966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565.exe
Size

93KB
MD5

33bdedff6dc24b6a4ee5070b1afcd96b
SHA1

e3360269aa8193446931de3d46ce2f2a2c22ece7
SHA256

966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565
SHA512

f8320b91782210ff87832a207d6c8864a1557d98d61256cb9cbff38f490f8e52553ce8eadb4cd153f014988df7355ba38f5961c0723e35fa65a91b630ad30062
SSDEEP

1536:Pd+O0Z5VNiKSasWS+g1tmlaB1/PF9msRQpRkRLJzeLD9N0iQGRNQR8RyV+32r:Pd+OSIrWS+ctP/PF9NepSJdEN0s4WE+3

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iffmccbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hpihai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jkfkfohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiikak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjcclf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijhodq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpeepnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jaljgidl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjhmgeao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gifmnpnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijfboafl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaedgjjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lmqgnhmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipldfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfdida32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jfhbppbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hcqjfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfhqbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fflaff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpgdbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iapjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdegnep.exe

Executes dropped EXE 64 IoCs

pid	Process
2216	Fjcclf32.exe
212	Fmapha32.exe
4816	Fbnhphbp.exe
1476	Fjepaecb.exe
3904	Fmclmabe.exe
2956	Fobiilai.exe
3616	Fflaff32.exe
3964	Fjhmgeao.exe
2648	Fmficqpc.exe
4508	Gcpapkgp.exe
4004	Gfnnlffc.exe
4256	Gjjjle32.exe
2236	Gmhfhp32.exe
3760	Gqdbiofi.exe
3200	Gpnhekgl.exe
1332	Gfhqbe32.exe
2936	Gifmnpnl.exe
2432	Gameonno.exe
3736	Hclakimb.exe
1444	Hjfihc32.exe
1508	Hbanme32.exe
4564	Habnjm32.exe
688	Hcqjfh32.exe
1512	Hfofbd32.exe
3128	Hjjbcbqj.exe
3864	Hmioonpn.exe
4244	Hadkpm32.exe
1344	Hccglh32.exe
4992	Hippdo32.exe
4544	Hpihai32.exe
5004	Hbhdmd32.exe
1980	Hibljoco.exe
1604	Haidklda.exe
1124	Ipldfi32.exe
1896	Iffmccbi.exe
4084	Impepm32.exe
4872	Icjmmg32.exe
4168	Ijdeiaio.exe
1356	Imbaemhc.exe
4504	Ibojncfj.exe
2204	Ijfboafl.exe
2060	Iapjlk32.exe
2272	Ibagcc32.exe
1972	Ijhodq32.exe
3336	Idacmfkj.exe
4628	Ibccic32.exe
368	Jaedgjjd.exe
1524	Jpgdbg32.exe
4904	Jfaloa32.exe
952	Jmkdlkph.exe
4916	Jdemhe32.exe
2948	Jfdida32.exe
2208	Jjpeepnb.exe
2932	Jmnaakne.exe
3112	Jplmmfmi.exe
2136	Jfffjqdf.exe
4808	Jjbako32.exe
4184	Jaljgidl.exe
1888	Jbmfoa32.exe
3588	Jfhbppbc.exe
5060	Jigollag.exe
1924	Jangmibi.exe
2572	Jpaghf32.exe
1736	Jdmcidam.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mkepnjng.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Jpgdbg32.exe	Jaedgjjd.exe
File created	C:\Windows\SysWOW64\Lklnhlfb.exe	Lcdegnep.exe
File created	C:\Windows\SysWOW64\Kgbefoji.exe	Kdcijcke.exe
File created	C:\Windows\SysWOW64\Legdcg32.dll	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Hefffnbk.dll	Kipabjil.exe
File opened for modification	C:\Windows\SysWOW64\Lddbqa32.exe	Laefdf32.exe
File opened for modification	C:\Windows\SysWOW64\Lgbnmm32.exe	Lddbqa32.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Lijiaonm.dll	Hibljoco.exe
File created	C:\Windows\SysWOW64\Ibojncfj.exe	Imbaemhc.exe
File opened for modification	C:\Windows\SysWOW64\Ibccic32.exe	Idacmfkj.exe
File created	C:\Windows\SysWOW64\Jaedgjjd.exe	Ibccic32.exe
File created	C:\Windows\SysWOW64\Kgmlkp32.exe	Kaqcbi32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Gfhqbe32.exe	Gpnhekgl.exe
File created	C:\Windows\SysWOW64\Ijdeiaio.exe	Icjmmg32.exe
File created	C:\Windows\SysWOW64\Cnacjn32.dll	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mgghhlhq.exe
File opened for modification	C:\Windows\SysWOW64\Jfdida32.exe	Jdemhe32.exe
File created	C:\Windows\SysWOW64\Lpocjdld.exe	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Hbanme32.exe	Hjfihc32.exe
File opened for modification	C:\Windows\SysWOW64\Hccglh32.exe	Hadkpm32.exe
File opened for modification	C:\Windows\SysWOW64\Kdffocib.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Ibhblqpo.dll	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Fjcclf32.exe	966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565.exe
File opened for modification	C:\Windows\SysWOW64\Jpaghf32.exe	Jangmibi.exe
File created	C:\Windows\SysWOW64\Mnocof32.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Cqncfneo.dll	Kkihknfg.exe
File opened for modification	C:\Windows\SysWOW64\Lkgdml32.exe	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Lcbiao32.exe	Lpcmec32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Lppaheqp.dll	Jigollag.exe
File created	C:\Windows\SysWOW64\Kkbkamnl.exe	Kpmfddnf.exe
File created	C:\Windows\SysWOW64\Mmpfpdoi.dll	Iffmccbi.exe
File created	C:\Windows\SysWOW64\Jaljgidl.exe	Jjbako32.exe
File created	C:\Windows\SysWOW64\Mfogkh32.dll	Hpihai32.exe
File created	C:\Windows\SysWOW64\Kipabjil.exe	Kgbefoji.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Fflaff32.exe	Fobiilai.exe
File created	C:\Windows\SysWOW64\Jdkhlo32.dll	Gifmnpnl.exe
File created	C:\Windows\SysWOW64\Lppbjjia.dll	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Mgnnhk32.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Mghpbg32.dll	Kgphpo32.exe
File created	C:\Windows\SysWOW64\Kagichjo.exe	Kipabjil.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Dngdgf32.dll	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mgghhlhq.exe
File opened for modification	C:\Windows\SysWOW64\Jbmfoa32.exe	Jaljgidl.exe
File opened for modification	C:\Windows\SysWOW64\Laefdf32.exe	Lklnhlfb.exe
File opened for modification	C:\Windows\SysWOW64\Jmnaakne.exe	Jjpeepnb.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Lddbqa32.exe	Laefdf32.exe
File created	C:\Windows\SysWOW64\Fmapha32.exe	Fjcclf32.exe
File created	C:\Windows\SysWOW64\Gpnhekgl.exe	Gqdbiofi.exe
File opened for modification	C:\Windows\SysWOW64\Kcifkp32.exe	Kdffocib.exe
File created	C:\Windows\SysWOW64\Gedmgfjd.dll	Fbnhphbp.exe
File created	C:\Windows\SysWOW64\Jmkefnli.dll	Hjjbcbqj.exe
File created	C:\Windows\SysWOW64\Idacmfkj.exe	Ijhodq32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6412	6280	WerFault.exe	234

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lppbjjia.dll"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbkdl32.dll"	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gcpapkgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbledndp.dll"	Ibccic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpfjejo.dll"	Jfhbppbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjeebd32.dll"	Fmficqpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gfhqbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feambf32.dll"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogijli32.dll"	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocaapo32.dll"	Gfnnlffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ijdeiaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dakcla32.dll"	Ijfboafl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hbhdmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jfhbppbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qekdppan.dll"	Jjbako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecaoggc.dll"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fjhmgeao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebkdha32.dll"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jiikak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnnkcb32.dll"	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aajjaf32.dll"	Jpgdbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghiqbiae.dll"	Kdffocib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hjjbcbqj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lilanioo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnepih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hippdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jjbako32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifhmhq32.dll"	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpgdbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gfnnlffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fojkiimn.dll"	Imbaemhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibpam32.dll"	Fjepaecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Habnjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpbjkl32.dll"	Fobiilai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mglack32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ijfboafl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2216	2004	966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565.exe	89
PID 2004 wrote to memory of 2216	2004	966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565.exe	89
PID 2004 wrote to memory of 2216	2004	966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565.exe	89
PID 2216 wrote to memory of 212	2216	Fjcclf32.exe	90
PID 2216 wrote to memory of 212	2216	Fjcclf32.exe	90
PID 2216 wrote to memory of 212	2216	Fjcclf32.exe	90
PID 212 wrote to memory of 4816	212	Fmapha32.exe	91
PID 212 wrote to memory of 4816	212	Fmapha32.exe	91
PID 212 wrote to memory of 4816	212	Fmapha32.exe	91
PID 4816 wrote to memory of 1476	4816	Fbnhphbp.exe	92
PID 4816 wrote to memory of 1476	4816	Fbnhphbp.exe	92
PID 4816 wrote to memory of 1476	4816	Fbnhphbp.exe	92
PID 1476 wrote to memory of 3904	1476	Fjepaecb.exe	93
PID 1476 wrote to memory of 3904	1476	Fjepaecb.exe	93
PID 1476 wrote to memory of 3904	1476	Fjepaecb.exe	93
PID 3904 wrote to memory of 2956	3904	Fmclmabe.exe	94
PID 3904 wrote to memory of 2956	3904	Fmclmabe.exe	94
PID 3904 wrote to memory of 2956	3904	Fmclmabe.exe	94
PID 2956 wrote to memory of 3616	2956	Fobiilai.exe	95
PID 2956 wrote to memory of 3616	2956	Fobiilai.exe	95
PID 2956 wrote to memory of 3616	2956	Fobiilai.exe	95
PID 3616 wrote to memory of 3964	3616	Fflaff32.exe	96
PID 3616 wrote to memory of 3964	3616	Fflaff32.exe	96
PID 3616 wrote to memory of 3964	3616	Fflaff32.exe	96
PID 3964 wrote to memory of 2648	3964	Fjhmgeao.exe	97
PID 3964 wrote to memory of 2648	3964	Fjhmgeao.exe	97
PID 3964 wrote to memory of 2648	3964	Fjhmgeao.exe	97
PID 2648 wrote to memory of 4508	2648	Fmficqpc.exe	98
PID 2648 wrote to memory of 4508	2648	Fmficqpc.exe	98
PID 2648 wrote to memory of 4508	2648	Fmficqpc.exe	98
PID 4508 wrote to memory of 4004	4508	Gcpapkgp.exe	99
PID 4508 wrote to memory of 4004	4508	Gcpapkgp.exe	99
PID 4508 wrote to memory of 4004	4508	Gcpapkgp.exe	99
PID 4004 wrote to memory of 4256	4004	Gfnnlffc.exe	100
PID 4004 wrote to memory of 4256	4004	Gfnnlffc.exe	100
PID 4004 wrote to memory of 4256	4004	Gfnnlffc.exe	100
PID 4256 wrote to memory of 2236	4256	Gjjjle32.exe	101
PID 4256 wrote to memory of 2236	4256	Gjjjle32.exe	101
PID 4256 wrote to memory of 2236	4256	Gjjjle32.exe	101
PID 2236 wrote to memory of 3760	2236	Gmhfhp32.exe	102
PID 2236 wrote to memory of 3760	2236	Gmhfhp32.exe	102
PID 2236 wrote to memory of 3760	2236	Gmhfhp32.exe	102
PID 3760 wrote to memory of 3200	3760	Gqdbiofi.exe	103
PID 3760 wrote to memory of 3200	3760	Gqdbiofi.exe	103
PID 3760 wrote to memory of 3200	3760	Gqdbiofi.exe	103
PID 3200 wrote to memory of 1332	3200	Gpnhekgl.exe	104
PID 3200 wrote to memory of 1332	3200	Gpnhekgl.exe	104
PID 3200 wrote to memory of 1332	3200	Gpnhekgl.exe	104
PID 1332 wrote to memory of 2936	1332	Gfhqbe32.exe	105
PID 1332 wrote to memory of 2936	1332	Gfhqbe32.exe	105
PID 1332 wrote to memory of 2936	1332	Gfhqbe32.exe	105
PID 2936 wrote to memory of 2432	2936	Gifmnpnl.exe	106
PID 2936 wrote to memory of 2432	2936	Gifmnpnl.exe	106
PID 2936 wrote to memory of 2432	2936	Gifmnpnl.exe	106
PID 2432 wrote to memory of 3736	2432	Gameonno.exe	107
PID 2432 wrote to memory of 3736	2432	Gameonno.exe	107
PID 2432 wrote to memory of 3736	2432	Gameonno.exe	107
PID 3736 wrote to memory of 1444	3736	Hclakimb.exe	108
PID 3736 wrote to memory of 1444	3736	Hclakimb.exe	108
PID 3736 wrote to memory of 1444	3736	Hclakimb.exe	108
PID 1444 wrote to memory of 1508	1444	Hjfihc32.exe	109
PID 1444 wrote to memory of 1508	1444	Hjfihc32.exe	109
PID 1444 wrote to memory of 1508	1444	Hjfihc32.exe	109
PID 1508 wrote to memory of 4564	1508	Hbanme32.exe	110

C:\Users\Admin\AppData\Local\Temp\966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565.exe
"C:\Users\Admin\AppData\Local\Temp\966ae738a56d8de19fe62310b56acc8510d93ccab2a809e4af81ec3f44dd3565.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\Fjcclf32.exe
  C:\Windows\system32\Fjcclf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\Fmapha32.exe
    C:\Windows\system32\Fmapha32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\SysWOW64\Fbnhphbp.exe
      C:\Windows\system32\Fbnhphbp.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1476
      - C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:688
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        25⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        27⤵
        Executes dropped EXE
        
        PID:3864
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1344
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4992
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4544
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1980
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        34⤵
        Executes dropped EXE
        
        PID:1604
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1124
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1896
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        37⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4872
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1356
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        41⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2204
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1972
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3336
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:368
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1524
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        50⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        51⤵
        Executes dropped EXE
        
        PID:952
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2948
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2208
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        55⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3112
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4184
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5060
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1924
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        64⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        66⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:684
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4740
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        70⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1372
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        72⤵
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        73⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        74⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        75⤵
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        76⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        77⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4148
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        81⤵
        Drops file in System32 directory
        
        PID:736
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        83⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        84⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        86⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        88⤵
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        95⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        97⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        99⤵
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        100⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4180
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        103⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        108⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        109⤵
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        112⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        113⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        114⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        116⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        117⤵
        Drops file in System32 directory
        
        PID:3212
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        118⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        119⤵
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        120⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        121⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5620
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        123⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3652
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        124⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        125⤵
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        126⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        127⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        131⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3580
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        134⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        136⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        137⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        140⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        143⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        144⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 428
        145⤵
        Program crash
        
        PID:6412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6280 -ip 6280
1⤵
PID:6336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Fbnhphbp.exe

Filesize
93KB

MD5
341b2e1663061a0ac95a76732a94b209

SHA1
236467fec111f8ad19d540f09b3df070425c11fc

SHA256
09a07606bb069fe51091c1885e702bdda2562fb084a0f7d798c5da1c97fa6280

SHA512
33ee3dfe7048e824011480d952d621cdbc79b76fbfb1cc414a383266bec03b97bb6a643cd1f97388516cd993ed4f9f72ff8782d32cbebad1b9bbd15d148f1201

Download Submit
C:\Windows\SysWOW64\Fflaff32.exe

Filesize
93KB

MD5
e53aac9b1ddb0c51db5997a3e0e68020

SHA1
e85d3fe7c0164f0e6394a7b75c733aba4810635c

SHA256
171702978c382a4a587203f5fd7cff85240603bc9a1a6532efdd4b12ee12af52

SHA512
72629c1eb419bd3ecd16783e5bfb734f78711c108987cc4d495654d9ea1fc73d84206b564290de70980d7811fa00f14acef763f464ba6a42e0534e8dc7a6cb0f

Download Submit
C:\Windows\SysWOW64\Fjcclf32.exe

Filesize
93KB

MD5
8740bf7a05bff6f16a01940d6d76f881

SHA1
e3995883733b4dec862fd5ea00f76c65cc348eae

SHA256
d976c0a6698ab7d1d12b021d2e5eb8bc53041050eecaa7fadb880c94c4c5a826

SHA512
26d660c455f20e75bdb20f81f5ecbfb67238738b2b2a81828baf6243b229a0b14329fce0195152012ecff5ffaa070d40c14731ddb7d4e1588a16e18f974aec3a

Download Submit
C:\Windows\SysWOW64\Fjepaecb.exe

Filesize
93KB

MD5
31a98e999856338878e39f828c18ecde

SHA1
66488c6baeead14306689171d634f54a0b2e3d9e

SHA256
13e65873fc2b4052121b2cb2a412863a671dece059f5865c0100c5827dee3095

SHA512
d9bb08c99884871624baf8b7a1e6ac2d3cff5693c1d00cfd65a33d971e3d4b0c6b004ce741670ea1ca8fda31b0e4a80624fcb00daa26c1eb112e964b78bd7485

Download Submit
C:\Windows\SysWOW64\Fjhmgeao.exe

Filesize
93KB

MD5
b69fed8eb3fdc9c9eb13b988eb4c59d2

SHA1
7f612661959f2a9c5d76ac345d2603095572df27

SHA256
0f947de75fe958445bc618c08e680ff61bfe489e1a87f622a956b956e5f2e886

SHA512
a1545915ddf7e2b7acbaf38b02a2e590547fce6d9982c46661c3bebbace368004b9cc8cfa17264ace0e14f7ce1ccd7964399e715b77a61bb886e60347176e385

Download Submit
C:\Windows\SysWOW64\Fmapha32.exe

Filesize
93KB

MD5
29b09986c6ddb5dcb9ff7fc09b851e18

SHA1
daa68c6763823d434e7062c13d12343436e0d212

SHA256
6391aca0868fe818d61bb965c416941334551df92774ebeb7520f46a9c25dc12

SHA512
ba94e4e3ce8e80ba9151f642b9c3e30654c9ef52bb45262488a159188807de2582e1ac9de6014c50578b394c9ac60f48339c1ce09b94abedbb448248123e9838

Download Submit
C:\Windows\SysWOW64\Fmclmabe.exe

Filesize
93KB

MD5
278522aab95561af47fcbbc21cfff9be

SHA1
9dd160a50c18b364f1caa35b8bea295b7c397871

SHA256
b4b32c81c007d43ff186fb6f4b86a26b84f2f87246e745998f1bb3d387467e42

SHA512
b0f2b4d52804a06a05d1d05e56b9c3068fc232db18232c01ad516183d03816bd695d8bfe66c25c4b98db4f9b3c5548929d2672de8d875592f8b1f55c9d4f11d2

Download Submit
C:\Windows\SysWOW64\Fmficqpc.exe

Filesize
93KB

MD5
94191d44b8aa08c74814eb44721e37b2

SHA1
0289ba556a2f80d776722e371b3321fff2ba58b2

SHA256
5becd2077f393dede21776be2f8b9175b1db39ed1ecdac218e4caeb9b2148bd7

SHA512
bdccd435b33b1887c6f487fca7093cac2e9048b0bb926f5d24e780de1a93b6fcc1b07e9eeeb71471454d0752987dca240ccb782e0fd536783bf7391080117a1f

Download Submit
C:\Windows\SysWOW64\Fobiilai.exe

Filesize
93KB

MD5
10dc0cc128529bb0bb11cc7300167104

SHA1
923ca98b22415ac5cf6a14f61f4b5ab166b8af64

SHA256
4606706307805f32951ff4d54669d899669bf00b12e6ab2f52b89ed46e5de191

SHA512
84bcf64fd8cd1010a3ab9f66f8bd647f56f47aeaa9e6459a72b91dae16f82074fbfb2caa7d1be1a43f37c80b879b2afeba5b3daa900475c05ecb2ea630876cbc

Download Submit
C:\Windows\SysWOW64\Gameonno.exe

Filesize
93KB

MD5
04764ca2d3d849bcbe11c200c6cb13a9

SHA1
da9914539da5f15d00ead1637c527d0a356e9c4d

SHA256
a9778a4fade64dee28439c00ed730425625c6d6c3a54d0a9528f31c81cde182a

SHA512
e1d1da8e7b130fc452d6822e02aa49d1064bebc06e39dfc70418f2be81fa6dcfe6812bd5066ffa8fd67d1bab55f406b6f756c36449039a40bc68bf09003386a3

Download Submit
C:\Windows\SysWOW64\Gcpapkgp.exe

Filesize
93KB

MD5
f58c4447c80e133f4432e7af30ecc479

SHA1
0ca13f2143ca1f6f1fe45f3f1bb501144481ab12

SHA256
6fef3dec67d0f87f46b4a87de63e760c88f0d995b80d5ab0c981d25e1160e924

SHA512
32945cd28edf9bca692510ea818d6ce0e5edb8de6ff2a4b45e0c1e953eb820f8c553fc1428137acba40087789a0992a4138eeec79b735c7d99e2717e191fdeec

Download Submit
C:\Windows\SysWOW64\Gfhqbe32.exe

Filesize
93KB

MD5
057562eddc90d758e0a671ed865fa4af

SHA1
7324b2deeeae4d4e6dbe7bf164503e12cec2a7f8

SHA256
63f5df883b79fc58c014c0176d4d7ad2db42eac86316fb13669851a46e884327

SHA512
d742859c6d044095cb8d761ebde2db5aa9407b63b4f79e2db3d622bc20caa87b4c95571fcca984e7aabfce7e4639a55e2f76b9f7c61ad8f1431d20a8d548215c

Download Submit
C:\Windows\SysWOW64\Gfnnlffc.exe

Filesize
93KB

MD5
73ee04d562cdf60ac31f5c7d7ce06ee2

SHA1
be19715f31b12fa8eac0928f573e0cfe93fd9531

SHA256
12f7e6830681d57a282462ea8b9fc693326040cb7706da41fb1cd0b104099c11

SHA512
2488d47fc6681bd7ac488cd244a1f3a4defcfdc7b67247956fb9b479ef13c08805d37b93ed48fb43b4029d13d79be707b660e349ae5c413fd90fcb87130e4c0f

Download Submit
C:\Windows\SysWOW64\Gifmnpnl.exe

Filesize
93KB

MD5
ba8e44e62a2c7d222c9e3641ec85d76e

SHA1
30e51de014b744d46ebfbc26364c1131f9bd0b5e

SHA256
f03941eec68145e7d309dfa997eaa1c32b33824e96999e44e4dbc1c87880e4e6

SHA512
68f41fcf0639255f52373461bcad0dcacc4f721432d23771d6985ed2250de8a312dd15d381ba058429e69171aa5fec2cba374e955b3e220a6da6eb91d2e9226e

Download Submit
C:\Windows\SysWOW64\Gjjjle32.exe

Filesize
93KB

MD5
8083c380120206d446151caf14b008ed

SHA1
f7bb88eb638c9a56c7b38ecc33f540fbc9498728

SHA256
421590567b367a7724b3ae40f2bc665e4f3172ee98f75bb7171b77d0ea012b42

SHA512
84359d6970b5c554d4d90c0254461cad14edb374913d441ddacc3df696cae2a83271a0264f854611963a91514c7f21f2715b16462c1b49f0df3f295b6b839187

Download Submit
C:\Windows\SysWOW64\Gmhfhp32.exe

Filesize
93KB

MD5
f190dbddbdd676bb3779abe6ecbb47f7

SHA1
254e19d8832145df772983fe96686ee2387a407e

SHA256
07b1544261dd8d627be63a4bbc6be73b9864ebf011d28dc7a126b923d71fdb2b

SHA512
6fbe90f7e95052f200201ab2629dbdee9639871be1340c086d1d4d56830c18be8a826d1e0ddabe3f3470c5db8a5335f44c11184b68d4f621780bd2dd0671e165

Download Submit
C:\Windows\SysWOW64\Gpnhekgl.exe

Filesize
93KB

MD5
e99e941bbf7c4000adfe405bafb2d7c9

SHA1
63e307bca1b203a2b7ba1d2b5afda66d9001b80a

SHA256
22829d7dc9302e5ee77fe77e46ecfbc608deec31598ce38b0253cd86b8d4e074

SHA512
6857032ebc363743cbe15b1da9dae67a6ee96dab2f120e3524254902ad529dba07111d8c890693dff0f7dec5ce9e070ea61fcbdf6611d306c8fcc05e51c2152e

Download Submit
C:\Windows\SysWOW64\Gqdbiofi.exe

Filesize
93KB

MD5
4451cb96563881dc02414ccdf56047c9

SHA1
f9373b7103ca2fd42f8726325c5017aabbbd84e2

SHA256
70b56b9182860418ef61fa27a67764e336b6b3d5b3d6c2cf4ab28edd3d59ee57

SHA512
b3766720f3944b7f1ce73ea19d9e9a75102c7d26568f69c4632b9345175343706d1cb56a80ffedc2ad1d86cf55f5aed333ac5f29cd1bad9c47f002eb3a4e7a0a

Download Submit
C:\Windows\SysWOW64\Habnjm32.exe

Filesize
93KB

MD5
0b2f27438f5dbf50ea78c1773320fb58

SHA1
f3a660bba2ca643e04090e8f930021cf6dbb39de

SHA256
991fe43497ce080e572a16759e9c7e2633b838bb5fe4e73adfd240e1eb812627

SHA512
4b4049c192d9ddd12cc06f7eb971af80830b7c44c09fde4dd1418e2dad14b098f99892a9c086b0b3dbe95fe644758b36675e9d66e3b1f19e4b1fbd1478554712

Download Submit
C:\Windows\SysWOW64\Hadkpm32.exe

Filesize
93KB

MD5
a0da072ce1d65361524b216277caf60b

SHA1
35f5608114ef59a91da1879ad106414b00524e62

SHA256
fc5fe3584422d568feef0d15d2dab8cc93da97312d7a986701a798d5072130ae

SHA512
5e5cf2d6a2fc70e8bfaae5a62ba186952777c4deadcdcf1951b8931dc66ec8484125609bcf7e7ab194b6d0269cc50be2edb3ea23a93d99969ed5c450da40c4c9

Download Submit
C:\Windows\SysWOW64\Hbanme32.exe

Filesize
93KB

MD5
4ae77169a2059ac70944c3a8e3c1e093

SHA1
f53025663b924f7e1397ca8cdb5e4d3266705e8d

SHA256
dc4e74f5ced2ca6baa5d41ac14ae0464b64ad903d812b1e17b63f346f28cad6f

SHA512
73d6de8d0406d472e62fcffe93de1037aba0b7333a95e39787b112a3596d2e9c718b334e7ca081e51bd5a99d57feaa9113307b44145a121ac647d768c0b7ec89

Download Submit
C:\Windows\SysWOW64\Hbhdmd32.exe

Filesize
93KB

MD5
5b9a074db39551f7ff6358f6aeb01c7c

SHA1
feb82c44fb6a8d9a6547c4fdc83bfcd6fcf646f0

SHA256
40bcae29a4d4290ab4a04199101ba815e9d2892cb0c9483d9baeeca1dfe5d407

SHA512
90f93b52b005947f0a677ad7223bddbeb679651e4416105d2b0e3301ea45e54c11256091945112e28ec0ff76dda7b669764a10dd1512934e57b154cb20aa16af

Download Submit
C:\Windows\SysWOW64\Hccglh32.exe

Filesize
93KB

MD5
a37ae8447a44f4f4d2e02588ad7c3906

SHA1
f0645455b8f3ab458b69821a70552f517cf405c6

SHA256
1c71d54910d10984de0e8d846f42d974bcd1a9372f1195005e3cbcf19c9d343f

SHA512
cafc0828e433a3714dd54782981f66f8d69dad99fe53ab6cd6896f8b75f9bbb09b7560e96fef655b959e6a389510e7f436826280a8733ce05e61d2af9839a1ba

Download Submit
C:\Windows\SysWOW64\Hclakimb.exe

Filesize
93KB

MD5
370ef3b7d380d8562d841260a086f95a

SHA1
8b2260ce2bb0963dfc94eb951885164ead0dbcb9

SHA256
be772f0cf6f70b1c4ce4f543904595d805bdfd0948eeeff89f030d1c548755d2

SHA512
594288702743a610492b4b2fc5f4668857302764cd5d5a0948e1abf25c549d3a8e9cb9abc35d6ec41cae6c6aa85dd83ac60cbd5f79e8b5727d4ebabd0881f1e1

Download Submit
C:\Windows\SysWOW64\Hcqjfh32.exe

Filesize
93KB

MD5
9073d5ac08e7e6953bd2b73f032bebd2

SHA1
151a1cf3913bf69bc6e7033517bb1903c4972d96

SHA256
44da88e36422bf2bcf53e0ef20bc22a9bf25ebdc3a57176fa489beac9a3edf4a

SHA512
8bac94320aaba040cdac8c97eb73c317f3c334528a3f3ad82521b26c0dded8db6adf7ec66a3e57b83b6a184ec92354f0504c908e8d2c6f34ce410f4fd9cb2795

Download Submit
C:\Windows\SysWOW64\Hfofbd32.exe

Filesize
93KB

MD5
cdf428a3e2573489fb4fe95d284cb555

SHA1
950e882deb8d3eab825c066ab500f98016cb52ba

SHA256
369030a35a6907b72bbed4a946a66a1be942e7aedf2679f1dcb6131e341117dd

SHA512
c90dd2ad4ab6aec0585381be1346a0e45d89b825dbdbf56e77103565b199bf74141d89d4257072aac4aeb97779541daba9744598d9d0ef889719a5d48e452a4e

Download Submit
C:\Windows\SysWOW64\Hibljoco.exe

Filesize
93KB

MD5
ca26b8e646e9e68d6a77cefe0f9179bc

SHA1
cc3412cd8082e244f6989276c479bbf2c5e5d059

SHA256
1ea1317f911e6b7e4781d20ead57f49906eced6f35ac63f3ab0cf4cbd08e250d

SHA512
a9f22485f880d188a6a90ce2674d650a79202a54fd085b0b0f10dbb20fe02740b8f5950a77e399f1eedb0547f9fa678290e187b2758d63944c4d1bcb9e8cae25

Download Submit
C:\Windows\SysWOW64\Hippdo32.exe

Filesize
93KB

MD5
56cdeeef5773d0a3cf63d7a1b5d3f806

SHA1
17037836c670a05f9e9216392149846ab3f13a9f

SHA256
ca937e2bd5db2d945f86cb958b8bdd1f65c4adb6d5cd92ca97777624158f92e1

SHA512
ed04b7019aa1f8f7e98e85e196271b1c7de875a4fd42619a9519dcb9a9c2546d5e949f841cb46462e83c666595c1a225d654ef84ce1215e3d0b5dc01b6e5c06e

Download Submit
C:\Windows\SysWOW64\Hjfihc32.exe

Filesize
93KB

MD5
686ad3d6e7fc69beab7f6c45f1547dfa

SHA1
9afed0779c69b4cf5c56ba8e8ccd6f917a02ee12

SHA256
1f8d3abde598afb1e1987b61fbd7e20d3111a801e7b87554400f44b90db60287

SHA512
53b2f9aea6af9c07543da41eae9d66b81b9cb529ddd9dac3e2837cfb0a5e40cdbad52354be87b1c2b06b1c6419a782811a8d3d48d3cc1f69c87d175b5bf592cf

Download Submit
C:\Windows\SysWOW64\Hjjbcbqj.exe

Filesize
93KB

MD5
c6984356abfc8be518b8f30ae47d88e1

SHA1
2279187f9d9e535079212d6f33c5268fc998aa7a

SHA256
887cb396de8a155d62a071b4bd2d882010fc02b3dc31b6644a31c0b7ec3fed0c

SHA512
085747832042f87365ce1fc15269af835ad535eeea5fe79c5c75570aa87cc8bac86fd76461fbfbfd2f0ba9ae61c831ee947a6b3efeb750d3c58534a65dbf7955

Download Submit
C:\Windows\SysWOW64\Hmioonpn.exe

Filesize
93KB

MD5
4513ef2c0dc2041b24cb0093d13c4084

SHA1
1b10a8980a7aa9412abf8dc092023112abae2aa5

SHA256
2e20f92defa6f1c751846d914107d089101a49dbef6c7a8d187a89fb5c35012b

SHA512
7a35338ad5ebd785df61e6f0912cbd463f45ff2f8d9914650f840dc59ded465fcb98beced601463911858f1b587dabd05c9b702f2c517f064e44bad6c8ea4d41

Download Submit
C:\Windows\SysWOW64\Hpihai32.exe

Filesize
93KB

MD5
c0cf93670c8516a8a6ee63e0bdbe74aa

SHA1
52ad5407f2b0bddd54b9651d65b62f4a5b18fc72

SHA256
5023320f2d76ddbe0723941c0d8fde697d8cb4811428f30368e0ecd2d2076b86

SHA512
54e6d7ba27ecb9f1a33d8df5a881b42730df457b0352c50e513459a9e76eabe449027927548b6813a22bc2639ad6edd74fe7000601cdb94fe167688088a4ec76

Download Submit
C:\Windows\SysWOW64\Jdmcidam.exe

Filesize
93KB

MD5
4b282018fbd610d36fb9a10df8f11fca

SHA1
86554675dd1fca9f9e59cb4f461bfffd3d66054b

SHA256
4053b85a167f03a892b77c3d87e5aa692c45de767f6e6510a3a31626ebaac72c

SHA512
b6ea6001b788569137a50f6aaf8d35e41f39c897c8ace578af2d8207b9b44436c3c02dc95e818fed8216528ec0bbf213d9c54efabb84a7fa23d1344db012b8db

Download Submit
C:\Windows\SysWOW64\Kibpam32.dll

Filesize
7KB

MD5
3c64eb5bc7237d682b56a7ade1049943

SHA1
d8857a5c11ad86bfb4af6509181c6c44952201d1

SHA256
49aa14ddbcaede522a27da9f69d28bf11e7baedd591309db16d732829970860c

SHA512
43c8b2310bf3ec2994e4d46840bec1b229779e12e0ade601a1c7fcf830f8836480b449a8041b5cd798f3afe89a789baeaa617b30c223eae1fd5d870c934639d8

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
93KB

MD5
9c11d01afff721b6d7f01772741a3295

SHA1
0933dee043f92b148b0eecf7e015da765134f5a5

SHA256
1c64589ff156f740ef1494270e9b2ab62388e7ee761dae8bb158b5152e15d5b5

SHA512
c6f098807eb447b829e689abdbb4f50347c42de74187353e2c96a19074a131df2fcca51d9ddf6fac34bbb3861d65287b0c9e6720ffe188f6dab17daf7dab53b1

Download Submit
C:\Windows\SysWOW64\Nkjjij32.exe

Filesize
93KB

MD5
2e52011bd871359e75abcda08bc91de4

SHA1
682542b6d9bfda8a34b874c877b660afc630426d

SHA256
be49ff4d14b5148c230f8670d4e41a131564c51044a6cc33680dd2f9a44e6765

SHA512
0cc5acc13bd3c5d296b2e75e34da89d701fd7015b5341f933b77480f1a5e9d7c2297e9b47e03075da2ce192cb8bd86554538152c629bded00350817b389a61e4

Download Submit
memory/212-111-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/212-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/688-199-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/688-291-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1124-290-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1332-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1344-242-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1356-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1444-170-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1444-260-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1476-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1476-123-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1508-271-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1508-179-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1512-203-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1512-298-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1604-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1604-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1896-292-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1980-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2004-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2004-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2060-342-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2204-334-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2216-100-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2216-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2236-110-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2432-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2648-71-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2648-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2936-149-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2956-47-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2956-142-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3128-219-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3200-211-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3200-125-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3616-143-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3616-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3736-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3736-250-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3760-120-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3864-227-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3904-133-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3904-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3964-159-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3964-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4004-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4084-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4168-315-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4244-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4256-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4256-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4504-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4508-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4544-259-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4564-284-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4564-187-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4816-115-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4816-27-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4872-309-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4992-253-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5004-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5004-327-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads