c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe
Size

256KB
MD5

0560225c5a51050674ee254f0cbc3116
SHA1

2ac346365608c53ca5452a1532abb9a1b8865930
SHA256

c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4
SHA512

ba6fee43730c1aaec7029a62fad4bc6f213f89c678f130cd7f945a29ae68ec9b67cae5147174afa4f3e590343ab37d9feecd37c7ef763afdd23481db0990f93a
SSDEEP

6144:x/XRAyW3YMQm9C81NByvZ6Mxv5Rar3O6B9fZSLhZmzbBy9:x/XCy8d9C8HByvNv54B9f01ZmHBy9

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpgdbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfkoeppq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdopod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Imihfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jaljgidl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmegbjgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpojcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdopod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kphmie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdhine32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpojcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jangmibi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpccnefa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcpllo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ijkljp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpjqhgol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpaghf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgdbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jdhine32.exe

Executes dropped EXE 64 IoCs

pid	Process
3264	Ijkljp32.exe
4548	Imihfl32.exe
1168	Jpgdbg32.exe
1448	Jbfpobpb.exe
1964	Jjmhppqd.exe
3736	Jmkdlkph.exe
2428	Jpjqhgol.exe
960	Jbhmdbnp.exe
2212	Jfdida32.exe
4540	Jibeql32.exe
2952	Jaimbj32.exe
4468	Jdhine32.exe
1420	Jbkjjblm.exe
1300	Jfffjqdf.exe
4948	Jidbflcj.exe
4976	Jaljgidl.exe
2244	Jpojcf32.exe
1212	Jbmfoa32.exe
4312	Jfhbppbc.exe
700	Jkdnpo32.exe
1680	Jmbklj32.exe
1880	Jangmibi.exe
4704	Jpaghf32.exe
1688	Jbocea32.exe
4448	Jfkoeppq.exe
2764	Jkfkfohj.exe
2708	Kmegbjgn.exe
3904	Kaqcbi32.exe
1060	Kpccnefa.exe
1096	Kdopod32.exe
5072	Kbapjafe.exe
4400	Kpepcedo.exe
4708	Kaemnhla.exe
3992	Kphmie32.exe
936	Kbfiep32.exe
3388	Kmlnbi32.exe
4564	Kagichjo.exe
4164	Kdffocib.exe
4144	Kkpnlm32.exe
2264	Kmnjhioc.exe
3012	Kkbkamnl.exe
3784	Liekmj32.exe
4964	Ldkojb32.exe
2040	Lkdggmlj.exe
3524	Liggbi32.exe
4032	Laopdgcg.exe
3932	Ldmlpbbj.exe
3504	Lcpllo32.exe
3712	Lkgdml32.exe
4160	Lijdhiaa.exe
2020	Lnepih32.exe
1164	Laalifad.exe
4676	Lilanioo.exe
4832	Lnhmng32.exe
2336	Lpfijcfl.exe
1748	Lcdegnep.exe
824	Lklnhlfb.exe
3356	Ljnnch32.exe
3240	Lphfpbdi.exe
4336	Lcgblncm.exe
1672	Mjqjih32.exe
2192	Mahbje32.exe
3004	Mdfofakp.exe
2512	Mgekbljc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jbfpobpb.exe	Jpgdbg32.exe
File opened for modification	C:\Windows\SysWOW64\Jkfkfohj.exe	Jfkoeppq.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Hfkkgo32.dll	c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe
File created	C:\Windows\SysWOW64\Jaljgidl.exe	Jidbflcj.exe
File opened for modification	C:\Windows\SysWOW64\Kagichjo.exe	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Kmnjhioc.exe	Kkpnlm32.exe
File created	C:\Windows\SysWOW64\Lijdhiaa.exe	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Bghhihab.dll	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Ijkljp32.exe	c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe
File created	C:\Windows\SysWOW64\Eplmgmol.dll	Kpccnefa.exe
File created	C:\Windows\SysWOW64\Kkbkamnl.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lnepih32.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	Nacbfdao.exe
File opened for modification	C:\Windows\SysWOW64\Ndghmo32.exe	Nbhkac32.exe
File opened for modification	C:\Windows\SysWOW64\Jbkjjblm.exe	Jdhine32.exe
File created	C:\Windows\SysWOW64\Jeiooj32.dll	Jpojcf32.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lklnhlfb.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Maaepd32.exe	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Imihfl32.exe	Ijkljp32.exe
File created	C:\Windows\SysWOW64\Lkgdml32.exe	Lcpllo32.exe
File created	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Oimhnoch.dll	Kkpnlm32.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	Ldkojb32.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nacbfdao.exe
File opened for modification	C:\Windows\SysWOW64\Jbocea32.exe	Jpaghf32.exe
File opened for modification	C:\Windows\SysWOW64\Mpmokb32.exe	Mnocof32.exe
File created	C:\Windows\SysWOW64\Bgllgqcp.dll	Jpjqhgol.exe
File created	C:\Windows\SysWOW64\Bclhoo32.dll	Jfdida32.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	Ljnnch32.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Jfffjqdf.exe	Jbkjjblm.exe
File opened for modification	C:\Windows\SysWOW64\Jidbflcj.exe	Jfffjqdf.exe
File created	C:\Windows\SysWOW64\Jangmibi.exe	Jmbklj32.exe
File created	C:\Windows\SysWOW64\Jpaghf32.exe	Jangmibi.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Mkeebhjc.dll	Kaemnhla.exe
File created	C:\Windows\SysWOW64\Geegicjl.dll	Mglack32.exe
File created	C:\Windows\SysWOW64\Nqmhbpba.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Jjmhppqd.exe	Jbfpobpb.exe
File created	C:\Windows\SysWOW64\Honcnp32.dll	Jfffjqdf.exe
File opened for modification	C:\Windows\SysWOW64\Kdffocib.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Imppcc32.dll	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mpaifalo.exe
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Jpojcf32.exe	Jaljgidl.exe
File opened for modification	C:\Windows\SysWOW64\Kaemnhla.exe	Kpepcedo.exe
File created	C:\Windows\SysWOW64\Lkdggmlj.exe	Ldkojb32.exe
File opened for modification	C:\Windows\SysWOW64\Laopdgcg.exe	Liggbi32.exe
File opened for modification	C:\Windows\SysWOW64\Laalifad.exe	Lnepih32.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Kdopod32.exe	Kpccnefa.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Ibimpp32.dll	Jdhine32.exe
File created	C:\Windows\SysWOW64\Ldobbkdk.dll	Kbapjafe.exe
File opened for modification	C:\Windows\SysWOW64\Kmnjhioc.exe	Kkpnlm32.exe
File created	C:\Windows\SysWOW64\Nngcpm32.dll	Lijdhiaa.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5788	5684	WerFault.exe	186

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jaimbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpaghf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgllgqcp.dll"	Jpjqhgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlgol32.dll"	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akihmf32.dll"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocbakl32.dll"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppaaagol.dll"	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akanejnd.dll"	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmlnbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qknpkqim.dll"	Jfhbppbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgqhjop.dll"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jibeql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcod32.dll"	Jibeql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jfhbppbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jifkeoll.dll"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jaljgidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpojcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgengpmj.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogijli32.dll"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bheenp32.dll"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll"	Maaepd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpgdbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqbmje32.dll"	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epmjjbbj.dll"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jaljgidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flfmin32.dll"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eilljncf.dll"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnapla32.dll"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3264	2948	c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe	89
PID 2948 wrote to memory of 3264	2948	c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe	89
PID 2948 wrote to memory of 3264	2948	c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe	89
PID 3264 wrote to memory of 4548	3264	Ijkljp32.exe	90
PID 3264 wrote to memory of 4548	3264	Ijkljp32.exe	90
PID 3264 wrote to memory of 4548	3264	Ijkljp32.exe	90
PID 4548 wrote to memory of 1168	4548	Imihfl32.exe	91
PID 4548 wrote to memory of 1168	4548	Imihfl32.exe	91
PID 4548 wrote to memory of 1168	4548	Imihfl32.exe	91
PID 1168 wrote to memory of 1448	1168	Jpgdbg32.exe	92
PID 1168 wrote to memory of 1448	1168	Jpgdbg32.exe	92
PID 1168 wrote to memory of 1448	1168	Jpgdbg32.exe	92
PID 1448 wrote to memory of 1964	1448	Jbfpobpb.exe	93
PID 1448 wrote to memory of 1964	1448	Jbfpobpb.exe	93
PID 1448 wrote to memory of 1964	1448	Jbfpobpb.exe	93
PID 1964 wrote to memory of 3736	1964	Jjmhppqd.exe	94
PID 1964 wrote to memory of 3736	1964	Jjmhppqd.exe	94
PID 1964 wrote to memory of 3736	1964	Jjmhppqd.exe	94
PID 3736 wrote to memory of 2428	3736	Jmkdlkph.exe	95
PID 3736 wrote to memory of 2428	3736	Jmkdlkph.exe	95
PID 3736 wrote to memory of 2428	3736	Jmkdlkph.exe	95
PID 2428 wrote to memory of 960	2428	Jpjqhgol.exe	96
PID 2428 wrote to memory of 960	2428	Jpjqhgol.exe	96
PID 2428 wrote to memory of 960	2428	Jpjqhgol.exe	96
PID 960 wrote to memory of 2212	960	Jbhmdbnp.exe	97
PID 960 wrote to memory of 2212	960	Jbhmdbnp.exe	97
PID 960 wrote to memory of 2212	960	Jbhmdbnp.exe	97
PID 2212 wrote to memory of 4540	2212	Jfdida32.exe	98
PID 2212 wrote to memory of 4540	2212	Jfdida32.exe	98
PID 2212 wrote to memory of 4540	2212	Jfdida32.exe	98
PID 4540 wrote to memory of 2952	4540	Jibeql32.exe	99
PID 4540 wrote to memory of 2952	4540	Jibeql32.exe	99
PID 4540 wrote to memory of 2952	4540	Jibeql32.exe	99
PID 2952 wrote to memory of 4468	2952	Jaimbj32.exe	100
PID 2952 wrote to memory of 4468	2952	Jaimbj32.exe	100
PID 2952 wrote to memory of 4468	2952	Jaimbj32.exe	100
PID 4468 wrote to memory of 1420	4468	Jdhine32.exe	101
PID 4468 wrote to memory of 1420	4468	Jdhine32.exe	101
PID 4468 wrote to memory of 1420	4468	Jdhine32.exe	101
PID 1420 wrote to memory of 1300	1420	Jbkjjblm.exe	102
PID 1420 wrote to memory of 1300	1420	Jbkjjblm.exe	102
PID 1420 wrote to memory of 1300	1420	Jbkjjblm.exe	102
PID 1300 wrote to memory of 4948	1300	Jfffjqdf.exe	103
PID 1300 wrote to memory of 4948	1300	Jfffjqdf.exe	103
PID 1300 wrote to memory of 4948	1300	Jfffjqdf.exe	103
PID 4948 wrote to memory of 4976	4948	Jidbflcj.exe	104
PID 4948 wrote to memory of 4976	4948	Jidbflcj.exe	104
PID 4948 wrote to memory of 4976	4948	Jidbflcj.exe	104
PID 4976 wrote to memory of 2244	4976	Jaljgidl.exe	105
PID 4976 wrote to memory of 2244	4976	Jaljgidl.exe	105
PID 4976 wrote to memory of 2244	4976	Jaljgidl.exe	105
PID 2244 wrote to memory of 1212	2244	Jpojcf32.exe	106
PID 2244 wrote to memory of 1212	2244	Jpojcf32.exe	106
PID 2244 wrote to memory of 1212	2244	Jpojcf32.exe	106
PID 1212 wrote to memory of 4312	1212	Jbmfoa32.exe	107
PID 1212 wrote to memory of 4312	1212	Jbmfoa32.exe	107
PID 1212 wrote to memory of 4312	1212	Jbmfoa32.exe	107
PID 4312 wrote to memory of 700	4312	Jfhbppbc.exe	108
PID 4312 wrote to memory of 700	4312	Jfhbppbc.exe	108
PID 4312 wrote to memory of 700	4312	Jfhbppbc.exe	108
PID 700 wrote to memory of 1680	700	Jkdnpo32.exe	109
PID 700 wrote to memory of 1680	700	Jkdnpo32.exe	109
PID 700 wrote to memory of 1680	700	Jkdnpo32.exe	109
PID 1680 wrote to memory of 1880	1680	Jmbklj32.exe	110

C:\Users\Admin\AppData\Local\Temp\c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe
"C:\Users\Admin\AppData\Local\Temp\c11b33bce279e60f04655675a83a4670e30e3da94a05590880aadc8551e9fbc4.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\Ijkljp32.exe
  C:\Windows\system32\Ijkljp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\SysWOW64\Imihfl32.exe
    C:\Windows\system32\Imihfl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\Jpgdbg32.exe
      C:\Windows\system32\Jpgdbg32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1448
      - C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        27⤵
        Executes dropped EXE
        
        PID:2764
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        29⤵
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1060
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1096
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4708
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3992
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2264
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3012
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3784
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4964
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2040
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3524
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4032
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3504
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3712
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4160
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2020
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1164
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        56⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:824
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3356
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3240
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1672
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:756
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        67⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3864
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5048
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2580
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        72⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        73⤵
        
        PID:992
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3328
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        75⤵
        Drops file in System32 directory
        
        PID:2308
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3092
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        78⤵
        Drops file in System32 directory
        
        PID:1736
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        79⤵
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        80⤵
        
        PID:236
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        81⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        83⤵
        Drops file in System32 directory
        
        PID:876
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        85⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5288
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        90⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5476
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5520
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        96⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 420
        97⤵
        Program crash
        
        PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5684 -ip 5684
1⤵
PID:5748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Hjobcj32.dll

Filesize
7KB

MD5
4e6525641cf319c76e944e2a3cf4830c

SHA1
991827f816d2f7fa0513871120ee78b16d5ee64a

SHA256
1bec7c3f24378351b2d0feb99237fa24ac567ded5e066459a0aaafd7599a0548

SHA512
4dd52334976b7fa6e0f78eaa572b05f5a1dcaa7b55589c04b9277ecbcd7faaffea75a296ff8305b1d0fb6bcca34a8f99917fe3ddf6aa7d87d4f03e27d1f6f752

Download Submit
C:\Windows\SysWOW64\Ijkljp32.exe

Filesize
256KB

MD5
21ac0b5734c14b2cd6a247a3e99444e8

SHA1
356b4a4c86be854bcb4b0a3e7feb02e58cc6205b

SHA256
50a32a38a985f1a87133c591db95fde64eb4430e7cd385c9a521304ff520d3a2

SHA512
3172a73a15aa0791bc481b0f6c5d231500099bf99341399d1952bfb1925356b22b224d8f22219d39dcd80a49d341b990b571288fda1ab9033cce223153c4c9fd

Download Submit
C:\Windows\SysWOW64\Imihfl32.exe

Filesize
256KB

MD5
2fd01238151f83b66b73c7793b726f17

SHA1
8eea59368258b5c29010a2b38e94f8a8d7592b75

SHA256
1a2882948ce8145e266493400b598eb1f56bf5cfc2b994a60f77731853830d0d

SHA512
abba981ed7f43fbcc90818f3586d1346f6cc71a77310360bc50a549727096e611135524140495e9be06203b3040dacd9f13fbdecb4c6a43f768410c121d6ed13

Download Submit
C:\Windows\SysWOW64\Jaimbj32.exe

Filesize
256KB

MD5
4048cdc4fda167325e503258e39dbd52

SHA1
bdac89018d3648ea2a6a387a3faedc394ce35f4b

SHA256
ef6b5b4cd1565b6635af078962dbe2e6053c5b3903d3aac5593e7d303bd10e60

SHA512
6a545b46b5c05041ddd04c7d54cf1368c0e882c07d26ef47890fb7196f74df9c4eea68fe0f094599f58dbeeb2f1cddedba4096d2e400fc06f54aa71ebd916652

Download Submit
C:\Windows\SysWOW64\Jaljgidl.exe

Filesize
256KB

MD5
0beef928746acf4e9fdfffc91fa509e5

SHA1
f104b1d69984830a93a8f18cc633eb92e87f63e2

SHA256
f9506c8fa802ce5c929e3cffe1ae122f8ea8458230242371bd48c38b49587388

SHA512
ffb3f35328b3cb18d78594fb448f396f09c9c06a8cadc88128b480315385fb64cb3ee19d1c9976e5685d298b47f0e186c41b59f98f0631ee431190953ad48012

Download Submit
C:\Windows\SysWOW64\Jangmibi.exe

Filesize
256KB

MD5
3c82a5dfd2e8d5b1c09ed2aa5386e9d0

SHA1
7ced7d005d3b783efc5140866197cc2c451b1cf7

SHA256
390e7d88f1756342dd9a1a4ea257ae3186a10460fa4f736b2abf23fddb5791a1

SHA512
3a1fa5f66993f3e79c5623b93e8063021730f5db870fd9b8a7cf49c29651dac061e9c64c0a9ba6a7e645a5394006db5e7e3452d1d2089c8aa419dd4e46a3035c

Download Submit
C:\Windows\SysWOW64\Jbfpobpb.exe

Filesize
256KB

MD5
13ba36bda78c3da7856dc53ebe991484

SHA1
502d082c91825f2a92490a2d991fe2b080fc7eea

SHA256
7e693cf6d3da53fd520d964c3390113378f47bf8f41229b32516624534d473ec

SHA512
c328acde6f512dfcbf9f2687a2e8dbda29721dbe8602f346e3bc7ceac63a28eeecc9ee72ff33fe71dbf995934956f91dcc841146498683f66cf3e81128d56885

Download Submit
C:\Windows\SysWOW64\Jbhmdbnp.exe

Filesize
256KB

MD5
7d8dd29856cfa588465015c5a6275ee5

SHA1
135ee162d1359afa839f18d592d0d1361141e8f7

SHA256
9c9c061a13f4b2d590df390bcdfe26197df96a9f1d7245e487437900950c8d47

SHA512
ccfcf22c70381af709b8738ef90b55e9348f4c88c5609df9937fc1cfc2d62f6973168595f2abd3bcb9b0ab2f7a0f0e0ca28a8efc20221d7ebc0caacfebc004bc

Download Submit
C:\Windows\SysWOW64\Jbkjjblm.exe

Filesize
256KB

MD5
9374ba223a742e9497380edaebb4410b

SHA1
30416378caea9e489bd7d1133d90ac245073d569

SHA256
b71f2eae2b8f5b5e89e40e30fe7ebb4ddbd31db39126c60cc2a81abc09e3392e

SHA512
f9b8e6cd44636b36f994f0f86f927116832d1df8cd5c09c8cafd97d34bf2c12484bca2f134a816d899dd0af5e5a10f18e12a5ebaf8e87968d26de5d6ad0dd55f

Download Submit
C:\Windows\SysWOW64\Jbmfoa32.exe

Filesize
256KB

MD5
c086cd91de1f2693be8142684ab3f30f

SHA1
90a3e2eaebfbcb4aa36162a3a63adb5277d7de4c

SHA256
ac32ae13b150ebb803e7ea789a0b182502e80c6c55e382e2eb1f1bdd18e75f7c

SHA512
1f65da795274c8001708ecabaf180f71eecaa63459ad71f8108a909ab81e6f5b2673dab72f957c472389abcde11610ce18c6e991c4d178d384b3497d1ee9cd17

Download Submit
C:\Windows\SysWOW64\Jbocea32.exe

Filesize
256KB

MD5
16d69aed0fd25c45098456e7e320f3fa

SHA1
75addf2724c2e0f864e8e36954a363e196725f8a

SHA256
1a5da30b6411e63c54aa14249409e36871cdad404bb85b2019ac2226de6c3065

SHA512
df8b56400c7e822be72ddf67d883d7c81b0fb4e20dfbeee502b38559cba4783d09ebe359dd4a7c0099ae18de08a6f28638cf5315e47ac5e49723be556c7199bd

Download Submit
C:\Windows\SysWOW64\Jdhine32.exe

Filesize
256KB

MD5
537f4ea3eae801b20718d8501bf67449

SHA1
48a554cb6463c5f96ec2edfee58159478a8ed71b

SHA256
4f04d2cf2b2299ed1e0e7540c8544ba1c6d606add152e3506f18cc2fc9ae258a

SHA512
fb4f97030827f8410fba323b06b4bc53f39a7d7fe2fb72b4d8f813558540299d9071d2bba2bfadcbac50825f38849ddf6aa5b24814a67038342a249e3a513c18

Download Submit
C:\Windows\SysWOW64\Jfdida32.exe

Filesize
256KB

MD5
591df437fa216a854bd41da74d2acce7

SHA1
a1897beac01271b5a18c238ca68e689a4fba390a

SHA256
a089644feb06cf52c807934dcf81ee22bfcb3bdd54e9d414e804faa63319da49

SHA512
b56e8e62f04e9834866441100ffbfff9d025158942e749f19368252f5ba4771ff23de2ce4b36a3ca8bedb2aa42d847279afe1447cbf6d162def6126536728d46

Download Submit
C:\Windows\SysWOW64\Jfffjqdf.exe

Filesize
256KB

MD5
e4264b0b63758198a6ee57006c8758aa

SHA1
8fe9e96d55d50072cdd4aa65a640e93f5adf52a5

SHA256
54d58e0b0267048b501f125e9219458d20b1910855feb21b353015e807d5e179

SHA512
f4b534cc8a9136e0b3d618daa711287746c1f5eb6b0b303d79d3b7358afd6af2354ce26003096285a7cc931beb6fe9140fa25b687771f0da5a91a1d2b71d1fcb

Download Submit
C:\Windows\SysWOW64\Jfhbppbc.exe

Filesize
256KB

MD5
e7d519a5e3fbbc7e9510ec0a655ddc1b

SHA1
426b858a452d961edaf4c0283d14e0bc06e92b29

SHA256
466e3a41211347e9bf87c7480d4edf1a980f50a4e8b5c544041c9ba20a701d60

SHA512
3166503ce242c642437c22a919c49a4147d9262f25837cf7019492f4d0d71dd24d46512b48195c50564d319eaff0b4210737eb3270346a3926a88d6b7b8c314f

Download Submit
C:\Windows\SysWOW64\Jfkoeppq.exe

Filesize
256KB

MD5
9d6480b1de28cabac1362ef5953d0dbb

SHA1
487e0990d87ff397c29451624b6c776c60e1f6fb

SHA256
dc44e2b6cfaee033dc6210c2ab3c53251eff81ce90aeef7ebb13b5937db54962

SHA512
adbe5339a538abd15f020097d78956abd3d00b07ab79fa8f5c549112033469fb22e0fa02ddfce22cddce69ec67a3df0ecda90c6b1a2f16ccc7904cdec31ca2d2

Download Submit
C:\Windows\SysWOW64\Jibeql32.exe

Filesize
256KB

MD5
c58d8491fbf3983c191561262c465f34

SHA1
183c44a3ec1a62937abcb0ec4d8eb178a29b194a

SHA256
4853648f2f1b11e5833e2e6628dda9ba3b4fa6752137a3504479b3999ec9fccd

SHA512
900afbce69daa19d9962e03a8b08bd59d2403d2675c7224fb01052425fb26d68d21317dc9f0d478cff87cde34c2aa418fca0d44cbc5dce7d5767fe683d0ffdaa

Download Submit
C:\Windows\SysWOW64\Jidbflcj.exe

Filesize
256KB

MD5
d943e3334cecbd4fc97ec14633dc49c2

SHA1
995bbf089ee9150c24e2f06c00193741a6dda7c3

SHA256
f0d0ec8d3e3ca4a1b2e5f41abbbf2511c2b645fecdff16f621ba7f8f55c73c97

SHA512
761969e9bac4e7c67e4fb68fab06af596d518e7e9d23522734ba6f45c474b7038c0375b79db53062c5d7579d6e2c4428b58df6b47eb864eb4fd6c15942035999

Download Submit
C:\Windows\SysWOW64\Jjmhppqd.exe

Filesize
256KB

MD5
593b94e862ab40192e5177147f696fd3

SHA1
10a4a20752e7b31d1bd224cc7dac82b26ed5a816

SHA256
cd0b4a8c44a9bcaf5a59130cad8c73e2aefd7a45c0437a626e667e023b04e7c5

SHA512
8a7671cf0bf3ae7029d30de2d2708aba088672e1c456437dffad5a27a412f7da005ce372bdb791a43f291239741142250954621e055ae713dd5b5a44e346ccff

Download Submit
C:\Windows\SysWOW64\Jkdnpo32.exe

Filesize
256KB

MD5
0efb6588964621e6784d61f8ac468907

SHA1
c5370e474de234a71a7005b7820f8e35c828abb6

SHA256
4766bc200f82a67f040cf63ed6d5bdd35191bab0bbad77ec1913b119cab104d4

SHA512
1cef6fab20807237cd194e24b6e53495242f741d3f7cb1ddea3fbd46bc8472ca8ac892ba182ac8c6fe90d25096a06fd4e160f09346a719fb679de1a1a100e2f6

Download Submit
C:\Windows\SysWOW64\Jkfkfohj.exe

Filesize
256KB

MD5
8a873f4536c1d59953277bcef12a2fb9

SHA1
3a24ab31be43c01fa91c231a9d2492f3c0641778

SHA256
a8699a947e4a63a24ca09faf02d582153529c448f5ee192a14d216042997d38f

SHA512
e5be797dfe8e2fa5f88c7bac5dba259023e5ffcf7cb368d2782bd3347ee2b23369e5afba1b061d8a498702a5f731c4c93acba4df64f327433785a5cfb2d4d886

Download Submit
C:\Windows\SysWOW64\Jmbklj32.exe

Filesize
256KB

MD5
15ffb7731c4181305ba9e7f907ab86c6

SHA1
4f9ac87a68c5a4c6d0c347fe47b58ff2328430ad

SHA256
3db6f8c6e18d4e19ff2f66e93292404b599abbf06931aac060bddf681b23cc5c

SHA512
845fb4a2b564d160f591299ac755ec477058694ab9ceb4ce48d6b41a22e4d07f3c8e9636c236011cb57ce51b86b527230b888476a84809a4668d5dcc8ace432e

Download Submit
C:\Windows\SysWOW64\Jmkdlkph.exe

Filesize
256KB

MD5
a6670f59e29d92e91b4f1290a96461ea

SHA1
adbaa7bce080eea09a0bfed6310dc54c2868035b

SHA256
dc8965446e9a93e622afe70bef689a7cb5055daf29463024acaf332e55d966b6

SHA512
8f9d1bd4e71d77510948193fa15f82ff48d49fa1c19609cedea4818160c0540520378954c264be46de8d5c9af70645dba30c23bea69c04d75e27939a2d485f11

Download Submit
C:\Windows\SysWOW64\Jpaghf32.exe

Filesize
256KB

MD5
547d3cb9fb74756551d149e5476cd040

SHA1
f9958da617fe7038fd855d4766bc53a84d6f7c0f

SHA256
e18aea58dd6e41bd5da57e9882c6512627dfe5cc01cdb71d001488542c5b68ec

SHA512
e433c2134df664493c03037dd0be02bc42d8a7d24f02c22a1adfda85206c552940ab1e949ab6acbe25266b3ce61e3abddf3c4b4c77ffd6af42c6f57e2e93cbe5

Download Submit
C:\Windows\SysWOW64\Jpgdbg32.exe

Filesize
256KB

MD5
e4c754d108458a9469af39a09dc3e9b1

SHA1
f329baa4776fde0c541bee2ba7834d96b74bcd41

SHA256
137a18d697dba3bf4775d36890484658b9dbbefdd12f879343ffc2756220c22a

SHA512
6bf67526233406994727e43c2fbd72ca3e1e1e1fffb847158c58c42681b1443549fb0f567de588817ae4137454a16ef0bdf14f4f3b9679c977495427abed46af

Download Submit
C:\Windows\SysWOW64\Jpjqhgol.exe

Filesize
256KB

MD5
0e165ad8dfb8040eb83849931a9099a7

SHA1
c494b4532b1d498d7ae6d14c95da2fd708aeb35e

SHA256
25ddf992b0c7ec3a25885e4a25dea6ff6c7e7f248c38c8c8e17049dfc5d883ff

SHA512
c90d71d4db819e2e5783ccd8cf6403102008ba61c1d1811585a5fa9d90d5a907be3c27ba3dd4b150551d1b3ceb41e1eef9cf59b74e6db6861369c2400c2a7ece

Download Submit
C:\Windows\SysWOW64\Jpojcf32.exe

Filesize
256KB

MD5
03ec312b437d8cc166d07dd4ec996aae

SHA1
4690442a5affe8d56c6337d8d8af71211ec33c00

SHA256
f71c64a75d18b6e0445dd0d5223eaadc4a93c58e21f39afed412c288245ac3d0

SHA512
5bec774d683fba50e0e6408381bd36cec2b5edfb945c1a3fcbefad01881834e5a7725f8b8e423044fa9dfe6dcaf6a21bcb16f7fb33c99335b2a308755fde701f

Download Submit
C:\Windows\SysWOW64\Kaqcbi32.exe

Filesize
256KB

MD5
8329a8c3e4d36a38d74d73f0bcc85ed2

SHA1
3fcff679c1af9b6629cbfd26c0641a20e93cd47e

SHA256
bbee59286db4560c1a4c6163fb012dfeeba6214dab14dedb76f5082351d3dc68

SHA512
47ae637553933e04d5efedd81e0bddf32ec48c6716f9ba20bc3596f248f8582b0d0d26b3cf3c072764de985d59861441acf88cfd55730b628d2beae54de44bd7

Download Submit
C:\Windows\SysWOW64\Kbapjafe.exe

Filesize
256KB

MD5
6d9e4f56d309113a73aa1397e826b4e3

SHA1
a81a23dad1b6d964672d9cf3e4a0c706db1fec89

SHA256
93418b447ce66f9714dd6be3e2273ddbb4fd318b18471eb069664ac99377cd99

SHA512
06b32a0a1f76e52c75a811a7dd3c8213799f3a5fdfff544b70b9b7da74863acc22157ba4ba970e5a59a4d24060f56be86858ea2fe34ba91dd475efac202d6a4b

Download Submit
C:\Windows\SysWOW64\Kdopod32.exe

Filesize
256KB

MD5
cde00274100729aae92d5b1936c55882

SHA1
474c05eba9c04979635eb753cb2a8b7afbbc33be

SHA256
05429dd02d1389d493075824a3bb76b36100cb27c4f4c8510f46fda014a1ccfc

SHA512
4e34af9ce88a3a66f8ec019fa08cefa623a93ea97aefd6c5c9a10da6a353ae35c76a936f26b3c91275c6dbe3ca780f5250d15f922f701d6251ebb9679273c451

Download Submit
C:\Windows\SysWOW64\Kmegbjgn.exe

Filesize
256KB

MD5
0654b331116b984c5820ef870f8f60e9

SHA1
fe60cd0e0693fbe820d670821c763af8ba38bf82

SHA256
2e44a87eca01be5945c3b7032c7fc9b74746277f8770685df4348f50c3769485

SHA512
8d9b8216346a8c3aaae541ca27f5f51dce4deed75100d5807fbb6bbcec72d446bbb4ed4e8aceb2e9606647025251afc39386ed91cfc519046cf01964a7840405

Download Submit
C:\Windows\SysWOW64\Kpccnefa.exe

Filesize
256KB

MD5
101297d5224cb0cc0533b094449c4616

SHA1
f2fda4d02f9f0287b61b59275f3c912f1d4f501a

SHA256
91e7b02adf26651af3fb9f2953744d34c47991bb4b752e72906abb3665ddda31

SHA512
6012148075ec433e375f4ed5e33cc6a9a09965879f80f200fe9c9f9053d58eac67147a48750975069791e5500e09af475c956d4e4cf37a99d1883e4b080c20c7

Download Submit
C:\Windows\SysWOW64\Kpepcedo.exe

Filesize
256KB

MD5
14dd12429044f11e954e7244aeba6a16

SHA1
1c51c4a5dba4770a4ff72c43a3a23b508cea270c

SHA256
f529e00ba395adb5332c14f9d7c28b41eefaa056de2e747265fd8e98865690ac

SHA512
10201017a4be08a2739cacd184dde7e49500b7e9bfd740cd840cd2c4755395ed49313a33e907bec29d6058149ff408f6802228020a5b466922e7845052f49d4c

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
256KB

MD5
ea58888d3993558f84eca48a2e0e2cd1

SHA1
e8be1c953e4c97a197b971a2c43bde0551063713

SHA256
76b012b559e8fd3950060962d8adf9951aa4dd771958b31cb5f24acfff9343f6

SHA512
7ef48cc56cf7d11a61d0e762d440451896555c3cd1ebee1598b3fcb0df5dc043c860cca244af8eae3a1e758575a49601bbc7b97a8f384c2bf30b52e312c21e6a

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
256KB

MD5
ce1732d69e57c6aff5dfb91a1937c2e4

SHA1
7a748b6784c2ba735368cfff5323ceddd98e5b2b

SHA256
a6d49597c89e51bd2c45d112f3c5af8e6a9a44a10eb170bd135a0541bf958da1

SHA512
76e4d96b76db9801d65e9529f436fd9af6748657482688f34a46dc4fe56eb12ab58a1e0209fb49ae05f501e1af6af15588e64842597aac64e1712e16fb0e519d

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
256KB

MD5
b97ef9b45741faa9670df453f06b401b

SHA1
dff9689f4cadc837d9ce3377540216dcff511d61

SHA256
f1dfa06ac43fe2ebfa10f46c15542e2a95510f2302403c977f771354c7c02624

SHA512
872c0ff029146b0667d3ff60e6ccb37e30382638c848903617a0b2575ced0010c3b32c0f986c85187723340120e8bb1cf36552f67642493211e7d691916c608e

Download Submit
memory/700-247-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/824-411-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/936-289-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/960-76-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1060-270-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1096-271-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1164-376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1168-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1212-240-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1300-280-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1420-229-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1448-32-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1672-430-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1680-248-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1688-256-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1748-405-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1880-253-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1964-39-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2020-374-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2040-333-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2192-436-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2212-79-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2244-238-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2264-304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2336-399-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2428-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2708-264-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2764-262-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2948-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2952-107-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3004-446-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3012-315-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3240-419-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3264-13-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3356-412-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3388-294-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3504-356-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3524-338-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3712-358-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3736-52-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3784-321-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3904-265-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3932-346-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3992-288-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4032-340-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4144-303-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4160-364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4164-297-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4312-245-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4336-425-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4400-286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4448-257-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4468-274-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4540-87-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4548-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4564-296-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4676-382-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4704-255-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4708-287-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4832-388-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4948-234-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4964-322-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4976-236-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5072-273-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads