d0f8184033db11a0948cf36b7d93ae446c4545e7322bd27d659317475f4cf9b6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d57459248fb1b316b7f2ffdab5e37a55.exe
Size

64KB
MD5

d57459248fb1b316b7f2ffdab5e37a55
SHA1

eff13987b5c60607d58f0dc2ea38378e93d21ac8
SHA256

d0f8184033db11a0948cf36b7d93ae446c4545e7322bd27d659317475f4cf9b6
SHA512

8cd466a6a50224cf98c47f5567bb4537f162400fbfada93b2e19754095d3b28c4e7803cf8b5367073c544de1c1cf9be637d1f753ed4856ab91ad80b638789859
SSDEEP

1536:0OiBAHwcwuE+AS+1lhxcmuJiCn5NeJ5DP7ZuYDPf:zmpcj+1/xBuJpn5Nej7ZuY7f

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmjqmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liggbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcmofolg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kagichjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mahbje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kagichjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe

Executes dropped EXE 61 IoCs

pid	Process
2868	Kmjqmi32.exe
2704	Kdcijcke.exe
4976	Kknafn32.exe
4340	Kmlnbi32.exe
1556	Kagichjo.exe
4676	Kdffocib.exe
3880	Kgdbkohf.exe
4228	Kibnhjgj.exe
3068	Kajfig32.exe
516	Kgfoan32.exe
4032	Liekmj32.exe
2348	Lalcng32.exe
5044	Ldkojb32.exe
1660	Lcmofolg.exe
808	Lkdggmlj.exe
3648	Liggbi32.exe
3056	Lpappc32.exe
1088	Lgkhlnbn.exe
2264	Lijdhiaa.exe
3692	Laalifad.exe
4700	Lgneampk.exe
3344	Lilanioo.exe
2024	Lnhmng32.exe
5072	Ldaeka32.exe
1900	Lgpagm32.exe
2760	Ljnnch32.exe
2892	Laefdf32.exe
5084	Lgbnmm32.exe
4392	Mjqjih32.exe
4496	Mahbje32.exe
4136	Mdfofakp.exe
2480	Mkpgck32.exe
404	Majopeii.exe
4980	Mdiklqhm.exe
3932	Mgghhlhq.exe
4752	Mjeddggd.exe
3192	Mpolqa32.exe
2248	Mcnhmm32.exe
4056	Mkepnjng.exe
4720	Mjhqjg32.exe
1784	Mpaifalo.exe
3812	Mkgmcjld.exe
2652	Mnfipekh.exe
1668	Mpdelajl.exe
2288	Mcbahlip.exe
312	Nkjjij32.exe
4628	Nacbfdao.exe
3752	Nceonl32.exe
3580	Njogjfoj.exe
1996	Nafokcol.exe
1464	Nddkgonp.exe
4244	Ngcgcjnc.exe
2772	Njacpf32.exe
4080	Nbhkac32.exe
4064	Nqklmpdd.exe
4304	Ncihikcg.exe
220	Nkqpjidj.exe
2080	Njcpee32.exe
388	Nqmhbpba.exe
1704	Ncldnkae.exe
1552	Nkcmohbg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kmlnbi32.exe	Kknafn32.exe
File created	C:\Windows\SysWOW64\Ldkojb32.exe	Lalcng32.exe
File created	C:\Windows\SysWOW64\Ogijli32.dll	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Ldaeka32.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Mpolqa32.exe	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Kmjqmi32.exe	d57459248fb1b316b7f2ffdab5e37a55.exe
File created	C:\Windows\SysWOW64\Lilanioo.exe	Lgneampk.exe
File created	C:\Windows\SysWOW64\Lgbnmm32.exe	Laefdf32.exe
File opened for modification	C:\Windows\SysWOW64\Mcnhmm32.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Gbbkdl32.dll	Mnfipekh.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nacbfdao.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Kknafn32.exe	Kdcijcke.exe
File opened for modification	C:\Windows\SysWOW64\Kgdbkohf.exe	Kdffocib.exe
File created	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Mgghhlhq.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Lfcbokki.dll	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Nacbfdao.exe	Nkjjij32.exe
File opened for modification	C:\Windows\SysWOW64\Nacbfdao.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Kdcijcke.exe	Kmjqmi32.exe
File opened for modification	C:\Windows\SysWOW64\Kagichjo.exe	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Jjblifaf.dll	Mgghhlhq.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Hbocda32.dll	Laalifad.exe
File opened for modification	C:\Windows\SysWOW64\Mkpgck32.exe	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Liekmj32.exe	Kgfoan32.exe
File opened for modification	C:\Windows\SysWOW64\Lcmofolg.exe	Ldkojb32.exe
File created	C:\Windows\SysWOW64\Ndclfb32.dll	Lpappc32.exe
File opened for modification	C:\Windows\SysWOW64\Mdfofakp.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Jcoegc32.dll	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lgpagm32.exe
File created	C:\Windows\SysWOW64\Majopeii.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Qcldhk32.dll	Mcnhmm32.exe
File opened for modification	C:\Windows\SysWOW64\Nddkgonp.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nddkgonp.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Kgfoan32.exe	Kajfig32.exe
File created	C:\Windows\SysWOW64\Lnhmng32.exe	Lilanioo.exe
File created	C:\Windows\SysWOW64\Pipagf32.dll	Kajfig32.exe
File opened for modification	C:\Windows\SysWOW64\Nqmhbpba.exe	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Kknafn32.exe	Kdcijcke.exe
File opened for modification	C:\Windows\SysWOW64\Kmlnbi32.exe	Kknafn32.exe
File created	C:\Windows\SysWOW64\Lcmofolg.exe	Ldkojb32.exe
File opened for modification	C:\Windows\SysWOW64\Mgghhlhq.exe	Mdiklqhm.exe
File opened for modification	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Bpcbnd32.dll	Kgdbkohf.exe
File opened for modification	C:\Windows\SysWOW64\Lijdhiaa.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lijdhiaa.exe
File opened for modification	C:\Windows\SysWOW64\Laefdf32.exe	Ljnnch32.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Kmjqmi32.exe	d57459248fb1b316b7f2ffdab5e37a55.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Lppbjjia.dll	Lgbnmm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3964	1552	WerFault.exe	149

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejif32.dll"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogijli32.dll"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flfmin32.dll"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ockcknah.dll"	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgcifj32.dll"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll"	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmlnbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfbhfihj.dll"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Offdjb32.dll"	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	d57459248fb1b316b7f2ffdab5e37a55.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipagf32.dll"	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihaoimoh.dll"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbkdl32.dll"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckegia32.dll"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	d57459248fb1b316b7f2ffdab5e37a55.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgqhjop.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Legdcg32.dll"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblifaf.dll"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d57459248fb1b316b7f2ffdab5e37a55.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndclfb32.dll"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lilanioo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2868	3848	d57459248fb1b316b7f2ffdab5e37a55.exe	86
PID 3848 wrote to memory of 2868	3848	d57459248fb1b316b7f2ffdab5e37a55.exe	86
PID 3848 wrote to memory of 2868	3848	d57459248fb1b316b7f2ffdab5e37a55.exe	86
PID 2868 wrote to memory of 2704	2868	Kmjqmi32.exe	87
PID 2868 wrote to memory of 2704	2868	Kmjqmi32.exe	87
PID 2868 wrote to memory of 2704	2868	Kmjqmi32.exe	87
PID 2704 wrote to memory of 4976	2704	Kdcijcke.exe	88
PID 2704 wrote to memory of 4976	2704	Kdcijcke.exe	88
PID 2704 wrote to memory of 4976	2704	Kdcijcke.exe	88
PID 4976 wrote to memory of 4340	4976	Kknafn32.exe	89
PID 4976 wrote to memory of 4340	4976	Kknafn32.exe	89
PID 4976 wrote to memory of 4340	4976	Kknafn32.exe	89
PID 4340 wrote to memory of 1556	4340	Kmlnbi32.exe	90
PID 4340 wrote to memory of 1556	4340	Kmlnbi32.exe	90
PID 4340 wrote to memory of 1556	4340	Kmlnbi32.exe	90
PID 1556 wrote to memory of 4676	1556	Kagichjo.exe	91
PID 1556 wrote to memory of 4676	1556	Kagichjo.exe	91
PID 1556 wrote to memory of 4676	1556	Kagichjo.exe	91
PID 4676 wrote to memory of 3880	4676	Kdffocib.exe	92
PID 4676 wrote to memory of 3880	4676	Kdffocib.exe	92
PID 4676 wrote to memory of 3880	4676	Kdffocib.exe	92
PID 3880 wrote to memory of 4228	3880	Kgdbkohf.exe	93
PID 3880 wrote to memory of 4228	3880	Kgdbkohf.exe	93
PID 3880 wrote to memory of 4228	3880	Kgdbkohf.exe	93
PID 4228 wrote to memory of 3068	4228	Kibnhjgj.exe	94
PID 4228 wrote to memory of 3068	4228	Kibnhjgj.exe	94
PID 4228 wrote to memory of 3068	4228	Kibnhjgj.exe	94
PID 3068 wrote to memory of 516	3068	Kajfig32.exe	95
PID 3068 wrote to memory of 516	3068	Kajfig32.exe	95
PID 3068 wrote to memory of 516	3068	Kajfig32.exe	95
PID 516 wrote to memory of 4032	516	Kgfoan32.exe	96
PID 516 wrote to memory of 4032	516	Kgfoan32.exe	96
PID 516 wrote to memory of 4032	516	Kgfoan32.exe	96
PID 4032 wrote to memory of 2348	4032	Liekmj32.exe	98
PID 4032 wrote to memory of 2348	4032	Liekmj32.exe	98
PID 4032 wrote to memory of 2348	4032	Liekmj32.exe	98
PID 2348 wrote to memory of 5044	2348	Lalcng32.exe	99
PID 2348 wrote to memory of 5044	2348	Lalcng32.exe	99
PID 2348 wrote to memory of 5044	2348	Lalcng32.exe	99
PID 5044 wrote to memory of 1660	5044	Ldkojb32.exe	100
PID 5044 wrote to memory of 1660	5044	Ldkojb32.exe	100
PID 5044 wrote to memory of 1660	5044	Ldkojb32.exe	100
PID 1660 wrote to memory of 808	1660	Lcmofolg.exe	101
PID 1660 wrote to memory of 808	1660	Lcmofolg.exe	101
PID 1660 wrote to memory of 808	1660	Lcmofolg.exe	101
PID 808 wrote to memory of 3648	808	Lkdggmlj.exe	102
PID 808 wrote to memory of 3648	808	Lkdggmlj.exe	102
PID 808 wrote to memory of 3648	808	Lkdggmlj.exe	102
PID 3648 wrote to memory of 3056	3648	Liggbi32.exe	103
PID 3648 wrote to memory of 3056	3648	Liggbi32.exe	103
PID 3648 wrote to memory of 3056	3648	Liggbi32.exe	103
PID 3056 wrote to memory of 1088	3056	Lpappc32.exe	104
PID 3056 wrote to memory of 1088	3056	Lpappc32.exe	104
PID 3056 wrote to memory of 1088	3056	Lpappc32.exe	104
PID 1088 wrote to memory of 2264	1088	Lgkhlnbn.exe	105
PID 1088 wrote to memory of 2264	1088	Lgkhlnbn.exe	105
PID 1088 wrote to memory of 2264	1088	Lgkhlnbn.exe	105
PID 2264 wrote to memory of 3692	2264	Lijdhiaa.exe	106
PID 2264 wrote to memory of 3692	2264	Lijdhiaa.exe	106
PID 2264 wrote to memory of 3692	2264	Lijdhiaa.exe	106
PID 3692 wrote to memory of 4700	3692	Laalifad.exe	107
PID 3692 wrote to memory of 4700	3692	Laalifad.exe	107
PID 3692 wrote to memory of 4700	3692	Laalifad.exe	107
PID 4700 wrote to memory of 3344	4700	Lgneampk.exe	109

C:\Users\Admin\AppData\Local\Temp\d57459248fb1b316b7f2ffdab5e37a55.exe
"C:\Users\Admin\AppData\Local\Temp\d57459248fb1b316b7f2ffdab5e37a55.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\Kmjqmi32.exe
  C:\Windows\system32\Kmjqmi32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\Kdcijcke.exe
    C:\Windows\system32\Kdcijcke.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\Kknafn32.exe
      C:\Windows\system32\Kknafn32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4340
      - C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3344
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2024
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        25⤵
        Executes dropped EXE
        
        PID:5072
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1900
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2892
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5084
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2248
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4720
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1784
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3812
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2652
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1668
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:312
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3752
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3580
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1464
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4080
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4064
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4304
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2080
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        62⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 400
        63⤵
        Program crash
        
        PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1552 -ip 1552
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Kagichjo.exe

Filesize
64KB

MD5
9e70972b0ef5c229cdd86fd64f75d3cd

SHA1
0b7c71aec5bd3da4d6f6faae87384aeb271c66eb

SHA256
70bbef4f23fd84fd91632dc7d0c360f2fa9e77255a7e464eea5ebd88e378fbb0

SHA512
0c6de350e5d34577a90a021588b910a54731666448a2857f17d1abc10411842abc212a46dd9b063d5ae58ff4169d9f6fc841cb8275bff07096b97cba330993b4

Download Submit
C:\Windows\SysWOW64\Kajfig32.exe

Filesize
64KB

MD5
c2574d81ff1bc87109d36f965a2e749b

SHA1
ef7a6fa1dbbe72c18d3588af5baad0e18499de9a

SHA256
bf4dfafd60f69c60e842fe84b9e1157a831b2cab13f56477b8d60b2c750a81a2

SHA512
bf62738b45ce874494a71b07841b5662292e5e09c9bde4c7bb07bd385ce0851db358f6f04ad273e5b4d519322793bea0080575a07b6ca61bfa2bdb9acd218ff6

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
64KB

MD5
1f54a0bf1a5f0d8bbfc8f99e3e10fcd4

SHA1
5443d8ce9cfd3baf7db9ca81e37b420864629aff

SHA256
812cf944dd3af32a2a6ab93541347b293921d7cc2c0f8916850631540ba093d2

SHA512
592df0d74bbaa676511af179eac78f1cd94008328da91e6c2891d243a431ea5e492f0c47a907d2f1a3aacccdb31c27183062eeb521feda05b4a6997d9e085a2d

Download Submit
C:\Windows\SysWOW64\Kdffocib.exe

Filesize
64KB

MD5
94ede4b4f958eea69cb12ca10b47026e

SHA1
5910e3f7d6e2a608a9cece3174eaa33052c7309d

SHA256
c5a23c9255b5b48fc8795399071e90a925c72c73498853f957a9b1132fa3c01e

SHA512
7dbc2ddf0e871db485ae5e5c02e9ace0e7d9a8dd8c77f84ad30dbed9de476998f65b954dc3b68531c6febcac0abff5406787eef550730c61b470e25cf20e4145

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
64KB

MD5
4cfe67fbcecdb295e22f1e22c8eb9928

SHA1
7fc745a175d85301815a096bc05d73cfc70462a9

SHA256
107e82c1b012e1a77d5ad66b44044e1d5dff8d660893f5a16eaeb5457a873e7f

SHA512
64bb46479804cac60b456f4150f4b02a65ba4ae2b626976fd110e28fbf32144a2a9e07d6b4d756b5398aad934d9036439e765e62c8cd0fc714c29589e5f01b09

Download Submit
C:\Windows\SysWOW64\Kgfoan32.exe

Filesize
64KB

MD5
5fb760884a6a73a177b0b13b98241072

SHA1
c743c0301e489c4bade31c968c101bc8b8c430ca

SHA256
aaddab82584d07cc463263c978289da67a15bebf358cbb47a4f11d65b8fad414

SHA512
f2505138c26647d8d374557b734c90af4e83ca264530a33d56f2a583f0f6e5274d0c10cd98db35fcced300ff5f4e9498c922e9830ff930719993fa7de5cdd26c

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
64KB

MD5
17119aebb78597ba530ca919c1743f46

SHA1
d7ca4093466f78d46c4b3b7bfb79aefea256920f

SHA256
783437e25cf15158fe9315b6bae90aff6617ee669f0baefb4123a632125ebd83

SHA512
37f45a4e04b55018a997db22f6404fb532b97d6a4ca4c7c63ccdceb77de5062987f5900e3f8d510fe498e82fa223163a602cc9c76e52d4a408c68e8bb99e81ab

Download Submit
C:\Windows\SysWOW64\Kknafn32.exe

Filesize
64KB

MD5
14a876ba243b257ef1a70aec24db7026

SHA1
247cb8c142c104d63edfe848fec919b578f8af9f

SHA256
ea030c7a49c64413c5568caa272d74eaa6e6c026be46b86f6bcb20fc2f41234d

SHA512
19a46418176eb89e8be4c4d9b276b8528824d1f2de71a8f887024e9c2d2af4e6c94dab2f13a7970af2ce2602c6ecaf3468da131c83363aaefb2ad36f1258e442

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
64KB

MD5
6b047a5cbbbc1439025b5d92c0ddc685

SHA1
37867ed0be9f5ed53350142aa7bd9e943963b978

SHA256
6e69ad60be293fbc81b8367c9d3a2d9074dd5c82d61a6c74013455e908e78eff

SHA512
e60ac0c1e7ca16fc3a3753d663e7d5317dbc041c30f8568ec567baadfc3d86e5a49bbde9ba3f176107d678e29a38e002f7bf252bb415cba66f1e720679fd1833

Download Submit
C:\Windows\SysWOW64\Kmlnbi32.exe

Filesize
64KB

MD5
c51a100cc466457e8fdcda098e36fddd

SHA1
23fd9db9452e87ec173dc53c72fcf0a884e331cd

SHA256
63140cd738e0370ccc294eec49a3e8268577e44ced87cfafa88a8310b80207c5

SHA512
6912b5454c4d3b35411353e0bb5c22d409466fcaac7d0930f94cced0d78d15ec5d4ee873bf02f2b14ef2accb3b4836c03dc1ee4695c809e7a3aca8218a2da6a9

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
64KB

MD5
62db1ef4949ffbbfac503ac09377b6c2

SHA1
25c5b26593b6eb95d1fa2f34a3ee6b130ae58364

SHA256
f324be2a35d7a58c739b416b84fecc63866684443540cc9b4ba97219c2ae63c1

SHA512
5ea74092472563b7ff7f6901aa412c3b389d8ed47f08f28500755018aa6a4c76095365f837a024afff903cd4cbef1a901f32b3813d2967e948db92a38245987d

Download Submit
C:\Windows\SysWOW64\Laefdf32.exe

Filesize
64KB

MD5
462fe67cdc83a65d70e5910bf1abed48

SHA1
d825dbe3947fc771420b7fcb9d6c2a7db395976a

SHA256
55d579b54ec4b83d14dc43ea1fed2019241094acda2144f2e4187f77084601dd

SHA512
24df68e8831b5d1a4427aae902147dbee602fd6a81a7ae945b946a31c49750b32290ba1d351313f03015e68da3dbdb287a72c94f49028e5e5ba0ecd16fb1dcb5

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
64KB

MD5
4f739bc0d7d5d648a3d77704263dffc0

SHA1
e65834bb72c863cb993a17775ea8763f4d780488

SHA256
cbd628f8c5e042607c0f1c43d83e24d34e784746c69bf71ae7b4be0b3fa09d0d

SHA512
e797f862ed57deffd3ec7fb7c9af877e45fbdcb8adf38e33cc1d6693b77ebd6f9c2e29372170bf843ab354a1636cd9a0a54cb60c527eec962b1a372e3893f8cd

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
64KB

MD5
3170722e56f6a95008c2a2ed71b21ca6

SHA1
e89f3a6443aa422c31a96d5daad5b238738df7cb

SHA256
576aac894e1ae916b49f1532a61ecb6121ee7b61c991e672ff453779a510b237

SHA512
bb0ba5b0a87324153c642693ebea27c50cab369cdbf41a84a674ef1ea867b44a578852fb9b3d4527ad2d51dd0aee4c703c7d9fb1939b45716f7026de2b1365c4

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
64KB

MD5
577819ce671d2af1e82b01e913655264

SHA1
5460ecee0ab2ae87c0c37f0f77dec2843ed040b4

SHA256
a3bc7118fe7e2b99375e6858da11d4e631f8fc8e41bed4c009bb47e968833306

SHA512
d37b8025835833bbfb8637c586b5f3ca6d146fdcc0bee9916672f715a43dc7a5edc3cdfef6bf0aeb7b03b972c7420a06bf6fb967c80f691aa383c6925b0a3138

Download Submit
C:\Windows\SysWOW64\Ldkojb32.exe

Filesize
64KB

MD5
c70a19c4fe4b0480319bed610faa2fb7

SHA1
9a1c97a0059e202243b0db49a4e644fd992c8348

SHA256
cfa0d64c7425fbbbe20bce6bf5c9ec232fb8ee6db43e2f4eeebd183576094d8a

SHA512
b3733155f64966cceb24fa653b2538f2e3234c19270282177b1097e22fb1d3171aa411fbe375d208a76d64c3ec8c90fd689e27105998233c85c6b43de88c9111

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
64KB

MD5
bd32ceeca8a8d02b8d04f897b6a29178

SHA1
15a55f319ae41e8c363369ad5da38360a1bfd989

SHA256
cd31cb948fe1630b8d2fb9508a49d36cf75da350d51788f4a562b645a71638c3

SHA512
92392a387d9ae3fd22aeaab49272d89b4449792022d30397fc4f7342f5cb0ba4ee5b88cd0e8fba200cef15add3fcfdb6f1d3b5b5f4984c5484a9da0e049fc69e

Download Submit
C:\Windows\SysWOW64\Lgkhlnbn.exe

Filesize
64KB

MD5
5552eadc305e932f15361f679162b7a0

SHA1
6cc3775f7d05f514bfcd6fe604243c5725dbf808

SHA256
2c81830fcdd8006c5e0dd1c1c1bc826aed30b2f992656f6d6860389ae49083d1

SHA512
40b773c3acd5f5e2c06308f23fdfc63b8c1ca888676f15692ace409fc8e91cbb6543107b67f9fd83233d2a56b3d1e216aed791ba0fef6470b1e1920c21edc123

Download Submit
C:\Windows\SysWOW64\Lgneampk.exe

Filesize
64KB

MD5
084a35c4cc4a968d4531d1c63f816cf3

SHA1
75cca17ac7c0ec49579421b96be8a9be42e9e3d8

SHA256
fee6afa2935007c76221292cc0fa5bf8c9492b0bc747c5ce1e6037dedcf07d7d

SHA512
cab6a1b393c47641545d187514494065a1aa5a5a1b17c0618aec3064a5542ee09671af6a7f904dc98448252e9181c29efb1c108e62c40996823fcdc36841682b

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
64KB

MD5
c729df90452f49bd18464435f14231e0

SHA1
98421adad3e21372e3f45c2a1089adfdc9af32bc

SHA256
c190157273fa3c150719d0189aea4c32749485be3aa17a9b0eb9dac5da1da16e

SHA512
220c922a85f138f5b08745b5e52df3ee89183c40fbaf05a6e4da21182c1be7734870eb2e23341c437ceafdc563c23dc1a0c2a2d332683a9358b922031695c743

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
64KB

MD5
07f1150af6a92600f65768c17c402122

SHA1
cc9f84ca7d71c92f391ae80778adaff989b03279

SHA256
cb87407cd292a9c5ecd4af84f89dba4eee12daeed2b3c311b5c3d797a90508bd

SHA512
1e62c3d667a37edd1415d8d729a175b613b6e850fec8ace3e3f735a0251d3037430115ee8d5d444629a02d5377aa435fb2c72ba38c281619fe7698e92438acf5

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
64KB

MD5
f19bf7fb1cd3cdb3adc7db6d1bc3958d

SHA1
21e2953f61e160271a013c5b2ff104b3fe599839

SHA256
ae01243295e0abdeb0f17aebc23ffe8e5448c6a157cd2d2cc07132591dfb6ffa

SHA512
84c271f0a0948d32d59ebe9c8b1ab9d4b2a5445a7fab302c2c4b64ff2d43d81c38ac307f1474d679b5f63b8c1c8143e2fee7aed57afa9d578196c88ee2cd1a5e

Download Submit
C:\Windows\SysWOW64\Lijdhiaa.exe

Filesize
64KB

MD5
18db468819fc053442686e156c14d370

SHA1
7cf792a2c47e734bb11ae24c8744d55a59ffe577

SHA256
6424cdcdbbcce6c5752f5624f0fe1473784f1138de9c2dfa377514d25900992e

SHA512
b5aa6f502bc433fbf459276ac4e18707d695e05823ccd679fd3b80073fe2e599931978d895fd2e3de79f84c7b0c610108a7b7f845147fb46711d120e13b3fb90

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
64KB

MD5
0f26dfb51ae6ef25738a26738d81a8e4

SHA1
11f4f9acee6be583ef22166e55c24f0fed9b676e

SHA256
39da9c65517c54b79c8bafde578749e606c56d3777e58fa0151f754ece3c4b73

SHA512
155b374e835f536a1fd1a9575e4443ea4ed6a437356545781bb8572d3a32d8892a0435d70727707ebc124725ae62f7af369f10b816f399c3698f03324e92a57b

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
64KB

MD5
76d0ff2e9191f5b4959e3d606fd66e7d

SHA1
09537eea7bbd65beb27a540c0bc4c27bfa110224

SHA256
9cb25453c04e1e4e2cf03c49c37e5c59057f41a5dfd68e2269ba1cd0c60ecd8a

SHA512
a3c861a7ad99d18a8c219d98bacb5e20ccdd0ad3a84c4a05cc21fc7949e8de4d640406dd05d4a4fc94e620f9230b407a013bdd64d1664eddcd2cd935c69f0c42

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
64KB

MD5
dc9eea7715633ed66202596dbf9d476a

SHA1
a78451ea9e7ff3dc44d6cc863ca1318ddf22dedc

SHA256
38887dce24716ab8bfa50d99696c95553d9378c10f1a17933dab217c4de6df25

SHA512
854028492f7a382d584ac9d5959773d103695c0a9acf07bd185f1de563634beddf011d2fbdb2b59ee717843aeb80977a9480f5d98b034464d8540160140682c5

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
64KB

MD5
254d60d4234f01a6ef58286305131c80

SHA1
02faff4a78f861b20c598a9e89d48fc8c90cfd6d

SHA256
7b177b9d0d5e4b5d4ff6a08ab486aad031901e8ef5520160c31efe3b43cbd7ce

SHA512
486353ad8dc168221f91704a476529455c312ac18d1664406ad6f827ce6b7402c53bf6e60593dff03c331fa069b200624d3e982f3cd4fdd194fa87123a02c7e3

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
64KB

MD5
b00f9fd26e6de4123211464892445012

SHA1
9ebb0c2a1f15149ab43f08694a28ecfe6594fc19

SHA256
ad8c05f040686f00356aaa975e20796f1bd7822a7833035afa0e9c429e8cf533

SHA512
754a000efdfa2d7b1d995253630e995762628837cb2645fd42116c55e10b491c8d9e363b99a59b445914f6e4c193586a6fb26c28343fb76045cc0b8075a9d1fc

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
64KB

MD5
c487956f8f2d70de8177f7806399a58f

SHA1
77cb44d77ce85fdaef54b874d49fab9602375bd4

SHA256
7914af42fa0b8272fe42a99443d07391a1c1d8bf6ff2caeca3d2835c4c2bbf3a

SHA512
68dc4ec1d8a3861ff40c1f6201bff122868b543eac70bb9d5b403764b8a7ba221a3d71ac870f6b9b69b5f46f2e9f792a0190fb6f999c5581d0e3f1e6a5ffef0a

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
64KB

MD5
e7425c737cf03e82683fcc118177f1e2

SHA1
3ea11aa67ca671b085f41d755e572d06954ab99b

SHA256
95df8b6759586896f671c5297da6a589fa2c46cb565c0ba6c561913860de5654

SHA512
5ccd0934bad33afa82ad0780ef29b50ea5cda54cbd7162f782739eae356abf504b088482d596efba1595a786f2dcfb79fe37c48dc54fae16a6ba2c9139d10855

Download Submit
C:\Windows\SysWOW64\Mjqjih32.exe

Filesize
64KB

MD5
27864b40702b8ce416cfe884e81cae8f

SHA1
a42d62bed7ab9bd969cfc0799cc9d6123c3aca74

SHA256
a4863de84281b80a737ca0b2e5bd1c9cf85117a041b97b3ab7f0ea1326305fd2

SHA512
2f4d3d1e8d0a0792cbc772548ed410e60927d1a6641528098992d682febcad4330ede9f0c3df5b9901ed4203c1641b2f777b74e4d5d15beddb639b52040be5ea

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
64KB

MD5
0aa3dbe5d1ef04b64bf5e8e0cee2957c

SHA1
c1621385566e5d9fcfea6133bb7209628ad64512

SHA256
e95a64515314e83b7b2060cf22d4a88a5cd43d533a16c43e668f90f16a62270c

SHA512
0615f96ba674bea52bd4bad5e0cd082a55342292fd9520c1f2a60cb1fc0e075fab96599d8b98a08ceb44e87441fab1371fa5d8d2cbc83076a18ef839c2fec919

Download Submit
memory/220-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/312-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/312-447-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/388-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/388-434-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/404-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/404-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-483-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/808-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1088-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1088-475-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1556-488-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1556-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1660-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-433-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-452-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-468-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1996-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2024-470-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2024-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2080-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2248-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2248-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2288-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2348-101-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2480-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2480-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2652-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2704-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2704-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2760-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2760-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2772-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2868-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2868-492-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2892-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2892-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3056-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3056-476-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3068-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3068-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3192-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3192-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3344-471-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3344-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3580-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3648-477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3648-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3692-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3692-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3752-445-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3752-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3812-451-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3812-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3848-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3848-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3880-60-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3880-486-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3932-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3932-458-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-482-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4056-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4064-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4064-438-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4080-439-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4080-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4136-462-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4136-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4228-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4228-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4244-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4244-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4304-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-464-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-463-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4628-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4628-446-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-487-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4700-472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4700-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4720-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4752-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4976-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4976-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5044-480-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5044-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-469-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5084-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5084-465-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads