eacd0b6396e9a89b21adfdbace3567a69fd6e1993c033a7f624e49bfb90a4c1c

Analysis

max time kernel
129s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4199d557cd47eb2cbec94c39af72ef0a.jaffacakes118.exe
Size 52KB
Sample240504-wdkfbadb2z
SHA256 eacd0b6396e9a89b21adfdbace3567a69fd6e1993c033a7f624e49bfb90a4c1c
MD5 4199d557cd47eb2cbec94c39af72ef0a
SHA1 9c7c2d140b7fc290276ed216e057542516a613de
SHA512 5d9b17816bbe87c45ad5aeb99087a50a82a707685a93b0180e8cb5265d2afd41e4440e6cf72ed50adfcb8c7b9902dcb4acb54febf83808fb5cda67a8b2bdcc23
SSDEEP 768:leggMj1hKkunvMTVN+gDwWi1HM6t/hWhScUB+1lKfSJfmql78a51ZIFo/1H5:ljgMxEkU4xDf6hhAL3iGLmg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmnjhioc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idacmfkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmlnbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhdmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iannfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbkjjblm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jibeql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iidipnal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiphkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iapjlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmmhjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbfpobpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njljefql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imgkql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iinlemia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jiphkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hibljoco.exe

Executes dropped EXE 64 IoCs

pid	Process
4144	Hbhdmd32.exe
1144	Hfcpncdk.exe
5096	Hibljoco.exe
5104	Hmmhjm32.exe
4444	Icgqggce.exe
4908	Iffmccbi.exe
1996	Iidipnal.exe
4564	Iakaql32.exe
1616	Icjmmg32.exe
4072	Ibmmhdhm.exe
3444	Ijdeiaio.exe
2332	Imbaemhc.exe
3944	Iannfk32.exe
2264	Ibojncfj.exe
432	Iiibkn32.exe
2172	Iapjlk32.exe
2604	Ipckgh32.exe
2248	Ibagcc32.exe
1928	Ijhodq32.exe
1836	Imgkql32.exe
2008	Ipegmg32.exe
920	Idacmfkj.exe
4124	Ifopiajn.exe
3388	Iinlemia.exe
3464	Jaedgjjd.exe
1068	Jbfpobpb.exe
3632	Jfaloa32.exe
5008	Jiphkm32.exe
4776	Jdemhe32.exe
2984	Jfdida32.exe
4344	Jibeql32.exe
4216	Jplmmfmi.exe
3096	Jbkjjblm.exe
3708	Jjbako32.exe
3528	Jidbflcj.exe
3920	Jpojcf32.exe
2656	Jbmfoa32.exe
1180	Jfhbppbc.exe
1884	Jigollag.exe
2416	Jmbklj32.exe
2520	Jbocea32.exe
640	Kmegbjgn.exe
1644	Kpccnefa.exe
2680	Kkihknfg.exe
1408	Kmgdgjek.exe
3252	Kdaldd32.exe
2344	Kgphpo32.exe
2092	Kinemkko.exe
3696	Kmjqmi32.exe
4816	Kphmie32.exe
3128	Kdcijcke.exe
1200	Kgbefoji.exe
4108	Kipabjil.exe
336	Kmlnbi32.exe
4120	Kpjjod32.exe
4140	Kcifkp32.exe
3620	Kkpnlm32.exe
1788	Kmnjhioc.exe
1484	Kpmfddnf.exe
2784	Kdhbec32.exe
2340	Kkbkamnl.exe
452	Liekmj32.exe
3956	Lalcng32.exe
2216	Lpocjdld.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jchbak32.dll	Lalcng32.exe
File created	C:\Windows\SysWOW64\Bgcomh32.dll	Laalifad.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mamleegg.exe
File created	C:\Windows\SysWOW64\Kipabjil.exe	Kgbefoji.exe
File created	C:\Windows\SysWOW64\Liekmj32.exe	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Joamagmq.dll	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lijdhiaa.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Hbhdmd32.exe	4199d557cd47eb2cbec94c39af72ef0a.jaffacakes118.exe
File created	C:\Windows\SysWOW64\Bpqnnk32.dll	Ipegmg32.exe
File created	C:\Windows\SysWOW64\Kinemkko.exe	Kgphpo32.exe
File opened for modification	C:\Windows\SysWOW64\Liggbi32.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Lijdhiaa.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Lcdegnep.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Dihcoe32.dll	Nqfbaq32.exe
File opened for modification	C:\Windows\SysWOW64\Jfdida32.exe	Jdemhe32.exe
File created	C:\Windows\SysWOW64\Jfhbppbc.exe	Jbmfoa32.exe
File opened for modification	C:\Windows\SysWOW64\Jbmfoa32.exe	Jpojcf32.exe
File opened for modification	C:\Windows\SysWOW64\Kpmfddnf.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Eeandl32.dll	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Lklnhlfb.exe
File created	C:\Windows\SysWOW64\Lmbnpm32.dll	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Mlmpolji.dll	Hbhdmd32.exe
File created	C:\Windows\SysWOW64\Imgkql32.exe	Ijhodq32.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Imppcc32.dll	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Efhikhod.dll	Liekmj32.exe
File created	C:\Windows\SysWOW64\Kdhbec32.exe	Kpmfddnf.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	Ldmlpbbj.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mcnhmm32.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Iidipnal.exe	Iffmccbi.exe
File opened for modification	C:\Windows\SysWOW64\Ijdeiaio.exe	Ibmmhdhm.exe
File created	C:\Windows\SysWOW64\Gmbkmemo.dll	Icjmmg32.exe
File created	C:\Windows\SysWOW64\Kmjqmi32.exe	Kinemkko.exe
File created	C:\Windows\SysWOW64\Kphmie32.exe	Kmjqmi32.exe
File opened for modification	C:\Windows\SysWOW64\Kgbefoji.exe	Kdcijcke.exe
File opened for modification	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Onkhkpho.dll	Icgqggce.exe
File created	C:\Windows\SysWOW64\Iakaql32.exe	Iidipnal.exe
File created	C:\Windows\SysWOW64\Lddbqa32.exe	Lphfpbdi.exe
File opened for modification	C:\Windows\SysWOW64\Mkpgck32.exe	Mciobn32.exe
File opened for modification	C:\Windows\SysWOW64\Kdhbec32.exe	Kpmfddnf.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lijdhiaa.exe
File opened for modification	C:\Windows\SysWOW64\Mdiklqhm.exe	Mpmokb32.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Kpccnefa.exe	Kmegbjgn.exe
File opened for modification	C:\Windows\SysWOW64\Kcifkp32.exe	Kpjjod32.exe
File opened for modification	C:\Windows\SysWOW64\Jfaloa32.exe	Jbfpobpb.exe
File created	C:\Windows\SysWOW64\Gcdihi32.dll	Kdhbec32.exe
File created	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Eeopdi32.dll	Ibojncfj.exe
File opened for modification	C:\Windows\SysWOW64\Jaedgjjd.exe	Iinlemia.exe
File created	C:\Windows\SysWOW64\Njacpf32.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nqmhbpba.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Kbmebabl.dll	Imbaemhc.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Lilanioo.exe	Lgneampk.exe
File opened for modification	C:\Windows\SysWOW64\Lnhmng32.exe	Lilanioo.exe
File opened for modification	C:\Windows\SysWOW64\Nnjbke32.exe	Njogjfoj.exe
File created	C:\Windows\SysWOW64\Icgqggce.exe	Hmmhjm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5564	5148	WerFault.exe	214

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkankc32.dll"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pglanoaq.dll"	Iakaql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jeiooj32.dll"	Jpojcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbocda32.dll"	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njcpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfdida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdihi32.dll"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfcpncdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijdeiaio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfaloa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeandl32.dll"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geegicjl.dll"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncldlbah.dll"	Ifopiajn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbocea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocbakl32.dll"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnhmng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgnnhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iffmccbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bclgpkgk.dll"	Ijhodq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbcjkf32.dll"	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogdimilg.dll"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fneiph32.dll"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjlcankg.dll"	Jiphkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmjqmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhikhod.dll"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmpolji.dll"	Hbhdmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibmmhdhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifopiajn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 4144	3492	4199d557cd47eb2cbec94c39af72ef0a.jaffacakes118.exe	85
PID 3492 wrote to memory of 4144	3492	4199d557cd47eb2cbec94c39af72ef0a.jaffacakes118.exe	85
PID 3492 wrote to memory of 4144	3492	4199d557cd47eb2cbec94c39af72ef0a.jaffacakes118.exe	85
PID 4144 wrote to memory of 1144	4144	Hbhdmd32.exe	86
PID 4144 wrote to memory of 1144	4144	Hbhdmd32.exe	86
PID 4144 wrote to memory of 1144	4144	Hbhdmd32.exe	86
PID 1144 wrote to memory of 5096	1144	Hfcpncdk.exe	87
PID 1144 wrote to memory of 5096	1144	Hfcpncdk.exe	87
PID 1144 wrote to memory of 5096	1144	Hfcpncdk.exe	87
PID 5096 wrote to memory of 5104	5096	Hibljoco.exe	88
PID 5096 wrote to memory of 5104	5096	Hibljoco.exe	88
PID 5096 wrote to memory of 5104	5096	Hibljoco.exe	88
PID 5104 wrote to memory of 4444	5104	Hmmhjm32.exe	89
PID 5104 wrote to memory of 4444	5104	Hmmhjm32.exe	89
PID 5104 wrote to memory of 4444	5104	Hmmhjm32.exe	89
PID 4444 wrote to memory of 4908	4444	Icgqggce.exe	90
PID 4444 wrote to memory of 4908	4444	Icgqggce.exe	90
PID 4444 wrote to memory of 4908	4444	Icgqggce.exe	90
PID 4908 wrote to memory of 1996	4908	Iffmccbi.exe	91
PID 4908 wrote to memory of 1996	4908	Iffmccbi.exe	91
PID 4908 wrote to memory of 1996	4908	Iffmccbi.exe	91
PID 1996 wrote to memory of 4564	1996	Iidipnal.exe	92
PID 1996 wrote to memory of 4564	1996	Iidipnal.exe	92
PID 1996 wrote to memory of 4564	1996	Iidipnal.exe	92
PID 4564 wrote to memory of 1616	4564	Iakaql32.exe	93
PID 4564 wrote to memory of 1616	4564	Iakaql32.exe	93
PID 4564 wrote to memory of 1616	4564	Iakaql32.exe	93
PID 1616 wrote to memory of 4072	1616	Icjmmg32.exe	94
PID 1616 wrote to memory of 4072	1616	Icjmmg32.exe	94
PID 1616 wrote to memory of 4072	1616	Icjmmg32.exe	94
PID 4072 wrote to memory of 3444	4072	Ibmmhdhm.exe	95
PID 4072 wrote to memory of 3444	4072	Ibmmhdhm.exe	95
PID 4072 wrote to memory of 3444	4072	Ibmmhdhm.exe	95
PID 3444 wrote to memory of 2332	3444	Ijdeiaio.exe	96
PID 3444 wrote to memory of 2332	3444	Ijdeiaio.exe	96
PID 3444 wrote to memory of 2332	3444	Ijdeiaio.exe	96
PID 2332 wrote to memory of 3944	2332	Imbaemhc.exe	97
PID 2332 wrote to memory of 3944	2332	Imbaemhc.exe	97
PID 2332 wrote to memory of 3944	2332	Imbaemhc.exe	97
PID 3944 wrote to memory of 2264	3944	Iannfk32.exe	98
PID 3944 wrote to memory of 2264	3944	Iannfk32.exe	98
PID 3944 wrote to memory of 2264	3944	Iannfk32.exe	98
PID 2264 wrote to memory of 432	2264	Ibojncfj.exe	99
PID 2264 wrote to memory of 432	2264	Ibojncfj.exe	99
PID 2264 wrote to memory of 432	2264	Ibojncfj.exe	99
PID 432 wrote to memory of 2172	432	Iiibkn32.exe	100
PID 432 wrote to memory of 2172	432	Iiibkn32.exe	100
PID 432 wrote to memory of 2172	432	Iiibkn32.exe	100
PID 2172 wrote to memory of 2604	2172	Iapjlk32.exe	101
PID 2172 wrote to memory of 2604	2172	Iapjlk32.exe	101
PID 2172 wrote to memory of 2604	2172	Iapjlk32.exe	101
PID 2604 wrote to memory of 2248	2604	Ipckgh32.exe	102
PID 2604 wrote to memory of 2248	2604	Ipckgh32.exe	102
PID 2604 wrote to memory of 2248	2604	Ipckgh32.exe	102
PID 2248 wrote to memory of 1928	2248	Ibagcc32.exe	103
PID 2248 wrote to memory of 1928	2248	Ibagcc32.exe	103
PID 2248 wrote to memory of 1928	2248	Ibagcc32.exe	103
PID 1928 wrote to memory of 1836	1928	Ijhodq32.exe	104
PID 1928 wrote to memory of 1836	1928	Ijhodq32.exe	104
PID 1928 wrote to memory of 1836	1928	Ijhodq32.exe	104
PID 1836 wrote to memory of 2008	1836	Imgkql32.exe	105
PID 1836 wrote to memory of 2008	1836	Imgkql32.exe	105
PID 1836 wrote to memory of 2008	1836	Imgkql32.exe	105
PID 2008 wrote to memory of 920	2008	Ipegmg32.exe	106

C:\Users\Admin\AppData\Local\Temp\4199d557cd47eb2cbec94c39af72ef0a.jaffacakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4199d557cd47eb2cbec94c39af72ef0a.jaffacakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\Hbhdmd32.exe
  C:\Windows\system32\Hbhdmd32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\Hfcpncdk.exe
    C:\Windows\system32\Hfcpncdk.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\SysWOW64\Hibljoco.exe
      C:\Windows\system32\Hibljoco.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5104
      - C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:920
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3388
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        26⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1068
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3632
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5008
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4776
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2984
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        35⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        36⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3920
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2656
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        39⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        40⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1644
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        45⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1408
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2344
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4816
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3128
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1200
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:336
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4120
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1788
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1484
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2784
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2340
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:452
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3956
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        66⤵
        Drops file in System32 directory
        
        PID:4936
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4336
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        68⤵
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        69⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        70⤵
        Drops file in System32 directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2296
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        73⤵
        Drops file in System32 directory
        
        PID:4528
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2536
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        77⤵
        Modifies registry class
        
        PID:4536
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        78⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        79⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        80⤵
        Drops file in System32 directory
        
        PID:1328
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        81⤵
        Drops file in System32 directory
        
        PID:4520
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:468
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3536
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        84⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3684
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        86⤵
        Modifies registry class
        
        PID:412
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2468
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2068
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        89⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        90⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        92⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        93⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5464
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        96⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        97⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5820
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5904
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        110⤵
        Drops file in System32 directory
        
        PID:6124
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        111⤵
        Modifies registry class
        
        PID:3148
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        114⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        115⤵
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5500
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5576
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        118⤵
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        119⤵
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        121⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        122⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        125⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        126⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 400
        127⤵
        Program crash
        
        PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5148 -ip 5148
1⤵
PID:5368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hbhdmd32.exe

Path C:\Windows\SysWOW64\Hbhdmd32.exe
Size 52KB
SHA256 be7cc1155136c49aa8420441bea309964642fe9e31c6e6526eb6d503d8f09443
MD5 2d0a219c088760ea4f69af161757c836
SHA1 9bdccffaf40001c99ebc99c0f7a70eeca16e80de
SHA512 5f64795ef6c461ed09f75587cdd4dd34cce12f256d09a088ecb2f1d408237b889fc5605882b047af7c6d2a0281049328bbc7596a33f7ed71fbfb440b8e0ede2d
SSDEEP 768:Xchy1w0whmv77hRB9uYt4V0U7l5sjYymqcgki+iK3ISPiGJnnnnnnnnnnnnnnnnP:mbo77uYt4VH7lUYG4inmIiimGj9w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hfcpncdk.exe

Path C:\Windows\SysWOW64\Hfcpncdk.exe
Size 52KB
SHA256 4c75c484e764714d7e4eeea112efceae7d248ec4979dc5cfd213bd70aef71b8d
MD5 2e63c91727602303794af5d3e8c7c5cc
SHA1 c13c311880a65393df48501cb8a5cab6d7dec0d2
SHA512 33e438008fcdbbf82fef5c5c9d277605d42ca7476b8f8282fb18d4cd01ce0f649b21c49ff4590379e004df82cc56e2680f068c38b2f4246f19c67b02812ba49e
SSDEEP 768:q2lfn8uYwpgl3bCL7fHWPp2esxDEAuXNVz4sj4LurQOWanPvTzbIXnx/1H5:xSuYwXLDep5u4h5CMQOW0PvTw3z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hibljoco.exe

Path C:\Windows\SysWOW64\Hibljoco.exe
Size 52KB
SHA256 4b39e959a16d8f7529482a9aae8726d0c8b825e9feee6ae1905888ff5d2cd054
MD5 d6f238f518d0bb4c8109c3954517f1a5
SHA1 31661beb7ebd48194a2e2e98997e7ba15b7847f4
SHA512 e424f370298b788c047143b9cda70293fbda58a84a3f11ec617bda398640991a2a8348fadcb098c8096ba776542b9850db0fc6b1e8c1cfb1ed4934ca9ce27828
SSDEEP 1536:f5Ozl0pgjcWbZQgBUVDZGgFjSM9MFcLw1seExR7gVj/x7:xel0iwWNjBUrGQjSM9MFcL4seEGj/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hmmhjm32.exe

Path C:\Windows\SysWOW64\Hmmhjm32.exe
Size 52KB
SHA256 68f472612d0dcd366261b1c7c6e3bbff97efa78759e2ebedb42f16deb55f9963
MD5 b078a11e7312ab5fdbf32f7ca86c1427
SHA1 2017fd5564c2dff83bc1b75f6a2f457ae28e57b3
SHA512 df6c5cbba3d8e8c55d421009f86d527a4d7854290f83ee92a51a0dca98ac4647462d5e0042a5d4a25f913df8a17ab20214f8898e49caf7b8f6ed54f7c258ca38
SSDEEP 1536:9LCOMPmkgqaSZAbsi+k1vLuAHarRWIReecFnfk+o:Yb53aSE1T7ecxkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iakaql32.exe

Path C:\Windows\SysWOW64\Iakaql32.exe
Size 52KB
SHA256 51ddd9052129e63fe648d35d501b6b4a6cc574b80d191370432f11af0908b34d
MD5 00b65af662e236125d0fc80856496262
SHA1 31aabeb5ca609fb6809e26622a3fc423bd724def
SHA512 04c6cb42e90dbf10ab673baca983e5c48e92b71530b1d981085659dc9bcbe6c6498cf9adc6604a461e21e988770236c3d458d442ce59327d6bd22465949f370b
SSDEEP 768:QBqyXjKfNOy93CUDmvMSVWO4VyRt7NGAoDOQ2LikTkwccuRNzKC/1H5:QLWfPyVr4RDh2Li3F9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iannfk32.exe

Path C:\Windows\SysWOW64\Iannfk32.exe
Size 52KB
SHA256 11d20eb47328dd453f5f274d735092da194184c374a06e1530e4442d06e764cc
MD5 0d8127e220890ee456e6cc5e5a4f8ed1
SHA1 a300995126923f100f3c3e3ed2a88895c773069f
SHA512 088ea2396665c6ecb2c0c7da1c6af45051ac47adc68d6fdb94ff7fef6bb811fa1873ef0b4d0e327cde217780a25843066fdd86cf9700388fb57f0a451527735f
SSDEEP 768:KKGFcAd9Z+THJqy1hncyYUAAEi+DFokqQ27tfJdx6NlkL6L+/1H5:K/cAhGFlYEEi+DFokqQwt16kL6Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iapjlk32.exe

Path C:\Windows\SysWOW64\Iapjlk32.exe
Size 52KB
SHA256 9acda0d1de2ed442344f89319a1f1b18b8a43ebd731b5440cd514383ba997282
MD5 f53938930e0d341a069952874dab6208
SHA1 06b13f4ab54a5438f92bf2117848a214a0306319
SHA512 ba170f6f2f9b2d43c29ead442fc7e853976b9eb8050a1c63c8a29b4947e2404eb754a350813651341f6c88dcd95937e9c481bd0ed41aeceb2caa772a306f7e7c
SSDEEP 768:1RMf2Tf0nq9d26EYbfRfQqIb7hE6I5zKddzQManxJctruOmHtjTTTTTTTTTTTTTN:1RE2Inq9LEY91IvhET24OmpEGVD8G+I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibagcc32.exe

Path C:\Windows\SysWOW64\Ibagcc32.exe
Size 52KB
SHA256 612b2a1cf4b71b3dad0f555293187d66ab772f163f1dc703bed6539b54b5dacd
MD5 bd7f192254838d4eab0a22d5dc49a6b7
SHA1 1145e8d1c8817ef8f2574341295f3938a876a4a1
SHA512 b61ada2ac8248f9127d93773403094567f49c12ff96b769f2620fbd77fc496c4320237cfa82ead0557cd955ec4b237362e8cf1ab92c24c28429a7fa1ba4bcebe
SSDEEP 768:qjzyBcAtqMoFkTXjSL1GH+FausJewOsVHI+z7I/1H5/:zB+ibHeaTtF7CZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibmmhdhm.exe

Path C:\Windows\SysWOW64\Ibmmhdhm.exe
Size 52KB
SHA256 59fa8f6390f18546d461ea7da77ba36787447301f6d0b3fec18b371eb81e1631
MD5 58f4f67a968cf7fdb8a63e8d71b8470e
SHA1 0c24a8090c397c1b4dcf365888085e9425546558
SHA512 d811751fbe3a72dd631984827caa24430c5f1aa3a4d3e8b5379d18344fe919c228fcb4f40bd1563815443d270f1f3099cae936a6b2712fb71d67938e2d5d3a77
SSDEEP 768:JgfomTNzn/DrbvfPr9jpKvboEiSGpC90t11P3Y8mN3YoLXO9/1H5j:tK/jfD9luboE2C9A11wHIGe3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibojncfj.exe

Path C:\Windows\SysWOW64\Ibojncfj.exe
Size 52KB
SHA256 d2f469c5d432e7d79351f974ad81e274a77325a3db8b31bc840dd0a5909ad79b
MD5 fe8d9ae19673cc5ddf5cd2b89f2e18e1
SHA1 c86c32e0de662d99106fcd1620660adf5da69b9d
SHA512 a025d723394cf04f2230ead336aee4c8bf0bb0c0c7d613954cc248e773863d5d375c2fb2892a8cea20b894d17668ce5cda8745911739fb73793f2f6dda817fbf
SSDEEP 1536:EjwT6lIRfDSgSglrU3HfhSO2VUADsC79piOXDIR:EjwT6M+gEHfKdZ7LisDk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Icgqggce.exe

Path C:\Windows\SysWOW64\Icgqggce.exe
Size 52KB
SHA256 ad935413e3fa51aff31403e2977db83cba567c156bc46c3096fd5b4d07c457de
MD5 cbc1a25ebf5f985dea3d9100806a6b05
SHA1 899095a0d5bc0232ad62ebc00d5a874b16e8a41a
SHA512 705f85dc5e3e2466e3e8f50621400b3019c31c413c2d87f79e02b26c077bd9aaa1f0e5e6e9fb163d0906642998cf68d2383afed37baf33d84f99a27afa94d5ad
SSDEEP 768:mNu6LUEcHIH0pzDIUnrH5aodjql2ZGwFov+DS8MI2ylwAUudRs+ONc/1H5:mNLnUpzDTaodjqlAGoY+Wc3m+We
MD5 SHA1 SHA512 SSDEEP

Submit Download

Icjmmg32.exe

Path C:\Windows\SysWOW64\Icjmmg32.exe
Size 52KB
SHA256 d1649ce8cf50d1ff4b079fd6228883e50a20dd64ecb29a0a6c1772864224ef39
MD5 2cc65887dd4a654716e8bca454212220
SHA1 9e5812c5b4dee4e931ab722172f1044bf8886a28
SHA512 b3770e7b59a30fb21ea76e0b90f760cc6ad1119d67bf7f46d14faaeed65e75bd06e2d4c26e03970564c3afb50f1fd4a7ee85a40740931d7bc399b4f25d9e476c
SSDEEP 768:Q3j01xuxLIVCL4sJUZZqygPCI7CnNW4xCm5SW+7sTCrMFwftA7SuSL/1H5:cInuxLYCL4unyg0GcX/GtA7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Idacmfkj.exe

Path C:\Windows\SysWOW64\Idacmfkj.exe
Size 52KB
SHA256 b6ff67f778d7a6a41cafbecba48d02de9a9c75437d1385ddec184db161069eb4
MD5 27d26df4ece3012bf537915f5728a678
SHA1 43d31fec87b9e82b2263387ef5b0f58ba75cc457
SHA512 909cc90a08a9e6ad71879b79d3558e21d2264d810afa725404fe696a4a2e0a3097945a73c974acb1777e2ba6dee4990656af480a3bd054f9affac4650d3129ba
SSDEEP 768:EtjT/sM7/W47epIXuZeJ1+MclcZVSeOAFQxPVoCv5DdeV6OW/1H5:EtjT/b7+KeCu46M56eOAuxPVo+U8OM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iffmccbi.exe

Path C:\Windows\SysWOW64\Iffmccbi.exe
Size 52KB
SHA256 ef9cf15953eb385a5315b26c8bab0fd7bdbe398e40fb860ece8abb9b1b3c0f5b
MD5 db5cfd3aee5f57ec50301954cf47ddf8
SHA1 2db3767ff471ccaef1457f0cd4ba712c3ffc9820
SHA512 2f4ab29e772c8f7dfe4ab9aef32765cc77b15bf97a5d6ecb4ff7c81d4679c50466a5358b691b676c07b7573818ee22dd1979feed2ad2204fc62c777a2d98ff58
SSDEEP 768:sNcTkTgwPBx6v3f98GdqMTx+tN6nvJD73kKDSUG2MaceuIs18y77777777777770:2caBU31qM1/vJ/kBFZa3uRy49/FhC/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ifopiajn.exe

Path C:\Windows\SysWOW64\Ifopiajn.exe
Size 52KB
SHA256 93f90d590b8f86ff6c3720d8d34ce74c73d97840756569f137bff0b5560ef728
MD5 bbcc307cb0a69e66f20dce4d9eaae34d
SHA1 95cbc9f7692476c05dee70bbda0b0379173987cc
SHA512 00c2e855d8f0ce12537eb1051e64445dd8ebdc49ab9696fbbb797fa08bc312fc287b31e52f2bed6c76bf08fe51cda1024652028d7c1a3ac83ea703b7b5fd5b83
SSDEEP 1536:a8lMXqkYmPSoEeD7Vlss7HUMdHk6hKjBcSfJ:a86qHYrXVlss7HUMdHkpjR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iidipnal.exe

Path C:\Windows\SysWOW64\Iidipnal.exe
Size 52KB
SHA256 323a45af1b67382ff170bc51f7419b64c61581d9dfc5eefaf9cddf7a068a5350
MD5 5078a2428ae3f9f5375a5ec928dfdf3a
SHA1 01da8dd9cc9dcbc9cf956bdd33869035f9b5db51
SHA512 9c426f3a16c58ff0a78a50692f48953c3a8543b6af36b10b17429c37fdb220838decf49a98c43adb02450d3349be8f394159883752cad7db6d92219d9264bb12
SSDEEP 768:R0Ufxgv4Sr3VYDtRzj+Lag3oNmOa6Sra0lYSoyxSmkplnzLh/f5M8Npj9APf9PgV:RDxgvbVmcaYoI5EzN/5pj9QVxE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iiibkn32.exe

Path C:\Windows\SysWOW64\Iiibkn32.exe
Size 52KB
SHA256 f003920ee133e2684fd832a39b6a45c9883b983eed8cb8ebd0d0529e8edbd373
MD5 118efe79b91ddf40b02499b07b79fe09
SHA1 367bf702e5521964da367d0beb01415d3c8a8c80
SHA512 41b1378415f666bb6addf714e05a16fdee61fcabcd458a662b58802155587c6633ac1bfd95e192656bba09816eb25e72ce03c2d317fec5806b129b4024344cc3
SSDEEP 1536:eIsiRIdbiwEBNr4Trel3mqCOcibulmnA6LX:jGuWwnA6LX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iinlemia.exe

Path C:\Windows\SysWOW64\Iinlemia.exe
Size 52KB
SHA256 841cdbac1f8a07807fe758d87dfd517a2dbe6a45f04bfa1af8ef1c8cbda30921
MD5 b99d144c2331fd7085ca8791332b1ada
SHA1 e700218b6136b6cef1f7b70faed90badc6ddd388
SHA512 3ddba10f196ec64e5798940611db4800394a170fd528478486414e1f075691d933b38c9db996f8be7929a56de8666c395a1212fb733bc41e1510b7d38fd2d7c9
SSDEEP 768:ITIZvi+pFQ0mZ6A5eZTG75U2ob1p+WyWYqE9Nnf8iUenOGzNhaGnzeh7Si/1H5:6Z/0mUA5eZE5U2ob1p+g6LfrTKoeGg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ijdeiaio.exe

Path C:\Windows\SysWOW64\Ijdeiaio.exe
Size 52KB
SHA256 9651b90fdc32e8dc6d9f7dda8cd3057bc36a634ca1cede23e820c9ab832b5cb1
MD5 5f800dc1b32bb34b78c12071bed6c05e
SHA1 73bd01c6c6b70ba45dc0da3998c587fc4e301de6
SHA512 9a673e9e7c67748e993fb2194c82f2ee4df997fb924f690c48563bbb0dadd85ccd723e6253bd5f597f79839d15123be72ec3396932a83cfc861eaea66a00329f
SSDEEP 768:BpmaamrF4TWRQ2q3JDC9UYUwSVNgB8Hx2HcC4bMDdaqB85JrFx/1H5e:BwaamR4TW83JDSJuVvOcC4s+5JrdI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ijhodq32.exe

Path C:\Windows\SysWOW64\Ijhodq32.exe
Size 52KB
SHA256 ee9ca684be15d56c5924394f660e5016080ac83331e7d9e5cd894cfb17f1507e
MD5 f0dea9fa2524c0c91689010cc73b41ff
SHA1 0b4612df013a8bf69c11f37cf1e5b215b2e6e31e
SHA512 2be9475ba0808e30b2f16a4675ab49a4dd83386089c970fbad72590f93f0f89608817cf7b0df519b5a498911ced76207f7e93e42a3dcb117b49eb7ed523d808e
SSDEEP 768:F7ocAbRY25gg+qgJPsi3P9nilMsSk9oHJSVqCfjQbkOo3ZRw1nfb/1H5A:FLAbRL5gg+Ji+i9oHkVqA0r8ZROfpC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Imbaemhc.exe

Path C:\Windows\SysWOW64\Imbaemhc.exe
Size 52KB
SHA256 9c52afa2094dbad019681633d5beb7cc97e53ba6977fb35a7daf51f071ccffc3
MD5 c3c76b8529d425854eb920140575bf2b
SHA1 1420ab6d7eb9ad8939ed001a0c70e25070de39af
SHA512 4812653aed0fb50c8ce3b6c636d8ad24153f49b146164dbe7cb0a68dd17954aa73c4ddaf77eee7482539e6d3ed8b3b0e4f0b16a7dd1c11fb8ffc3fbfaa6c7858
SSDEEP 768:QxzIisiPmMbg5+hTCzyHS3T5tVtBe+OHAoA+UD2Dz/aUxo7HFh2/1H5Fz:4zkyg5ry2T5FsHA0zyYo7lyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Imgkql32.exe

Path C:\Windows\SysWOW64\Imgkql32.exe
Size 52KB
SHA256 bfecd40ad8b404b2271294cd8a2db968d3cb00ef841edcc931c4ffec549f962b
MD5 0768a311dfbba664982ffcb721f20183
SHA1 bf4204088a4347730a8df64bdec3b2efe16a4601
SHA512 fb3c3f2351598635d8f7b86eb578b60fa248bed0147d2b8c0fd7599e2982be5183618d9beb292b2e7ddf2235e5f757c0abd925000d2cf7bd664a1a4b97812226
SSDEEP 768:pIELTQTvWpU+iiYMbrMtQLhoHe0TgGSCt0H8Jp22cj/1H5:pRTXU6r6QodgGjt0H8JpPcx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ipckgh32.exe

Path C:\Windows\SysWOW64\Ipckgh32.exe
Size 52KB
SHA256 8aab3aa802b360ca332a38c6c73c5a293c39c07f9c0fab56c1ea6c70c6daa595
MD5 ce7a9ebdadb4b0ca34ad8a768e6ddb3e
SHA1 66d1f77ade0af8aa047ce7933c267ed282ae92bb
SHA512 216e4c82ba60c553fd637140ed6ea734284467ede5951959cd0ca08c0c0f1a11ae02f1ea73c24f38fae68995e4937e3332e110ecb87cc4e12d6bb4aac2b39c8e
SSDEEP 768:xVahrXCe/NPk4uw3YUevxzQlDMJCalkk9lpML4enV2Si9yxEHHnHHHHHHHHHHHHL:G9Ce/eHBUeJzTJhPXSiAxpVznc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ipegmg32.exe

Path C:\Windows\SysWOW64\Ipegmg32.exe
Size 52KB
SHA256 740c8445018a3d3db751f90afa44cb1e4191cbbd11a2d3b4e2be24a03d77533a
MD5 ea8bacf50c693f519f5af32f325fd4fb
SHA1 4358125efcb0e293b101d9b1000370613b396eb8
SHA512 24ceeafbecd1df1639603f5cad9aa573e1369541c52b812a2d242a26bfadf35545d5d94abaf4ceafa87756e335f09606be066955d5a4e2258ff510b42607e6ad
SSDEEP 768:SPZVddrw1xp2+ZaAJDPAKRl3SzENhFmje/F7J2y9oxkydBqvPL/1H5j:iVk1xZSKRl8EA01900Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jaedgjjd.exe

Path C:\Windows\SysWOW64\Jaedgjjd.exe
Size 52KB
SHA256 41deb352fec6977a435284d48c2882a0fc88bb3d3df9ee37f5ff4a26ac5969e8
MD5 4eaa947c08daf26ad6319f3ae1e13ee9
SHA1 e2417e14ee4c260c447fbf62f9b6c7910159ca0c
SHA512 63d1ce42d6fb830d90382f060d68208bdca306eab36a86828fa1062c60b4e8a6fc5b19608e334c90f8cf1c9bdd3e2b5f9380aebbdb9aa0f0687a05ed2a8c293e
SSDEEP 768:/P1bCoPlldLdvNuqC3xHG08vNLxeNCVtcxxPyIJRH5El4/1H5:/zNldLdv4hHG08feNCVtcM8RH5Oy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jbfpobpb.exe

Path C:\Windows\SysWOW64\Jbfpobpb.exe
Size 52KB
SHA256 8210388e2b01cc1dcd011f1dece6c1cfc8b2c167ae85409fb299e119f3125521
MD5 85a197b814090c45542a8b5638fbe4ca
SHA1 221afc965d042cba98d65f487d3725453f505a3c
SHA512 7714e5299ce33c7da5641989e1a7a571b49dffc2c0f54e2001421be8d47b6af10c809167b8bbf9af25a495eb0129b0c5a9f5daf575d6a0f23fd058166675cffc
SSDEEP 1536:Rjv6uiqtNClLb+jZR6XCnbUOGvC8RHv048:lv6KljP+C8RP0x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jdemhe32.exe

Path C:\Windows\SysWOW64\Jdemhe32.exe
Size 52KB
SHA256 7f03c7e37865d4d157ffb223aab787d4d6b02439d40022a95a2d1343158e178b
MD5 6ab25f00fd33d3d8697c29e793626d05
SHA1 bcc667de90f94f925529fca7a08d161a226f4a29
SHA512 fe528d46ff5d07131dbd1a5da6ad5576ba54c2204b10b638cfc5842713fc676e6d5dad61fe33a306460f5aed92939d788f2fdc604d8a10a2d174ca8393504ac9
SSDEEP 768:0TT2oRP+cBj5VufFEe2SVpH1T1unGbXG3Iyexu5Iw1dM5WX0/1H5:0TTBRP+crVKtRunG7G3HexqBdW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jfaloa32.exe

Path C:\Windows\SysWOW64\Jfaloa32.exe
Size 52KB
SHA256 5bad2600e78194ea15176e68fff57aa5b3fdeedcb12b6c3db99137ce4062257c
MD5 f815d07bee11ea8cf7b386bf3bd779df
SHA1 442aa02d09f83de8b646510ced4a401cf35bf8f4
SHA512 2acde3b3590a2ec64a23b3e8f9e4d24dcb305dbde87a03081e32e0607d1db2612fc06b33dc4e0f4c86d00f86e4b072064b64c4d83644a8780f785ad8e6489ed9
SSDEEP 768:Shsn6gmYZ4wIMYZU4LY11qeIh+mlBBMK+wkGERbO24Ufcw42YR5TJ/V8B6ppg/1r:dRxYW4LY1Y+QBMRw9ERhJcCYoBf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jfdida32.exe

Path C:\Windows\SysWOW64\Jfdida32.exe
Size 52KB
SHA256 3aa1a162da54deeab1a9c2151aa903cb47fdb629aac57b517cd148cd4782213e
MD5 60cdfe7abbb829afeabc59f3772ad2cb
SHA1 c46ccc8034c6b4ac40ffbc07dc857591bc7ba305
SHA512 a939f6340581eb10944f200dbaa630f87aa78199602ddd6fbc4c0c8fc90a4e4ad78f96b6e1b0c60ea749c6bc0841513e7b8f43d5199b515388f6ac78751b67e0
SSDEEP 768:sQcf7hqjSgOUVfKo9taVr7HUEiV5W4dXonGwbawd2tEKOM0v3Zx/2dmpm7ogh/1Z:svTg2UVfK5xL7iVBwPB133O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jibeql32.exe

Path C:\Windows\SysWOW64\Jibeql32.exe
Size 52KB
SHA256 32dca428f1c000673205eaa5f166d220b87ea3b19e84d276f81a485a63938d6c
MD5 a2cc90e60f91d65b6801359c2250eec8
SHA1 a3d03203c4d8c7e681c9993bc73b86208f962e8f
SHA512 4369ee33ea3a1ae24a15f1442dbd7cf3cb01e24d868c8e74562d77758b4c76322ae64415c817fa1e6af78db757b621c1f73269ca6fa073efe67cc3e895037265
SSDEEP 768:nA7xhl3pO7sQdBjrdt+afA71JIg0qyizN/R+ly+SXzLY/hk/1H5:A3VasQbjrKOAhJJ91XzOhG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jiphkm32.exe

Path C:\Windows\SysWOW64\Jiphkm32.exe
Size 52KB
SHA256 5fdd6def08b99a9bed3fc7b1b1173ebc3c677f303d2f8579c34c006e064886e3
MD5 4dc2efe35d46785cc8836d77319dbfd6
SHA1 5ed589d116d7c6edc407f8415af06ee309351ba0
SHA512 be8cadecaefd881b4387c95d0d6a061eb7e44345428d22b43a53a48083a82c126efb2d99e60f361068311c5d98d75ce1c98055b179e02f5c22721a176de3b189
SSDEEP 1536:UYmRxkql4oqrQpdkeioEaT3H0eGpI/5OOJP0:U5xkhQpdkeixaH0Q5PJs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jplmmfmi.exe

Path C:\Windows\SysWOW64\Jplmmfmi.exe
Size 52KB
SHA256 8b2f1f4a533fc4434983db00bcc2dc03823a7136ca00fa831710fc36bf1994cd
MD5 3a7e33483875858af4b256bcb1bcd5d7
SHA1 d0a03b7f60b938228c54b717958b852da2afd7c7
SHA512 b973be1f7b5ffa5c580cc0b71812c4d35822d8f2bb5e10761dccec33284e68fc39f05f5b1dcbc85d9733fa044b2059a0a2ff46037ec5658c3f3c5fffa59a56d0
SSDEEP 1536:SdLfSd/EMjXy5wAVR6cfgcZai8SbBXq5CJ0R27WrN9:SRSd/EMjXvUHhmI76
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmegbjgn.exe

Path C:\Windows\SysWOW64\Kmegbjgn.exe
Size 52KB
SHA256 f2debc88d951512d1d09f1ab6e0b585d0d3303e3ddd917907c65dcfab3e703fc
MD5 4889ebe64377835f33e41f2110a48b3c
SHA1 1f9fe7431f1e5eb5c10e179fa6e300508de04b0a
SHA512 d56ce6f700398f89f9d5d723103b5da066c4b7294d9707c87529abd3008575f103dcff6138ac85efcb58b2586293a4053525f1c1980ca4967c6de12232d87b77
SSDEEP 768:FvxCetqBAV7NiuBXxaTeBGDR0J34WcI6GBfWGhMi72U4gK0uE0Aqghu0Rz/1H5:BUe1bBXgKBoRgIfwfPhMi72RQuoB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maaepd32.exe

Path C:\Windows\SysWOW64\Maaepd32.exe
Size 52KB
SHA256 27328ab6a0b15f876730203362323502e41d779427c3cb23861e368d1ac3220f
MD5 a44b0b58d4198b26c592a6126d1ed82c
SHA1 09f2997b12805c9879204349fb4ef7c1ecf11414
SHA512 d976222ad18ee858f4b8b723610288606c3c1091655c3a9a3b90517d8a113400359ede9d4a514e3fd9605977050a60bd18fc3cd079ba117b07f3861a89ddf6f7
SSDEEP 768:bSPwtMmvOnsracWq6aReWZk5H5pLCYYeSj3LRdIy/1H5:24tM4O5O6ok5H5KljIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngpjnkpf.exe

Path C:\Windows\SysWOW64\Ngpjnkpf.exe
Size 52KB
SHA256 87e982f5823221422134cfdb7e96588f182d69e4ef7ba980603146ffbd642bc3
MD5 d3a55230534e9bceb8408ec8330dc37b
SHA1 0bdd66268b0b32cc6225639c39456ffb8ffe4e71
SHA512 c5aebacb8c78bc1e7ce54407ada4ba27638551e82daef0c28154240e33b07ca9066ddd9f0893a1bd03a1a9cd03908b91f874b36e33ef0e167829c0273916bf1e
SSDEEP 768:eWaIwNfARn19l5tJykkoZR4p9UKKTrBHNKKXul/1H5oi1:DzRnhYkkoZRGUz9NKKe/3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/336-388-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/412-582-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/432-120-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/452-441-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/468-555-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/640-316-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/748-565-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/748-915-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/768-530-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/920-176-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1068-213-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1144-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1144-564-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1180-296-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1200-376-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1328-538-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1408-334-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1452-502-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1484-422-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1616-72-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1644-322-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1788-416-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1836-160-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1884-298-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1928-151-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1996-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1996-592-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2008-168-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2068-910-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2068-593-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2092-356-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2172-128-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2216-448-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2248-144-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2264-112-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2296-934-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2296-490-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2332-101-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2340-435-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2344-350-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2416-309-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2468-585-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2520-310-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2536-508-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2552-472-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2604-136-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2656-291-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2680-328-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2784-424-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2984-239-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3096-262-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3128-370-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3252-340-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3388-196-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3444-92-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3464-200-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3492-553-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3492-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3528-274-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3536-563-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3620-406-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3632-219-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3684-576-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3696-362-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3708-268-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3920-280-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3944-103-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3956-442-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4072-80-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4108-386-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4120-398-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4124-189-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4136-484-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4140-400-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4144-8-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4144-562-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4156-532-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4216-260-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4336-465-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4344-252-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4444-584-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4444-40-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4488-466-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4520-544-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4528-496-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4536-520-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4564-64-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4632-518-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4776-231-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4780-483-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4816-369-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4908-591-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4908-48-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4936-454-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5008-223-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5096-28-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5104-31-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5104-580-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5168-604-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5576-866-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5688-892-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/5776-888-0x0000000000400000-0x0000000000431000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads