a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54.exe
Size 90KB
Sample240404-3r21vaef68
SHA256 a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54
MD5 008c7142024274fabf76a53d4ce186fa
SHA1 ec1f078c8fc5202cdc9b7930d947acc3e46bbe50
SHA512 b2b9c492c648c543aa7c016be5b9e83829481b659f0eb06601633ef4ea9a7255452f36b7e054f4c7c4658764f089137943262f5ac91e906abc39d2e0ba417bf5
SSDEEP 1536:K9v3DMTXY0gJqm1iLrsThHqkvTaDo8eEXCfOOQ/4BrGTI5Yxj:K8o0g51eshF+eEuU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffggkgmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fifdgblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fckhdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iinlemia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaedgjjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fifdgblo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifmcdblq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbllkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fmclmabe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqmlhpla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gqdbiofi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gjlfbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjmgdlf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hikfip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbllkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imbaemhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kaemnhla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hikfip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipqnahgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jigollag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icjmmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifmcdblq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gjjjle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iidipnal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbkjjblm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Goiojk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jibeql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffekegon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmmhjm32.exe

Executes dropped EXE 64 IoCs

pid	Process
380	Ffekegon.exe
3796	Fjqgff32.exe
468	Fqkocpod.exe
2640	Fbllkh32.exe
1788	Ffggkgmk.exe
2492	Fifdgblo.exe
464	Fqmlhpla.exe
1040	Fckhdk32.exe
1384	Ffjdqg32.exe
2084	Fjepaecb.exe
2112	Fmclmabe.exe
2676	Fobiilai.exe
912	Fbqefhpm.exe
2964	Fijmbb32.exe
3488	Fmficqpc.exe
1224	Fqaeco32.exe
2460	Gcpapkgp.exe
3548	Gbcakg32.exe
2868	Gjjjle32.exe
2960	Gmhfhp32.exe
2616	Gqdbiofi.exe
1176	Gjlfbd32.exe
2712	Gmkbnp32.exe
2008	Goiojk32.exe
1036	Gjocgdkg.exe
1072	Gcggpj32.exe
4240	Gqkhjn32.exe
5012	Gcidfi32.exe
4244	Gfhqbe32.exe
2572	Gjclbc32.exe
1740	Gmaioo32.exe
1012	Hclakimb.exe
784	Hfjmgdlf.exe
1112	Hihicplj.exe
3060	Hmdedo32.exe
3832	Hpbaqj32.exe
2892	Hbanme32.exe
3608	Hjhfnccl.exe
4748	Hikfip32.exe
3484	Hbckbepg.exe
4384	Hjjbcbqj.exe
3988	Hippdo32.exe
1272	Hcedaheh.exe
4960	Hfcpncdk.exe
5100	Hmmhjm32.exe
1968	Ibjqcd32.exe
2548	Iidipnal.exe
1948	Iakaql32.exe
3216	Icjmmg32.exe
4152	Ifhiib32.exe
4400	Imbaemhc.exe
2664	Ipqnahgf.exe
2828	Ifjfnb32.exe
1480	Ijfboafl.exe
756	Ijhodq32.exe
2852	Imgkql32.exe
2260	Iabgaklg.exe
3928	Iinlemia.exe
4040	Jaedgjjd.exe
2644	Jaedgjjd.exe
3268	Jbfpobpb.exe
2512	Jagqlj32.exe
4424	Jpjqhgol.exe
548	Jibeql32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Adijolgl.dll	Gqkhjn32.exe
File created	C:\Windows\SysWOW64\Bclhoo32.dll	Jpjqhgol.exe
File created	C:\Windows\SysWOW64\Jfkoeppq.exe	Jbocea32.exe
File opened for modification	C:\Windows\SysWOW64\Lpfijcfl.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Gqdbiofi.exe	Gmhfhp32.exe
File opened for modification	C:\Windows\SysWOW64\Hmdedo32.exe	Hihicplj.exe
File created	C:\Windows\SysWOW64\Pckgbakk.dll	Jaedgjjd.exe
File opened for modification	C:\Windows\SysWOW64\Kagichjo.exe	Kmlnbi32.exe
File opened for modification	C:\Windows\SysWOW64\Mgekbljc.exe	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Fifdgblo.exe	Ffggkgmk.exe
File opened for modification	C:\Windows\SysWOW64\Hmmhjm32.exe	Hfcpncdk.exe
File opened for modification	C:\Windows\SysWOW64\Mkpgck32.exe	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Gbcakg32.exe	Gcpapkgp.exe
File opened for modification	C:\Windows\SysWOW64\Gjjjle32.exe	Gbcakg32.exe
File created	C:\Windows\SysWOW64\Mnapdf32.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Gfhqbe32.exe	Gcidfi32.exe
File opened for modification	C:\Windows\SysWOW64\Gbcakg32.exe	Gcpapkgp.exe
File created	C:\Windows\SysWOW64\Gmaioo32.exe	Gjclbc32.exe
File opened for modification	C:\Windows\SysWOW64\Lklnhlfb.exe	Lcdegnep.exe
File opened for modification	C:\Windows\SysWOW64\Lgbnmm32.exe	Lcgblncm.exe
File opened for modification	C:\Windows\SysWOW64\Iidipnal.exe	Ibjqcd32.exe
File created	C:\Windows\SysWOW64\Ijhodq32.exe	Ifmcdblq.exe
File created	C:\Windows\SysWOW64\Mgghhlhq.exe	Mnocof32.exe
File created	C:\Windows\SysWOW64\Kmalco32.dll	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Hfjmgdlf.exe	Hclakimb.exe
File created	C:\Windows\SysWOW64\Pjpdme32.dll	Hihicplj.exe
File created	C:\Windows\SysWOW64\Hfcpncdk.exe	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Mlmpolji.dll	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Dempmq32.dll	Icjmmg32.exe
File created	C:\Windows\SysWOW64\Kkkdan32.exe	Kdaldd32.exe
File created	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Ahgndd32.dll	Fijmbb32.exe
File opened for modification	C:\Windows\SysWOW64\Gbledndp.dll	Jaedgjjd.exe
File created	C:\Windows\SysWOW64\Ggpfjejo.dll	Jbmfoa32.exe
File opened for modification	C:\Windows\SysWOW64\Lcgblncm.exe	Lphfpbdi.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Dmnlpfhd.dll	Fbllkh32.exe
File created	C:\Windows\SysWOW64\Gmkbnp32.exe	Gjlfbd32.exe
File created	C:\Windows\SysWOW64\Mgblmpji.dll	Ibjqcd32.exe
File created	C:\Windows\SysWOW64\Imgkql32.exe	Ijhodq32.exe
File created	C:\Windows\SysWOW64\Ppaaagol.dll	Kaemnhla.exe
File created	C:\Windows\SysWOW64\Fbllkh32.exe	Fqkocpod.exe
File opened for modification	C:\Windows\SysWOW64\Fijmbb32.exe	Fbqefhpm.exe
File opened for modification	C:\Windows\SysWOW64\Iabgaklg.exe	Imgkql32.exe
File created	C:\Windows\SysWOW64\Kkdeek32.dll	Kgmlkp32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Gjjjle32.exe	Gbcakg32.exe
File created	C:\Windows\SysWOW64\Maohkd32.exe	Mjhqjg32.exe
File opened for modification	C:\Windows\SysWOW64\Maohkd32.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Gedmgfjd.dll	Ffjdqg32.exe
File created	C:\Windows\SysWOW64\Gcpapkgp.exe	Fqaeco32.exe
File created	C:\Windows\SysWOW64\Gqkhjn32.exe	Gcggpj32.exe
File created	C:\Windows\SysWOW64\Mgekbljc.exe	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File opened for modification	C:\Windows\SysWOW64\Gjclbc32.exe	Gfhqbe32.exe
File opened for modification	C:\Windows\SysWOW64\Hjjbcbqj.exe	Hbckbepg.exe
File created	C:\Windows\SysWOW64\Mghpbg32.dll	Kdaldd32.exe
File created	C:\Windows\SysWOW64\Lkdggmlj.exe	Lpocjdld.exe
File opened for modification	C:\Windows\SysWOW64\Fifdgblo.exe	Ffggkgmk.exe
File created	C:\Windows\SysWOW64\Ifhiib32.exe	Icjmmg32.exe
File created	C:\Windows\SysWOW64\Jbmfoa32.exe	Jmpngk32.exe
File created	C:\Windows\SysWOW64\Pellipfm.dll	Liggbi32.exe
File created	C:\Windows\SysWOW64\Mpolqa32.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Mbfppi32.dll	a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6052	5308	WerFault.exe	236

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odegmceb.dll"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbanme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hikfip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdgpjm32.dll"	Hmmhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogndib32.dll"	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Imbaemhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmdedo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldooifgl.dll"	Hpbaqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbcakg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klebid32.dll"	Hjhfnccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oggipmfe.dll"	Ffekegon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bademghm.dll"	Fjqgff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglppmnd.dll"	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcioj32.dll"	Hclakimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblgaie.dll"	Kilhgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ffekegon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jigollag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjepaecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lghekack.dll"	Fobiilai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kncfca32.dll"	Fbqefhpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifjfnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbledndp.dll"	Iinlemia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlgol32.dll"	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kaqcbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mghpbg32.dll"	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbanme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifmcdblq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbllkh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbcakg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgqhjop.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gddfpk32.dll"	Fqkocpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gjlfbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jibeql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adijolgl.dll"	Gqkhjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmaioo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jaedgjjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kmlnbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbfppi32.dll"	a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ffggkgmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fobiilai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iidipnal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjqgff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 380	3184	a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54.exe	85
PID 3184 wrote to memory of 380	3184	a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54.exe	85
PID 3184 wrote to memory of 380	3184	a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54.exe	85
PID 380 wrote to memory of 3796	380	Ffekegon.exe	86
PID 380 wrote to memory of 3796	380	Ffekegon.exe	86
PID 380 wrote to memory of 3796	380	Ffekegon.exe	86
PID 3796 wrote to memory of 468	3796	Fjqgff32.exe	87
PID 3796 wrote to memory of 468	3796	Fjqgff32.exe	87
PID 3796 wrote to memory of 468	3796	Fjqgff32.exe	87
PID 468 wrote to memory of 2640	468	Fqkocpod.exe	88
PID 468 wrote to memory of 2640	468	Fqkocpod.exe	88
PID 468 wrote to memory of 2640	468	Fqkocpod.exe	88
PID 2640 wrote to memory of 1788	2640	Fbllkh32.exe	89
PID 2640 wrote to memory of 1788	2640	Fbllkh32.exe	89
PID 2640 wrote to memory of 1788	2640	Fbllkh32.exe	89
PID 1788 wrote to memory of 2492	1788	Ffggkgmk.exe	90
PID 1788 wrote to memory of 2492	1788	Ffggkgmk.exe	90
PID 1788 wrote to memory of 2492	1788	Ffggkgmk.exe	90
PID 2492 wrote to memory of 464	2492	Fifdgblo.exe	92
PID 2492 wrote to memory of 464	2492	Fifdgblo.exe	92
PID 2492 wrote to memory of 464	2492	Fifdgblo.exe	92
PID 464 wrote to memory of 1040	464	Fqmlhpla.exe	93
PID 464 wrote to memory of 1040	464	Fqmlhpla.exe	93
PID 464 wrote to memory of 1040	464	Fqmlhpla.exe	93
PID 1040 wrote to memory of 1384	1040	Fckhdk32.exe	94
PID 1040 wrote to memory of 1384	1040	Fckhdk32.exe	94
PID 1040 wrote to memory of 1384	1040	Fckhdk32.exe	94
PID 1384 wrote to memory of 2084	1384	Ffjdqg32.exe	95
PID 1384 wrote to memory of 2084	1384	Ffjdqg32.exe	95
PID 1384 wrote to memory of 2084	1384	Ffjdqg32.exe	95
PID 2084 wrote to memory of 2112	2084	Fjepaecb.exe	96
PID 2084 wrote to memory of 2112	2084	Fjepaecb.exe	96
PID 2084 wrote to memory of 2112	2084	Fjepaecb.exe	96
PID 2112 wrote to memory of 2676	2112	Fmclmabe.exe	97
PID 2112 wrote to memory of 2676	2112	Fmclmabe.exe	97
PID 2112 wrote to memory of 2676	2112	Fmclmabe.exe	97
PID 2676 wrote to memory of 912	2676	Fobiilai.exe	98
PID 2676 wrote to memory of 912	2676	Fobiilai.exe	98
PID 2676 wrote to memory of 912	2676	Fobiilai.exe	98
PID 912 wrote to memory of 2964	912	Fbqefhpm.exe	99
PID 912 wrote to memory of 2964	912	Fbqefhpm.exe	99
PID 912 wrote to memory of 2964	912	Fbqefhpm.exe	99
PID 2964 wrote to memory of 3488	2964	Fijmbb32.exe	100
PID 2964 wrote to memory of 3488	2964	Fijmbb32.exe	100
PID 2964 wrote to memory of 3488	2964	Fijmbb32.exe	100
PID 3488 wrote to memory of 1224	3488	Fmficqpc.exe	101
PID 3488 wrote to memory of 1224	3488	Fmficqpc.exe	101
PID 3488 wrote to memory of 1224	3488	Fmficqpc.exe	101
PID 1224 wrote to memory of 2460	1224	Fqaeco32.exe	102
PID 1224 wrote to memory of 2460	1224	Fqaeco32.exe	102
PID 1224 wrote to memory of 2460	1224	Fqaeco32.exe	102
PID 2460 wrote to memory of 3548	2460	Gcpapkgp.exe	103
PID 2460 wrote to memory of 3548	2460	Gcpapkgp.exe	103
PID 2460 wrote to memory of 3548	2460	Gcpapkgp.exe	103
PID 3548 wrote to memory of 2868	3548	Gbcakg32.exe	104
PID 3548 wrote to memory of 2868	3548	Gbcakg32.exe	104
PID 3548 wrote to memory of 2868	3548	Gbcakg32.exe	104
PID 2868 wrote to memory of 2960	2868	Gjjjle32.exe	105
PID 2868 wrote to memory of 2960	2868	Gjjjle32.exe	105
PID 2868 wrote to memory of 2960	2868	Gjjjle32.exe	105
PID 2960 wrote to memory of 2616	2960	Gmhfhp32.exe	106
PID 2960 wrote to memory of 2616	2960	Gmhfhp32.exe	106
PID 2960 wrote to memory of 2616	2960	Gmhfhp32.exe	106
PID 2616 wrote to memory of 1176	2616	Gqdbiofi.exe	107

C:\Users\Admin\AppData\Local\Temp\a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54.exe
"C:\Users\Admin\AppData\Local\Temp\a801b5dea56cd263aac26c53b7d6e9f877d6e604959fa4e342b515f7f48b6a54.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\Ffekegon.exe
  C:\Windows\system32\Ffekegon.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\SysWOW64\Fjqgff32.exe
    C:\Windows\system32\Fjqgff32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\SysWOW64\Fqkocpod.exe
      C:\Windows\system32\Fqkocpod.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:468
    - - C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2640
      - C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1176
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        24⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        26⤵
        Executes dropped EXE
        
        PID:1036
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5012
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2572
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1740
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1012
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:784
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1112
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3060
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3832
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3608
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        42⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        43⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1272
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4960
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1968
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2548
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        49⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3216
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        51⤵
        Executes dropped EXE
        
        PID:4152
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2664
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2828
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3440
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:756
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2852
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        59⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3928
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        63⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        64⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:548
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        67⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2648
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        69⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        70⤵
        Drops file in System32 directory
        
        PID:1884
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        71⤵
        Drops file in System32 directory
        
        PID:4316
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2624
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        73⤵
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4980
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        75⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        76⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        77⤵
        Modifies registry class
        
        PID:1576
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        78⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        79⤵
        Drops file in System32 directory
        
        PID:2684
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        80⤵
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        81⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3008
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5048
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4480
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        86⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        87⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        88⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2632
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        90⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4292
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3520
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3576
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        94⤵
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5136
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        97⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        98⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        100⤵
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        102⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        103⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        107⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        112⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        113⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5932
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        116⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        117⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        119⤵
        Drops file in System32 directory
        
        PID:3400
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5264
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        122⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        125⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        128⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        130⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        131⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        132⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        133⤵
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        134⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5440
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        137⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        140⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        143⤵
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        144⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        146⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        147⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        148⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 412
        149⤵
        Program crash
        
        PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5308 -ip 5308
1⤵
PID:5888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dmnlpfhd.dll

Path C:\Windows\SysWOW64\Dmnlpfhd.dll
Size 7KB
SHA256 b9359641ca3208a65f1e14cce1a7bc1ccece451acc4fd47898b18434203a7026
MD5 887d7e3678c25ffb2243f69354cc7ffe
SHA1 ea2826c2898b562f7046a8026129e1af7a76ecdb
SHA512 851c686c4a5094b45bc5624519e81a5b066455696d5323d178ff42d5ffa3e67f7fd92e9221c3f81d36774e8210c0bced6323d333abd9e2c5101b7d12bec1cad7
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW0bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPeq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbllkh32.exe

Path C:\Windows\SysWOW64\Fbllkh32.exe
Size 90KB
SHA256 fdace579645c455c7cb84c125d4a026dbf672f1034fe6a20e3173dc7917e4491
MD5 96a5d98612b1a8dad2b23858561fa39b
SHA1 890d429c31e3b19b768d4a7a9325b00eae15bcd5
SHA512 7ad4faf04912f83b6c34ecfcbf6febc018ddbd9e4c48bf8d56599cf517cef1b9986aa34a7ae6fa41fbc67335ad3f25006b5f9f60c355d87ea45821b84e5d3bd1
SSDEEP 1536:U1CJdt5WFs7k3iiIAI8N6MUv4knLtYHW4drbEXmfOOQ/4BrGTI5Yxj:U1uZWFs7k3iBo6nLtcrbECU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbqefhpm.exe

Path C:\Windows\SysWOW64\Fbqefhpm.exe
Size 90KB
SHA256 1182cd9a973aa507756e2d30e0f51ef2c7e36e4a9418121039d0dbf186d500be
MD5 6d850b5404a73acb3e7e2a3b3066917b
SHA1 cf648f3fc0400791f773ad234356da48e9e706a5
SHA512 2f499c06d53d3b22f3e16a2d39d004fd7e8116f4d21989505ed3b437eaee01214bd1519bdabd5d9e8811e772fd956afcc75100e015319cf6cdd14209ee8ffd87
SSDEEP 1536:1BW0Wq77Xf1Bxj62WgbRjfCpjxOSWoOphKFlyoLXXSfOOQ/4BrGTI5Yxj:1BW077XfZyI4tKoOpg5LOU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fckhdk32.exe

Path C:\Windows\SysWOW64\Fckhdk32.exe
Size 90KB
SHA256 d5eab85a4f56a9dd443e054ab80def8e6d7e5bab626949a43d333e25647db62c
MD5 e73e36460ff3dec7fdd223d57d1bb440
SHA1 d1040bf0df7102f9862c887fbfc35f524918b4e7
SHA512 d7a55da328cefc6029f5f3bc9056f535de06c3541afdc0c952838af868d70eb31a6926386db57f2dc3fda815853a5b2eac0d1a5b916e1bfdc84e18be5776b64c
SSDEEP 1536:bVEuFrYvKQ7iIDR+ncPDHzvv7QvWilD36qLkibLXCfOOQ/4BrGTI5Yxj:JVuh7iIUW5aD36qLRLuU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffekegon.exe

Path C:\Windows\SysWOW64\Ffekegon.exe
Size 90KB
SHA256 d240db12eb0a110e5da9edbe409a6fa05af38740932e3c90ffc046a4a3b3166a
MD5 e3641db40f29a8c651d0d50c49b5ce05
SHA1 b408436c5d03dc61cfb09c26204702a425b3c038
SHA512 0222b3d2cb6cc734c4acf65f46b9bede578837f70c491884a2977535bc8e14e4957ada50bdd69f92db2407634e590a7fec8a32be0dc223dd0d737cb05e65ca9e
SSDEEP 1536:wmrbrmaT8pBkcTcomEFMkmTXR+aqqynXX+fOOQ/4BrGTI5Yxj:wm6yaLsQ9XqU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffggkgmk.exe

Path C:\Windows\SysWOW64\Ffggkgmk.exe
Size 90KB
SHA256 bfff77d7c94b4b68b4d48c5d3537092583fb2e538ee5f42a5fe4413c6f32c799
MD5 b255b1a68b1f120c4d44728e01923afa
SHA1 85433b427220e27623be1998de52fbf9ddb86736
SHA512 1cd3afbfe880e7dd605655e3101839e4c5a68139556ba2f94e2fff467d483718c22c36f3ad5962baace8d83a02e098fa19622c41ac21cc884b7d367b88ea40a5
SSDEEP 1536:XXjbQDxdSEo9TFY9ORD3fbtlA3NdEp3sIYz1duFqXXfOOQ/4BrGTI5Yxj:X3QldSEo9GERLTcdd0pYLuA/U/4kT0Yt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffjdqg32.exe

Path C:\Windows\SysWOW64\Ffjdqg32.exe
Size 90KB
SHA256 00238859ce456a5b915af2e6165ee7cdf4d3ab1a4f42e2490d42745a6e2611a5
MD5 4ff82418f603d4c6339843ed4f1e6a67
SHA1 bf2bb52341b296911e913e2a61724ad384aaf058
SHA512 8a52a6746c66ba68dcc142f80d828c92e7eb8cd569bad990e8dfee9d329647136cf7d6a1f130e6f9bdb92b7a347342058965fdb3f5cef83d6d05cab266823dca
SSDEEP 1536:znYVE46nOayVymmzRZgCgek4YsJHgqM6bNKX2fOOQ/4BrGTI5Yxj:UenOVkmwZg4zYsRgv6pKSU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fifdgblo.exe

Path C:\Windows\SysWOW64\Fifdgblo.exe
Size 90KB
SHA256 e2b6ae44a05ed706757d2b3fa681b00d4a232abb4b7b3d552a5a84b8bbfb0747
MD5 b9d46f80140f50027d1badd1d35ee3ce
SHA1 4a3274a900f7ebb9870f9b37a59a0753911d5510
SHA512 e0aee58d89d59a857b2fadcf46f650de1c1a58ece3ac3a47d00a3c6cdd6cab65fd3464969ca28ce05b7f953e95a03856731686a859e92b770d66d2c1fe535ba0
SSDEEP 1536:NgUYUUtjltFPfzjpmUlqTpe7JP3NJfO9ZntKm6NNRVo6gXKfOOQ/4BrGTI5Yxj:al/PfzjpmUyUNNhOzkFkmU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fijmbb32.exe

Path C:\Windows\SysWOW64\Fijmbb32.exe
Size 90KB
SHA256 3e0d292f07facf479f036d78ac5ef10e6c3d799f111bd9e924c8baec06fcb16f
MD5 6a0e9f8ee72dbbd3ef007e473ed8d0d5
SHA1 2ef23ba4fb6838476dcf0ee8a3e13f5d4e60b333
SHA512 aa2a2a945cd67303b5115c36ee7d694715a350bd78bc6bbd2332ff887c715e14c3fc305ab4042307093377139cf4c6eec546eeea1297a5578380631831aa16a4
SSDEEP 1536:y/nldP4zua6HSA5Bvh1c2cUQb9Epp1oEWCR/Dpt9GSXVzfOOQ/4BrGTI5Yxj:0P4DOgUpHlWChBjdU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjepaecb.exe

Path C:\Windows\SysWOW64\Fjepaecb.exe
Size 90KB
SHA256 4905485ef6c482c53927e3a12fc662f0edde8a945d0b47946e71f5769ade5188
MD5 d09c48eed93a803c1bd1c767afdd2988
SHA1 40edd11ad40b3d55eaf7e75936e20dcf6a4795bf
SHA512 ffcf7bcbfb8908f2b010c8bfebf10871d55c7e66be8d622670dace068b81cdafa4cb9357adf6f04185d22de0e81a4a8ae2ee7e4ee83036c195dd3e65ee4dbecf
SSDEEP 1536:nTztNYkoyj7hVaMXna+lAK4ciCM6NkDNzXbgeXUfOOQ/4BrGTI5Yxj:fjYgdVRB8cXyDJrgeIU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjqgff32.exe

Path C:\Windows\SysWOW64\Fjqgff32.exe
Size 90KB
SHA256 a7a74591117be39f7be3605a8f5e10f313e288a5ab09d88d4d847a11c98c5ae4
MD5 ea6339fccbdb4ccd6daf57deeaa55cf5
SHA1 d772a13890827b517196482ea9049ea5958f90c0
SHA512 b8efa2e1fcbd461efe3ce229d60c10aff1e9da68a8638432226e48429f7652fddcc6163b0ae1d4f20358defea33b358e8f162ca4299612caa2873c2245d5ca55
SSDEEP 1536:lZEN+FqRUKBwC7oSuSEP8RbKCsJIcZEf0Bi3whUXqfOOQ/4BrGTI5Yxj:lZWdRzBwC7EfURnsJ9cgitGU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmclmabe.exe

Path C:\Windows\SysWOW64\Fmclmabe.exe
Size 90KB
SHA256 addd62f44841d6b7a19c95fc184cee987f713131359667dab9a5ec6aedd6e47c
MD5 51c7c3eefb8f195c8b140255aab479a2
SHA1 742e777be91cbc4d38ca001237b51891bedff0ff
SHA512 d0c8d1813e9567f44aa15ce1089b747bb2ec98906425a9745644793508f1d7ff7b1fcd394c3afa39f96d8b14322ff1c41d55073aa626c7991c76c8b46eb02572
SSDEEP 1536:6FAk7GkJmDJK/LhqYDhPR7M9bfNEdCZE//vDksUQOFMXBfOOQ/4BrGTI5Yxj:6FAdkJ22pDURKgq//rTNOFMBU/4kT0Yt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmficqpc.exe

Path C:\Windows\SysWOW64\Fmficqpc.exe
Size 90KB
SHA256 a146795236026d85777091db4378c41af6c91a51f8db0281317708c7437d3bbf
MD5 45b4589fb80185951a6ab29ecd575157
SHA1 bb6cc9da0edee380a418e270eb5926a2c0d89fa7
SHA512 e0accb68ad32e5b9551eb3a1b4963f1df9e0c089b90c196727da1b4d5a1f4f4f4827d77d6ac7f2127ef833383496626e1f1d5bd5b9a0291cec843da5d0d19040
SSDEEP 1536:hyspxSf+l9YJFeHzVaqMKQoXE6VBOH8H9CK5RGaolULbnXwfOOQ/4BrGTI5Yxj:xpx1EgsKQoXEWBqK5RGmLzkU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fobiilai.exe

Path C:\Windows\SysWOW64\Fobiilai.exe
Size 90KB
SHA256 0f4e32438727caec4cb0066267b25bb7defe79a9e0b622805f1adada6b2408ae
MD5 8274dba5d1dcb0e4d4fca9391d3e47ee
SHA1 0aa0571b7e34899c3470549910ea1154fb112690
SHA512 723695c64f779ada1c15f8536d691c86f7cd1f25811d0c858174685627f68f3d42a4dd796471117b1fd1ac387a5772ec6860046317e926e93536400a539457a2
SSDEEP 1536:sbgKx6xnuIZzlJEwlUZG+qOHi6med6eTvXOfOOQ/4BrGTI5Yxj:5A675EwlR+/HoEaU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqaeco32.exe

Path C:\Windows\SysWOW64\Fqaeco32.exe
Size 90KB
SHA256 9064cba5e12cc647dfdf44ca0b2d2f0ffad6ed7766792aacb32f960241a6d1c2
MD5 4858a7a0b3de07bcb300227ec1514e61
SHA1 025072c5dff840d468405f01b77ace3104be472f
SHA512 7703fcfd1057c9a97e09e4ce7f5b79e8fd06b8deaaa95be33f0ca9837fe07a1e21f0fedb4c252907ad26019a38c5e1ac919950b2b77c7cf93cd7dbaecb02453f
SSDEEP 1536:Ahv8/u+CY0fduPLopEOvYoxPKIorW3xHutOwbI4t97f+SRqJIcQfXfbfOOQ/4Br4:U8/0XawxPzfI1t97GGqJIciLU/4kT0Yt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqkocpod.exe

Path C:\Windows\SysWOW64\Fqkocpod.exe
Size 90KB
SHA256 834521a125635b9f95eb631185aa56ae5016e3dc5cb7402c9da87b4114c49df4
MD5 a406cd26cd90964aa79ad548dd510286
SHA1 d10446a91974c6c800b1ba54efa8046cba069c48
SHA512 b6e19cb668ef7c5cf758517fb1a648d479b639cd97bd8f73712a8141ca6f159129dae12faa5894c1b7e862fa0e18179ee86ff37cf5d5c05bc70b33c16b67532b
SSDEEP 1536:sxzN3NJpkVYxwB1Jd8wGygv2PelBGXLzvPRzb5t8AY7/mAOTsHxgWXptXQfOOQ/Z:m3ziFdKvM/vBb5t8AU/IoRlXLkU/4kTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqmlhpla.exe

Path C:\Windows\SysWOW64\Fqmlhpla.exe
Size 90KB
SHA256 fa944aa6268099adf0207615f6bfc34483a89840ec0a422c9e990945c290ad3d
MD5 943548e5ee910a98c42da87bdaf399e3
SHA1 3691a208954755985eae108bb7e839baea77b442
SHA512 91b9a78df7bf0840d8978c1ed713086e578dfaa78bcb0e042aaa162b11a4abc4c7247c63fb6334081dc230c99c897efa3ff2fef93b76eb40c6b6fccaa248ce52
SSDEEP 1536:cgkEb50S+8+5+aglguBhL7BB3aYw/EoQv9Woi2s9iOyzUps6o/UGW3mJDXzfOOQh:cgz6pF5+1lgubfaTQFBDzUX11MrU/4kD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbcakg32.exe

Path C:\Windows\SysWOW64\Gbcakg32.exe
Size 90KB
SHA256 f28d81dbd7ad77491b4a997502ecd67eb62c6d9cf3993d06de80765d2c7bf9f9
MD5 5021735744223f0d70071ab105bd5c3b
SHA1 e7c8ce72818028e328a32b06c384668051629f06
SHA512 6eaedf739e343ffdf4dc9aa423be959fab087eab220b325a6c6a861491c17251055996d6cda2d4691e88efce28bc8ec59b1cd0ec3ab309347cf89d2488719e04
SSDEEP 1536:FzNQoQyR4vwWT+L1UGvADhzQLi28dhzF8JrxvuQRjhLXEfOOQ/4BrGTI5Yxj:Fz34vwWIUGvADhz8qze9x/p4U/4kT0Yt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcggpj32.exe

Path C:\Windows\SysWOW64\Gcggpj32.exe
Size 90KB
SHA256 7c57b230f56304ee86128d06eaad70c8b1d9f14affb9519f31aeeaf1be233515
MD5 208a4c0ea14075b458e5d428888e30a5
SHA1 a485191df00356f78f13b6c23009662b359f86b2
SHA512 26efd0f6d544094208d47ac587af20fd1a5094a2b36acdb7d849f45a03251cbb951cb160f5500d20f7c3014624819a9393103f32dea20cf54f224032f58ff600
SSDEEP 1536:VShT3oFVxxVQSgLrJpzWVZoAPmzDCaXbfOOQ/4BrGTI5Yxj:VETYz2BLjzSPmlDU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcidfi32.exe

Path C:\Windows\SysWOW64\Gcidfi32.exe
Size 90KB
SHA256 5946f0d1349ea563c79efd9df739e9c7c5c4ecdbc21ac918b10dcd28b5716e4d
MD5 adb9e0acf43e38dd15d364e8bf15bfd7
SHA1 a2e17afe5d26a0d11fffb485f01976ae5acf2507
SHA512 0ffa2cd66d89fd605ae4f8f63214bb2ec9d24388a338a2421d0e3f05f8ab9583a4170817f078e99a1adda2dbf2de2bcbbb28fd008131132b9f0766c3b06bb675
SSDEEP 1536:rbZEtwwFY51GSHqbmSaqIAp0q8XSj/qNeEaV5hmdJiyXS7fOOQ/4BrGTI5Yxj:rbZCij/XAtOGygGzT8U/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcpapkgp.exe

Path C:\Windows\SysWOW64\Gcpapkgp.exe
Size 90KB
SHA256 7eb669b32c025388c784c22dec5239a64607cfa4fca24627109cfb34424564cb
MD5 8af9a087d780a86fb737a0019174bfed
SHA1 84b7cf075a2b63034412aa29dbde190e4d33077a
SHA512 bef80aed78c957a09839d700fa120871e52f2f9fc611a419115f1f15b4457ab92e81685f13a4405ba51f072e1808da5a6df1d2d4e5fd8dfcf77574e7fa4a194a
SSDEEP 1536:1j8pgi7SixO0DfbDTXitpuuZRZksad/5RVaG5dum8rj25gx+XHfOOQ/4BrGTI5Yt:1j1i7Jx7nDTXpud8/5RVdR8+5ggvU/4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfhqbe32.exe

Path C:\Windows\SysWOW64\Gfhqbe32.exe
Size 90KB
SHA256 f27296e0580484eea5eb631404fbd7ad3957bfb3249f9e50a053cf54085e398d
MD5 0ea6736d1151c3585d0d0f583454814a
SHA1 cbad2cfaf01693553475362a8ebaa569425030b8
SHA512 73532874e452c1545b2367f31864dc4be3ab70408addc31904dcd874f904c7cdec34dc539ca5cdc6c7fb52dd8ece3dbcffc490955c23b7f0942f96c78d7c0bf8
SSDEEP 1536:nmaaGpjscsGMGfRnMEr9sNe3yl0E6HI/5tYTaVeBSvXSZfOOQ/4BrGTI5Yxj:hdscspsmyyl0E6HGtMawBSvqU/4kT0Yt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjclbc32.exe

Path C:\Windows\SysWOW64\Gjclbc32.exe
Size 90KB
SHA256 d0a0afeba7028a99244d5d3c9a4f7b450e420a2925e9ac56de5d83b6d90f4c81
MD5 e1da97eb82cbb05ba53d8e54f2d8e2fa
SHA1 fe5c38baa5b16ab2bb237453237d26a37cae48a2
SHA512 0064af506c4b4af6a557f6031ff5b7dc96488cde00df2077a6ab70414f667e384ff2e78df80c146b0590954ecdb8220d8b12327c552bb186b918bc8554084c2b
SSDEEP 1536:Pc0YfoetezjCb0zpGOSF1rDekqgWTX+ofOOQ/4BrGTI5Yxj:goe0Q01GO1k6vU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjjjle32.exe

Path C:\Windows\SysWOW64\Gjjjle32.exe
Size 90KB
SHA256 717f7b8533af6ba0dbe5556ee884fdc45fde2bc34fb5b28d9e321dd530c74523
MD5 e4225b9e712654da6da5b39c8e762329
SHA1 c12fa8dac87fd5c0591795eb92ad25ef9f11df47
SHA512 4fa56b8447a0192d5ba6ed067d25c3025e09d7fc0258938fcb315dd18a6416d39cdfe3ce26b3eca3a3e39d8757a55d1b81b5f58523749428cfad8ad8a0b6356c
SSDEEP 1536:lDES48j0sy2DwTjHhM8kOZKZuVMcWIA+lnQQQQQQQQQQQQQQiQQQQQQ93QQQQQQ6:lDxWfhRKZ8WIAkor1zFU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjlfbd32.exe

Path C:\Windows\SysWOW64\Gjlfbd32.exe
Size 90KB
SHA256 592d01d103fefd9b518de8b492ffbd5b810af58eacb3c4cbf14025b926455133
MD5 63b8d3b00b27603ca536054246282211
SHA1 d22ace1838b630b2f4247d45fe54a5396d1436e9
SHA512 7a342cf5ced73a6b560003bc13632f7c43dc3cb970ba940892cfe138ac2c7f440952fcbc9957bce79f9d50fceeeab1b7170290519943f9dd78e8688942170451
SSDEEP 1536:e0OCyiE7gMsxZdRRw6JxbNcpVSVe69VC9QFXGfOOQ/4BrGTI5Yxj:kCyiEa1w6jqSNnRiU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjocgdkg.exe

Path C:\Windows\SysWOW64\Gjocgdkg.exe
Size 90KB
SHA256 f1006a71a2cbcba43945738cd80d91ad352031f0774ca4eb27dc150bcccc5003
MD5 932d8229bebd6b406c53dfc83dc291ec
SHA1 3deb1bdff4ab9b93dca72884ae4f6c5e77ab9bc9
SHA512 7efc19da31956f753b773470d7970845ede5f5aaf102c6ba658f663dc9a62f1dd57be525975ab6c741c1d6a88bfe64a9f8568fc5c4664e476c473953488e5f91
SSDEEP 1536:FpB7WMtqc8LAjYwBO3AJAtDa9nIuQCet4Hn2MdRqLMXmfOOQ/4BrGTI5Yxj:vB7VtHYyYo4AJAs9nNQTtdoLiU/4kT0y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmaioo32.exe

Path C:\Windows\SysWOW64\Gmaioo32.exe
Size 90KB
SHA256 427b493cb35d418d09f76891224d233dc970b298c4eb9d28ca41a59f8ce36c36
MD5 61932dfd8be6de6f96a7f189135f8ac3
SHA1 060b105368601f2aefdd67fca660a2fe2f633f39
SHA512 90299203a7a9071dffae062bd5e1211cb65a9a98434eb282499cdfedf88265211b03cf472b22705964f7b5cb520c0c5fa4aac4fc4436533238ef682d4ce2cdbd
SSDEEP 1536:QcN2fwfCuTaK6FTj2c1m0ICvUH8TuMlflvw74X2pfOOQ/4BrGTI5Yxj:nN2fwv6FTjps0WHjQflvvmpU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmhfhp32.exe

Path C:\Windows\SysWOW64\Gmhfhp32.exe
Size 90KB
SHA256 a436230b70611f4dbd035ce93cd5f0235aa9592812e8ca3952ca520ee3c53b0b
MD5 d8e5d5b76be620e9e225667634b5d79c
SHA1 8008f82498ed18612c2df85b01c962cf3fa29ce5
SHA512 2a2148553fe93a3d17fd30170d829f4a8a353defd92696f639e9fae71fcc7e64d05237cd515543baa3448fe7630cb120b0c3f91f6a70868368ae9b05d6b76af5
SSDEEP 1536:/BL76v5FAR/9ZfgsWe94cIDnMkc9IMXe2/abXmIfOOQ/4BrGTI5Yxj:65FARsssPnMx9Pl43U/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmkbnp32.exe

Path C:\Windows\SysWOW64\Gmkbnp32.exe
Size 90KB
SHA256 abacdf390891ad1bf4f579ce349c53880b2c42f38537b01a7d6a1973420186e1
MD5 dbcd30db5d3865e07416fab99daf4164
SHA1 13132b9e120bb8fbd121b75ba4c384606b4e0e69
SHA512 4fb27c7f583aeb4b487b952ae59474fc158b91f07ac37ce86f55bfdf6d3066d09786386f47d851d713a82273ac33188d801e92b8390d6d8ea43b3c89f73d3dab
SSDEEP 1536:eoCWMKcSXcGmRP07gleHj95aXc0YflKDYYXCfOOQ/4BrGTI5Yxj:eXvGu87gsj/aXLrYYOU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Goiojk32.exe

Path C:\Windows\SysWOW64\Goiojk32.exe
Size 90KB
SHA256 7751e58e8f7244c31b6f27fb89b0c1a30e41d925f3178bb853a08384baf02da2
MD5 941fd21c78953a1939001d209e4a89d2
SHA1 19883f13d66b490953639b8d156b472a4c7cb8e5
SHA512 812d5711b3c19daee32172628eee4ae17c710e2cb32795e9ab41bdf483ef1905206ad1bcecad0fab22f1f3a413e52851e263071748baba129095405255ce4ec8
SSDEEP 1536:eB8ua+oSr2zw+cTR/kqxK/EdfFspKwyEH7f2uNBxn/XzfOOQ/4BrGTI5Yxj:e9hQwtR/WifWEBwbbV/rU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqdbiofi.exe

Path C:\Windows\SysWOW64\Gqdbiofi.exe
Size 90KB
SHA256 0e6636f0cece3e4cdc24e0012de7fead9473fda5801ca984d23b6086bb38b3bc
MD5 4335f097c1b7353a1d0b40fbed9306df
SHA1 949fd3fc3c3995fefa7486359543c8eb6e94339a
SHA512 1aaf75572ebbaff91a888953820ebfb6ea5ccbae822ddc86c7d6625696539e4ea71303e34aeed06e7d1b28bd8bb102a50a016cfd3709e3a9b5149e3ff58a6d79
SSDEEP 1536:DZr6Ml0PqdV/bOln8Zs4TIpO2f6CWtZ5D2CawXIfOOQ/4BrGTI5Yxj:DlAPE/6ln/4co2f6rtZFiwsU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqkhjn32.exe

Path C:\Windows\SysWOW64\Gqkhjn32.exe
Size 90KB
SHA256 a190423f2ac5dce7d1fbdad4930b2b51470651a3b8465a3bb0693ac33c78ef1d
MD5 1ecb684fb359fc80ff2c822fadf118c9
SHA1 cddff72714c945f8e66f28975b5521ed7242fe89
SHA512 1663f9beb2ffcd517c6b2543222df9c797d904b8ff30fcce721d43f7f5e051d255aa92b69b8e51b1e336c73a6c476d5e1c2e12387e6e4618917690b9fe445856
SSDEEP 1536:iQ4jzfQKTyBrYIKwMwORl+THwU6LPPX+XTfOOQ/4BrGTI5Yxj:iQ432BrYIRMwORl+THwU6b2LU/4kT0Yt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hclakimb.exe

Path C:\Windows\SysWOW64\Hclakimb.exe
Size 90KB
SHA256 7f315135d2746049ef8ee7f9d134f035545bbfd655bbe527d840b9bbf7026abf
MD5 6907b1e7c923eca3a15b993bcdff6b58
SHA1 8a205e8b2af1d81a827232b3950213bf79c8726c
SHA512 42d84f4bb36e3e2ed462bbe9101061d8319cf820bed5d3aad20d7d58b5c754d4b8e2bd6bc91d86baa24c68c77c41c6d19ef93fd3c67d4d4a99f8147fe4b70b15
SSDEEP 1536:MBXRYJp/+RVjci99Vt929JmTZKYvGr5R7B2YjKxVgnHILXWfOOQ/4BrGTI5Yxj:MCj/Mj399VtEqMYvGVRN253goLSU/4kD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgekbljc.exe

Path C:\Windows\SysWOW64\Mgekbljc.exe
Size 90KB
SHA256 accfa310440f871529771738d191a4b2a6d7a22bdebbf46a24b104228e3f79bf
MD5 f87aea27cec3e0dd79fe9589956c5078
SHA1 c36c13db46a9349bf30cffc875038a7583931191
SHA512 b1c6a53b7e637bce693741737a17bf6549efdbaab1178d1d2e17f8e7e4b70ba8a8834898212365d8c887f7ea68fcef270f6d42bed254d57808891876b8bfff64
SSDEEP 1536:ZvauNTAfiUDTK2chYdOjrc7kOumS0Bi1sL2GYtjXMfOOQ/4BrGTI5Yxj:JNTgiUDRBOjA7kO7y1wYtjwU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgghhlhq.exe

Path C:\Windows\SysWOW64\Mgghhlhq.exe
Size 90KB
SHA256 a1948feace0d252b0fa5886e06b13998a688186c7966eeee6739661a56299c50
MD5 7c70bf55d43d2bdbb56b12526defff39
SHA1 b211bc2b458c4f53dff23e68a0c37cfbad113e62
SHA512 a4d25b32838cf11562b5998510adf2928ea003b877ffce3f7f147a202b0dc912998edb53b019ffc6c7b4968c2eb2a1943f3783952f5a92c0b6d7d106e214fa48
SSDEEP 1536:L9VwN4TIO8UPcgJcn+IDtGzO46ZWuVn3YC6X9ktXOqfOOQ/4BrGTI5Yxj:LoyIOHn6n+IRGz96rOtktdU/4kT0Yxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-13-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/464-60-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/468-118-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/468-23-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/784-275-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/912-111-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1012-268-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1036-206-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1036-287-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1040-64-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1040-194-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1072-296-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1072-215-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1112-282-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1176-188-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1224-146-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1272-338-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1384-71-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1384-204-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1740-331-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1740-256-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1788-43-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1788-163-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1968-361-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2008-198-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2008-279-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2084-88-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2112-93-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2460-147-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2492-52-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2548-362-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2572-248-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2572-324-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2616-180-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2640-138-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2640-32-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2676-97-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2676-230-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2712-196-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2868-170-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2892-302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2960-172-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2964-122-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-289-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3184-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3184-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3484-323-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3488-130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3548-155-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3608-303-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3796-15-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3796-103-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3832-295-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3988-332-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4240-223-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4240-309-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-322-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-240-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4384-325-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4748-311-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4960-348-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5012-310-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5012-231-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5100-350-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads