108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e.exe
Size

320KB
MD5

c19644fb7f2cd6ca9a8ea652259b72f4
SHA1

e35856bc08b61ff7fcd76a29e0ea092f6b82f600
SHA256

108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e
SHA512

bbce94564bc3150209ebd9579a5ca555ec6f9b69d3ddde9c07520851afc95c1a3e01c9f13cb242fe02dfe88e685562d62b0debf7ed0d016ee4ac3f76085b0728
SSDEEP

6144:ekUFOvl9Y/m05XUEtMEX6vluZV4U/vlf0DrBqvl8ZV4U/vlfl+9Q:e1OvSm05XEvG6IveDVqvQ6IvP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffjqdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jagqlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpeepnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjpeepnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdcpcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgneampk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmkdlkph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jagqlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmnaakne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjmhppqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdemhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe

Executes dropped EXE 64 IoCs

pid	Process
4716	Jdcpcf32.exe
1660	Jjmhppqd.exe
3748	Jmkdlkph.exe
1152	Jagqlj32.exe
2164	Jdemhe32.exe
3228	Jbhmdbnp.exe
3808	Jjpeepnb.exe
1812	Jmnaakne.exe
2944	Jplmmfmi.exe
3100	Jdhine32.exe
2040	Jfffjqdf.exe
444	Jigollag.exe
2448	Jangmibi.exe
1248	Jfkoeppq.exe
2820	Kpccnefa.exe
1552	Kbapjafe.exe
8	Kacphh32.exe
1788	Kgphpo32.exe
1052	Kaemnhla.exe
1956	Kbfiep32.exe
3428	Kmlnbi32.exe
4324	Kagichjo.exe
4248	Kgdbkohf.exe
1460	Kibnhjgj.exe
1824	Kdhbec32.exe
1780	Kgfoan32.exe
4824	Liekmj32.exe
3840	Lalcng32.exe
1176	Lpocjdld.exe
2656	Lkdggmlj.exe
2236	Lpappc32.exe
4524	Lkgdml32.exe
4820	Lnepih32.exe
3084	Ldohebqh.exe
3540	Lgneampk.exe
1636	Lilanioo.exe
548	Laciofpa.exe
1224	Ldaeka32.exe
1820	Lgpagm32.exe
2908	Lklnhlfb.exe
2612	Lnjjdgee.exe
4496	Lphfpbdi.exe
2628	Lcgblncm.exe
860	Lgbnmm32.exe
5092	Mnlfigcc.exe
4492	Mahbje32.exe
1588	Mciobn32.exe
2732	Mkpgck32.exe
3944	Mnocof32.exe
4896	Mpmokb32.exe
3784	Mdiklqhm.exe
1652	Mcklgm32.exe
1088	Mkbchk32.exe
4204	Mjeddggd.exe
4952	Mamleegg.exe
3852	Mdkhapfj.exe
1504	Mgidml32.exe
2624	Mjhqjg32.exe
2016	Maohkd32.exe
4364	Mpaifalo.exe
2012	Mcpebmkb.exe
4300	Mkgmcjld.exe
2264	Maaepd32.exe
1528	Mdpalp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Jbhmdbnp.exe	Jdemhe32.exe
File opened for modification	C:\Windows\SysWOW64\Kgphpo32.exe	Kacphh32.exe
File opened for modification	C:\Windows\SysWOW64\Kdhbec32.exe	Kibnhjgj.exe
File created	C:\Windows\SysWOW64\Ibhblqpo.dll	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Omfnojog.dll	Jjpeepnb.exe
File opened for modification	C:\Windows\SysWOW64\Jplmmfmi.exe	Jmnaakne.exe
File created	C:\Windows\SysWOW64\Kaemnhla.exe	Kgphpo32.exe
File opened for modification	C:\Windows\SysWOW64\Lgbnmm32.exe	Lcgblncm.exe
File opened for modification	C:\Windows\SysWOW64\Kbfiep32.exe	Kaemnhla.exe
File created	C:\Windows\SysWOW64\Khehmdgi.dll	Lilanioo.exe
File created	C:\Windows\SysWOW64\Kcbibebo.dll	Mgnnhk32.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Lgneampk.exe	Ldohebqh.exe
File opened for modification	C:\Windows\SysWOW64\Mjeddggd.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Lkgdml32.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Mahbje32.exe	Mnlfigcc.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Kgphpo32.exe	Kacphh32.exe
File created	C:\Windows\SysWOW64\Ogndib32.dll	Lkdggmlj.exe
File opened for modification	C:\Windows\SysWOW64\Lilanioo.exe	Lgneampk.exe
File opened for modification	C:\Windows\SysWOW64\Lnjjdgee.exe	Lklnhlfb.exe
File created	C:\Windows\SysWOW64\Jmkdlkph.exe	Jjmhppqd.exe
File opened for modification	C:\Windows\SysWOW64\Jagqlj32.exe	Jmkdlkph.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Jfbhfihj.dll	Mciobn32.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Hnfmbf32.dll	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Jmkdlkph.exe	Jjmhppqd.exe
File created	C:\Windows\SysWOW64\Jfffjqdf.exe	Jdhine32.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Jdhine32.exe	Jplmmfmi.exe
File opened for modification	C:\Windows\SysWOW64\Jigollag.exe	Jfffjqdf.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Kmlnbi32.exe	Kbfiep32.exe
File created	C:\Windows\SysWOW64\Liekmj32.exe	Kgfoan32.exe
File created	C:\Windows\SysWOW64\Ckegia32.dll	Laciofpa.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lcgblncm.exe
File opened for modification	C:\Windows\SysWOW64\Mkpgck32.exe	Mciobn32.exe
File opened for modification	C:\Windows\SysWOW64\Mamleegg.exe	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Jbhmdbnp.exe	Jdemhe32.exe
File opened for modification	C:\Windows\SysWOW64\Kbapjafe.exe	Kpccnefa.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	Lpocjdld.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Lnepih32.exe	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Lnjjdgee.exe	Lklnhlfb.exe
File created	C:\Windows\SysWOW64\Mcklgm32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Jgiacnii.dll	108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e.exe
File created	C:\Windows\SysWOW64\Ggcjqj32.dll	Jmkdlkph.exe
File opened for modification	C:\Windows\SysWOW64\Jdemhe32.exe	Jagqlj32.exe
File created	C:\Windows\SysWOW64\Lpocjdld.exe	Lalcng32.exe
File opened for modification	C:\Windows\SysWOW64\Kagichjo.exe	Kmlnbi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5500	5404	WerFault.exe	177

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Legdcg32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlhblb32.dll"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbhmdbnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdhoohmo.dll"	Jbhmdbnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphqml32.dll"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecaoggc.dll"	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpnkgo32.dll"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblgaie.dll"	Kbapjafe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nngcpm32.dll"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgcomh32.dll"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghmfdf32.dll"	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jplmmfmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbapjafe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblifaf.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfkoeppq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jangmibi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kacphh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhikhod.dll"	Liekmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdknoa32.dll"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omfnojog.dll"	Jjpeepnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmlnbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebboiqi.dll"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbfiep32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4716	5024	108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e.exe	90
PID 5024 wrote to memory of 4716	5024	108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e.exe	90
PID 5024 wrote to memory of 4716	5024	108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e.exe	90
PID 4716 wrote to memory of 1660	4716	Jdcpcf32.exe	91
PID 4716 wrote to memory of 1660	4716	Jdcpcf32.exe	91
PID 4716 wrote to memory of 1660	4716	Jdcpcf32.exe	91
PID 1660 wrote to memory of 3748	1660	Jjmhppqd.exe	92
PID 1660 wrote to memory of 3748	1660	Jjmhppqd.exe	92
PID 1660 wrote to memory of 3748	1660	Jjmhppqd.exe	92
PID 3748 wrote to memory of 1152	3748	Jmkdlkph.exe	93
PID 3748 wrote to memory of 1152	3748	Jmkdlkph.exe	93
PID 3748 wrote to memory of 1152	3748	Jmkdlkph.exe	93
PID 1152 wrote to memory of 2164	1152	Jagqlj32.exe	94
PID 1152 wrote to memory of 2164	1152	Jagqlj32.exe	94
PID 1152 wrote to memory of 2164	1152	Jagqlj32.exe	94
PID 2164 wrote to memory of 3228	2164	Jdemhe32.exe	95
PID 2164 wrote to memory of 3228	2164	Jdemhe32.exe	95
PID 2164 wrote to memory of 3228	2164	Jdemhe32.exe	95
PID 3228 wrote to memory of 3808	3228	Jbhmdbnp.exe	96
PID 3228 wrote to memory of 3808	3228	Jbhmdbnp.exe	96
PID 3228 wrote to memory of 3808	3228	Jbhmdbnp.exe	96
PID 3808 wrote to memory of 1812	3808	Jjpeepnb.exe	97
PID 3808 wrote to memory of 1812	3808	Jjpeepnb.exe	97
PID 3808 wrote to memory of 1812	3808	Jjpeepnb.exe	97
PID 1812 wrote to memory of 2944	1812	Jmnaakne.exe	98
PID 1812 wrote to memory of 2944	1812	Jmnaakne.exe	98
PID 1812 wrote to memory of 2944	1812	Jmnaakne.exe	98
PID 2944 wrote to memory of 3100	2944	Jplmmfmi.exe	99
PID 2944 wrote to memory of 3100	2944	Jplmmfmi.exe	99
PID 2944 wrote to memory of 3100	2944	Jplmmfmi.exe	99
PID 3100 wrote to memory of 2040	3100	Jdhine32.exe	101
PID 3100 wrote to memory of 2040	3100	Jdhine32.exe	101
PID 3100 wrote to memory of 2040	3100	Jdhine32.exe	101
PID 2040 wrote to memory of 444	2040	Jfffjqdf.exe	102
PID 2040 wrote to memory of 444	2040	Jfffjqdf.exe	102
PID 2040 wrote to memory of 444	2040	Jfffjqdf.exe	102
PID 444 wrote to memory of 2448	444	Jigollag.exe	103
PID 444 wrote to memory of 2448	444	Jigollag.exe	103
PID 444 wrote to memory of 2448	444	Jigollag.exe	103
PID 2448 wrote to memory of 1248	2448	Jangmibi.exe	104
PID 2448 wrote to memory of 1248	2448	Jangmibi.exe	104
PID 2448 wrote to memory of 1248	2448	Jangmibi.exe	104
PID 1248 wrote to memory of 2820	1248	Jfkoeppq.exe	105
PID 1248 wrote to memory of 2820	1248	Jfkoeppq.exe	105
PID 1248 wrote to memory of 2820	1248	Jfkoeppq.exe	105
PID 2820 wrote to memory of 1552	2820	Kpccnefa.exe	106
PID 2820 wrote to memory of 1552	2820	Kpccnefa.exe	106
PID 2820 wrote to memory of 1552	2820	Kpccnefa.exe	106
PID 1552 wrote to memory of 8	1552	Kbapjafe.exe	107
PID 1552 wrote to memory of 8	1552	Kbapjafe.exe	107
PID 1552 wrote to memory of 8	1552	Kbapjafe.exe	107
PID 8 wrote to memory of 1788	8	Kacphh32.exe	108
PID 8 wrote to memory of 1788	8	Kacphh32.exe	108
PID 8 wrote to memory of 1788	8	Kacphh32.exe	108
PID 1788 wrote to memory of 1052	1788	Kgphpo32.exe	109
PID 1788 wrote to memory of 1052	1788	Kgphpo32.exe	109
PID 1788 wrote to memory of 1052	1788	Kgphpo32.exe	109
PID 1052 wrote to memory of 1956	1052	Kaemnhla.exe	110
PID 1052 wrote to memory of 1956	1052	Kaemnhla.exe	110
PID 1052 wrote to memory of 1956	1052	Kaemnhla.exe	110
PID 1956 wrote to memory of 3428	1956	Kbfiep32.exe	111
PID 1956 wrote to memory of 3428	1956	Kbfiep32.exe	111
PID 1956 wrote to memory of 3428	1956	Kbfiep32.exe	111
PID 3428 wrote to memory of 4324	3428	Kmlnbi32.exe	112

C:\Users\Admin\AppData\Local\Temp\108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e.exe
"C:\Users\Admin\AppData\Local\Temp\108c4ebb8dfb1a841fa20727e4e88be56bc2628de3dd7e3aac8879be11a6072e.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\Jdcpcf32.exe
  C:\Windows\system32\Jdcpcf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\Jjmhppqd.exe
    C:\Windows\system32\Jjmhppqd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\SysWOW64\Jmkdlkph.exe
      C:\Windows\system32\Jmkdlkph.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1152
      - C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:444
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4324
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4248
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1460
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1824
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1780
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3840
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1176
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2656
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3084
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1636
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:548
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        39⤵
        Executes dropped EXE
        
        PID:1224
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        40⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2908
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2612
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:860
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        47⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1588
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3944
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3784
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3852
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1504
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2624
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2016
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2012
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2264
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        68⤵
        Drops file in System32 directory
        
        PID:1320
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2852
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3676
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1920
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:856
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        76⤵
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        78⤵
        Drops file in System32 directory
        
        PID:1580
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        80⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5276
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        83⤵
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        85⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 400
        86⤵
        Program crash
        
        PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5404 -ip 5404
1⤵
PID:5468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Jagqlj32.exe

Filesize
320KB

MD5
d64e09f3f8abb54442431d37ae329a6b

SHA1
36b72f1a4352c9ecf3ea3babbeb0a6b9480207f5

SHA256
8a06f04169cef44297f27e068017cfbe1236873d37aa4184e4b93761e01ae74b

SHA512
9d116e235ae2f29194a6e29e7636d4cf61464f848cd9c819da8b29286a676ae14df85fb8066e7ad27ad12bb8bb9a3e926bcaf625c19909daa7317798c64bc2ca

Download Submit
C:\Windows\SysWOW64\Jangmibi.exe

Filesize
320KB

MD5
e4692d2ef4c68685781e6bbcadd89e79

SHA1
a8e705098e2140bae7f6c63751121a4788f78c91

SHA256
68049757f730ecaeb3b5e416f0200e1f8139bd680869d5390b2e40afa5d0a979

SHA512
b74201e69069be3f4b8182048f8eafe357f1ad1dd1378d836f4f423ed942e01387dcd879cf07fe2ac62c33fdfc192e30801ba4612de9b1088bd3a84e739c6219

Download Submit
C:\Windows\SysWOW64\Jbhmdbnp.exe

Filesize
320KB

MD5
54b332ae7843a5848eda7ba07e56a889

SHA1
18f92985525a7f7244c97ab756e4380514bd2741

SHA256
5768bacb6d5388d1f252946e71b365acb6a6bee93c3ee88830b0bc1a7dae7939

SHA512
36f5de22db8c8bf2236d48166d27a18525c01890d4dbf2e5e2c51a4dd0a2521fe1fc9fa9d07594a26c57a83f33bff69e45637d03fdf90f38d6bd0ffb586d3989

Download Submit
C:\Windows\SysWOW64\Jdcpcf32.exe

Filesize
320KB

MD5
565edfcae365c252714ba78f5f307cf3

SHA1
24b24fbd04bb0913866d83edd19b38d112486a0d

SHA256
e471919919d26fd20be7ab4a593f0932d4db92a84a803295a374c7c14b8b1897

SHA512
7f104f64a8bf406e97115302ecd33b59f6144c413a264cad8e1a1ee83b7f2fa87834f072bc0b333d56b9ed727ddb2a685f7188f0dc5a11ebfee38b2fcda0fece

Download Submit
C:\Windows\SysWOW64\Jdemhe32.exe

Filesize
320KB

MD5
997a2fe0e39ebe13b20158c77c264ef0

SHA1
6f58380b48fd38e2900b9500612af8ec0bceefbf

SHA256
68412991247874357ffab1d81d2487b302f00d44754eaebaebcb09ea2407dc8e

SHA512
1445eb46df614f1b6fb96be36b761d79c95287eebf2d3b6b2bec750e547b7da1e48df223352059a5b3b0a718ee1bad84ef77b69cc1a21c22a6954d60eaf66b8c

Download Submit
C:\Windows\SysWOW64\Jdhine32.exe

Filesize
320KB

MD5
82e9f4e260a28288ccbe57fa61929589

SHA1
784c02641dd0991695e936731af81b1c6c88ac36

SHA256
7f2d2d592165109fb84e015e79a69d93f11a022f71150f1ca615b09bda3b62e1

SHA512
e6acde9b4196a4b96b50cec0f20448dd08299f148a2af4d4216cbec6506d6370da546dd1b4ed7005c52c8f5200dd11310e50cc36d3caf1a5cc084fd60464c059

Download Submit
C:\Windows\SysWOW64\Jfffjqdf.exe

Filesize
320KB

MD5
df1b2f1d27f7d1112941c6a2a3b06a38

SHA1
7203c84dfba751a9f19b6765fd3e142c92a9f3ba

SHA256
e4ad80e3cf188043e221e2db3af1b013df92b07adc5ec203a4c8de9ca49e90d4

SHA512
38d1581b0722f9e61018dcfc95bbc782f8e4c8dbbf4bff2318fad1997a761e91a55f52cfe8393542644252003a922625fd3bbde93d5e85feb3b68d19ad8da618

Download Submit
C:\Windows\SysWOW64\Jfkoeppq.exe

Filesize
320KB

MD5
d32fbd5b2504f49118ad5dc689394951

SHA1
6720f2c615ac3fff99d421928f12146fc2c6a7aa

SHA256
f0005e9262be5ea9143f9a64cb8d7536effecb7239f00bc3f8f8c9070c823d55

SHA512
8d1665c1136029d37d13e0fc3c3ae142cb7d72c34f298ef01b10a9323cf930f2f56a705fd470cef3b1792870f004ce985207008acb32fc16e4908d1ab1c9a304

Download Submit
C:\Windows\SysWOW64\Jigollag.exe

Filesize
320KB

MD5
be91c30fb20be655c2840851244c57b1

SHA1
a6a0f826d08f140f16730b9ad9ceceaacf7b2759

SHA256
77a93fd73b292629ce2d30db83ec936c180de0888df83360e2d2e03868286205

SHA512
51bf0d995d6ba4eacd716b8d96056a8bf8916afca683d3b8af259d52581e0c6eb9ddfcf50887e765a6a553d1e2e479323b618a18462b326381cff962c162b990

Download Submit
C:\Windows\SysWOW64\Jjmhppqd.exe

Filesize
320KB

MD5
386a2f23e262748a4d9df527b005f792

SHA1
e38a708ff0d7093f5aa8baf7e9b67ca650043081

SHA256
723765c1b29bf1b1151a646a98f7497702373c1ae7c37d7902790643ce0032e6

SHA512
0e264d8890f89f5e8430975bfc06579dd43798e6746709ec308439725ed1115f1df3ab198165df58f2797e163e5f65725a31ed5c823395a2b020e5cd5a0d6981

Download Submit
C:\Windows\SysWOW64\Jjpeepnb.exe

Filesize
320KB

MD5
c7873e446213be6cc89906cc05ea0ddb

SHA1
63eb9779fba24a27bdef46cad9b210d29a4012b5

SHA256
a19dc19f6bab6dce4e42b96b0817121402e537f6ffaa5223e76620c3ab336711

SHA512
73ea9852737121d079cf30cca34d99a9fc5187bd2fb8137f2d6facb88b02ee044ef8d5530ad777fa55ef3e871a5abc9d8a52a0243128a9e297b48641fba18fa5

Download Submit
C:\Windows\SysWOW64\Jmkdlkph.exe

Filesize
320KB

MD5
72470558ff3bcef6e8b8a0d37efc9680

SHA1
c2f93f1b731d18d900925b178b7ae92650053a61

SHA256
89904b5f9e8c7d653660b5bbc7d9aaf1c076a3c4ac435382065424373dfffdfa

SHA512
7ad7a076cf5bbdf217aebd87b052b38626d09fc4c78f4bd0f76b9bb3ed85dbfdda96a6eb10b85ef277b1ffe6c90bd491c4d8b7f7a6cef2a3c5f27678e9df1a67

Download Submit
C:\Windows\SysWOW64\Jmnaakne.exe

Filesize
320KB

MD5
ad7f97cacd99729c94e5d29da0b173ab

SHA1
33e028ca1c3c602acd69bf0b619e6f56ea17b85a

SHA256
98ba27ce2524245b2c095a6fb820777248a0803e7f43642633dc5f2137f8b348

SHA512
18843ec6c21fd5310f656ea87908a514ac948f1eb0078926f3eb8b46fd3a05d5d82ce3f4f65c12eb9761199ce39bf5e5e93d345f7df116103049710e9a48f62f

Download Submit
C:\Windows\SysWOW64\Jplmmfmi.exe

Filesize
320KB

MD5
cac77057f2afd2afea575fda7a4ec56b

SHA1
c3b5f2708c191a0b053081acbb4714325b7f9883

SHA256
06cb5620492b01f464784d5b59840deb22853d85592adff39063baa251903c3a

SHA512
19dac71cfa1f83dab56ea4e455669f403389c7db71c0d72a816fbbe84943ffef047d60b54c2a6706df98a2c77e29cc24f2470021af9a9568e9ff699bcd66c4c7

Download Submit
C:\Windows\SysWOW64\Kacphh32.exe

Filesize
320KB

MD5
69d8e8f4d0ea8630334b0c937935d1e4

SHA1
9659fa555904350780c7e69431fa83c1ef5aed76

SHA256
e3d35309d7261a21465e0a057d2b3862f9f867c586f45db0f523e2bd6f1a1829

SHA512
424327c794b252e71d1cbdb678162e1e47d72b8a5a4b6d3498a74d77b6db8c7c169bb8b82cf9f84ce67795f6bd065a2ecb6ec9e521cb67cbce858e73f9f536c1

Download Submit
C:\Windows\SysWOW64\Kaemnhla.exe

Filesize
320KB

MD5
e208176f828730e2eda03e7ca6bb8fd6

SHA1
3a2f90556a5c3f557f4911f0d714c36b2171141c

SHA256
477e4a41c642301cfd34ad734f69330e9004b77378bf0720d21abfcc247b25e5

SHA512
208203bb6c6ebe19258df665158f6850d370f075eec40efd90d9385a6b19c182d4f32793c6b4a6f812337b82606bb6aed320462b4f2e51933b1a1380db31dcd4

Download Submit
C:\Windows\SysWOW64\Kagichjo.exe

Filesize
320KB

MD5
18cc0cbf7708e102a7999a49436585f1

SHA1
108d888a6175ba3c264f76c516a93da3d3f34220

SHA256
6d1accf494d4a9ad7b91f38ca7658d2f19ad206526bd17bd4ff61c54be35e427

SHA512
1b69e5a24e0dd180d86d96e897b66889ab10772536348debbb42ae6670601f7ebdae5fe03429335c143adab437358d586e840f293a078ce5ca32f5f4978350f6

Download Submit
C:\Windows\SysWOW64\Kbapjafe.exe

Filesize
320KB

MD5
eca00f45da9f4076d0ca8a101ead3b84

SHA1
db74e7d1ae347073dd89117ce018ad7b204dc302

SHA256
476f71ca66c5edd4821283d771a8b3722b07d2d87e43c4cea6052c509002ec67

SHA512
4405db7e053f79d3a3dcf2017c5461dd89566d572980fc76710beae2dfa6a43d8853c7d18303b996877ead961305aebe7c23f7878f5e9342cdf166e74dd778c0

Download Submit
C:\Windows\SysWOW64\Kbfiep32.exe

Filesize
320KB

MD5
0ec89538d69d3402561fbce2d6a56d50

SHA1
82b5d0a3a6c89cdc97750512bbd2eb31c22e7593

SHA256
53eee46fb273b301c0ddc732b956ef46a0969a05149705c5b25f5edca1904b5b

SHA512
3d348b872f1623beb96cf14cc3cdd245ef99b22858e7e35e44db6f0ec2f9454e778739397832058739944b13563bcb3fb990fb99909c7f5b7da464db34a291c9

Download Submit
C:\Windows\SysWOW64\Kdhbec32.exe

Filesize
320KB

MD5
d29345336ac35157f84ff246f60886ff

SHA1
8d30ac0c614d2963f9b466799966483e3b5116eb

SHA256
8b96a0c4d5486c3763cb28ea67da675ec007fbef2f9427e1142838f0418ea024

SHA512
a161d7641a13437f3886ceab17caa19eef204da53365cf08d3bc469e609f3b91eb4a06f1f1bfbb2b3df972645c884b9a1cd0a36c9a2e263775925a12310bf15d

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
320KB

MD5
4a14d37aa08ec6963f944b50e7b0db3f

SHA1
7470a371e348ef2b28b2055e6ed56ee49143a567

SHA256
08fa1ac8a5f8b646fcbe6a3e0e250b1864b7f77febb5d04a597cde652bdf0c12

SHA512
65238731b24958da7ae255af25c094801a45fa1586391408d1c86eb5668ddac1ef4664daf37db62de5160b2fd4a6fea77c2cc065d97a0c83281504a2a175889e

Download Submit
C:\Windows\SysWOW64\Kgfoan32.exe

Filesize
320KB

MD5
fa7753fd7c2f87ad96166a6ef921cb87

SHA1
e8dac4ca8d6c161b60f9a49e7e327a4963519968

SHA256
e24eaffd10f0e8098ab7cb7633df28f8f8fdd3c7f1b4dbd3f78319f5a83431ac

SHA512
6def32182a9402f290fdce4f033016b9863495313469ae155fcb6c2020bacaa97b6a5a8b3b39363e46658a1689c285b9b841e2218ff1c79b23001bbb2ceced4a

Download Submit
C:\Windows\SysWOW64\Kgphpo32.exe

Filesize
320KB

MD5
0ca10ad23022c24c4a77687e12e64723

SHA1
e19c7ee26dcd3015be0badfaf789c6665fcd70fd

SHA256
3c5b624508e98be489c1bd87576cb524857a1dc7649d3649ab4e7b16fd5c8c9a

SHA512
168c4ce6a79ce8eb1218f20991cbaff8dafb45623c14ded7f5e7b71caeb8ff697407b6ea559a563c07e2ce02c4de6f15a0107b4109f399142fcb00accae327be

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
320KB

MD5
28ef13304069e90b93e0bd324ed8853d

SHA1
a40f3cfc78594b386f2e1f212ce8db0aa3783d62

SHA256
832133af5ac582febfe662154f68239dbdb9e13f56f377de1c6e27905b903a8d

SHA512
beb255113bd8206aaca88217e7866b07757c6d524141310faa732340e240b8b89658f685abb464cf3c2aba5e0d7c70006f78894831795bca05023af69e403663

Download Submit
C:\Windows\SysWOW64\Kmlnbi32.exe

Filesize
320KB

MD5
388c5a7594f38721504cb657eba8c94f

SHA1
5ece4ff47220df4ea144be14695d75b7f795eb42

SHA256
4ec6b19cfaec8b06ebc2288f7088b8e1f136384f811b2df420d03c658044423b

SHA512
d282c3f3fec862f384612f5e73f1a9242b36cf90ed442b16a0617cdc5c2d3f6d70be01059d21987ae7b7b0aedc7cf00c5219684cde743b8693f567d0db6301d0

Download Submit
C:\Windows\SysWOW64\Kpccnefa.exe

Filesize
320KB

MD5
21eba5368770e82961223c359c2e36d0

SHA1
b77abc8d18a6bf0b95db92da5f5f90e660e91262

SHA256
78527ec498629de5f2ed936dbbbe861c5198181a43ee1e6f364598c9a52fd503

SHA512
6b1706f2c61d6721fbedfc605a31a92533a0ec6a99da23a868d002a004e2de1ea64b69a09b59dbd11f09214d33b1ef7edd2533c69e7e09c1ac16413dc0400715

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
320KB

MD5
7be6c4be35fd8f54172804dd51e349a1

SHA1
dfe408a0de282710da918c5fca18462cc0773b0b

SHA256
a14d829a6d2403125d00de4c3dc17fbea704ff9bc13f6d3956229ee3d75181aa

SHA512
55a005e1bc3fb8de556fc2860bc67a52e45bfe3422dfc407096c3953c979a1ff29a90e98b9e856440b91f988077f1812eb29e830d185337ae45f855f635f32b5

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
320KB

MD5
de70138316a1c88d5dde3b6938108837

SHA1
545ed22ccaa1d88fe5bb363f6c4637823d96543d

SHA256
ccd7f81964265a3f0cb75dd4522220d8e44bfc3708c4536108e9fa7c6e80d8a2

SHA512
1ece42bf470175334e5470f24c9902dbcbc21e340c80cec987fe62f470edb53f808b9bee429a782e630be480f45e73e211ea461856c1f3eb79efa38eec009fad

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
320KB

MD5
de8dbc6013d19d43e929c10b96fb265f

SHA1
c6bce989838211e9b6fc7ce95fbc72936feffb43

SHA256
c2b4f5ce2dd18ec40f55bbf3b7087d4e14a98eb3a7462259e3d817ea8b88bc76

SHA512
79786d024187c7029a4f7cdb0134224f9c0a18c7329265be0aacedf2ede2254b73a920976a9d44885eaff5d43646c9c165567dbe93cce2a1773b95a48f265b1c

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
320KB

MD5
6147498b5c62a6e976e7e74626f5bc07

SHA1
048a29e64d19a4885fd90e2944d20e5b28784078

SHA256
a44acbf85610d103e175270e040749ca9a431b89bdea2255500470db0426e10f

SHA512
59edac77f3f98dbb71763ad6b4fb800a95be676683769a5097cf6381de6b168976eb6f51c804e76b96c2663ce214ffae85d287ad595ab3c60f6d333f2b39e5e8

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
320KB

MD5
e8a0b52b83447eab4015729099c1e0a6

SHA1
85e67f749116425e762e6db40f5407666bc47fc7

SHA256
007d95d0ddd62d68b02f89959770ee5b699f1be5a9053fbe68efe24fa0dca34c

SHA512
c9f63838f1216dbd7fe0492315d98aaf90ad1d6e1e0e3bb6ac3114639c2a421689d879a06e17e83f20852aee050ed502be3410917f2d9a3f9fdc3b003584bb41

Download Submit
C:\Windows\SysWOW64\Lpocjdld.exe

Filesize
320KB

MD5
44424725fa05b0c5dd221588c2d96d0e

SHA1
4548d63a7345cc3d7ce05d91dfc143d2d4e72a04

SHA256
3be5c2ff9161653d676d8490418ca54d36d5c198b74b8cc0863c3ebbbca4ce91

SHA512
a9d89b5744b3cc2570bf71a02e584e0fccc2cd4e9335d8e9f0cf449e598e30469f2769854c3a271bfb37ffac78035f35aab5501363360be0793d0c46faa33d31

Download Submit
memory/8-137-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/444-97-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/548-293-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/860-334-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1052-153-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1088-388-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1152-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1176-234-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1224-294-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1248-113-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1460-198-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1504-408-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1552-134-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1588-348-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1636-282-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1652-378-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1660-28-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1780-210-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1788-145-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1812-83-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1820-304-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1824-202-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1956-161-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2012-432-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2016-425-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2040-93-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2164-51-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2236-249-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2448-109-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2612-312-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2624-414-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2628-324-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2656-242-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2732-354-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2820-125-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2908-306-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2944-85-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3084-270-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3100-88-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3228-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3428-170-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3540-278-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3748-43-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3784-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3808-71-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3840-226-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3852-406-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3944-363-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4204-394-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4248-186-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4324-178-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4364-426-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4492-342-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4496-319-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4524-258-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4716-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4820-264-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4824-218-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4896-366-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4952-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5024-129-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5024-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5024-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5092-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads