df4699541657cfa3ae46281fb7559547dfb90d203f42df5862998880a61350f3

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df4699541657cfa3ae46281fb7559547dfb90d203f42df5862998880a61350f3.exe
Size

64KB
MD5

35a5c9f4181118b4a4476a18acb7051f
SHA1

40276890e2359b4a4299dd1350df3d359a587afc
SHA256

df4699541657cfa3ae46281fb7559547dfb90d203f42df5862998880a61350f3
SHA512

ab86b3d30f39471044076412470ca6feeef1a09b42a40dcdfc748ae8baf75399c3fbb17768e990bbff8b6bda4ac99a714b3e20d4301646eb282dbab39e96f316
SSDEEP

1536:sxt9dcP+L1+jkDUdY3bNCgPyPOkWy/rPFW2iwTbW:Ut34kEjkDn3bAg8OkXLFW2VTbW

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iakaql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imgkql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmmocpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haggelfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iiibkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpjqhgol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jigollag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fijmbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fijmbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gidphq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmdedo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfljmdjc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpjjod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffggkgmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfhqbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbanme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjepaecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfaloa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpjqhgol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfdida32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Himcoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifhiib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjocgdkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpenfjad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imgkql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfnnlffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icljbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hccglh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haggelfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffekegon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fobiilai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbjhlfhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmoliohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfachc32.exe

Executes dropped EXE 64 IoCs

pid	Process
2068	Fcgoilpj.exe
3700	Ffekegon.exe
2508	Fjqgff32.exe
4600	Fqkocpod.exe
2180	Fbllkh32.exe
2268	Ffggkgmk.exe
2504	Fmapha32.exe
2000	Fqmlhpla.exe
2456	Fckhdk32.exe
3208	Fbnhphbp.exe
2444	Fjepaecb.exe
4788	Fobiilai.exe
3608	Fbqefhpm.exe
4352	Fjhmgeao.exe
4876	Fijmbb32.exe
2380	Gfnnlffc.exe
2196	Gimjhafg.exe
4860	Gbenqg32.exe
1404	Gfqjafdq.exe
4932	Giofnacd.exe
716	Gbgkfg32.exe
4896	Gjocgdkg.exe
5016	Gmmocpjk.exe
3636	Gbjhlfhb.exe
3536	Gidphq32.exe
2940	Gmoliohh.exe
3404	Gcidfi32.exe
3864	Gfhqbe32.exe
2376	Gifmnpnl.exe
520	Gameonno.exe
4340	Hclakimb.exe
3564	Hfjmgdlf.exe
1672	Hmdedo32.exe
5060	Hcnnaikp.exe
1156	Hbanme32.exe
2512	Hfljmdjc.exe
1552	Hmfbjnbp.exe
1824	Hpenfjad.exe
1864	Hbckbepg.exe
4968	Himcoo32.exe
4408	Hadkpm32.exe
1528	Hccglh32.exe
2536	Hfachc32.exe
4816	Hjmoibog.exe
3212	Haggelfd.exe
1464	Hcedaheh.exe
4336	Hjolnb32.exe
2988	Hibljoco.exe
4872	Ipldfi32.exe
4068	Iidipnal.exe
4384	Iakaql32.exe
4252	Ifhiib32.exe
3448	Iannfk32.exe
4924	Icljbg32.exe
4376	Iiibkn32.exe
4420	Iapjlk32.exe
552	Ibagcc32.exe
3412	Ijhodq32.exe
2132	Imgkql32.exe
2788	Idacmfkj.exe
3900	Ibccic32.exe
4216	Iinlemia.exe
4528	Jdcpcf32.exe
1920	Jfaloa32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gedmgfjd.dll	Fbnhphbp.exe
File created	C:\Windows\SysWOW64\Hjolnb32.exe	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Qekdppan.dll	Jidbflcj.exe
File created	C:\Windows\SysWOW64\Ckegia32.dll	Lnhmng32.exe
File opened for modification	C:\Windows\SysWOW64\Gbjhlfhb.exe	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Hfachc32.exe	Hccglh32.exe
File opened for modification	C:\Windows\SysWOW64\Haggelfd.exe	Hjmoibog.exe
File opened for modification	C:\Windows\SysWOW64\Kknafn32.exe	Kaemnhla.exe
File created	C:\Windows\SysWOW64\Pellipfm.dll	Lgikfn32.exe
File opened for modification	C:\Windows\SysWOW64\Lnhmng32.exe	Lkiqbl32.exe
File opened for modification	C:\Windows\SysWOW64\Mgghhlhq.exe	Mnocof32.exe
File created	C:\Windows\SysWOW64\Gddfpk32.dll	Fqkocpod.exe
File created	C:\Windows\SysWOW64\Iapjlk32.exe	Iiibkn32.exe
File created	C:\Windows\SysWOW64\Kilhgk32.exe	Kdopod32.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Bademghm.dll	Fjqgff32.exe
File created	C:\Windows\SysWOW64\Jkageheh.dll	Hadkpm32.exe
File created	C:\Windows\SysWOW64\Qchnlc32.dll	Hccglh32.exe
File created	C:\Windows\SysWOW64\Dendnoah.dll	Iannfk32.exe
File opened for modification	C:\Windows\SysWOW64\Kmgdgjek.exe	Kilhgk32.exe
File created	C:\Windows\SysWOW64\Kgdbkohf.exe	Kpjjod32.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Nafokcol.exe
File created	C:\Windows\SysWOW64\Pmcglkid.dll	Fijmbb32.exe
File opened for modification	C:\Windows\SysWOW64\Icljbg32.exe	Iannfk32.exe
File opened for modification	C:\Windows\SysWOW64\Idacmfkj.exe	Imgkql32.exe
File created	C:\Windows\SysWOW64\Kpmfddnf.exe	Kmnjhioc.exe
File opened for modification	C:\Windows\SysWOW64\Ldkojb32.exe	Lpocjdld.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Gbjhlfhb.exe	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Gameonno.exe	Gifmnpnl.exe
File created	C:\Windows\SysWOW64\Himcoo32.exe	Hbckbepg.exe
File created	C:\Windows\SysWOW64\Mnocof32.exe	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Kkbkamnl.exe	Kpmfddnf.exe
File created	C:\Windows\SysWOW64\Fbnhphbp.exe	Fckhdk32.exe
File opened for modification	C:\Windows\SysWOW64\Fjhmgeao.exe	Fbqefhpm.exe
File opened for modification	C:\Windows\SysWOW64\Gmmocpjk.exe	Gjocgdkg.exe
File created	C:\Windows\SysWOW64\Ibooqjdb.dll	Hbckbepg.exe
File created	C:\Windows\SysWOW64\Iakaql32.exe	Iidipnal.exe
File opened for modification	C:\Windows\SysWOW64\Jidbflcj.exe	Jdhine32.exe
File opened for modification	C:\Windows\SysWOW64\Jfkoeppq.exe	Jpaghf32.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqbl32.exe	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Fqmlhpla.exe	Fmapha32.exe
File created	C:\Windows\SysWOW64\Gfhqbe32.exe	Gcidfi32.exe
File created	C:\Windows\SysWOW64\Kmgdgjek.exe	Kilhgk32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Giofnacd.exe	Gfqjafdq.exe
File created	C:\Windows\SysWOW64\Jdkhlo32.dll	Gifmnpnl.exe
File created	C:\Windows\SysWOW64\Ldooifgl.dll	Hcnnaikp.exe
File created	C:\Windows\SysWOW64\Nkjjij32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Lpfihl32.dll	Iapjlk32.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Ldaeka32.exe
File created	C:\Windows\SysWOW64\Gbenqg32.exe	Gimjhafg.exe
File created	C:\Windows\SysWOW64\Ifegaglc.dll	Gbjhlfhb.exe
File created	C:\Windows\SysWOW64\Jifkeoll.dll	Lpocjdld.exe
File created	C:\Windows\SysWOW64\Lnhmng32.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Bjikbh32.dll	Fqmlhpla.exe
File created	C:\Windows\SysWOW64\Iebapp32.dll	Giofnacd.exe
File created	C:\Windows\SysWOW64\Bekppcpp.dll	Hibljoco.exe
File created	C:\Windows\SysWOW64\Jgiacnii.dll	Iinlemia.exe
File created	C:\Windows\SysWOW64\Kpdobeck.dll	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Ffekegon.exe	Fcgoilpj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4168	6056	WerFault.exe	206

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjmoibog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgblmpji.dll"	Ipldfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jifkeoll.dll"	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lghekack.dll"	Fobiilai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilaidmmo.dll"	Gimjhafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjjod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diefokle.dll"	Gcidfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iinlemia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaljgidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iblilb32.dll"	Fjepaecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifegaglc.dll"	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfjmgdlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkbhbe32.dll"	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfkoeppq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kknafn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdgohg32.dll"	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmcglkid.dll"	Fijmbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdjfcecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pellipfm.dll"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfnnlffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgengpmj.dll"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gddfpk32.dll"	Fqkocpod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fobiilai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kilhgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgcomh32.dll"	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Giofnacd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Giofnacd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdkhlo32.dll"	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggcjqj32.dll"	Jfaloa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjhmgeao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaimbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Peeafpaf.dll"	Gbenqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icljbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egqcbapl.dll"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpenfjad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iapjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiphogop.dll"	Idacmfkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hadkpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnjdmn32.dll"	Kmnjhioc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 2068	3632	df4699541657cfa3ae46281fb7559547dfb90d203f42df5862998880a61350f3.exe	83
PID 3632 wrote to memory of 2068	3632	df4699541657cfa3ae46281fb7559547dfb90d203f42df5862998880a61350f3.exe	83
PID 3632 wrote to memory of 2068	3632	df4699541657cfa3ae46281fb7559547dfb90d203f42df5862998880a61350f3.exe	83
PID 2068 wrote to memory of 3700	2068	Fcgoilpj.exe	84
PID 2068 wrote to memory of 3700	2068	Fcgoilpj.exe	84
PID 2068 wrote to memory of 3700	2068	Fcgoilpj.exe	84
PID 3700 wrote to memory of 2508	3700	Ffekegon.exe	85
PID 3700 wrote to memory of 2508	3700	Ffekegon.exe	85
PID 3700 wrote to memory of 2508	3700	Ffekegon.exe	85
PID 2508 wrote to memory of 4600	2508	Fjqgff32.exe	86
PID 2508 wrote to memory of 4600	2508	Fjqgff32.exe	86
PID 2508 wrote to memory of 4600	2508	Fjqgff32.exe	86
PID 4600 wrote to memory of 2180	4600	Fqkocpod.exe	87
PID 4600 wrote to memory of 2180	4600	Fqkocpod.exe	87
PID 4600 wrote to memory of 2180	4600	Fqkocpod.exe	87
PID 2180 wrote to memory of 2268	2180	Fbllkh32.exe	88
PID 2180 wrote to memory of 2268	2180	Fbllkh32.exe	88
PID 2180 wrote to memory of 2268	2180	Fbllkh32.exe	88
PID 2268 wrote to memory of 2504	2268	Ffggkgmk.exe	89
PID 2268 wrote to memory of 2504	2268	Ffggkgmk.exe	89
PID 2268 wrote to memory of 2504	2268	Ffggkgmk.exe	89
PID 2504 wrote to memory of 2000	2504	Fmapha32.exe	90
PID 2504 wrote to memory of 2000	2504	Fmapha32.exe	90
PID 2504 wrote to memory of 2000	2504	Fmapha32.exe	90
PID 2000 wrote to memory of 2456	2000	Fqmlhpla.exe	91
PID 2000 wrote to memory of 2456	2000	Fqmlhpla.exe	91
PID 2000 wrote to memory of 2456	2000	Fqmlhpla.exe	91
PID 2456 wrote to memory of 3208	2456	Fckhdk32.exe	93
PID 2456 wrote to memory of 3208	2456	Fckhdk32.exe	93
PID 2456 wrote to memory of 3208	2456	Fckhdk32.exe	93
PID 3208 wrote to memory of 2444	3208	Fbnhphbp.exe	94
PID 3208 wrote to memory of 2444	3208	Fbnhphbp.exe	94
PID 3208 wrote to memory of 2444	3208	Fbnhphbp.exe	94
PID 2444 wrote to memory of 4788	2444	Fjepaecb.exe	95
PID 2444 wrote to memory of 4788	2444	Fjepaecb.exe	95
PID 2444 wrote to memory of 4788	2444	Fjepaecb.exe	95
PID 4788 wrote to memory of 3608	4788	Fobiilai.exe	96
PID 4788 wrote to memory of 3608	4788	Fobiilai.exe	96
PID 4788 wrote to memory of 3608	4788	Fobiilai.exe	96
PID 3608 wrote to memory of 4352	3608	Fbqefhpm.exe	98
PID 3608 wrote to memory of 4352	3608	Fbqefhpm.exe	98
PID 3608 wrote to memory of 4352	3608	Fbqefhpm.exe	98
PID 4352 wrote to memory of 4876	4352	Fjhmgeao.exe	99
PID 4352 wrote to memory of 4876	4352	Fjhmgeao.exe	99
PID 4352 wrote to memory of 4876	4352	Fjhmgeao.exe	99
PID 4876 wrote to memory of 2380	4876	Fijmbb32.exe	100
PID 4876 wrote to memory of 2380	4876	Fijmbb32.exe	100
PID 4876 wrote to memory of 2380	4876	Fijmbb32.exe	100
PID 2380 wrote to memory of 2196	2380	Gfnnlffc.exe	101
PID 2380 wrote to memory of 2196	2380	Gfnnlffc.exe	101
PID 2380 wrote to memory of 2196	2380	Gfnnlffc.exe	101
PID 2196 wrote to memory of 4860	2196	Gimjhafg.exe	103
PID 2196 wrote to memory of 4860	2196	Gimjhafg.exe	103
PID 2196 wrote to memory of 4860	2196	Gimjhafg.exe	103
PID 4860 wrote to memory of 1404	4860	Gbenqg32.exe	104
PID 4860 wrote to memory of 1404	4860	Gbenqg32.exe	104
PID 4860 wrote to memory of 1404	4860	Gbenqg32.exe	104
PID 1404 wrote to memory of 4932	1404	Gfqjafdq.exe	105
PID 1404 wrote to memory of 4932	1404	Gfqjafdq.exe	105
PID 1404 wrote to memory of 4932	1404	Gfqjafdq.exe	105
PID 4932 wrote to memory of 716	4932	Giofnacd.exe	106
PID 4932 wrote to memory of 716	4932	Giofnacd.exe	106
PID 4932 wrote to memory of 716	4932	Giofnacd.exe	106
PID 716 wrote to memory of 4896	716	Gbgkfg32.exe	107

C:\Users\Admin\AppData\Local\Temp\df4699541657cfa3ae46281fb7559547dfb90d203f42df5862998880a61350f3.exe
"C:\Users\Admin\AppData\Local\Temp\df4699541657cfa3ae46281fb7559547dfb90d203f42df5862998880a61350f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\Fcgoilpj.exe
  C:\Windows\system32\Fcgoilpj.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\Ffekegon.exe
    C:\Windows\system32\Ffekegon.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\SysWOW64\Fjqgff32.exe
      C:\Windows\system32\Fjqgff32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
      - C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4896
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5016
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3636
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3404
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3864
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2376
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        31⤵
        Executes dropped EXE
        
        PID:520
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        32⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3564
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5060
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        38⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1824
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1528
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4816
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        48⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2988
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4872
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4068
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3448
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4376
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:552
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3412
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2132
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        62⤵
        Executes dropped EXE
        
        PID:3900
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1920
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        66⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3460
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3592
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        69⤵
        Modifies registry class
        
        PID:1980
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        70⤵
        Drops file in System32 directory
        
        PID:1568
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5116
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        72⤵
        Modifies registry class
        
        PID:4032
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        73⤵
        Modifies registry class
        
        PID:4344
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1408
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        76⤵
        Modifies registry class
        
        PID:3572
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4708
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        78⤵
        Drops file in System32 directory
        
        PID:4704
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1852
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5008
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        82⤵
        Drops file in System32 directory
        
        PID:4620
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        83⤵
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        85⤵
        Modifies registry class
        
        PID:1396
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1176
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4136
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3384
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1696
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1660
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2116
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2660
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        96⤵
        Drops file in System32 directory
        
        PID:2296
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:776
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        98⤵
        Drops file in System32 directory
        
        PID:2332
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        100⤵
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        102⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        105⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        106⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        107⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5440
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        109⤵
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        111⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        112⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        114⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        116⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        121⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        122⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 220
        123⤵
        Program crash
        
        PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6056 -ip 6056
1⤵
PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Fbllkh32.exe

Filesize
64KB

MD5
9a48a355e4e34951b3cef5b5e48eb821

SHA1
85c85cb4e6c0bb63bcb5526da52935f6fb06df20

SHA256
e971176f9a405577b1a2648bb994d15da7d51de806c31b21abaeee243bb002b9

SHA512
b3f2a536cf1639d823a0fc3e810e6d8582311f37f51be6dae16d274f118a842480dba9b1f2acc0dd363e676928d367c689211ff857f2a5cc7edf73a04178fae3

Download Submit
C:\Windows\SysWOW64\Fbnhphbp.exe

Filesize
64KB

MD5
658ebe3941caa44956a8166c93130a7b

SHA1
ed513517c8ae97a22a9cb33a20dc159d8111f748

SHA256
9b09b86ffe0143dc6fc76a2dd20ca8b3a53c01f85cb71fd72011073b9639f670

SHA512
92c9f1a237c6109b45ff2797cfcb22f30bf411594596fc221dfb09e50d42aecf7a49d11903872ffbf2ffd5a2cc80b8578ef64010332805d098281ea889eee313

Download Submit
C:\Windows\SysWOW64\Fbqefhpm.exe

Filesize
64KB

MD5
81728c9aa517b516e460738296b637b2

SHA1
944e3b4eff1890393770cc3ca926b4edf6732ec7

SHA256
809715f2bbb9732f4269ee8998671e851da0136b9980c7ae7484b7eb183dcffe

SHA512
6b1523fa0310522d8ad7e25d93ac249102cfaff86151ca2199dddd5f95cf130f8022e37947c83506301085e448abeb2019fc858f7554d3095cb4454a3e785f85

Download Submit
C:\Windows\SysWOW64\Fcgoilpj.exe

Filesize
64KB

MD5
aaa329fea0a95e12563d88a544f0f02a

SHA1
ea18ba85c7aa31c92e6e4dc00a639746a0e44135

SHA256
61bf10f929ea9d668d1d263318d4d5e21ecf89fda7c4cafc4f6d4a2363f3d083

SHA512
32e3b751e15ea278c0a10b118bf2bb95d52198062cd7a7ada2fd5ab2dc8b5e52bb4f3e0b3970866dbbf99ca0fa2ee025d356cc9636fd90845ac55e5877101686

Download Submit
C:\Windows\SysWOW64\Fckhdk32.exe

Filesize
64KB

MD5
c9638f5a01097f312306a4acf1ac05b6

SHA1
e3e301a6e6e22701717c3a163a00546dd4c35d2f

SHA256
e60a8b9a2524f08d078858902bf3f71175cf806f907b6fbb8f247431725065e6

SHA512
07cabafb4476fb9863f64d2c0b2f0c83329275a165ab0b5ac058939849864fe997ddb3cbb771f7601b857ac92a1098e16cbe307ee3a236d695d5e9abd2b40942

Download Submit
C:\Windows\SysWOW64\Ffekegon.exe

Filesize
64KB

MD5
47bb87e5bc8557fbe60fd478e0431bda

SHA1
79f0edeb65744967506299e4836fe9dff1f29171

SHA256
c75d407b1397c29b0c42ccb8c4cdf1f176169f4035d486cc268ef5e606ce4fcb

SHA512
5d00c2f112a7eca0650ed1b068233173a0c69a7526cb2eba962830768ea8e48123e7d4ec9a5cc9b5e7f3f3847c7abfbedde3405cb113bf3aae8d0ced5d0c4097

Download Submit
C:\Windows\SysWOW64\Ffggkgmk.exe

Filesize
64KB

MD5
6ace1490c0722ee0f4d5f63d9b89d282

SHA1
a341b12fe74ef180926fb9e9b6a24f7ef771bf36

SHA256
c9c05072243b4becfba79df0099bb4cf6e1e4f21421db5029346160c6023f4cc

SHA512
ac17469486d2a3eb105f744c29027edc6cd7e5134f253d6a60930f19147e61d06b18adcd0468dbc8ce67ad962fa1fa7d0230af2fa38bedf3111b46ad57fea2e2

Download Submit
C:\Windows\SysWOW64\Fijmbb32.exe

Filesize
64KB

MD5
3470ac5e3071b20399c16e63c994ffef

SHA1
af85830ff2d49d8896fb1c4239274f56214a7439

SHA256
77ef49333bb9ba0c0b792fad91cbdd78e4bfbf26d9dee9852d2e52b123fb86aa

SHA512
34100293ac4c40e66aad2217a3151e9475c95babc5cc71e6ea8bbf6a6161608e3ff48fd087db630c532680add9d2cb6d99a0c3b49d12a0d7fe741ca0f765901d

Download Submit
C:\Windows\SysWOW64\Fjepaecb.exe

Filesize
64KB

MD5
388164fd185141640c2346aa0b84169f

SHA1
4cbce1d9474563aacbb9fa3425a074e588553c30

SHA256
04fbb420515712f2f47d773df855cd4ea143811b996d1bb004254a1e46ec177c

SHA512
8a63f46e0844e30cc31be60347cd85e8e32e11e0e1aabf45c5f8d44aa60eaec85f1d90a7f3f2a68ac36ea93c0d5641e820aa57485c76480167dde7a30920afe5

Download Submit
C:\Windows\SysWOW64\Fjhmgeao.exe

Filesize
64KB

MD5
9f963cb5c2c17f570fd7aebbdb584131

SHA1
6421cebc425560b8f1ebe18777e92017892bdeb7

SHA256
d78b23a22da78aa5032d6d7e5b3606e2a307de47bd69731b6573cce6bf13dc1b

SHA512
632735734662a11b46aa48df8e347005e31e436b4c88604853e523ca4f3f47507eaa448b017cb5b2d4d35d31169a0d19633e26665ee09f7bc52211a21061845e

Download Submit
C:\Windows\SysWOW64\Fjqgff32.exe

Filesize
64KB

MD5
3872c6b28baf0dec28f6f9df9c017f3e

SHA1
f357327a36f1c5ddb78c5398584a2003c3ded361

SHA256
428cf74df8e06e7bae27ffdc1b36411c4613b03d16eaddd9d6b3166a024642dc

SHA512
47a56b243c7def09ee1d37f87919c96c13d1fe264c17386300890f3ae1d60075f20fdb7a5ed2771b2d57420e9b9f0a34b8b2185f8e355770b11e61f66b587054

Download Submit
C:\Windows\SysWOW64\Fmapha32.exe

Filesize
64KB

MD5
9feba749df8bb2d279b65d484ecbf350

SHA1
96aacc284301e12adcc1c02636458628329a92bf

SHA256
ca14af399f65fbb2085aa08f292c91b8e90e082af613c0b21ed1b05e71cd56ed

SHA512
e43f8d241d1d79fa26b10a319be055661a9bc5a6266399850c29122649a96dc697a82b2dd4ff47ae5fdca8ef2a947d0c23dd1e3b5b1d3742bcd1eead4c4a6d76

Download Submit
C:\Windows\SysWOW64\Fobiilai.exe

Filesize
64KB

MD5
898ca00e0c75cde72a7e5733f73f7ae5

SHA1
a43bbd1b6de3f7fa28b5c509f834fecd4c3c6a81

SHA256
a03202ac5e455cfa60a89dae2de6b0784387aebf3a9232cf614c969c3454ddb1

SHA512
034079b93e7a91b10cb9ff25a789094cf7b475b584a1d6a4a3c88612fea5dff0540392c71669b10caf4e338af6ac11563a2b8d057fb493931006bed94136c98a

Download Submit
C:\Windows\SysWOW64\Fqkocpod.exe

Filesize
64KB

MD5
1808ebbdaaf166c191b73441058f3ac7

SHA1
0535a0f0b8c29237d766b51da51b051fb1926a45

SHA256
01f5fc76c6739ed9cd8e05281f9588c584ac7cc3984bf2ac0c813f1a0977ab6c

SHA512
2125f36f6296e358950737c7a0925183d9f80b495004cac3d38a5d31b6c2ac3b4acfc18b8b326e80e3dc409de05d3f02a8fdd5e77fa348e6d03e7183db3fcf8a

Download Submit
C:\Windows\SysWOW64\Fqmlhpla.exe

Filesize
64KB

MD5
9170facc000bea1fa3b18c76b61c51b6

SHA1
6c7a3f0941a5fd82965caef1721c42706449fa3e

SHA256
c1d8a1de81d8fff4f04085792f612d19f6c61c320cddaa1ff1876ff70e716f39

SHA512
8e6068e3f757d93e037a2a25ea07ee0be6ec68c3161cf874d484658e3a65fb54916321ad880e69234284434e54d2ccc14c32ca175b6707f0540d41469cb7f41b

Download Submit
C:\Windows\SysWOW64\Gameonno.exe

Filesize
64KB

MD5
af1266a226d76d7a315f3a115ff595f1

SHA1
f0fdc45e669af5ad8e7bfe4cbecb4880e429eeed

SHA256
aefdb5f7b3a14b222c6e2797148f8271467cd9e07a1e57885afb34b0ddfc2f91

SHA512
f9e6050b1a87b52d0d2cc47203c4a1ff89673a3f6845be9fc65e75d44af621b0bc8b5cf642d6b0f371ed9b8c978d210d3d1f4cee7580ac15bb6028e827d2d1e2

Download Submit
C:\Windows\SysWOW64\Gbenqg32.exe

Filesize
64KB

MD5
4045ca8a7b9bc399745de9e2be34e858

SHA1
9f11cdfc11cd5fff8c33dfa776d3205c399b4eee

SHA256
3139b66718e2c000cfffba818f73849f6fdcd9c3c0dae660be3960afa698c93d

SHA512
312fb18c803a654195b39d3331a5807a766def316b36c3896cf4a0bdd63e1446d1219448cc57deb3813b75be7c61bd7996a7445b1ec069a04c80b6425adcdc86

Download Submit
C:\Windows\SysWOW64\Gbgkfg32.exe

Filesize
64KB

MD5
6f692ff4ac284b4b45dfc0006fc67cc5

SHA1
c31baec958b6a61f4043b4fa919b3a470ef86817

SHA256
988becf1988008f367ad19a3f24576996e1fce8d9f668bd181edff66d97d32fd

SHA512
269cfb426c1617f40886faa726827490945e13446cdbc1a0a6c6a2bd245e067e9ed5be5336de9907bd777de85838d385fe861ac780a7cc6097953b0659b67337

Download Submit
C:\Windows\SysWOW64\Gbjhlfhb.exe

Filesize
64KB

MD5
a719dbaabb138788484d01385ab394ec

SHA1
d1dcf72932a3fe3caeb18423ac2a697622d990be

SHA256
c28414b88b9a6f60a3fcec149ce8ff81a5a194537365ead98224d78a0b972601

SHA512
5f0c6c93d24acf80432f640a7de0052662bbbf489f50da1db13da4b980c86cf793c8af806ad87ccf876ac53edde751d5a92ce84f3bab4af0aa52e42c1c1735b4

Download Submit
C:\Windows\SysWOW64\Gcidfi32.exe

Filesize
64KB

MD5
375b62864eb5c9ef6aef8e0002b907e2

SHA1
0d84a000dc5e10d2e66a179fd34c3ff983f75aa8

SHA256
c2b83028d76a39f7148ca5c39db4a4a9472d674a06a1e2f29936bfd4faec5f30

SHA512
c7b9584f65aedbf2104bbcae9c10a75573e6fa6088de3f5540b90b8d168efa3dc876103590d142ca566ba53d97f7d17a7c1fc0b02e77a209268301697de27f5b

Download Submit
C:\Windows\SysWOW64\Gfhqbe32.exe

Filesize
64KB

MD5
99b4621855fbc66a329b749a65326af6

SHA1
7d2793d2730ef5929e959dc841223c2f65249536

SHA256
b252ec2184e246fbfe1fb8d6308a16efd93c1658007aefb1bb4d5bedb51e9fb3

SHA512
50111fd72ab4476ccd4905a35becc5a5a4be2e95801c18ca8560679ff8a133f2fa856493b54dad5f64b19e84194d5b620c6eb5409d0b5a5e5e1e7db4644e8bfe

Download Submit
C:\Windows\SysWOW64\Gfnnlffc.exe

Filesize
64KB

MD5
fa279ee866c50df6591c570c60aa441e

SHA1
b15459f7b5929e21ae11043608359532442c6a8c

SHA256
6faad55f7568dc0287f799ba112d9eae9da66132e63044376c8ad91a89fef2d6

SHA512
6de3c55f3e4d69554f47137a6db864b97218da946de0d959fda20376b0c13d1173832841b9acdccd79f98d5e18d33be250736f3b538c73efa2e4d4adbd2fdeb9

Download Submit
C:\Windows\SysWOW64\Gfqjafdq.exe

Filesize
64KB

MD5
45d8d78dc5d5d018836a290315365c17

SHA1
66f529f57859ae68914394e1185af56fa2d75f8c

SHA256
8124e9401566d885b2d7652a7da12ec534098efbd87646e1aa7a652c93be1429

SHA512
ebbfca6bd9e743c5f6baae8a6fcd0eb7a3a507ab4e56607ac04dff0f2d7fda71f8f43e118cb807526bf63d06c12079bf6b66730557d73fc506ee0d0058c6554f

Download Submit
C:\Windows\SysWOW64\Gidphq32.exe

Filesize
64KB

MD5
4b4219fece20e243d6598551acc216ef

SHA1
7949d05398d04e58fe299a79e4d85a9a6b7ed55c

SHA256
59bf74c44ccc5abbd13f66929498b8869356b24c724dcef66a15518bc1e4832f

SHA512
4e6b001e221a093993c2fe1fa09b8b0d4c91297848b079844959350423660b706f8422444308406a48a7489805a5c4432dbb15334cfba036686d89be54837d34

Download Submit
C:\Windows\SysWOW64\Gifmnpnl.exe

Filesize
64KB

MD5
85c47107dff441b3e0911a3dbaac2fab

SHA1
076c8e44ec820f3dc920ee13ac5356c3ade27f1e

SHA256
39cd2161d13244a1f97d57fbe341875ec9ca1baab5ab61fc1845aa25830b03e4

SHA512
3e3c6c6008daa3fecfcab0bf88539cf8eff04f49c95000d59d23d870bdf96e47a8c7efa2122a50df01852964eb85bd1990f0d9480c661b223cbc41beca8113b6

Download Submit
C:\Windows\SysWOW64\Gimjhafg.exe

Filesize
64KB

MD5
f982f81bd834c61c3d08164125cfabc6

SHA1
55820e2d74a40c583edc85e3165dd12202483e22

SHA256
3f5743ab5ec17a23dc2084669de502ff536fe17619e2835f4624be98000d6eb0

SHA512
217c8318bc3ae56ace3c944cc94bd79dc07c4dafeea51c0c033b92a661e578e9fdfb67c16651443e9fbfda0e5c1679e3407a29dea85d43f1d8b786b71f0e049f

Download Submit
C:\Windows\SysWOW64\Giofnacd.exe

Filesize
64KB

MD5
53b0fc807a49eb90159efacf60ad7a37

SHA1
3a46aa2cd5354e6735b9dfd0798d85005b71aae6

SHA256
5555bfe51d969c7d04c5887a671fde92583aa6835ea9430f4392c88dd30f2c3d

SHA512
42654486596730d2a68d55411d5767721cc13b98dddd839bbc26cedd92ab45f4085df01fb5561aec5aa1f7650ccc63a161d8de6c7a808c87ef96c9a4e5d9a343

Download Submit
C:\Windows\SysWOW64\Gjocgdkg.exe

Filesize
64KB

MD5
fef1eabe58d73af4b641813e9a0ba16c

SHA1
d1a60a95fc04495d65b63ae61b9ba505fb8417dd

SHA256
9b268ce3c65312516efd1a3256d6c326d77068dc1d82dd84ef20d51d8cd9ec64

SHA512
bf21720bf7ce22622c2d9e1158ec7695ed6fc565ce0e3fe5c01c1073cc92669e9a5326ea4cdb9babf2ab437e4eddc8695c9bff9a6bd0ee07535471dc10d3eec9

Download Submit
C:\Windows\SysWOW64\Gmmocpjk.exe

Filesize
64KB

MD5
28f512283ca717cabe05ff4b015a9ecc

SHA1
dfe47a7ad0da8cd471d10856bd34b8b178040d5b

SHA256
890d9f9f7a96a21d3e9d378863d2989d3ebc76d8134d7388a46197185b1635f6

SHA512
12aa8cf7bf65e3dadc21c2fab36215bbc1e3c00c54adbc2af3c5549ed804e7748e9af84a176c023cda82deccf82e00664a69579b7eb739ca5d4c123dc63a64e8

Download Submit
C:\Windows\SysWOW64\Gmoliohh.exe

Filesize
64KB

MD5
bb869129226a7b0fe300bf9f0d1b160c

SHA1
a951e992e86d78250572bb551583884a0726e650

SHA256
85fd4e61d11cb4330ecb41f7efb2f6240bf85558f6683bb84a7c49da039e4443

SHA512
86f2def01274d52c746ef92de932268c2b6f73fa5667ac18cbcb37f8ad307690f6067c3e827fb5acd09c86d5f0edf8cce54ff7d6fe8f6864a1c7d92c15424332

Download Submit
C:\Windows\SysWOW64\Haggelfd.exe

Filesize
64KB

MD5
7d9ec4a4665ea84ced312c0d92cbbaa6

SHA1
d9eda17070f0500bb6786f18e2ec4c3d31655bba

SHA256
16f07863fd1da77be7972fed813d6441c372ef52d9c7d1c1b68b78b7c8fbd383

SHA512
c3d016b005ecea37533934fe386c6600491243fe2fa8a6c68a7b114f1c1d185e90951ea89566487800d3d6a1aefcec2eb398b4adb550e23158250caca5ed2e76

Download Submit
C:\Windows\SysWOW64\Hclakimb.exe

Filesize
64KB

MD5
c767f332b4df8b79b3f8417012331201

SHA1
6004c42198a615470d60127a42551103d24f86a3

SHA256
85d80ab25ce821acca0854d842a631f9b7e8c6522b46981962589d1b4c4e3ca4

SHA512
fbbe65820bbdb4bba169f6a485524925ebf9b271882b2ab68d0e81ede68e8244608642b2a829e94ccb893dce4da312401ccaf8b537d19dca48b6a414862e80c9

Download Submit
C:\Windows\SysWOW64\Hfjmgdlf.exe

Filesize
64KB

MD5
3323e4b41f4d9925016b982f1bbf7ae9

SHA1
12569953cefb478cfc03b645b2783948de922cb9

SHA256
6d4ab828d6fae0462dff02b79bc590dafa7d8a2951aabed42a56d4f34d7d251f

SHA512
75bf468aae075a89a4984aa7d2e18d00d539eeb14b812b1c56a45051413186e5685b1f147dfe30c572eb5c6529e5a6fdf877b662cf91096157b0f2415790a529

Download Submit
C:\Windows\SysWOW64\Iannfk32.exe

Filesize
64KB

MD5
81f1881aeef7707af22c6f0c6863195e

SHA1
066b58e29f92fbb5fd74738c962d94f460d59ad4

SHA256
2d475b35a2bfa814b8caf335dcdd6521d2854234916c0d2448435ef00c578728

SHA512
e8762dcc947161404f10ed882e630193faba29dbf7501ee8bc6c2d065951fdbae3f9d1d7bac1482b30227fcc2d12071b694e7486e760933e5af18f4e6ffb654f

Download Submit
C:\Windows\SysWOW64\Ibccic32.exe

Filesize
64KB

MD5
0275cad102faa2aa4deffbe93f411447

SHA1
c5326ad9bf0094a2964aa45de1d6d6694dca3afa

SHA256
0a68f5c7f7473b77b2d88b09b45bae3d8178e626d4bddd0c48e3e313d7ada93d

SHA512
2df6fe0e16a97155a3057af51faaaee9bdbcd7bf3499490df2e506d4d78530fc116894ee7c3a3262f62a4ca9792b3fcb5e2495f865643c6ec87011c569a4c1e1

Download Submit
C:\Windows\SysWOW64\Jaljgidl.exe

Filesize
64KB

MD5
628a5491b6905fa2055af4f2767ee8d0

SHA1
3f61946ea5a74392648f9b498420535495d701d3

SHA256
5855e2dbe5174f34d3cbe65543787d2107b5190f9ac2c7d3b7739f5d204014d6

SHA512
a1db774dd312336181900d69ec644cd63f7a5dcba4193319b48ee26564835cb0d91db170b8d54a14aa7b6faceac56e5cc4abd671d8c63ad220aa5bcdc7b9501d

Download Submit
C:\Windows\SysWOW64\Jdcpcf32.exe

Filesize
64KB

MD5
c3b8d15692b17fe8a2f586b6250f07a5

SHA1
678dc841dbaa83928ae440968752ed06d4a4d9bd

SHA256
1447535b25b69f3bc46997f875cafd9ce287f0f0934c42bbbf89170510adaf66

SHA512
68485ac3bdad5cc43e308e5faeaa77b111666f24678ebb7a85f0b2a39bda092b8c6b2405b1917c493efffdc3f881df8523a52370c4bd62068fb4439f09c2ba4d

Download Submit
C:\Windows\SysWOW64\Jfdida32.exe

Filesize
64KB

MD5
9667ad34c9c9886087642d386f6b7bf1

SHA1
9e6831cc2b1bf935e178d0d85e4960152a56d698

SHA256
869b400af6be15b868e911d9c6923f55b7e076990174287a8ac4f86997a837aa

SHA512
0b045e24c3073d71cba9f55908bcc8075233db506814a430dfae5b669d4ae47596f102addc2086b8e167343afe52a39c9b0973a905f40ba6db540cc9cabe6492

Download Submit
C:\Windows\SysWOW64\Kgphpo32.exe

Filesize
64KB

MD5
39ed3b01985ba20e6da55a95d9aa7b40

SHA1
864dd0ce075cc9106a8ff26754fadf4e5fd526db

SHA256
5e864ba4b0bf6b4ed0b7a5d52c793e8ea29bc4503194041d5284e1a11bfc3b68

SHA512
bb342636c2f76b16ca5ca85f1ccb9e56f72b0f8a3ea166585a4b0d67b28beace134335cc4d1d6d4aeff4b5938a91c331a273ecc67e12335ce43e49e628a96314

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
64KB

MD5
9240e664041c0ba7e861b52e122a4f01

SHA1
f3dae2e82d6ec75e6323fb67103dcba3d86a3139

SHA256
e19740fe59ee49b405ce5d5b15758fd866cd6baf2c2a0defff1126cc56d68b59

SHA512
379e20ee1bdc1edb70bd57a43f8d764318b98ae1f3a08423942f8de602306fdce296ca9d22d5a24af734ccf424ab83cdb068d61e5b0808f4e5352bdd80ad5b08

Download Submit
C:\Windows\SysWOW64\Lnepih32.exe

Filesize
64KB

MD5
83e914dc78e33cfe140ee8f793338d3e

SHA1
fddb243dec64f9e0a238b26693d35a6cea706475

SHA256
5e9323cfad7e25cde6f783068459199611292d73a4e4273760f46fd935095eab

SHA512
b2348b6d09c3be5576031a08d624c56ff5b8c213049e4f545fdc7432a52321c2a4b63e87b17f00464d6a2e7d8086edccfe7d829c06584d337ffa03442ee07830

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
64KB

MD5
e88c2d67b9dc4ffc76fd08c063c34ca5

SHA1
e78d5c57ca277d8dfe40b28e0f59b93715e847f6

SHA256
74dc6035b1572a208aac37474da5f8351e65f25e366a660acbbaf23a3ea5f201

SHA512
e2ff69eb26cb249d5c1b7fd568f4a5ab9675dd1bc6391fa3c34023b5a61dd0b3106617f903ee23e1b2b38280e4f639366e4d7d1276beba249e1cecfcaa063f2a

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
64KB

MD5
b4727ac6f66c17ac62f39886e5dc4bb9

SHA1
352cb636d19095e37b5a61257f2f79c441b99675

SHA256
3a675976e832d10dbac8285abb2a9d783bd7755e84755dc13f927dfaf9ec78fa

SHA512
681d303e393150cf3175e1e10c01f22d8981619171058527096ddf3506e82bb2f0eab5d461ed36ebc1a35981d83a4bf74acc77e24f2b2bea406465d380c9fcb6

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
64KB

MD5
1186120104ce50198dd043d1c80c7b81

SHA1
1bd79f12c01cdd5ae82b21a7419bcb53637c98cb

SHA256
d7c600c452564bb12a7a5211c8c40453d4d4f9f58209ad5c45f97fde2647edcc

SHA512
14b493766530841f4372a9ecd305094a1cdd2165eba7f295ef88ffd317be706857536f7d274789f76327ad63deae62f60aaf6b0064703376cee7857e21c29342

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
64KB

MD5
b6846e38a40d75c511d2afef1c115b74

SHA1
6247048f927fc11cda3bb461d67bad256a7b2add

SHA256
578d83b9d4b1b5708ec446071e14263edb05bc581f6310906b31b383e5929548

SHA512
e197cabba0c723289bd3bb88c503d3e5961a0931fe923103625beb7ca2e0901346edda1625e0ed4c2aad565ab0908768809b1c99d2b34d3923d0373f72d23db5

Download Submit
memory/520-261-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/552-440-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/716-179-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/716-265-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1156-298-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1404-165-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1464-433-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1464-367-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-341-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-405-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1552-313-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1672-281-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1672-347-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1824-379-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1824-318-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1864-386-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1864-321-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2000-155-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2000-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2068-89-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2068-12-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2132-454-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2180-123-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2180-40-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2196-231-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2196-142-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2268-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2268-47-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2376-252-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2380-221-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2380-134-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2444-178-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2444-90-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2456-164-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2456-72-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2504-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2504-141-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2508-106-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2508-28-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2512-366-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2512-301-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2536-348-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2536-412-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2940-300-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2940-222-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2988-446-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2988-380-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3208-85-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3208-168-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3212-360-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3212-426-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3404-232-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3404-311-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3412-447-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3448-413-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3536-218-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3564-340-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3564-273-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3608-196-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3608-111-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3632-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3632-80-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3636-291-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3636-205-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3700-20-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3864-239-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3864-317-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4068-397-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4252-406-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4336-377-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4340-266-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4340-337-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4352-120-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4376-427-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4384-399-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4408-339-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4420-434-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4600-32-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4600-119-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4788-98-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4788-191-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4816-419-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4816-354-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4860-156-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4872-387-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4872-453-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4876-124-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4876-217-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4896-192-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4924-420-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4932-260-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4932-170-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4968-331-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5016-197-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5016-280-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5060-292-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads