35e94aa0377e15e05541091bda302f3e477bbf0ea7c2817af5d05b627faec8a0

Analysis

max time kernel
138s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe
Size

92KB
MD5

4468ad36dd57159f1b157b834cc65195
SHA1

c6117868b42577f1ffee2225c7235a882463c808
SHA256

35e94aa0377e15e05541091bda302f3e477bbf0ea7c2817af5d05b627faec8a0
SHA512

65995a898653b7cec37c1bf06fb8a7bb46cdfaf905c38e2eef2d896099d33c44e2c04db7a636a7635f12e6c0af444867570aed28277e27837651b569ce888fc0
SSDEEP

1536:on0obu+XrLt0/l0Zxmg4yULy8R1ehCnOFjXq+66DFUABABOVLefE3:lr+1W6OxXeHFj6+JB8M3

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebploj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gqfooodg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmapha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Habnjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffjdqg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gppekj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibccic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaloa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmegp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjcclf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjapmdid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hadkpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imihfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmkdlkph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpihai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmpngk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebploj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ficgacna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjcclf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcnejk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fomonm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipckgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpeepnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgfoan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eodlho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liekmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfachc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipegmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpaghf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbgbpihg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfofbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqciba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqciba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjnjqfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfdida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgikfn32.exe

Executes dropped EXE 64 IoCs

pid	Process
4608	Ebploj32.exe
4440	Ehjdldfl.exe
3108	Eodlho32.exe
2188	Efneehef.exe
756	Ehlaaddj.exe
2676	Eqciba32.exe
1036	Efpajh32.exe
3892	Ehonfc32.exe
1152	Eqfeha32.exe
3040	Fbgbpihg.exe
2144	Fjnjqfij.exe
4596	Fmmfmbhn.exe
4124	Fcgoilpj.exe
640	Ficgacna.exe
4476	Fomonm32.exe
1604	Fbllkh32.exe
2292	Fjcclf32.exe
2884	Fmapha32.exe
4720	Fckhdk32.exe
536	Ffjdqg32.exe
1828	Fqohnp32.exe
3692	Fcnejk32.exe
2564	Fflaff32.exe
3696	Fijmbb32.exe
2352	Fodeolof.exe
4548	Gjjjle32.exe
868	Gqdbiofi.exe
1168	Gcbnejem.exe
2836	Gjlfbd32.exe
4376	Gqfooodg.exe
3444	Gcekkjcj.exe
1180	Gfcgge32.exe
3644	Gmmocpjk.exe
4524	Gpklpkio.exe
2684	Gbjhlfhb.exe
5008	Gjapmdid.exe
4496	Gmoliohh.exe
2088	Gpnhekgl.exe
4664	Gfhqbe32.exe
2840	Gifmnpnl.exe
5096	Gppekj32.exe
4648	Hihicplj.exe
3884	Hfljmdjc.exe
4928	Hikfip32.exe
3448	Habnjm32.exe
3652	Hcqjfh32.exe
3940	Hfofbd32.exe
2220	Hmioonpn.exe
3800	Hadkpm32.exe
3064	Hccglh32.exe
2440	Hfachc32.exe
3188	Hmklen32.exe
3600	Hpihai32.exe
3520	Hfcpncdk.exe
1864	Hibljoco.exe
2588	Haidklda.exe
4236	Icgqggce.exe
1048	Iidipnal.exe
1972	Ipnalhii.exe
3748	Ifhiib32.exe
5016	Iiffen32.exe
964	Iannfk32.exe
2300	Icljbg32.exe
4836	Ijfboafl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ehlaaddj.exe	Efneehef.exe
File created	C:\Windows\SysWOW64\Icgqggce.exe	Haidklda.exe
File created	C:\Windows\SysWOW64\Qnoaog32.dll	Jfaloa32.exe
File created	C:\Windows\SysWOW64\Fmmfmbhn.exe	Fjnjqfij.exe
File created	C:\Windows\SysWOW64\Ginahd32.dll	Gjjjle32.exe
File opened for modification	C:\Windows\SysWOW64\Hmklen32.exe	Hfachc32.exe
File created	C:\Windows\SysWOW64\Mnnkcb32.dll	Imihfl32.exe
File created	C:\Windows\SysWOW64\Jkdnpo32.exe	Jbmfoa32.exe
File opened for modification	C:\Windows\SysWOW64\Ldkojb32.exe	Lalcng32.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Jeiooj32.dll	Jpojcf32.exe
File created	C:\Windows\SysWOW64\Kdopod32.exe	Jiikak32.exe
File created	C:\Windows\SysWOW64\Ebploj32.exe	4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Ehjdldfl.exe	Ebploj32.exe
File created	C:\Windows\SysWOW64\Fjcclf32.exe	Fbllkh32.exe
File opened for modification	C:\Windows\SysWOW64\Fmapha32.exe	Fjcclf32.exe
File created	C:\Windows\SysWOW64\Gqdbiofi.exe	Gjjjle32.exe
File created	C:\Windows\SysWOW64\Lpacnb32.dll	Gmoliohh.exe
File created	C:\Windows\SysWOW64\Kcbibebo.dll	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Ndghmo32.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Jdemhe32.exe	Jmkdlkph.exe
File opened for modification	C:\Windows\SysWOW64\Kgmlkp32.exe	Kdopod32.exe
File created	C:\Windows\SysWOW64\Kknafn32.exe	Kbfiep32.exe
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Mdmegp32.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nafokcol.exe
File created	C:\Windows\SysWOW64\Ocdehlgh.dll	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Mdiklqhm.exe	Mpmokb32.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Mncmjfmk.exe
File opened for modification	C:\Windows\SysWOW64\Nqmhbpba.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Fflaff32.exe	Fcnejk32.exe
File created	C:\Windows\SysWOW64\Chbijmok.dll	Gqfooodg.exe
File opened for modification	C:\Windows\SysWOW64\Kphmie32.exe	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Efhikhod.dll	Liekmj32.exe
File created	C:\Windows\SysWOW64\Kgkocp32.dll	Lgneampk.exe
File created	C:\Windows\SysWOW64\Mnocof32.exe	Mjcgohig.exe
File opened for modification	C:\Windows\SysWOW64\Fomonm32.exe	Ficgacna.exe
File created	C:\Windows\SysWOW64\Qfiapa32.dll	Fbllkh32.exe
File opened for modification	C:\Windows\SysWOW64\Gfcgge32.exe	Gcekkjcj.exe
File created	C:\Windows\SysWOW64\Hmjdia32.dll	Hihicplj.exe
File opened for modification	C:\Windows\SysWOW64\Laciofpa.exe	Lilanioo.exe
File created	C:\Windows\SysWOW64\Lkakml32.dll	4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dofqcl32.dll	Fmmfmbhn.exe
File created	C:\Windows\SysWOW64\Fbllkh32.exe	Fomonm32.exe
File opened for modification	C:\Windows\SysWOW64\Gfhqbe32.exe	Gpnhekgl.exe
File opened for modification	C:\Windows\SysWOW64\Imdnklfp.exe	Ijfboafl.exe
File created	C:\Windows\SysWOW64\Imihfl32.exe	Ibccic32.exe
File opened for modification	C:\Windows\SysWOW64\Eodlho32.exe	Ehjdldfl.exe
File created	C:\Windows\SysWOW64\Oddfqf32.dll	Gjlfbd32.exe
File created	C:\Windows\SysWOW64\Kmgdgjek.exe	Kgmlkp32.exe
File opened for modification	C:\Windows\SysWOW64\Lpappc32.exe	Laopdgcg.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	Laciofpa.exe
File created	C:\Windows\SysWOW64\Icljbg32.exe	Iannfk32.exe
File opened for modification	C:\Windows\SysWOW64\Ipckgh32.exe	Imdnklfp.exe
File created	C:\Windows\SysWOW64\Lidmdfdo.dll	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Fldggfbc.dll	Lklnhlfb.exe
File created	C:\Windows\SysWOW64\Bdknoa32.dll	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Nkbkiioa.dll	Efneehef.exe
File created	C:\Windows\SysWOW64\Hccglh32.exe	Hadkpm32.exe
File opened for modification	C:\Windows\SysWOW64\Jbocea32.exe	Jpaghf32.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Cmddeh32.dll	Fjcclf32.exe
File created	C:\Windows\SysWOW64\Kmlnbi32.exe	Kknafn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6240	7136	WerFault.exe	250

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbgbpihg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfachc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Legdcg32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fflaff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcqjfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmioonpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dempmq32.dll"	Ipnalhii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmkdlkph.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqqjmnii.dll"	Ebploj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehonfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcglnp32.dll"	Fijmbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeahce32.dll"	Gcekkjcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fomonm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipnalhii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjlfbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bheenp32.dll"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mglack32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebploj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdnklfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipegmg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbocea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjcclf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hibljoco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icgqggce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflepa32.dll"	Jbocea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Offdjb32.dll"	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pellipfm.dll"	Liggbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbllkh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfhqbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmapha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqohnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkageheh.dll"	Hadkpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ficgacna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codhke32.dll"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcnejk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qchnlc32.dll"	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihaoimoh.dll"	Kbfiep32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4608	3016	4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe	83
PID 3016 wrote to memory of 4608	3016	4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe	83
PID 3016 wrote to memory of 4608	3016	4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe	83
PID 4608 wrote to memory of 4440	4608	Ebploj32.exe	84
PID 4608 wrote to memory of 4440	4608	Ebploj32.exe	84
PID 4608 wrote to memory of 4440	4608	Ebploj32.exe	84
PID 4440 wrote to memory of 3108	4440	Ehjdldfl.exe	85
PID 4440 wrote to memory of 3108	4440	Ehjdldfl.exe	85
PID 4440 wrote to memory of 3108	4440	Ehjdldfl.exe	85
PID 3108 wrote to memory of 2188	3108	Eodlho32.exe	86
PID 3108 wrote to memory of 2188	3108	Eodlho32.exe	86
PID 3108 wrote to memory of 2188	3108	Eodlho32.exe	86
PID 2188 wrote to memory of 756	2188	Efneehef.exe	87
PID 2188 wrote to memory of 756	2188	Efneehef.exe	87
PID 2188 wrote to memory of 756	2188	Efneehef.exe	87
PID 756 wrote to memory of 2676	756	Ehlaaddj.exe	88
PID 756 wrote to memory of 2676	756	Ehlaaddj.exe	88
PID 756 wrote to memory of 2676	756	Ehlaaddj.exe	88
PID 2676 wrote to memory of 1036	2676	Eqciba32.exe	89
PID 2676 wrote to memory of 1036	2676	Eqciba32.exe	89
PID 2676 wrote to memory of 1036	2676	Eqciba32.exe	89
PID 1036 wrote to memory of 3892	1036	Efpajh32.exe	90
PID 1036 wrote to memory of 3892	1036	Efpajh32.exe	90
PID 1036 wrote to memory of 3892	1036	Efpajh32.exe	90
PID 3892 wrote to memory of 1152	3892	Ehonfc32.exe	91
PID 3892 wrote to memory of 1152	3892	Ehonfc32.exe	91
PID 3892 wrote to memory of 1152	3892	Ehonfc32.exe	91
PID 1152 wrote to memory of 3040	1152	Eqfeha32.exe	93
PID 1152 wrote to memory of 3040	1152	Eqfeha32.exe	93
PID 1152 wrote to memory of 3040	1152	Eqfeha32.exe	93
PID 3040 wrote to memory of 2144	3040	Fbgbpihg.exe	94
PID 3040 wrote to memory of 2144	3040	Fbgbpihg.exe	94
PID 3040 wrote to memory of 2144	3040	Fbgbpihg.exe	94
PID 2144 wrote to memory of 4596	2144	Fjnjqfij.exe	95
PID 2144 wrote to memory of 4596	2144	Fjnjqfij.exe	95
PID 2144 wrote to memory of 4596	2144	Fjnjqfij.exe	95
PID 4596 wrote to memory of 4124	4596	Fmmfmbhn.exe	96
PID 4596 wrote to memory of 4124	4596	Fmmfmbhn.exe	96
PID 4596 wrote to memory of 4124	4596	Fmmfmbhn.exe	96
PID 4124 wrote to memory of 640	4124	Fcgoilpj.exe	97
PID 4124 wrote to memory of 640	4124	Fcgoilpj.exe	97
PID 4124 wrote to memory of 640	4124	Fcgoilpj.exe	97
PID 640 wrote to memory of 4476	640	Ficgacna.exe	99
PID 640 wrote to memory of 4476	640	Ficgacna.exe	99
PID 640 wrote to memory of 4476	640	Ficgacna.exe	99
PID 4476 wrote to memory of 1604	4476	Fomonm32.exe	100
PID 4476 wrote to memory of 1604	4476	Fomonm32.exe	100
PID 4476 wrote to memory of 1604	4476	Fomonm32.exe	100
PID 1604 wrote to memory of 2292	1604	Fbllkh32.exe	101
PID 1604 wrote to memory of 2292	1604	Fbllkh32.exe	101
PID 1604 wrote to memory of 2292	1604	Fbllkh32.exe	101
PID 2292 wrote to memory of 2884	2292	Fjcclf32.exe	102
PID 2292 wrote to memory of 2884	2292	Fjcclf32.exe	102
PID 2292 wrote to memory of 2884	2292	Fjcclf32.exe	102
PID 2884 wrote to memory of 4720	2884	Fmapha32.exe	103
PID 2884 wrote to memory of 4720	2884	Fmapha32.exe	103
PID 2884 wrote to memory of 4720	2884	Fmapha32.exe	103
PID 4720 wrote to memory of 536	4720	Fckhdk32.exe	104
PID 4720 wrote to memory of 536	4720	Fckhdk32.exe	104
PID 4720 wrote to memory of 536	4720	Fckhdk32.exe	104
PID 536 wrote to memory of 1828	536	Ffjdqg32.exe	105
PID 536 wrote to memory of 1828	536	Ffjdqg32.exe	105
PID 536 wrote to memory of 1828	536	Ffjdqg32.exe	105
PID 1828 wrote to memory of 3692	1828	Fqohnp32.exe	106

C:\Users\Admin\AppData\Local\Temp\4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4468ad36dd57159f1b157b834cc65195_JaffaCakes118.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\Ebploj32.exe
  C:\Windows\system32\Ebploj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\Ehjdldfl.exe
    C:\Windows\system32\Ehjdldfl.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\SysWOW64\Eodlho32.exe
      C:\Windows\system32\Eodlho32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2188
      - C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3692
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        26⤵
        Executes dropped EXE
        
        PID:2352
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        28⤵
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        29⤵
        Executes dropped EXE
        
        PID:1168
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2836
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4376
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3444
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        33⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3644
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        35⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2088
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        41⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4648
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3884
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        45⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3448
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3652
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2220
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2440
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        53⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        55⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2588
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4236
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        59⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1972
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        61⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        62⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:964
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        64⤵
        Executes dropped EXE
        
        PID:2300
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4836
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2160
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3384
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        68⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        69⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3272
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:412
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        73⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2172
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5052
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3808
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4404
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        79⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4144
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        81⤵
        Drops file in System32 directory
        
        PID:4488
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        82⤵
        Drops file in System32 directory
        
        PID:2424
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        83⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1536
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        85⤵
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        86⤵
        Drops file in System32 directory
        
        PID:4504
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        87⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        89⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        95⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        96⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        97⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        98⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        99⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5744
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5832
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        103⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        106⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        107⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6088
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        109⤵
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        111⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        112⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        113⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        115⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        116⤵
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        118⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        119⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        120⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        121⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        122⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        124⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        125⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        126⤵
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        127⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5860
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6028
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        130⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        131⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        132⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        134⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        136⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        137⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        138⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        139⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6196
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        142⤵
        Drops file in System32 directory
        
        PID:6272
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        143⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        146⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        147⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        148⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        149⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        150⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        151⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        152⤵
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        156⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        158⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        159⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7048
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        162⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 400
        163⤵
        Program crash
        
        PID:6240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7136 -ip 7136
1⤵
PID:6180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ebploj32.exe

Filesize
92KB

MD5
afcb422e5755b0834ee559f68397a2eb

SHA1
891330bc4e917eb5b69053b6163b53c0c174d607

SHA256
aa39ceb5aa4d443f690a04b0449d88875932fd19d963f2bebc9b60a076d74df1

SHA512
ef69b1546caa8c3ee9717ac75d98f91d2a2b2bc385a1d6411941e21045f0e93f16d522ce1dccc56b1750dee68bb71747999c65b14b8c1b2e2250ae1bf907ed5a

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
92KB

MD5
8083d4c96e034d0b3c2199a111e945c3

SHA1
87639f9a8224534220faa1ece8fdbae8474c75a1

SHA256
5f287d3f89dd6e32123dc1cb091d4bf2e5fc73f9dee296648bcd6aa384e14975

SHA512
b9df739a34a3d8772491c4a04667c3c3df039c934c265110aacabfd66c5d8577e5532080010ff4ecd96a1c65b7e629f5fbd7b57a5a7ce1fd7610d2d7ca6cda27

Download Submit
C:\Windows\SysWOW64\Efpajh32.exe

Filesize
92KB

MD5
eaf1098910deaf585155f2caa86cb27a

SHA1
9f2e19b270867471924a8d1027709b6d681ee67a

SHA256
bb53c88c3cdb2c333b2d95f2572dca093f17601708806f76b96d4e5f9ebde41c

SHA512
6ce369800c654ff338c4f2ecd43efd51bf3f86bdc839da3572a89b75d124c48b982bde3e637bfd16f4fc17783b349ead0e253e86a6e43dad7388a5e036932ac1

Download Submit
C:\Windows\SysWOW64\Ehjdldfl.exe

Filesize
92KB

MD5
159253d7a573f8ba07593f04ca0825cd

SHA1
cc93cef289f3313b80859b108feae8fdab70f72b

SHA256
c2a5d1d121d260c4e87a318f574badfd6e99a235cff9ff8334b9e2fc585362e9

SHA512
bfe3e0646731a9c805d9017dce06422c1bbc68476a03d16d369d63f8f32133b536a683dc890585e8c5591c81cb86a258f507776f2abe0309ff3aacb1369d8c7b

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
92KB

MD5
9028b9615a0b26eb2f3e6e4711c15da7

SHA1
c82c125cf871721fd9f8d9b4f775114d14f47f11

SHA256
00776dce05ce3a8d70c2560882d8b6d3b7d8ca63c682110d70f75c62631e1bf6

SHA512
dee4ec380a66556d991b6285ebc76d765e4dd62ff2efc0eb91b098d8fb9901aca3c399853638490b8e628ffd534b906dfe4a208628ad36c86dfdaae69cb5e403

Download Submit
C:\Windows\SysWOW64\Ehonfc32.exe

Filesize
92KB

MD5
0852fb627e55e2d393359a6de0ed4910

SHA1
778269b2992e93c93bfe178187000aa6abd2a154

SHA256
231c05481c285f00ad0b66a0f179c66d59c33d8db71ec366a4582aa41e9dc88b

SHA512
4d2c5b9e859b2bc993dab147561c813b9d312b67750fe74ed30829674caae866a151778ef05311514b8d3a60e07d332b1967008c723947c26dfdeaa4cb10122d

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
92KB

MD5
f72b64ee9ddcdea51b22edad1f80b761

SHA1
63898a4d078622b2355c6ea7da8194cdb2d0908c

SHA256
00ecf893a99cd3245909f73c5a32df7a00e36444326cc324b4b8b91c353f317b

SHA512
5b584b9c23509e4273f6df0d6adf8fabe156719c7434afda7e5f6fb8a993fa953d5963379a2b06826adf538d14014a780f5efa969dfcaae61997c42a8e6eb05c

Download Submit
C:\Windows\SysWOW64\Eqciba32.exe

Filesize
92KB

MD5
dfa49d7949596080c8d4cad96aefe5fb

SHA1
320cb4a9947d7240811e4b132b0a2426f2decd0e

SHA256
e8a854fa6a5093b84c1bf17135200cea0ad441ea76676bbe607a0b2edffda3aa

SHA512
194e472c58a979c597ed6871449fca445a39dd63d3fa64627466b4dc7f1fb8ad78ac319fc163ea0a5169660c785042841373ee5c204020930ded7ae1df723d96

Download Submit
C:\Windows\SysWOW64\Eqfeha32.exe

Filesize
92KB

MD5
3b866f798add6e254874bd1fc598b362

SHA1
a1f5a7628cf2986204c22f2e6b7d155c5aa0188d

SHA256
f76977c2b3449bbf6308840c160675535100b2652180c0c46ac3cf6f5261f57e

SHA512
41d2725f1cab7bb0918ed379fd45f1cc413693df7279089afefac4bc4342bf28192941500b3fab7ece2c81d38f2ccba80e5da05771897d4d2b6dd2bc6006d0cd

Download Submit
C:\Windows\SysWOW64\Fbgbpihg.exe

Filesize
92KB

MD5
0e739410c9930956e87320d3fbefc975

SHA1
1100b331c19b299016fef11e0e8af25825c99dcb

SHA256
1700e543fec7aa460003c41d61b4e288d948fb2a585a66047d29eec490f2dadd

SHA512
32d1eb428a46cc3e373c5980235a7ee7602e6e654fbadfdcdf964be2a509d874509619fbf80959a888aed0b326862be06225c4f76551ca40041bab1a0a185a2c

Download Submit
C:\Windows\SysWOW64\Fbllkh32.exe

Filesize
92KB

MD5
a30641eb45adb1240c02fde4e1aa1809

SHA1
6726ecb54e11cc6d10785fa4aafe8ce7a03324c0

SHA256
dcfc2e9678fe812a08441872f6bf91c0c2dce7b8609280aaa39939c62018b4d9

SHA512
d324275b4ce956478d28910229975b5c8fd3346fa9bc46cfbe958193ebca0a0c32f14c4e01e61e8d7ec53ccf719fd92a593c276f7c0cbe2eb0fabf35647c35ec

Download Submit
C:\Windows\SysWOW64\Fcgoilpj.exe

Filesize
92KB

MD5
fe3a5a3334cf05f2dfa6267e89d0c427

SHA1
e224e5e04b6361a5ea9ad93aa4897dc9d6a2912e

SHA256
d5591502b5309955f234bce6f9e65b41f8b450c7f7c5496849f209f52e04975b

SHA512
1efac30e5dc9a38778ff2c0f7251c9c45e757101f4bc366fea8c0c901b2830a060f137f470dd4f33da0510ef1fa5f5a82240647e9f68336d0c48815e03efbe0a

Download Submit
C:\Windows\SysWOW64\Fckhdk32.exe

Filesize
92KB

MD5
6ebfe05db20e2e4ce7634b3c90b7ecb7

SHA1
3617c0378fb8f0c1993a77f3b6c38eee9c409d76

SHA256
0b435f87a49124eca2238e70c9cbcc27f16eb8c3099d78a446ce2c24c56366c3

SHA512
588db52ee4f2e2006b4d51e8ccfdc8f570de77b3db7dc2423f10c906fa34092b26e37dc1544d385909059aaec30a3d782a042493faf5646e54d65caf5d717aec

Download Submit
C:\Windows\SysWOW64\Fcnejk32.exe

Filesize
92KB

MD5
1122073e08dcad18ebec6715176500e0

SHA1
8c578ea36de36283e724ea42c54863d1154ef655

SHA256
11d535238f8de5633ec65643218e84e7000fff6abd3ef06be7e2857086807726

SHA512
5079286fd95b627f9760e70f6a11391edf6fa8f18e00f89cc132b320bc09b40e0b10f4ad28daf056b8702916bf53a420ee497be4265ed578302f7bc858bd4408

Download Submit
C:\Windows\SysWOW64\Ffjdqg32.exe

Filesize
92KB

MD5
fbb245d2f1772774f36057e0b2fc73b8

SHA1
597b1df492b17cf185b58b0cf84d38c174134190

SHA256
f0900edb7599689e0ec0a58af9a43c89a4da8d09cb1a8cac15bf534ee3f5bc13

SHA512
256ba0515a11e23e5cf68f17a8074e3f4afb19c83134f161c06f27bb6f6017bcf0917f48afb19e0cd033bab697349033d9d18e91dc4544ac0f001a3b1cb3184e

Download Submit
C:\Windows\SysWOW64\Fflaff32.exe

Filesize
92KB

MD5
28fb56004c0021243142b4f78490a48d

SHA1
9c2b0ee3890ec9f2d3def3d16209d0c90be9bf6f

SHA256
845bc2d56de4788021f5950fd79da5de62254921751c1c232aef13577b9688ab

SHA512
85fac05ae0531cfdee04130b2b73c38e6542e0b8fbde23a5d78bb7320783885466072352d266b50bafe19b8c3c26b3daa1b722511b6ebe8864176b392b6b6530

Download Submit
C:\Windows\SysWOW64\Ficgacna.exe

Filesize
92KB

MD5
dc3654c44e035c2ec79e00284e793ec5

SHA1
582b23e969424f486c0cef383f8f9cba82fc43cc

SHA256
bff58c3944094b4c203c40a820411a53291b6c61442833dfd73a516f6d4c2ef5

SHA512
c685f5eadbb04382ebb1c82514bad9d1c6b627f82649eec19b7e0e2c90b41ac614a7e3482486b59f60de94cf7ee3be26888c0d569515cdc7a1d54fbce60d8456

Download Submit
C:\Windows\SysWOW64\Fijmbb32.exe

Filesize
92KB

MD5
8952761721b4e998cd738c4efd8a798d

SHA1
8916b83c9949977fb4817a56afe1e24fb26906cf

SHA256
5a44b06013cfe21aba44ae0f5202e7ca6a588b3b42958668365018f6c6c08624

SHA512
7d2b56a82af2dfcdaab6686c43c6d4a254f902f40136872e3719abe285932c3708313750ba7b6d633d399642b128ec48e8dfdab6bdaca8f8d6188da9f4c06dab

Download Submit
C:\Windows\SysWOW64\Fjcclf32.exe

Filesize
92KB

MD5
e85e366605626bf4fefa26857c94977e

SHA1
726cfdda53257a839001469910a2d98410da4edf

SHA256
354c83502cee9a0b3c2febc1cb766b27f1c7141d5d9bffdb97b6dbbf99a3b592

SHA512
ac6e003be1326538567f7f3f498cf9703f7c97163f9c226c864b78c0e247624a049f29e93aaf81b65e7b15c82700d2e3302d9af06bfba555ac8fc31feaee53bf

Download Submit
C:\Windows\SysWOW64\Fjnjqfij.exe

Filesize
92KB

MD5
64a6662e9e2bc28827f3974353606550

SHA1
6ea0a94d98fd5afef5b66695119de0c22e5c2df5

SHA256
a9f4a6dbbf247238a9140b970e9ae9d66c3037a71e12d85e6da5a049011c0e25

SHA512
e9773a2500c4a980def2341cd35afea2175ff542fe5d0f582be6659d078307a77bb829fea854357b4d10702fd6d974710ddcc74b0f143581da6d8cbdacc022a5

Download Submit
C:\Windows\SysWOW64\Fmapha32.exe

Filesize
92KB

MD5
8c4c2690a9bc8cee8f7e45a92f5e5617

SHA1
1d044c87d0b389efdc145eaf42000918b722c815

SHA256
dc1833b6e2e28f23a156ff57c7c66af05b85c1dfc530c1ae493c288bd9f18f99

SHA512
ab2ce69300d45e5e6facf59800f423321fa4f1403c15cc56c4d9d8977f83447bf77f239175568deb4e43a7046417a18ab3c582d05d808a501072ecb5d4cac93c

Download Submit
C:\Windows\SysWOW64\Fmmfmbhn.exe

Filesize
92KB

MD5
207bb07fea5845baf3f7cda02e98d94d

SHA1
c797c8840e028c12efd7c8a8334faa8091593ab0

SHA256
b69251b364e5ccde036a89aaf2c78d2973afa1377582cbab9bb5e587cb5649be

SHA512
6a559aaa7ddbcbd416e23887a687cf40a4ae366b57b1d082489f6239c0ecf0d3bd28d5b476e692b60e0482a59e955d88402156a08769253d39402341cb4d0613

Download Submit
C:\Windows\SysWOW64\Fodeolof.exe

Filesize
92KB

MD5
0d4307c5dfd99a62d23db09583c3a3c0

SHA1
6fc6b8f5a1b4df25ff8d8f0bd4dc080d7d4161c9

SHA256
2e709ae0f0890b61dddc9c12fe0aa7efa1856e7327160efd9422faa535b12ca9

SHA512
eac0147b8c51ce0b959e89eb9d872eefc2374d6db31d40e744ba88c01c6e2815058e0591bd191b67313e22f937627018c84d1130bce6e2f0333251297ffc3113

Download Submit
C:\Windows\SysWOW64\Fomonm32.exe

Filesize
92KB

MD5
bc32e69b69cb1eb7edcba7bbc5dd43ec

SHA1
84cbf1d39406735ed0dd7dbd3c98e20d12cafd60

SHA256
19125f62335925f6d5c7c7fced528312038a155d96a3da0421fd01ff1f8c303c

SHA512
d496465eae0ddd3748fad3820c1133247c98f1e1b79293ea1e76eaf01974fd83358a0789753b4d4c13a50f5e5effee79f67189b8bfa31289d70c34db0970c132

Download Submit
C:\Windows\SysWOW64\Fqohnp32.exe

Filesize
92KB

MD5
12e5c8c957d3494f1371d790e3c9f984

SHA1
e01a283c99c61ade6dcccefae4de9b8809984df8

SHA256
b06fec4c5211e8096b60157d0f39735658b6cff159e10e414303fd11516da3dc

SHA512
5fae288917bd8bc4352aac8b62ab741126dadc7ec153cb6662a8a46e37c468b8ad51630a0d6baa8c670505d2229019eee09a6258ce62002b37021f3519874f0c

Download Submit
C:\Windows\SysWOW64\Gcbnejem.exe

Filesize
92KB

MD5
f087254de57af705e6e6590b256138b0

SHA1
873b0cc00901a39b87a23f9fa251f1bc0fa16f06

SHA256
eeec8529e01e71aada8dcd09a1a017ab5093f0317aa471ce9cd5de7862b6e8e1

SHA512
d43e42b520de603de24229f126988ffe24645505c9325f9284e0a1c81c59aa94507915d51139d53199dbfa9399b45aedd72e36842b5d3347bf6c9f02ae2081a0

Download Submit
C:\Windows\SysWOW64\Gcekkjcj.exe

Filesize
92KB

MD5
7792f89875fb44ee9339af77048f0261

SHA1
e7229dfbc5f33634be088547e4b87fb038be5015

SHA256
bebc1c56e3bb555aa3ee19ed5f89e2ec7c20004e5b0d0618d2e3952800e5b270

SHA512
32e09230f95af58cdc793a117dd530e8b233fa786912318bf30cf3f2ed0fa268368f824872bbe0a6050c2452788da0dbb2f4698f02e6061441275a21fefec952

Download Submit
C:\Windows\SysWOW64\Gfcgge32.exe

Filesize
92KB

MD5
addf171df2459ae9ed797a5c86e0a3f8

SHA1
04f9a46fbdc90383833b6f72b5eb372b41c31f68

SHA256
8c83525ae49bd59156477842b1d3f74b85d32353c2db6d3bce01f7e46d6b9b0e

SHA512
45efabe8ebaa00bd8547aa05754739b9589c5dbdecb1ef1b8eead98dc10eba43a017795913110fc26e9ebc439102561e741e450ddef9526ae8a06a973ef11490

Download Submit
C:\Windows\SysWOW64\Gfhqbe32.exe

Filesize
92KB

MD5
313821ca480a39d486140f12a12b63df

SHA1
a679d766c9de818eb62ba81ac75680f17910971a

SHA256
52ec40f4ef2b898d900a8867461b4824d53dd17181b99a405ba1af2430bd2b23

SHA512
4bb0f79fa6865ffe618db92b187beb9770591719857d06755777117ae7abf7dcf8956c5f8b80ddefb2be87bdd7127c13b91bcea748ee188aaf530de1fbe07bcf

Download Submit
C:\Windows\SysWOW64\Gjjjle32.exe

Filesize
92KB

MD5
8903e4bdf6f729f413901187bfe48e7a

SHA1
e95ff9afd0026892af7563f52ceab77f9ad794c5

SHA256
0a282ceded57294fbe85e6888543bd8b976819e392b2a3079427a545029e96f9

SHA512
125f49e3161f6242fbf419e6f5c0cdf88b695acbf784c52fa35828b9f2af6cbf1fb4c0ce093f7811af0eefbcd742bbf84c5f680fb4848e7a6b26cce1573f873f

Download Submit
C:\Windows\SysWOW64\Gjlfbd32.exe

Filesize
92KB

MD5
2b43fb52e1ba418a4085585b74dd61c7

SHA1
eb57c6dc1fec5ebf76355e7206e3feb8365a52d2

SHA256
b0843e330e4643287fcc29c361731d0f637228872b9c8d57a84ec25ea6575462

SHA512
5618fa17d3871826f280f1f57977c952b72e9ac9358ec95982623a71093f5d5c71e18b3d401618b45938b398d36e83995b8840b9f787475176fb2a803537d075

Download Submit
C:\Windows\SysWOW64\Gqdbiofi.exe

Filesize
92KB

MD5
a1a1ff15747375ec73423ffc626dfaf4

SHA1
3b4e3bdb300db610af633a1bc5ad8c362f9e4777

SHA256
9b423d0fdd7052a2a691765798ad9379b851b2853f0afa5b2eb9c86889554187

SHA512
5158cdee419218b231186d6cc033b32b7f04a290efacb3a527ebfc21684584649776a6d28ca52b1d1346883fbff5b12d7e598e1da6a90658e75640c923d1fbf2

Download Submit
C:\Windows\SysWOW64\Gqfooodg.exe

Filesize
92KB

MD5
2b1fbc299905944bfe173461b97e5361

SHA1
853ccd1b7c748daeec12118cee197e0e2cf8025d

SHA256
054e0481a63f22dbd4c0fc4e747a0918560f034b78577866bc5248f07605c326

SHA512
e14fc8ee59c70cb9d7a309e697deb8ca2e9ce8926e06db42b92df658c026891f32e3cfa148a1ac0bb41c3a35a6254a21f078224c18a29bdfcfb710d5d305e931

Download Submit
C:\Windows\SysWOW64\Jiikak32.exe

Filesize
92KB

MD5
219d8c822a3a090a44d28c2d1f46ce0d

SHA1
9e3f666826c4cab333acb101ee06522e8acc79db

SHA256
e964d87a0726fe81b4a509d83d3696035da8f61914ca5137064942eceb022e6b

SHA512
5d5f0bb2f56f7b060345b039f2d7ef09a5fe2c60860b79487dc019effe110a911a8320e651ed5f55c3923f986bdee6070d3cc17928a99f4916b2c3e458d43939

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
92KB

MD5
387e7d15fefac0aa8775773e601a0667

SHA1
53c279500708bd0bdb4a83862ebed4e346d6211e

SHA256
f2a3f068758144d3459a76d24f619b70a2d54f25827b09fd911c810a27b0f617

SHA512
efde9f0a7ecf3dc19a382907dddbefe47d407e87577f2a877390f7678304f8f83d1963d21a000c152a67422bc7946beb62af18ca0a90256797139703b844e3e7

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
92KB

MD5
6338dcd7d8f3538417205c089b7c6c45

SHA1
04af425db75e680ab8fc638c96f0843892a456f8

SHA256
d01bfe0208659291f7d22067e6bea4cb5ad4e449f60cfeff3243777d6aed0ae4

SHA512
101fb0c93339d13146e822ff6dde51ea3454c5e8c4015520a3d46427543c1c04a6c37b3b1c08e205594724c200f9321fd707820ad0c70b51fa826d6d15ce7b17

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
92KB

MD5
45355701ad750bc514d05894711cd8a1

SHA1
4d73703c18d85c68750636aa0ba998d0c1dd8c20

SHA256
1efa7f517ff22816cc761c6f1a7def7297b8cf3d0f66ab51ca7e6ecd912dcc01

SHA512
2b6b70bd2a435a037d32f297fe07d80dd39f5207a8cf381e82a6fd65f8aea8b71c1509612a65475a4e87545a543af0a37f003e874a068ca5dc24b9a5d93194a4

Download Submit
memory/412-495-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/536-160-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/640-113-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/756-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/756-577-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/868-217-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/964-442-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1036-57-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1036-591-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1048-413-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1152-73-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1168-225-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1180-257-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1536-564-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1604-129-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1828-169-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1864-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1972-423-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2088-293-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2144-89-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2160-459-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2172-507-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2188-570-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2188-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2220-353-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2292-137-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2300-443-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2352-205-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2424-556-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2440-371-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2512-509-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2564-185-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2588-401-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2676-584-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2676-49-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2684-279-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2744-472-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2836-233-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2840-309-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2884-148-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3016-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3016-533-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3016-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/3040-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3064-365-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3108-29-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3188-377-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3272-485-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3384-461-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3420-500-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3444-254-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3448-335-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3520-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3600-383-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3644-263-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3652-346-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3692-181-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3696-193-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3748-429-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3800-363-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3808-521-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3864-534-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3884-323-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3892-598-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3892-65-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3940-347-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4016-473-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4116-571-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4124-105-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4144-540-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4236-407-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4332-483-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4376-241-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4404-527-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4420-558-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4440-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4476-121-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4488-546-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4496-287-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4504-578-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4524-269-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4548-209-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4596-97-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4608-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4648-317-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4664-299-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4720-153-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4836-453-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4928-333-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5008-285-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5016-431-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5052-520-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5096-311-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5164-589-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5208-596-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5252-599-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads