf5a48151a0c3684de2510e5691ea

SHA1
2d4374d5c8f11763efeab5d5116b219f25d0ecdc

SHA256
7478015bc7021d335209342bbd719eb658a1ac1814ac2e1dd6a6cd82c8a874e1

SHA512
c73aee7bf9a182a24e3aeab2727b85f9247917c8a759153da616a10d0f94bb5e2e9addfa4d72443441a2a338ebb4a48babe54c0e218a0d0f61c7b92d63cd38ab

Download Submit
C:\Windows\SysWOW64\Gbbajjlp.exe

Filesize
144KB

MD5
454d9ffafc490fbc3d876ead0fd48c0d

SHA1
94be3e971573a1e7e89094a8b08f5370167e7bbc

SHA256
055dddd59335189dda92cf56ff8133e5b6358792f556b1031eab7b694da7b4b9

SHA512
bec63ec483b4d20eb4016b4d6cbc33c600c6be95ee52715471ee0f269695301fd821768145457cd513066a0487d44ee47d13f0298f1562e7c88a749f1b10ee9a

Download Submit
C:\Windows\SysWOW64\Gbbajjlp.exe

Filesize
144KB

MD5
7927d76ec7ee2b8c7697f819060ce3d1

SHA1
63b1229dee170f4033b996c9bc42cf325d279303

SHA256
958ce1669016be57f315952da32630c118ee6ab42eb398da57611f36904951c9

SHA512
f692b7f85579c6cf86659733e11e52a63cf3a026fdd090324018e5853f97d530f3bd2f2e5c749706b65232859113277fef23d17e33244e5f4bca121f7d011191

Download Submit
C:\Windows\SysWOW64\Gbiockdj.exe

Filesize
144KB

MD5
903f40c33e9c750de313ec34e874ceba

SHA1
47863f40321f953ee1b68898edf43b35abff0a37

SHA256
cabdcb6af70e4ff2ce9576b543d56cef40c73f4ce3e23c661a590c2f50e0803e

SHA512
241d492949d3b363eeb4d6f96345f64c9f77c8e0d283a5f1e6b24465649940d3820ffb2a9aeb31d4342956623a25dc74c4f1ed967871a10ea4111cf66fde315c

Download Submit
C:\Windows\SysWOW64\Gbkkik32.exe

Filesize
144KB

MD5
92fac64d23a93b035fa909e0e020fb98

SHA1
66223712d14b22ae509a84f21ab2236512d9b3b6

SHA256
d4d508ca989c9f5dcd16a1ebedb4c705434e14bdd31eab5a1f3b9b91144395bb

SHA512
83bb5ce562aacdd465377af56494403389d4b9a10700f4e019bad218592beff9f39badfe9153518c4eac91cc60a252a5a12a5923ad906140a82559f5944c8002

Download Submit
C:\Windows\SysWOW64\Geanfelc.exe

Filesize
144KB

MD5
d5caa759e23f6b401946692b98b91a3d

SHA1
4e8d73b546b8211ce341290c586542b85d2eee46

SHA256
9dcc53b81b32e75f785cc3e92379f9bc7a601d59de449a2eea66438d8aa6815b

SHA512
8eee2e6595cfdcede18b83a2e5c62f5ddd93f556c2c3d3ee38313695a8514ae70bf5ec621199a89d5e338b4154e0bc1595a256166e7b11b6b28d75b7b4647637

Download Submit
C:\Windows\SysWOW64\Gegkpf32.exe

Filesize
144KB

MD5
7e4d54bd5b5f6bd0abe96e47c2475846

SHA1
37fbac182725c4b3967b409cad7adf0cd63ae84d

SHA256
d7f0da6fdad1005112b65ccec7ca47fd35809d7404a0f92af9193c0865a1ea7d

SHA512
58f241748bd7d2da94f064c9f9cb4856257939bd0d450372601be4419182034dd221fb8aebd0bd4b8c2dae79a3bd577e01c4f2bc3eba07a65ec2a060351a8300

Download Submit
C:\Windows\SysWOW64\Geoapenf.exe

Filesize
144KB

MD5
6f6ad18cb419561dc7ec79569d2a636f

SHA1
d5ae8a5f841436848e7e17ee10e967da3f92b9f0

SHA256
d09b5219bf132d7e22c9a256e28712c68c3308fe1e4eaeff780e39a9f2b6c472

SHA512
7f17a87cb87a0f110a02213038733175799d1f16287d2460b5de56d8ec3647cce3ec2364443a58e5cf7e18b6bd34c6658a4d98d716fcca5417e32865eeebd107

Download Submit
C:\Windows\SysWOW64\Ggfglb32.exe

Filesize
144KB

MD5
7e23a5f877a4c43bb9233a8abd687cb7

SHA1
ccbcfea71f4abd685f2a4ab68e141c4adb55041e

SHA256
84e2ea462b87d20c77e78f07455a3cf4b9df8b0b3c1caadbb41dc89d7d571073

SHA512
46e2f59d476f1f0f0a4b98a480e90ca060310afe03211e0f845dbc1aba16770e6067a54e9934a882735bf95b9cebc05fbe68b48556d54237db0f6ccaec980c69

Download Submit
C:\Windows\SysWOW64\Gghdaa32.exe

Filesize
144KB

MD5
64c99e9e6c030a76472b1f09a24fd140

SHA1
6b60147cb6d200418b03385708e40069713499a2

SHA256
39938e16aa1b873633377e835c53c04b9dc3885765ef8397b232b948c9ff2af8

SHA512
65e3c372d5c9c7020317745d1495d0b974e5bbe2f61b7ae23ab3888faf27cf10823dc377846fc9a3b0d73004655e51f6e1d35941545ae2cc797bb21bfa69d99c

Download Submit
C:\Windows\SysWOW64\Gihpkd32.exe

Filesize
144KB

MD5
3719859926253fe3e0b15685e2eb41c6

SHA1
447a256529a95927dda08c948614ac5d9b443309

SHA256
d6f6c6b7a3888ce14bb6024fccbd524022d5792ce00b6585829618e7110b0d7a

SHA512
4bc1e2295c14d83c8e8ef61c1a10fcb5ecb64bca6e4069e65310b1d50bc8475b30e01c7188d47608a6c738aefdcff9c17a1db260f2eda8516b9d618cf034fc7b

Download Submit
C:\Windows\SysWOW64\Glhimp32.exe

Filesize
144KB

MD5
6f977b2f681e62b38c0605d3ff063a79

SHA1
a3ed81b6f45f430937dfba9c0800307ccf4e276d

SHA256
d2fa66e5a521f46817048b6acba3dde22511b82a05e28962fde05796ffd46e1f

SHA512
86d43a5282ef85ed6182ae04d66baee4b89764b8da9db938ba034abcd08ec99bf35da2df7d67c696332773bc10cec975d7bae952d574c637d86994d149e0af24

Download Submit
C:\Windows\SysWOW64\Gpaihooo.exe

Filesize
144KB

MD5
92e94c4315556e9dcf2e6572d305d2bf

SHA1
a91da16842d4f835bc34f0cd58a6c536b19c2734

SHA256
e08dd17ba9d3c7e3eafc9c26d5931a6a98d35b0298e01091442d2a008c5eee23

SHA512
9847925ddd5d128cf55eabeede42c226823a078de36cde43af8dfc472a0efc7d9062181b588d6ddafe6adeadca125de0ffd17c49ed8d1d569f72d855f63eae95

Download Submit
C:\Windows\SysWOW64\Halhfe32.exe

Filesize
144KB

MD5
9e6d7c4c149e015be99620c70413b3ba

SHA1
38b8428d8ca62f43cc64514c89a0e9b17f4e81f5

SHA256
e9c37d52d002440a83ec2e8dad08ee42982ed29b600161b4f8e5a2429b485bdc

SHA512
9654c44504830223961252fcdb639ca5a0750afa46f8d97b8116390fbd1301ccbb29c61852355dbff107743feea76ca3ab493504bf9c86748c4d94d563f3054d

Download Submit
C:\Windows\SysWOW64\Hemmac32.exe

Filesize
144KB

MD5
6465d33b3a200ad2b4d03ef4a16022b5

SHA1
6bc4ddfef59dc3b5b53b667aa90ceb42ec485bd7

SHA256
2cddba355815e2597fdfed892fc537061038af1d37e6643af37dd178a6887190

SHA512
22b0608de0165ad1adc8392de1b1fb7fdd48321b8e7cf71b34334586ad7dc93396862da356a2161012657a78de1a313bc54883b3746a3fcf3e18fe06024f6e5c

Download Submit
C:\Windows\SysWOW64\Hemmac32.exe

Filesize
144KB

MD5
39ee6dc248c905de5517321ae8de9057

SHA1
5a85c12ee240d6a85feb87a1cea6911f13bc5bd1

SHA256
eb7c73c7c0c1b66ea3158623573312f6f04b572c671f0fbbaa926a504bd44dfb

SHA512
cf9b58a8f3918b743d599155a518686626bc623488ec08720a3d129c88588e108b6c834c3136980df1d2e864faae11edf6132fe43a9ea82c790f4e050e3e8d45

Download Submit
C:\Windows\SysWOW64\Hiacacpg.exe

Filesize
144KB

MD5
7893e5e27089174d8ccd1390893e1146

SHA1
458366f44fccd2b1112ca4ad3195918beaa4a340

SHA256
a8037aeef2dea0833976c8f4b7350b1539aa64708cda5ef052dadf20aac7a655

SHA512
147ab7906a65c0947fbdb908e61b1d8894e30fb481c837475d5a0104e3a3511f3b8601b51cff057e14cc70ebad8561487c228522075d53e4e6d4d55de55af611

Download Submit
C:\Windows\SysWOW64\Hifmmb32.exe

Filesize
144KB

MD5
e3abea366cfb6b5e08f1e436feccc3c3

SHA1
03fdc641d47d62d769ed9d6e01c35a5a568d04d5

SHA256
3ba77316b54bae16c391b90a3b637fd6d4e2f440877cd163b8acabbd7d534c2b

SHA512
6d05261a7f7702fc96582f138124287aefa3aea76340c31610ae58dfc9dc101e31754ac14f94414d7f21a171392fac85b4a118b8bd84034439769433d95d3fba

Download Submit
C:\Windows\SysWOW64\Hioflcbj.exe

Filesize
144KB

MD5
aa8aac180e86bc0b4e4325dfd663ecfa

SHA1
f8060079493b3c79e81a7bcb6a2077ab463eb5af

SHA256
8473addaf1501ffeb7ff9d3e8c61f382be07b4516f271af3fa82395986d6ecfc

SHA512
e2e382eaa8306ac4e099e9389fa6629bfcef8229dcb417475cfe3070b3df72bda78b7558c270a07dbae5be661174e6379f376e5f9532ac757dd8d71ba3eef0ac

Download Submit
C:\Windows\SysWOW64\Hlmchoan.exe

Filesize
144KB

MD5
666c4ebd6164d4b7d6c83f91c525bbb6

SHA1
34b3babd571b2c4883939b63e59b239d063e5c52

SHA256
005c66d436461b2143cf96ab2f3d2af95a2e943fc72d5e148afd7fa1df478e2a

SHA512
9067904bcbbe29655029c408f60cf68ed4a7e081bd345939f4cbfb04ad8e1dc9c0b84c17196344d791ddc7d5aad9bbaa74aff4423ec59e54a2145478b7eee341

Download Submit
C:\Windows\SysWOW64\Hnphoj32.exe

Filesize
144KB

MD5
ee7a717db14dc9e6ee1aea4fda969da4

SHA1
e4b419870d1360fbb2a1ae95647be2e685a639be

SHA256
ceb0962425e956ec8b6d600a82780b3c9f3d01ce708452e46710c2427da671c0

SHA512
8bc853e381ea875566b1191b55037122b945c29a1048a822cbbbe98170fdb2bd6bdfc2cb040d562ca4bf3d89c211851a8c7a2f889f6ab310e17ffb0b3341d3d0

Download Submit
C:\Windows\SysWOW64\Iacngdgj.exe

Filesize
144KB

MD5
19e4455add644110795182fd0f973ee5

SHA1
d0b145604b81dbaeb35ef729e9d11de4b3af454f

SHA256
0158edb2428790f03e371910f33eaf4075cc7348b4a7bb6007a91572860d6d4e

SHA512
a4945cbbe7fa01b2bc98e8eb860f049f4e12aff05303a33f73bd3e706daa7bdff988c7f37144f0f61bfda8a5dc29a488790fd4735b45e99c2b23d0e9234597c3

Download Submit
C:\Windows\SysWOW64\Iafkld32.exe

Filesize
144KB

MD5
b8c7ff5f53d751e9c844ff24c47bf2f9

SHA1
296489e1d88fae4717d1b0416dee770ef8cc002a

SHA256
917eb4e3bedcb112b7f3d50a4c21cd5955bd926f28f7ee8129f2be1ce6be57c3

SHA512
28508f310dd700715c99728ce6e25298c03593e0aae610e9be64661e3b2799e9a6a79bbc33efb4531e0ecc1cc0601a792e3ea901ac0ff02334ba05cf31c35466

Download Submit
C:\Windows\SysWOW64\Ibgdlg32.exe

Filesize
144KB

MD5
cfffbeda7a32d4055b12258165489aab

SHA1
82347dd06a11e14830b6209a759dee8145cdfd00

SHA256
845cd9e553a2a715a14c2b8de1f98cbe39c8df867a6811c87012a70108c1030b

SHA512
f57efc3b1d34170c936b7839af769620e7bd25749c0de5fb1e41582cfbbfa3867d03ffcd5728b44f3bc70f37af70fb772afcef40c7a755e5ad3cdae6837caee0

Download Submit
C:\Windows\SysWOW64\Iefphb32.exe

Filesize
144KB

MD5
c8d44f040190e45f1da1e8c1b42258e3

SHA1
6c46069eda286c4033474820898f192cb063746d

SHA256
f7c8f49ae77c7c177638a073003d1360761cb75d21d4f11dfcb415e7770dba46

SHA512
488b0b33b6e24d5eb234073507c01682164955950be7ffe03ccdcfaf87c1979db2431b0eb237003f1c0c4f51dbefbfd11acd771cbd33d64cc63fc10e05804298

Download Submit
C:\Windows\SysWOW64\Ihbponja.exe

Filesize
144KB

MD5
92844ec5b8e82e48cb06452bf7119077

SHA1
f77b0591e63a76a5d5968e1f55eaade645a87c33

SHA256
d3924f31a7ce078fc5481bfd98039a5a59f6e25a2a29bde9075bd82d16fb7d38

SHA512
5e0585fef6c5e6afea65ce8ed89a8af42291caa29378fa1b695f2f736a775158f982eb2911c8e504cbffc8edfbf812d1f4fca4d71c3d3867306d65ffa927cdc8

Download Submit
C:\Windows\SysWOW64\Iojkeh32.exe

Filesize
144KB

MD5
75e932bbb7bd6abee6212e02a703cdf1

SHA1
bd3ef6380f47c67c6b7bb53cce9bbcd248905330

SHA256
36e1e2aff490953da391b893fd7ce79e934b5f7c396f1753b214f13f2d1608b5

SHA512
1c6f432310f2cf24b4b131e3b30306cf16b566562394b60bd48bb7759895e86cfc198c8781296aebba632387b5ebf4cb9880c7756a69954528a4457e07461896

Download Submit
C:\Windows\SysWOW64\Ipdndloi.exe

Filesize
144KB

MD5
3c11d7130cb2cdcc0e2c67507358b16b

SHA1
5a4a8b680c4f86b3bf1736c8745d432d20a672ca

SHA256
e903c990c753a907594bcc6bfd9a181247d4eb769ee2cd0de03b2646fc727848

SHA512
5b5ff3975d4e569b74bfdc8e07d7d2718d1ff65a199100f1bbdb33703dcab2bef2c9a34f2f9f2005447fbe2d56f1e84b70f1ee84d96f619407c0130836b373e1

Download Submit
C:\Windows\SysWOW64\Ipkdek32.exe

Filesize
144KB

MD5
3a07c726769387fa11eec5abd6049d04

SHA1
5098f2fe04dc454a08527a0272fd170c41ea353b

SHA256
3561728d2b84877bddbbf1466d16bae5a0cb797319a7facca2ce62736d9d1ec4

SHA512
7b383d4ac0524a97626ae92ebdf0d593dc07d9d195c2a4cd086235eab8abceb4f904394ceb9cbe3aee8813546b82d04b9fdb77ceb940518db73e45a36238ed10

Download Submit
C:\Windows\SysWOW64\Jblmgf32.exe

Filesize
144KB

MD5
ec256b668798c4319b033181b231f845

SHA1
ecb226dd22d22fbec48ed28a5eea45071ab8d812

SHA256
471c07f312847ff8e04ac77b5d7ad1eea4bf4a24611fd4335976f662830313d2

SHA512
6f36b49dca69f3f162931633ad176c1f86b035b30583ec4d5db0fb972cd61288cd9969135a74f972c918ff1ed8695e04008ae98b7d46c010fe82d678b2593508

Download Submit
C:\Windows\SysWOW64\Jbojlfdp.exe

Filesize
144KB

MD5
7b40f68bf1d97917cb63922d65aef70d

SHA1
53bfa9285a69caee30f70556a8966bf067db2577

SHA256
c81ece30d29b22ae5ed26e79864ccf36bb3065a07f73e3e028bac0cc741d8ecd

SHA512
fca751d6ee4088519f7b5a96876c571b11069374a58ed6f7833db618fb0c01141d0ee146e913d14b070a803ac08fe3b9788d5e9dd455439b561b9d1ee27a150d

Download Submit
C:\Windows\SysWOW64\Jhifomdj.exe

Filesize
144KB

MD5
b4287d1a61f782e851bebce98f1d48a6

SHA1
6f22931f5e44e6fa42da31e35ef3a7c790dcd37b

SHA256
1146f7fd036798fec748e92c32cf8316dbe7b9b630d1b3cd0907dca0b4712eda

SHA512
5ba50c0dc549d442a3092f0f7b3fdaf0b77c29498560e04f83fe049fdacae086768d82e303d07accef8678c8ee0af366582a238f17ba9da56490e6bc09883707

Download Submit
C:\Windows\SysWOW64\Jhplpl32.exe

Filesize
144KB

MD5
0d15bfce3261ce1a768fe4b14e0d9dd1

SHA1
53d645ff458e06de292741bcd785f7b9f5dee5f4

SHA256
23c05ea54c4db7ebf2f550d1f925c43c90cc1f7815156830e9d705b942017834

SHA512
0c2181a3372d82ed2e34c0241dc140e30bfe369b4d084913ec5200a3e3b810f0f04d06890c36e4eb2334edd0e39cdf32d1a17a37a19877b9c4b8ffdadd4dfee7

Download Submit
C:\Windows\SysWOW64\Jidinqpb.exe

Filesize
144KB

MD5
6643362bd33d008991f647afe17b5524

SHA1
dac62e4de653c22aacd3886567f6758708f8b613

SHA256
5901dd2e4ab00ec65dccf673131f90591ad9349d8bba6aac2a1658f2e5cea7be

SHA512
7ce91518086fe36ba2dd9a21139f253df3b75e215b8a5b71133cd943f0e3defffcad00edd5158c98ee6715f8b6cfc7dee59ed93a13aeebe020c69969548824c5

Download Submit
C:\Windows\SysWOW64\Jlgoek32.exe

Filesize
144KB

MD5
321ed587da15dd892a027c500fb61487

SHA1
7a166c34e2ec8a3ca519797f26cfb187aa519b6a

SHA256
28ceb91ddd25723ba2be7eebbc75d485ac9ee331a7f9279b14ba236c9b77ee66

SHA512
62652287ee5ec20129d2d8757809e6e31fe4cf5df96d935ed005a0db6bb8aeb60833941f167cfb1c66bed705761f186b6e8174a0bfb5c00774f455aab8af1e55

Download Submit
C:\Windows\SysWOW64\Kidben32.exe

Filesize
144KB

MD5
1c5d9b145f9ba1da44a650176bcab388

SHA1
2bb5f39a37d510d43335487a3f8ea9e389922b00

SHA256
6b7d18fc9ed413e3ad39d96b77cdcf7991c8934d10404e30173609a39f305f0a

SHA512
e8cfe7eebb0836c7da74c9b079cc0cca55c65406b479d2645b64b55ef91bbc24d171cd0160f792a463641c326dd4ac5cf4802839332ab89375e534ed8ea05428

Download Submit
C:\Windows\SysWOW64\Lebijnak.exe

Filesize
144KB

MD5
3f7347f8985dcb3ef9c6331da868356e

SHA1
078b96ea3d3b0f6494c6b45ff70363287374a3e2

SHA256
bd9b2c387d39a334d8bd04672689dc4f020e88c06100da73f9572036e7b79c4c

SHA512
0b7ad732d3a23a2dbad14c16051c2039ed550acf6f9ed2ca199e88a508e6d15a4692c515a8372d248388645fb905829c09d4684e18849caf06ec01e4092e53ee

Download Submit
C:\Windows\SysWOW64\Lepleocn.exe

Filesize
144KB

MD5
4de539b5673a6a6bc6ac39138dd04904

SHA1
07ee2933135b345f2007b09031069bdce2449eb4

SHA256
6cc8dbd65051e3e07f81a70f3f2ec83c9a9e1a704a310b58630dcacfd6f059cf

SHA512
ef2897df49afa43ec2e33ed7f86d5bce335596aa4eda11b1e479b155bba5ffe5773aab7f2e1d069d2b1402d5d8d1b0aa02e9ebf8caff98b9e8daf193436ca4c3

Download Submit
C:\Windows\SysWOW64\Ljpaqmgb.exe

Filesize
144KB

MD5
86851818bf78e1b783da3006f2a3a315

SHA1
66d3fe49a3eade54f3a4331bce8488ab7c4d7fac

SHA256
fb073fe2507d47b40af6515ed690862f7586bb28ce4faccde65a50fcead3e431

SHA512
ecb3801882ac71b9d3fc702d39c7ee5f09099827e2039c6011d863b91b0e4fc62ca08636302baf2d90188d8207e66b0f66b4f47f76ab26e7e323eb2d9e353e04

Download Submit
C:\Windows\SysWOW64\Mfenglqf.exe

Filesize
144KB

MD5
ca0deffb7eb45602c48d4206a9563153

SHA1
764022fce6e51950649b03736edd1cea3014fa5a

SHA256
5d27b6c2f6665e610c14c3a02d76ec3a2748f7de0c4016f5f53c209081411a62

SHA512
64833dd991cc98e264cb4dbdc7b46fd33b35a1b1592a37b1190eb05c0c4f89ea7ee313070c2789f37493afbe3a3b96754aadf04c19928f588e699d46d36c0668

Download Submit
C:\Windows\SysWOW64\Mfpell32.exe

Filesize
144KB

MD5
8091dd3084253d39e61b7a1e1f97d460

SHA1
55a6de6e358c60ab59806fe229d9c7396c3d9da7

SHA256
8648b2e2ec9f2beabc887a2ece89b239ee41fc10ce8139a23ca95f9615d24898

SHA512
200176d14f1e5bc43db658e4b895173cfe1dcfc10e9325ef0afd22895f1c462068b2a42a9ad8f2646ff49b332229b83f3086c2a56b13ea58c525855bd962ba65

Download Submit
C:\Windows\SysWOW64\Nfihbk32.exe

Filesize
144KB

MD5
bdf2eccf2faa55025d83d79cf24bfdad

SHA1
82d143af20c6882045b4cacba730dbcf20f1aa71

SHA256
b8782197a1bd92bc7c163afac13428cc0492dacd813be41def250492bd0defe6

SHA512
0f95e0865f9e0c1d749d16ccd82e359184849153ea8c3cb3dd9156bd885f560a5eeec4a021bb96b7d0f920648b13c8c313e6788cc78a396cbd00f5c3df6d2928

Download Submit
C:\Windows\SysWOW64\Nhegig32.exe

Filesize
144KB

MD5
539489afc6e306ba0fb8142b2b6d84c4

SHA1
cf9a5ec757fcef6fc56f9ba95764d2ec74cedbcb

SHA256
8e529f246c70cb2d00dc4e94b787e189417ac8e006c52f19625f88a6c395a7e8

SHA512
0044cdf80831038b15bf1f9f648e5ebd8ac09722f39249b78bcbd99040d7cebc79e42e2507e73907a5efb67bb07fc46d15d17251ddbfc3066a98f70f3f73f4aa

Download Submit
C:\Windows\SysWOW64\Nmcpoedn.exe

Filesize
144KB

MD5
8725409075e77ffcbbf9f4a0883a6f65

SHA1
281b8fc6649a0f2ff8f3733e14284d683b16c837

SHA256
4e98d6efac823f608de0f02c3927b2538882f240c80a35da832fec58e676411a

SHA512
97e55ecb02d1c6788b59c6cfd37a5906a86c90d68aba89ae02d5a1dde58c9d8a4cff31892787567b4d2dd8a03e232ab6dfa2f485dcf271bcf095c30bfb8e8152

Download Submit
C:\Windows\SysWOW64\Noblkqca.exe

Filesize
144KB

MD5
f18c59ee43044fdca83e83becd8359f1

SHA1
c6b63d7b08ba7203f22945ed313894f16150b4ba

SHA256
d8ed63cc3237449dede33feacf6bacea3c7672b839b45b24e7ac559a7f3df0f0

SHA512
429788afa25080c347ba6ba888e3e3cf5be0aecba6c22ab00581359836620a2504abca666ce673d4450a709ba49a6b9a75581b6a749c15444328df9f04fd5416

Download Submit
C:\Windows\SysWOW64\Omalpc32.exe

Filesize
144KB

MD5
d2ae5af618f75f074cdd503d8836a405

SHA1
319d16bb239e830e02bede78e52840d12d50a3cf

SHA256
f98448fdd0707c9dd21f19df4fff1c9b753f113d4ac920c5cad27b93748f3a80

SHA512
b8614e326da4ae1e437725ed5d06197577546b5d257ae4ff2e65aabd55791ca6bd86c59cfc71843dd3724105fdc1d134f61a7d57bbcaebca68d00d133343988f

Download Submit
C:\Windows\SysWOW64\Ommceclc.exe

Filesize
144KB

MD5
9450b95a57a6ae6c227169e4615e2668

SHA1
fcfd08e6c58e554a76fa55ca3fab0f88df99d5d5

SHA256
98c984f1334ccecbbb8d84dba5f689b3b3f3250ae9e28a5a86fcdd1b0dd6cb9a

SHA512
1a7a131e2fa3246a240acda6fb5be89d1020f53e10050fad439b29f34adbe7a1f8fae4715776dcf8475e85960ee97133f7b1c2f280b2997dc176735b3d8444e4

Download Submit
C:\Windows\SysWOW64\Pcpnhl32.exe

Filesize
144KB

MD5
e3ea841f7dce42387276f972fc333a97

SHA1
237ffac18e0a5988670fdc13d00f0bcf97379f81

SHA256
4d7bc02b0747d047af5571e105cfd8e01aa29fe6947e2c4634097960eb45bf54

SHA512
a4448574d665641d96ac7aaf0308c15c6aa81e5cca732d1a57a5f6fad1d3a4a788b20e14c2c5119ce903e720c9ba321aba14d893a6c084ea3843ae79935a6867

Download Submit
C:\Windows\SysWOW64\Pfepdg32.exe

Filesize
144KB

MD5
133f684fd895b3ea232893b6d60d9e3f

SHA1
f18d954405a9a33467935c96e200ba7267e3003a

SHA256
58eab7cb429240dd60027fcdad89028616563990dc59edcc05dbe01342ac6857

SHA512
0035a9b43b5a3a6158c0cb1b98ca788ccd977d083b5813cb33b12efd2584ae820a551f6e17d19654c72b3711ec4441a1739ba959ae113bc0f22f6944993aad91

Download Submit
C:\Windows\SysWOW64\Pififb32.exe

Filesize
144KB

MD5
5a9050a23b355e96debc109b68489591

SHA1
42bbcb60ee92fd13a8cb084804a2ae75ff1d0047

SHA256
646360ef1c72477f8c55917f2eb61b691dff4e2f26ee7afe4ec866c775e6150d

SHA512
5e139ab10fe5eadddb8ceba35c5a6585785a13c313a6626ffd0cdd8c995073231987273a9c363addd2330e197dd2fa14e7aabe433c274a61d794d20008672684

Download Submit
C:\Windows\SysWOW64\Ppgomnai.exe

Filesize
144KB

MD5
e289326dcd91a132b3edf0555ebc3e40

SHA1
c7646fe366fa9d4de9a504bb0bb36488c8c9f8ea

SHA256
59788ce6cca55fe13f949c47715c20b397813cb1fa0d17d30f7c08ed6e4f5320

SHA512
9ac097c6543301eafe62830f210b34a589538c40be71c3df8ef30e4d9bb45ab997035fa815cd808281caccafbb64f7ec447cdc47e3b919f0e3bc7d12c4a9ab1d

Download Submit
memory/428-98-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/428-187-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/468-380-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/468-313-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/540-401-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/540-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/556-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/556-169-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/760-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/760-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/768-223-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/768-134-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/832-48-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/832-133-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/880-277-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/880-188-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1004-399-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1036-367-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1040-259-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1040-333-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1256-347-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1256-278-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1388-94-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1548-387-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1548-320-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1576-416-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1588-365-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1592-355-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1592-422-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1604-396-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1604-327-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1652-151-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1652-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1656-108-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1656-195-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1668-115-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1668-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1796-348-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1796-415-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1912-373-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1912-306-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2424-268-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2424-178-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2428-233-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2428-312-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2588-251-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2588-326-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2604-423-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2928-250-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2928-162-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2932-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2948-302-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2948-215-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2988-409-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3000-152-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3000-240-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3136-374-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3164-214-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3164-126-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3336-284-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3336-197-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3428-161-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3428-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3536-295-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3536-206-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3584-340-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3584-269-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3680-241-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3680-319-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3704-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3704-107-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3736-354-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3736-285-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3864-402-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3876-296-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3888-144-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3888-232-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3936-303-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4084-171-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4084-258-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4156-205-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4156-116-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4240-224-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4240-305-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4444-429-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4452-93-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4452-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4508-381-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4604-97-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4604-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4672-408-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4672-341-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4680-125-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4680-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4704-142-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4704-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads