njrat | c4dba6c89d8b239df92af6a7627113beb23ba98eb823b1fb5c8911272aab6dbe

Analysis

max time kernel
137s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4dba6c89d8b239df92af6a7627113beb23ba98eb823b1fb5c8911272aab6dbe.exe
Size 337KB
Sample240504-c6f4taec47
SHA256 c4dba6c89d8b239df92af6a7627113beb23ba98eb823b1fb5c8911272aab6dbe
MD5 5734fb80014a20b937f2d17c157eaa78
SHA1 78c82c278c316e7f0b3ff0516603089763683509
SHA512 04e6536c4a7eed712cf4ace7266d823d09dcb3ad877464bb4f513aafdda14aabc1b99ce904f35cf6fcaefd1efa4a2335789961653fad5e9e710a1946b61d85de
SSDEEP 3072:JodrDMwWgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:JyrAwW1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Goiojk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iidipnal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhdmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibccic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbanme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icljbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaedgjjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmnaakne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdopod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqkhjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haidklda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbkjjblm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iffmccbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iiffen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iabgaklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icjmmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kagichjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjfihc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfhbppbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjocgdkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibmmhdhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcbnejem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqdbiofi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iapjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpenfjad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iapjlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imihfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Himcoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmklen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbanme32.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
2184	Gqdbiofi.exe
4168	Gcbnejem.exe
3628	Goiojk32.exe
1272	Gjocgdkg.exe
3068	Giacca32.exe
4936	Gpklpkio.exe
4452	Gqkhjn32.exe
4640	Gcidfi32.exe
4996	Gmaioo32.exe
1212	Gppekj32.exe
5048	Hjfihc32.exe
3116	Hihicplj.exe
1384	Hbanme32.exe
1228	Hmfbjnbp.exe
4552	Hpenfjad.exe
3984	Himcoo32.exe
552	Hadkpm32.exe
1076	Hjmoibog.exe
3924	Hmklen32.exe
2172	Hbhdmd32.exe
5044	Hjolnb32.exe
4952	Hmmhjm32.exe
2564	Haidklda.exe
3244	Icgqggce.exe
3520	Ibjqcd32.exe
4484	Iffmccbi.exe
2668	Ijaida32.exe
208	Iidipnal.exe
436	Impepm32.exe
1920	Iakaql32.exe
4308	Ipnalhii.exe
3048	Icjmmg32.exe
1700	Ibmmhdhm.exe
228	Ijdeiaio.exe
1896	Iiffen32.exe
4884	Imbaemhc.exe
408	Iannfk32.exe
2504	Ipqnahgf.exe
1284	Icljbg32.exe
3196	Ijfboafl.exe
4836	Iiibkn32.exe
2872	Imdnklfp.exe
2920	Iapjlk32.exe
464	Idofhfmm.exe
4400	Ibagcc32.exe
3920	Ifmcdblq.exe
4896	Iikopmkd.exe
3052	Imgkql32.exe
2860	Iabgaklg.exe
2896	Idacmfkj.exe
3088	Ibccic32.exe
2736	Ijkljp32.exe
2732	Iinlemia.exe
4232	Imihfl32.exe
3184	Jaedgjjd.exe
4156	Jbhmdbnp.exe
2544	Jmnaakne.exe
5040	Jbkjjblm.exe
2568	Jaljgidl.exe
4000	Jbmfoa32.exe
4368	Jfhbppbc.exe
716	Jigollag.exe
3852	Jangmibi.exe
4024	Jdmcidam.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jaedgjjd.exe	Imihfl32.exe
File created	C:\Windows\SysWOW64\Ifmcdblq.exe	Ibagcc32.exe
File created	C:\Windows\SysWOW64\Jdmcidam.exe	Jangmibi.exe
File created	C:\Windows\SysWOW64\Laciofpa.exe	Lilanioo.exe
File created	C:\Windows\SysWOW64\Icgqggce.exe	Haidklda.exe
File created	C:\Windows\SysWOW64\Ijdeiaio.exe	Ibmmhdhm.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Liggbi32.exe
File opened for modification	C:\Windows\SysWOW64\Mjcgohig.exe	Mkpgck32.exe
File opened for modification	C:\Windows\SysWOW64\Hbhdmd32.exe	Hmklen32.exe
File opened for modification	C:\Windows\SysWOW64\Imdnklfp.exe	Iiibkn32.exe
File created	C:\Windows\SysWOW64\Gcidfi32.exe	Gqkhjn32.exe
File created	C:\Windows\SysWOW64\Lkbhbe32.dll	Hbhdmd32.exe
File created	C:\Windows\SysWOW64\Ibagcc32.exe	Idofhfmm.exe
File created	C:\Windows\SysWOW64\Kdopod32.exe	Kmegbjgn.exe
File created	C:\Windows\SysWOW64\Kkihknfg.exe	Kdopod32.exe
File created	C:\Windows\SysWOW64\Qekdppan.dll	Jbkjjblm.exe
File created	C:\Windows\SysWOW64\Mciobn32.exe	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Hmfbjnbp.exe	Hbanme32.exe
File created	C:\Windows\SysWOW64\Iffmccbi.exe	Ibjqcd32.exe
File created	C:\Windows\SysWOW64\Ijfboafl.exe	Icljbg32.exe
File created	C:\Windows\SysWOW64\Mkpgck32.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Kijjfe32.dll	Hmfbjnbp.exe
File created	C:\Windows\SysWOW64\Mkgmcjld.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Gbajhpfb.dll	Gpklpkio.exe
File created	C:\Windows\SysWOW64\Aqnhjk32.dll	Iakaql32.exe
File opened for modification	C:\Windows\SysWOW64\Kagichjo.exe	Kipabjil.exe
File created	C:\Windows\SysWOW64\Baefid32.dll	Laalifad.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Nqklmpdd.exe	Nnmopdep.exe
File opened for modification	C:\Windows\SysWOW64\Nnjbke32.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Hefffnbk.dll	Kipabjil.exe
File opened for modification	C:\Windows\SysWOW64\Liekmj32.exe	Kckbqpnj.exe
File created	C:\Windows\SysWOW64\Ldaeka32.exe	Laciofpa.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Hadkpm32.exe	Himcoo32.exe
File created	C:\Windows\SysWOW64\Mmpfpdoi.dll	Iidipnal.exe
File created	C:\Windows\SysWOW64\Ipqnahgf.exe	Iannfk32.exe
File opened for modification	C:\Windows\SysWOW64\Iinlemia.exe	Ijkljp32.exe
File created	C:\Windows\SysWOW64\Omfnojog.dll	Jbhmdbnp.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Iidipnal.exe	Ijaida32.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Fjkiobic.dll	Haidklda.exe
File created	C:\Windows\SysWOW64\Kmegbjgn.exe	Jkfkfohj.exe
File created	C:\Windows\SysWOW64\Akihmf32.dll	Kagichjo.exe
File opened for modification	C:\Windows\SysWOW64\Goiojk32.exe	Gcbnejem.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Kckbqpnj.exe	Kdhbec32.exe
File opened for modification	C:\Windows\SysWOW64\Ldaeka32.exe	Laciofpa.exe
File created	C:\Windows\SysWOW64\Ibhblqpo.dll	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Ldooifgl.dll	Hihicplj.exe
File created	C:\Windows\SysWOW64\Haidklda.exe	Hmmhjm32.exe
File opened for modification	C:\Windows\SysWOW64\Jaljgidl.exe	Jbkjjblm.exe
File created	C:\Windows\SysWOW64\Goiojk32.exe	Gcbnejem.exe
File opened for modification	C:\Windows\SysWOW64\Ibagcc32.exe	Idofhfmm.exe
File created	C:\Windows\SysWOW64\Bpqnnk32.dll	Iabgaklg.exe
File created	C:\Windows\SysWOW64\Kaemnhla.exe	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Kdffocib.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Lifenaok.dll	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Dbcjkf32.dll	Jbmfoa32.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Iakaql32.exe	Impepm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6220	5696	WerFault.exe	231

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Goiojk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iannfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iabgaklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgabcngj.dll"	Gppekj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iapjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpnkgo32.dll"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nacbfdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcbnejem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hadkpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gqkhjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imihfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlgol32.dll"	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkqpjidj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcnodhch.dll"	Impepm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiphogop.dll"	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmmkpmf.dll"	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdehlgh.dll"	Giacca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mngoghpn.dll"	Gmaioo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jangmibi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmpfpdoi.dll"	Iidipnal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijfboafl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbhmdbnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiidlll.dll"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Goiojk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldooifgl.dll"	Hihicplj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjmoibog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnapdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdffocib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Haidklda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkmdbdbp.dll"	Gjocgdkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iabgaklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecppdbpl.dll"	Jangmibi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjmoibog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjcgohig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gppekj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmmhjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcbnejem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdnklfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idofhfmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfbhfihj.dll"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imbaemhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iikopmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 2184	556	c4dba6c89d8b239df92af6a7627113beb23ba98eb823b1fb5c8911272aab6dbe.exe	86
PID 556 wrote to memory of 2184	556	c4dba6c89d8b239df92af6a7627113beb23ba98eb823b1fb5c8911272aab6dbe.exe	86
PID 556 wrote to memory of 2184	556	c4dba6c89d8b239df92af6a7627113beb23ba98eb823b1fb5c8911272aab6dbe.exe	86
PID 2184 wrote to memory of 4168	2184	Gqdbiofi.exe	87
PID 2184 wrote to memory of 4168	2184	Gqdbiofi.exe	87
PID 2184 wrote to memory of 4168	2184	Gqdbiofi.exe	87
PID 4168 wrote to memory of 3628	4168	Gcbnejem.exe	88
PID 4168 wrote to memory of 3628	4168	Gcbnejem.exe	88
PID 4168 wrote to memory of 3628	4168	Gcbnejem.exe	88
PID 3628 wrote to memory of 1272	3628	Goiojk32.exe	89
PID 3628 wrote to memory of 1272	3628	Goiojk32.exe	89
PID 3628 wrote to memory of 1272	3628	Goiojk32.exe	89
PID 1272 wrote to memory of 3068	1272	Gjocgdkg.exe	90
PID 1272 wrote to memory of 3068	1272	Gjocgdkg.exe	90
PID 1272 wrote to memory of 3068	1272	Gjocgdkg.exe	90
PID 3068 wrote to memory of 4936	3068	Giacca32.exe	91
PID 3068 wrote to memory of 4936	3068	Giacca32.exe	91
PID 3068 wrote to memory of 4936	3068	Giacca32.exe	91
PID 4936 wrote to memory of 4452	4936	Gpklpkio.exe	92
PID 4936 wrote to memory of 4452	4936	Gpklpkio.exe	92
PID 4936 wrote to memory of 4452	4936	Gpklpkio.exe	92
PID 4452 wrote to memory of 4640	4452	Gqkhjn32.exe	93
PID 4452 wrote to memory of 4640	4452	Gqkhjn32.exe	93
PID 4452 wrote to memory of 4640	4452	Gqkhjn32.exe	93
PID 4640 wrote to memory of 4996	4640	Gcidfi32.exe	94
PID 4640 wrote to memory of 4996	4640	Gcidfi32.exe	94
PID 4640 wrote to memory of 4996	4640	Gcidfi32.exe	94
PID 4996 wrote to memory of 1212	4996	Gmaioo32.exe	95
PID 4996 wrote to memory of 1212	4996	Gmaioo32.exe	95
PID 4996 wrote to memory of 1212	4996	Gmaioo32.exe	95
PID 1212 wrote to memory of 5048	1212	Gppekj32.exe	97
PID 1212 wrote to memory of 5048	1212	Gppekj32.exe	97
PID 1212 wrote to memory of 5048	1212	Gppekj32.exe	97
PID 5048 wrote to memory of 3116	5048	Hjfihc32.exe	98
PID 5048 wrote to memory of 3116	5048	Hjfihc32.exe	98
PID 5048 wrote to memory of 3116	5048	Hjfihc32.exe	98
PID 3116 wrote to memory of 1384	3116	Hihicplj.exe	99
PID 3116 wrote to memory of 1384	3116	Hihicplj.exe	99
PID 3116 wrote to memory of 1384	3116	Hihicplj.exe	99
PID 1384 wrote to memory of 1228	1384	Hbanme32.exe	101
PID 1384 wrote to memory of 1228	1384	Hbanme32.exe	101
PID 1384 wrote to memory of 1228	1384	Hbanme32.exe	101
PID 1228 wrote to memory of 4552	1228	Hmfbjnbp.exe	102
PID 1228 wrote to memory of 4552	1228	Hmfbjnbp.exe	102
PID 1228 wrote to memory of 4552	1228	Hmfbjnbp.exe	102
PID 4552 wrote to memory of 3984	4552	Hpenfjad.exe	103
PID 4552 wrote to memory of 3984	4552	Hpenfjad.exe	103
PID 4552 wrote to memory of 3984	4552	Hpenfjad.exe	103
PID 3984 wrote to memory of 552	3984	Himcoo32.exe	104
PID 3984 wrote to memory of 552	3984	Himcoo32.exe	104
PID 3984 wrote to memory of 552	3984	Himcoo32.exe	104
PID 552 wrote to memory of 1076	552	Hadkpm32.exe	105
PID 552 wrote to memory of 1076	552	Hadkpm32.exe	105
PID 552 wrote to memory of 1076	552	Hadkpm32.exe	105
PID 1076 wrote to memory of 3924	1076	Hjmoibog.exe	106
PID 1076 wrote to memory of 3924	1076	Hjmoibog.exe	106
PID 1076 wrote to memory of 3924	1076	Hjmoibog.exe	106
PID 3924 wrote to memory of 2172	3924	Hmklen32.exe	108
PID 3924 wrote to memory of 2172	3924	Hmklen32.exe	108
PID 3924 wrote to memory of 2172	3924	Hmklen32.exe	108
PID 2172 wrote to memory of 5044	2172	Hbhdmd32.exe	109
PID 2172 wrote to memory of 5044	2172	Hbhdmd32.exe	109
PID 2172 wrote to memory of 5044	2172	Hbhdmd32.exe	109
PID 5044 wrote to memory of 4952	5044	Hjolnb32.exe	110

C:\Users\Admin\AppData\Local\Temp\c4dba6c89d8b239df92af6a7627113beb23ba98eb823b1fb5c8911272aab6dbe.exe
"C:\Users\Admin\AppData\Local\Temp\c4dba6c89d8b239df92af6a7627113beb23ba98eb823b1fb5c8911272aab6dbe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\Gqdbiofi.exe
  C:\Windows\system32\Gqdbiofi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\Gcbnejem.exe
    C:\Windows\system32\Gcbnejem.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\SysWOW64\Goiojk32.exe
      C:\Windows\system32\Goiojk32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3628
    - - C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1272
      - C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        25⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3520
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2668
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1920
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        32⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1700
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        35⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1896
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        39⤵
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1284
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4836
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:464
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4400
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        47⤵
        Executes dropped EXE
        
        PID:3920
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        49⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3088
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2736
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        54⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4232
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4156
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        60⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4000
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        63⤵
        Executes dropped EXE
        
        PID:716
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4024
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3740
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1660
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2608
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4964
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        71⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        72⤵
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        74⤵
        
        PID:892
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        75⤵
        Modifies registry class
        
        PID:3548
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        76⤵
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        79⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        80⤵
        Modifies registry class
        
        PID:3308
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        81⤵
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2784
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        83⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        84⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        85⤵
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        86⤵
        Drops file in System32 directory
        
        PID:4132
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        87⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        88⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5052
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2796
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        91⤵
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        92⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        93⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        95⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        96⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        97⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        98⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        99⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        101⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        103⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        110⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        113⤵
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        114⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        115⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        116⤵
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        117⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        121⤵
        Drops file in System32 directory
        
        PID:5548
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        125⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        127⤵
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        129⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        131⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        132⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        133⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        136⤵
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        137⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        138⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        139⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        140⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 400
        141⤵
        Program crash
        
        PID:6220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5696 -ip 5696
1⤵
PID:6192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gcbnejem.exe

Path C:\Windows\SysWOW64\Gcbnejem.exe
Size 337KB
SHA256 bcb8cbd4aa70cacecd2774725c65091b5ed5505e37a378f11cf1bc8afc72bbc0
MD5 9e2fd82b05f7a44def341e0b6114a9bb
SHA1 73eb72da801ab430bc4656ce76f7405d527fe41d
SHA512 7c7d9513df45b58ae4bd4708ee47c21ac1a4360a5a1a4874e79ae9d54b3b9d182a98cb2768f18bdfa2b6539175db9f5738104d6f045b158afcf30173ff99a406
SSDEEP 3072:RWn9Iz3Q7oLogYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:R+IDQ0Lo1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcidfi32.exe

Path C:\Windows\SysWOW64\Gcidfi32.exe
Size 337KB
SHA256 f2c907c2c887b36b823b84fcc97a7b5f501d721c7da87751e70d8b839b2a155f
MD5 b29ae542f6a5dea9b55a70e9211e0814
SHA1 c4d8a458335855b6ba13904495b06df5f4624842
SHA512 b6e91ac919ed1d6c0b7b9e5fed702f33a2c39d0d2898c60b7a3e5f64256301c421e35653eb473177586a493bb530d6addbbdeb8abf80cb88e8416db74c9114b0
SSDEEP 3072:4WoLD2gnYd9gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:uLDxYd91+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Giacca32.exe

Path C:\Windows\SysWOW64\Giacca32.exe
Size 337KB
SHA256 e58e38fb9cdc650ead8ffd9992091a3c0799cb5d30a92a369068ed5a784dbf05
MD5 75fbf9fe79989750d5f14366ffca68aa
SHA1 835fb0c44291d08e6517c279e82d5dc01c8f51da
SHA512 8b56a932c2c8e4a57275b8cdf4ce60ed157e10d425a259f12934338ec7e88b7c43310ea007fb51c8da103b02c85e2cbef1503dd7b43ea8f694096411e2af34ba
SSDEEP 3072:gU3N41TKIXtR/0b10/OKmgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:goSTtG1Km1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjocgdkg.exe

Path C:\Windows\SysWOW64\Gjocgdkg.exe
Size 337KB
SHA256 2d937777b496d27f86d9da875ba21a413830154e479c87d989186f72c0a8337c
MD5 22b61711964d170f1f04d6807543b9d1
SHA1 f8a43ae79914687d8cd4ffa8d4fe9e5317fb0fd5
SHA512 60d9634a399bccacdba2d6e46ad8ee477e373c72dc9ae408a36ed8ce09671b640bff77fa047e4154016355e9b9d11c0a56b86c23c46c19c509c20955b9c99f88
SSDEEP 3072:Pt1oFLAx3bgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:PL4A3b1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmaioo32.exe

Path C:\Windows\SysWOW64\Gmaioo32.exe
Size 337KB
SHA256 32410dde6c662e558082436e3ad417e734d6e0b25414105d5cc9813092d45ede
MD5 3ae67071d0a23ec10a2b885b4d599e14
SHA1 c98b566e265af233eed68b54faf16f54da80800e
SHA512 796f4dcf9b9bcd11d29e6884a9652cd885ed74d37653fa3cd205df79d1bd3855e5ece6d98a1f70c6ef7f0c0af691d4854c5abe7ed034d0f52e1eb7d6c5b6d8c9
SSDEEP 3072:wz9k4sN4q/t0CUHc9pgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:wzKBN40McX1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Goiojk32.exe

Path C:\Windows\SysWOW64\Goiojk32.exe
Size 337KB
SHA256 34625dd8e9116348afd880ebbf84a35e1d4f3797b515639c102d4877d4aae945
MD5 45692bcb963c2a75fae69829776551ce
SHA1 2ed4c075bf668079f0d0f01253c4f4d75e309fbf
SHA512 6a4cdb4e86fc7939a6e84fd4c5ab2bb2ab17e1486c615026fd4ac6663e7a079ae035709953d02644fc14a5f1f2a2a0b4805bbf005ccdaa0a6eebcd20928c4a50
SSDEEP 3072:G1TcW6jkrYfpbgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:QlrYhb1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpklpkio.exe

Path C:\Windows\SysWOW64\Gpklpkio.exe
Size 337KB
SHA256 55d2e66aa30f04348346d3f410becb3df43f5d3627479c2f6ad2692c6ba79b21
MD5 456a482814f8ef6682ec723d2f1bb59e
SHA1 9e32012568f9f0a4c3d9beea4f2d83ccd736ba19
SHA512 f217601a44712017472a98e372f50848ef93eded957663f28c90476bfc246fc68dfb6ddb0fbe2c501615bb040e823fc00ca86312d2e6fa383f6a07a2cde5f762
SSDEEP 3072:d8hnW6ua2F/S4gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:d8hnWVaCS41+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gppekj32.exe

Path C:\Windows\SysWOW64\Gppekj32.exe
Size 337KB
SHA256 a4cc450ba4c19d632eb7a0c13da8752da8e0ee00c9f2556a1463b45dc247eee1
MD5 6c600ffc409c9c01c0c29e3a905fe5da
SHA1 227802c31752d247262e42853c2c35662aff799e
SHA512 5bf2c4ecddce6e04f8cc9f3dfff99e670735b0d56e4b8e2c285935f18998c09fc7385d9af8b02484cc7aca37985bd3e9038ee7a3d8a5ec8b52789895fae4c4c7
SSDEEP 3072:HFNHSVVIztGaYDTDoWgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:lNy6FYDTDoW1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqdbiofi.exe

Path C:\Windows\SysWOW64\Gqdbiofi.exe
Size 337KB
SHA256 d46cd88d8dc5a70d8cd737191e328f474110c4d5a3ae341f570f75d6b6c2ecd2
MD5 01068e2f33a404a92169951ee5ffa7c8
SHA1 0e40b3d6ec41c950247e43ccdcc402bfdd8cde1e
SHA512 85345e2bf94275d08fc35e6af401ef8257d288eb6f3695491da2c5b0425ec197df427db979d7a9fbc217ed42e119f735338226888f139461d4acb81c15797656
SSDEEP 3072:u1ShuFWHOKyz8xgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:WSh2WHc8x1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqkhjn32.exe

Path C:\Windows\SysWOW64\Gqkhjn32.exe
Size 337KB
SHA256 b5f1d3f26aa29bbbb9d95225a1ba2ec2dd83131b75be0cb52c1055b04ab5f424
MD5 d6be8fca1078117f6e02eb6ce2f30a78
SHA1 52b069459fd204d94305e0235abaef230d244c97
SHA512 c8958547a0791be05732d7f8fb08a5d06265d71d5e30c4c140c47c50b28bb6f3c47e002b4a6713be20f7d97390c482b7ea08004a586b561a5ecbd9735a09a55e
SSDEEP 3072:+TF0+pPsKR0A6ZIOZjgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:o0OPsKOA6jj1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hadkpm32.exe

Path C:\Windows\SysWOW64\Hadkpm32.exe
Size 337KB
SHA256 da0575fb1b97ddaf3ab114623ca5f9fb0d1a050adaf02cd7494dd11ff2a6bed0
MD5 76c171691c5f8eb0881f4193ec1782e3
SHA1 21750ab207a3a56862b78081e1d9545d94ed8b2c
SHA512 9efa86d631c1e3480b7e57400f26d209159a133ec9ffab54a6fcf05968c535fc8a6d35236563f78085ceda951412a4bf67aa02afc03ffca044842ec8b604ed6f
SSDEEP 3072:v1W3AMWuExmgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:v1W3Exm1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Haidklda.exe

Path C:\Windows\SysWOW64\Haidklda.exe
Size 337KB
SHA256 40f6c81ecb807f457ce088e062c86a5dcecf8d0ca0fbc0dd3103cb68b72a4392
MD5 04f982b712d4a306c47a0d10403b7710
SHA1 92fe1eb55bb588450efca2cdf5f8819e3076eece
SHA512 0f110cb0605ef4b096369f6c882d53fdd9c39a81e3c39952a445d2e8112855f0d77ed259328631b8dc4ee5b96e71979548ecccb5370c539e4149fc2706bf520c
SSDEEP 3072:SCVqeAK4lGCUI8gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:zjngGCL81+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hbanme32.exe

Path C:\Windows\SysWOW64\Hbanme32.exe
Size 337KB
SHA256 9fdc309b60d3e77c39c3a093a55e61bebc6e8e229ffd435e5428c8f55d10e4a1
MD5 556170a8d6ec2c5104bea85c23e37230
SHA1 22a3c68836705e840f15e6f033e8e9a588208b12
SHA512 f9887d5b29ccad0db03ca4d85ecdeca3f96314f71a1fd49f1260bcf97ba57c43ab8a71104b47128b2810cced7b420983398fd6dc878d266ea64cc637407d35da
SSDEEP 3072:6KVv/gpky80gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:NQpN801+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hbhdmd32.exe

Path C:\Windows\SysWOW64\Hbhdmd32.exe
Size 337KB
SHA256 0b236994f0b07072ed98ead26bae8a1cec4080c28af4c77520cbec823a728356
MD5 81b62285fa53a75b9e359cb6b22cef8b
SHA1 8e0db91e8733e72bb1afee4b02be198563818d06
SHA512 41709f7772fd3e40ec31c25958335662a297022f76cd3de82db13fe0cbf2c7b4bfa874605e5fd56aa00fc14da448511024c59ad317bcc65ba874ed17b58f9087
SSDEEP 3072:0Fy1VyTIfqsvKBYNEv+TgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:0FUnCneT1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hihicplj.exe

Path C:\Windows\SysWOW64\Hihicplj.exe
Size 337KB
SHA256 c473b58696354906358ea9be78977e6f0fbffd40755f6ae013f178dedf11db2c
MD5 738df1acb09856a2d7b9685044c5f987
SHA1 8570b78afc98c7a3c8b7b70792a89a29927c042f
SHA512 60d898da208d8a4b343bf7f4e383513804030c17a240b0eec2d25849a9dfd0cfdbaa828b0ab33c7382a8d6e409c697e4bd6823c01d458724138844c9e604b50f
SSDEEP 3072:G3GW5SCtKOBgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:G3Ntt1B1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Himcoo32.exe

Path C:\Windows\SysWOW64\Himcoo32.exe
Size 337KB
SHA256 15e12ba37193291aaa371311224ce5bc16a7150063b3919a15942a6612543892
MD5 e2d0a6d9140c2336266c8fab353aaf10
SHA1 42709b5620ed0ff9486f5d4c04846aa1e11dedf0
SHA512 4a08e229daf5f293d40d0a313bdabd1401ef66536578f6e0b4d444e4e6d6cff4453058e870c0c92917ffdd2a1498ca02143306a87b4f17c46e6f5f5dfb7dfe25
SSDEEP 3072:KJQ/2Aw63YL+bfwDf+sgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:KalICboD2s1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hjfihc32.exe

Path C:\Windows\SysWOW64\Hjfihc32.exe
Size 337KB
SHA256 a381860c97846daea6d047c1e1997b3499207e1cce9b6f47f1a443845b2ec377
MD5 23ef27d2ab1136a5178a586120df2846
SHA1 a43c538f27fbc8ff669e927e3d81aa350dc78d99
SHA512 543282497b76fe740f6651996c93c983b60db2163375dce211ce5d40c644de9ca8f5c98aa7ed8651313f49d4f9ee6fef64df8e9fb5317700f7ed3541226ef5e6
SSDEEP 3072:3tJEYxJ2dR5yeZXlZ6LgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:9WqJ2r5yeZXlZ6L1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hjmoibog.exe

Path C:\Windows\SysWOW64\Hjmoibog.exe
Size 337KB
SHA256 cc9f9a98c649d0200b914b5f1f9d4dec7204a47926d173d8a9e99c0bb2316160
MD5 65d6b9ea8c86e8c4d032129ff54e9f6e
SHA1 ce2b1c01466a8ba1a077e04e4577f5986c0d0300
SHA512 a282fba206c6d6da681ffd48eed9fda89c814c815f6962212f6d6ad37b1b2b2ae56127578c61368a5a79bd0425b4f2b9b7738be41580aff572b96a5e6822eb07
SSDEEP 3072:TAjvhJiXCGeaGgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:TAjv/IpeF1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hjolnb32.exe

Path C:\Windows\SysWOW64\Hjolnb32.exe
Size 337KB
SHA256 d6db9e5b0b0a4cf77e8edb19e30f161e82c2bb100881a931d859e10fa984fb71
MD5 f990027c60b61a89b0823012e75ef3b4
SHA1 9e61c19fdb2075e57b6eade239474b224d5cdbec
SHA512 2294b2625d64d8732a4e14eece2c53474cce850b43398bf1e7fb4f655dbb0f3441cd154f268be6cab30c04d3346cc70b5c5d7bacc30d63ed674bd177c5b58af2
SSDEEP 3072:iy285poM/oA2Hml4gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:iy283GHml41+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hmfbjnbp.exe

Path C:\Windows\SysWOW64\Hmfbjnbp.exe
Size 337KB
SHA256 2293bf022b7f57f0dc77b57ff9d0ce7f765ac84f0dbe5ce60eb71648c04cdad6
MD5 08946b1bcb7fd07310aeed919c7ffc60
SHA1 7261b8f8752474250d68e6afdd8bfe7a3f754498
SHA512 5eaa0d3d86169f4708ae1782559248e477562f138d0ebdce3950e3c584a2479db2a312709db274c21736e155573f03c7f41296676f3992247bc9246f5971baa7
SSDEEP 3072:m3u7CLfBU7T5Z/dpYxgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:EefLAx1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hmklen32.exe

Path C:\Windows\SysWOW64\Hmklen32.exe
Size 337KB
SHA256 d27ef0132a6ed71248c7071e2fe2e0e6e0e2fec6b19dc1e21928ee38e9c6f67f
MD5 8177da71891a7c10c9c2610aabe90ddc
SHA1 598e1cbe9b0c4c72dc1b2fd5ee8a5e0551f2bdb7
SHA512 2678fc8bd4efa37b28e4964b6926b500e00edeee10571c2f8dfec93c4cfdae7fdb07ea4da0d9f145a8247af5264150aa61aa239304f7992386c7eb16c8d5a3c9
SSDEEP 3072:yOFc0UdDfgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:y+c3dDf1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hmmhjm32.exe

Path C:\Windows\SysWOW64\Hmmhjm32.exe
Size 337KB
SHA256 49d3eae3fcadacb53bbc19c31cd2b872ae3f01a80180b04861f666c886e15f21
MD5 46b6c50be5df44c531f66b004bd97ea5
SHA1 c7c4ef85004162e989ca339ceae31d4b0dd1ba3d
SHA512 2862d2684188effdd5231ddf84b2bbcf6e9bcbbab8b874bb2ed3d97ba0cc37b2eff240aa05590ca837b1457767263aa78f902444091d63005055ff80ac6d3349
SSDEEP 3072:/RDWMwmllldt2IIMSgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:JDh3BS1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hpenfjad.exe

Path C:\Windows\SysWOW64\Hpenfjad.exe
Size 337KB
SHA256 bdf5bb0a4616727024d70e878754e0f31555586b0c98c43b9cb59339336de163
MD5 cf5095eca500b8c595477ba6fe1df423
SHA1 5dbaf0b20001bca5337b533d903e86d099b21cda
SHA512 3e021cdb716a8d29326cb762c4f99cb1613b622902bf1262479951b9ddfbba21cbc0e6da3dfae75a5ff871134784553b6cbd6c75d0868139e410ede370234705
SSDEEP 3072:3+CjtKCgqGgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:V/bG1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iakaql32.exe

Path C:\Windows\SysWOW64\Iakaql32.exe
Size 337KB
SHA256 ec9cecb9e996b7e7130a1b43ea4fb4f8f1a7c6fca3053acf7656973909557fc2
MD5 20bf1f33a420ef1cf50cc14c59fcaf90
SHA1 25c69ea508b9029c5c6aa558b4a96919197c6bcd
SHA512 55518673960832a78b2e6db907ff15306594b6f130aad51c642729470ed7998c1278f0a2968cd20e080d02e9f8c1d5ccc5be43c90ee62789bf4a9bf41a1794ec
SSDEEP 3072:OPV7r2QVFe3mFKgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:cI3mFK1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibjqcd32.exe

Path C:\Windows\SysWOW64\Ibjqcd32.exe
Size 337KB
SHA256 f96d0cd941e987d296c0c388dcd601c02c580ac078f58c99e9f9f090851d2b31
MD5 a18851fe5faaec5305253f54c070eeb5
SHA1 2c0977d67f8c73a369b9799be906a37c7e676af3
SHA512 29c5e90be42a7aafa1832937d58776b45450aa038eb4b120371337914614e9238d23e5e5887e9f426cac0647ea088b8ca23c3c463d113705b69beb3b20dc2cab
SSDEEP 3072:SOWzP7EYOVkdJacgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:fEHCkTP1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Icgqggce.exe

Path C:\Windows\SysWOW64\Icgqggce.exe
Size 337KB
SHA256 197fcd0532ecc478e8f2f76d7dcd403a7a2f91f8ee803d0a749a0645a8cf74bb
MD5 b1b8084c0a6d338b60f9ee7d0e7601bd
SHA1 a04bac6265243417f168023f6a15c2b695373e73
SHA512 9d174aebd8e9242dd4630dc003d19a088bc229ebc46a27c182e957e14ef7785d375038ee0ebcf5badf5a366a43f55f9ff30e914354106f4cc6013141eab0c1d5
SSDEEP 3072:3tfMAz7LOkU8qZw3kZKgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:3tfbPLORZw3EK1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Icjmmg32.exe

Path C:\Windows\SysWOW64\Icjmmg32.exe
Size 337KB
SHA256 082325674966280dbb629a28502ca52e37da71b2cc5a14b4799cbf95770629d1
MD5 2e5147eca5ec6c9379c708e28fcefd6c
SHA1 20099466f871906c3408e822066c018fd09aa527
SHA512 712090e8ae709b8bf07033f2a0e42ab20f7183060687cff7805be68616dd4914a0ea98db1cd3803ed5b1997dee2232bca1df0decc95e55d042f4869de8487c51
SSDEEP 3072:WKawKxGlHS7stAsigYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:baxzJsi1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iffmccbi.exe

Path C:\Windows\SysWOW64\Iffmccbi.exe
Size 337KB
SHA256 98d0ccffb843995bf1845ac43ecd1ad92e23b189f6a6b4a7b020b5942cd35756
MD5 0bbcbaccf227820220a54b331d775232
SHA1 121149f403e5ccd43393377ff50d48971a89ec32
SHA512 b3b3822e1cfa041cca9a791595e79fb8e62049366b6bf0a69642422cc1a07dac2bd7dc5fa13b0fe788a36b28f2bbade9a8a27b87042a5c737d2c39db485867cd
SSDEEP 3072:sSb/Mqi1o1iwFhCnmgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:sZXyNcm1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iidipnal.exe

Path C:\Windows\SysWOW64\Iidipnal.exe
Size 337KB
SHA256 933da237ca2c533200b50ce67fac7c05ce1a1b29640e4ecfbd2d7340699b6858
MD5 497adacb163fc8e5a27b28135377dd00
SHA1 c8d709ac90332131d1503c4147d185e964e1759a
SHA512 8f59cc0d7db86a08f07c70c86d821027adc2d45a2af2be3e680f6a6f3bad08dd1bebe63ca1758de745ff26cb74cc60d45c72f0233c6d24b831ee87141094b8a7
SSDEEP 3072:Q9eg8Z+tAhFXVVsWgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:yu+tAhxVVsW1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ijaida32.exe

Path C:\Windows\SysWOW64\Ijaida32.exe
Size 337KB
SHA256 688b2434d05565c726a05410b4679f9bfc563d805659fa4f04bdb3bb9c2ef001
MD5 9c1a25273e7a09b87bb6c8ff41e1aee5
SHA1 8f1a6132268580c6e6b90e2a912bdaea6aefc1d1
SHA512 83582007f73995fff264cac1a3d296ad0846bbf7caf15a5ddb2f3e9e530d49b354f3f412762413017e63e5eb41c987fcff04fced809e5a002941036bc50f1d7d
SSDEEP 3072:Lu+rYbkgSPwaZvv42bBFpBTmgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:Lu+rrZvv4YjpBTm1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Impepm32.exe

Path C:\Windows\SysWOW64\Impepm32.exe
Size 337KB
SHA256 c32ab4256d6e826aa2b0fe21322066cc2e6428e509fbbdda7e07af897e38bf5e
MD5 03cab946bc8db3d2ba16f09ee256006c
SHA1 048ab90ae98b9d40dc4b2f5b6ca92d3628f866d1
SHA512 bc6e75f728070aeeb1b79e19b010fed8bfca8a3fd815719812e73f3d8656f21a5273d25293334f7d57179c5e8438dec087195b0fa21c52ebf3e15e5c32711ebb
SSDEEP 3072:+vwwzfevY426f8gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:+n142A81+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ipnalhii.exe

Path C:\Windows\SysWOW64\Ipnalhii.exe
Size 337KB
SHA256 23a5b5b2115d4c51dc3fbbdb0a8cbd832f72d9cd26c37fe616d757f6bbced9e6
MD5 4e03567fed81c77ab25ea1e2569c9ce6
SHA1 6524e10e0c7b39e4c4240fbffa0d7e99e11f07a3
SHA512 1e4eeaf931970ee43ea9dc7d3f04667de180e5780846cd9b4036e623864755e1dd867df588728c5c27e810384035d5087f20849e0d82f83dc76880af887379e0
SSDEEP 3072:q1xPTAaBvZyZ9gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:q1xPbBhyZ91+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbdmpqcb.exe

Path C:\Windows\SysWOW64\Kbdmpqcb.exe
Size 337KB
SHA256 6012c251aa9bd5625db6361bcd699c6a59cfe0abe8a2b45fd7be397fc379c044
MD5 026cc5329e42b9a47bdceee1cdbf2b50
SHA1 01f6522372150327e9bbaa67b5c590b97d12670a
SHA512 879ee2dfbe869a099ee89d85d66f0e945f8e94518fab5464ca3516581c0236c3ec7fb39febe6bf0693229d20179213f7323b3cfd69f6b0d915c4a5c77d25c2c5
SSDEEP 3072:qH6bQI01JqAc9VksZwgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:tbOJyw1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kibnhjgj.exe

Path C:\Windows\SysWOW64\Kibnhjgj.exe
Size 337KB
SHA256 f9d2e72eab6b2d1d04a3fd058225b3030bcf079c5198279695ae49e3036146d7
MD5 8043dabace90442df0e5d68084b7eb89
SHA1 404b0433ac419d50ef5b4f527468d5e8c7cf91b3
SHA512 3e70bd1f8aa18c1cc216b399d6be8524001adf489dbffdf93f94408c85d7bc976f17a79b264bc5302660e192911aa3a2f12df612a44ea8b888191c9ab661bfd8
SSDEEP 3072:Td00XcKEt1gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:TaKkt11+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcgblncm.exe

Path C:\Windows\SysWOW64\Lcgblncm.exe
Size 337KB
SHA256 3ec05492862df4752f1711ffb6ba9e8748646383bb9ba57b874376fa7e7fcca5
MD5 a720c830761a3d22b2dd36eacfec905f
SHA1 6654f67c0f75f1559f132ea35a27a6806ff7deb5
SHA512 f462c4c293c76388bb71046ed89c594bb349317544e41532c8130090aa67a2dec94b4a995d8d69003526fbe69da6490d5a5ee03f9c848f783d7c192240621395
SSDEEP 3072:O6OHzYGaKr/Zg6X5oQLsmjDYiqpLgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:8cT1L1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgpagm32.exe

Path C:\Windows\SysWOW64\Lgpagm32.exe
Size 337KB
SHA256 12b3a8e5de73ca0911fa034e23e7aef3a5b1a000ae963a210069ffcda0d98d67
MD5 5a75e36cd840bfb3bae8031a867b1186
SHA1 72f7d7674bbb0749177ac2f55d38370a78c1ed30
SHA512 8973a2dd87a467b57267cc8eea7b3e4099a8bf86256b7cc0901e694755541decb26833c6beb4f2ee01c01d8c54102c172f3622626138a74099ec766bc3869b1e
SSDEEP 3072:5yL+5uQFduG/vAp6gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:IL+5uQFduyC61+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lilanioo.exe

Path C:\Windows\SysWOW64\Lilanioo.exe
Size 337KB
SHA256 7ae9309b90f476eaa121d33649d7fa232d544ba5fa8fc0e820384d621ae37c35
MD5 6de75a30de933c6b2a63f841177f4057
SHA1 9592b8e4f95d2dcd5605bb7105e1c2daf408003b
SHA512 48aceb053dedc29656d2971b9ad8b9cbe569ba924d8d685bea9f827b9794c0bdb3acaafc61663620d0bc8edcffa490b972e00969b60a7f0c32f98827099a8208
SSDEEP 3072:08xiVFTwH/6u13UgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:0eiDwH/6u3U1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnjjdgee.exe

Path C:\Windows\SysWOW64\Lnjjdgee.exe
Size 192KB
SHA256 ad42735b0b56ddbb1fa3cd7e63f085f01c21638332b3a7b3c441e1732bfb638c
MD5 92d8d63ace91544d2da67c104d5e6a5e
SHA1 bbc3e8725fe824435a7f9466d34ad6bf5eebf0b6
SHA512 80c62d4740d7af9a7498ab61649e9a261a3c2597168b611d1cbeb03da93bd6d04f4f1ac4573ae3089f945f45872cc32e74338c59a9fc98207bdbeeb9507930c3
SSDEEP 3072:5yL+5uQFduG/vAp6gYfc0DV+1BIyLK5jZC:IL+5uQFduyC61+fIyG5jZC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjjmog32.exe

Path C:\Windows\SysWOW64\Mjjmog32.exe
Size 337KB
SHA256 c01f3b75c82ba1628402592c4d3dcfc78689c65db032d7093c121c3875193266
MD5 e98d5e7a580f6b0f3249fbcd61956d75
SHA1 0ee05f6fededfb3ed0d87741165c1cb296c5cd08
SHA512 9e1594945d803deacea88f089b66a6ce2fc534a769d510124c60794d05f32cecf3367bc71db54aaf77ec640fdda82996d1ada5b22c11dded2348a73ada6fd60f
SSDEEP 3072:x9AVBI7aI5wHt/VngYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:xQ8aPZ1+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndidbn32.exe

Path C:\Windows\SysWOW64\Ndidbn32.exe
Size 337KB
SHA256 d13a806cc0acced9071c7da13e0fa09e521aeab91a0eec22bcc87576a0c97ceb
MD5 d89661b901b36d67184cf2750b724ea4
SHA1 be2ae3c821a5c83753369cd84ed9eb110d7b4844
SHA512 04ac5e7da83dc0e0ad87eac824f53f9c97cee04791a01cfea8ceb730cb035cbd8966e644e3977c8adcb6d0eeed3ed66b3bac6dd6d1c399211a3af4cc082ac325
SSDEEP 3072:ID82IJEB/bail178gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:Io23bDl1781+fIyG5jZkCwi8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-368-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/228-374-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/408-381-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/436-369-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/464-389-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/552-137-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/556-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/556-5-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/716-442-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/768-605-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/816-563-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/892-503-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1076-145-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1212-85-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1228-113-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1272-37-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1284-383-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1364-569-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1384-105-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1660-461-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1700-373-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1896-379-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1920-370-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1944-491-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1956-485-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2172-165-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2184-9-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2376-533-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2504-382-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2544-412-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2564-362-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2568-419-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2608-473-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2668-367-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2732-398-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2736-397-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2784-551-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2796-603-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2860-394-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2872-386-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2896-395-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2920-387-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2996-521-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3048-372-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3052-393-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3068-41-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3088-396-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3116-96-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3184-400-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3196-384-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3244-364-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3308-539-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3452-497-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3520-365-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3548-509-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3628-29-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3740-459-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3852-447-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3920-391-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3924-152-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3984-128-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4000-429-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4024-453-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4124-557-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4132-579-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4156-411-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4168-17-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4232-399-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4308-371-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4332-581-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4368-435-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4400-390-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4452-57-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4484-366-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4496-545-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4548-519-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4552-120-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4632-467-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4640-69-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4728-591-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4820-527-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4836-385-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4884-380-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4896-392-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4936-48-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4952-361-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4964-483-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4996-72-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5040-413-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5044-169-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5048-93-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5052-593-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5136-611-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5176-620-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5216-624-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5256-629-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5748-969-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads