575dd8506f22b18b59467a28c9667ed933719cc88e182219d9ccf37c0243ca39

Analysis

max time kernel
132s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

386d7b81fa6f30f456d154344e74d900_NEIKI.exe
Size

72KB
MD5

386d7b81fa6f30f456d154344e74d900
SHA1

e9e4c217d8d2ba0572f1419b3c211640f2c3e44e
SHA256

575dd8506f22b18b59467a28c9667ed933719cc88e182219d9ccf37c0243ca39
SHA512

c3e130c986004f20c5523fa4a79615a40e584ea50fd104b8a1df2010c503d2e3102a8af3f0a4e3833675bb332868843c8e0bf80c964737e0856f2ec046798349
SSDEEP

1536:pmPEpbcyI8Qbcf+C+DoqS9WmQSLR3jXrxum2fBEjnxezB5:cPcbcyTfWDo7WDSTqEjxs5

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbqefhpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hippdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkdnpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmgdgjek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jangmibi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ecdbdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbjhlfhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haggelfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcidam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gjocgdkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elccfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eleplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hadkpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaljgidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lddbqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffekegon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ficgacna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fihqmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fodeolof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iidipnal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikopmkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdopod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqkocpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fifdgblo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjocgdkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkdnpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fqkocpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbcakg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifmnpnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hadkpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	386d7b81fa6f30f456d154344e74d900_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fobiilai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipldfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	386d7b81fa6f30f456d154344e74d900_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fmmfmbhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffekegon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffjdqg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbldaffp.exe

Executes dropped EXE 64 IoCs

pid	Process
4296	Elccfc32.exe
4792	Eflhoigi.exe
4736	Eleplc32.exe
4632	Eqalmafo.exe
4988	Ecphimfb.exe
4608	Efneehef.exe
5000	Ehlaaddj.exe
2156	Eofinnkf.exe
1576	Efpajh32.exe
4024	Ehonfc32.exe
4772	Ecdbdl32.exe
408	Fjnjqfij.exe
3296	Fmmfmbhn.exe
3684	Fokbim32.exe
2376	Ffekegon.exe
4424	Ficgacna.exe
5100	Fqkocpod.exe
1380	Fbllkh32.exe
4652	Fifdgblo.exe
8	Fqmlhpla.exe
4532	Ffjdqg32.exe
3764	Fihqmb32.exe
3628	Fobiilai.exe
3060	Fbqefhpm.exe
2440	Fjhmgeao.exe
664	Fmficqpc.exe
2508	Fodeolof.exe
2920	Gbcakg32.exe
2788	Gjjjle32.exe
5060	Gimjhafg.exe
872	Gmhfhp32.exe
2272	Gogbdl32.exe
3224	Gfqjafdq.exe
5012	Gjlfbd32.exe
2968	Goiojk32.exe
400	Gbgkfg32.exe
380	Gjocgdkg.exe
1584	Gmmocpjk.exe
2492	Gpklpkio.exe
1828	Gbjhlfhb.exe
2452	Gidphq32.exe
544	Gmoliohh.exe
4404	Gpnhekgl.exe
2420	Gbldaffp.exe
548	Gfhqbe32.exe
512	Gifmnpnl.exe
4884	Gameonno.exe
4544	Hclakimb.exe
2992	Hfjmgdlf.exe
4952	Hmdedo32.exe
4012	Hapaemll.exe
2596	Hcnnaikp.exe
1084	Hfljmdjc.exe
116	Hikfip32.exe
4896	Hmfbjnbp.exe
3776	Hcqjfh32.exe
1932	Hfofbd32.exe
4212	Himcoo32.exe
2888	Hadkpm32.exe
1936	Hbeghene.exe
3616	Hfachc32.exe
1956	Hippdo32.exe
4432	Haggelfd.exe
1100	Hcedaheh.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fjnjqfij.exe	Ecdbdl32.exe
File created	C:\Windows\SysWOW64\Fodeolof.exe	Fmficqpc.exe
File created	C:\Windows\SysWOW64\Pjpdme32.dll	Hfjmgdlf.exe
File created	C:\Windows\SysWOW64\Idofhfmm.exe	Ipckgh32.exe
File opened for modification	C:\Windows\SysWOW64\Mnapdf32.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Bejnmepn.dll	Eleplc32.exe
File opened for modification	C:\Windows\SysWOW64\Jagqlj32.exe	Jfaloa32.exe
File created	C:\Windows\SysWOW64\Anmklllo.dll	Jfffjqdf.exe
File created	C:\Windows\SysWOW64\Lnohlokp.dll	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nnjbke32.exe
File opened for modification	C:\Windows\SysWOW64\Idacmfkj.exe	Iikopmkd.exe
File opened for modification	C:\Windows\SysWOW64\Ipqnahgf.exe	Imbaemhc.exe
File created	C:\Windows\SysWOW64\Jjblgaie.dll	Kmgdgjek.exe
File created	C:\Windows\SysWOW64\Fldggfbc.dll	Ljnnch32.exe
File opened for modification	C:\Windows\SysWOW64\Eleplc32.exe	Eflhoigi.exe
File opened for modification	C:\Windows\SysWOW64\Efneehef.exe	Ecphimfb.exe
File created	C:\Windows\SysWOW64\Hfljmdjc.exe	Hcnnaikp.exe
File created	C:\Windows\SysWOW64\Lcnodhch.dll	Iidipnal.exe
File created	C:\Windows\SysWOW64\Eqbmje32.dll	Lpappc32.exe
File opened for modification	C:\Windows\SysWOW64\Majopeii.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Icjmmg32.exe	Iakaql32.exe
File opened for modification	C:\Windows\SysWOW64\Ldmlpbbj.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Fifdgblo.exe	Fbllkh32.exe
File created	C:\Windows\SysWOW64\Hdgohg32.dll	Fbqefhpm.exe
File created	C:\Windows\SysWOW64\Mbaohn32.dll	Laciofpa.exe
File opened for modification	C:\Windows\SysWOW64\Kmjqmi32.exe	Kinemkko.exe
File created	C:\Windows\SysWOW64\Kdhbec32.exe	Kajfig32.exe
File created	C:\Windows\SysWOW64\Jdkhlo32.dll	Gifmnpnl.exe
File opened for modification	C:\Windows\SysWOW64\Hikfip32.exe	Hfljmdjc.exe
File opened for modification	C:\Windows\SysWOW64\Iikopmkd.exe	Ijhodq32.exe
File opened for modification	C:\Windows\SysWOW64\Jdjfcecp.exe	Jaljgidl.exe
File opened for modification	C:\Windows\SysWOW64\Fmficqpc.exe	Fjhmgeao.exe
File created	C:\Windows\SysWOW64\Gmoliohh.exe	Gidphq32.exe
File created	C:\Windows\SysWOW64\Gameonno.exe	Gifmnpnl.exe
File created	C:\Windows\SysWOW64\Jmbklj32.exe	Jkdnpo32.exe
File opened for modification	C:\Windows\SysWOW64\Lmqgnhmp.exe	Kkbkamnl.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqbl32.exe	Lcbiao32.exe
File created	C:\Windows\SysWOW64\Jmpngk32.exe	Jfffjqdf.exe
File created	C:\Windows\SysWOW64\Kmgdgjek.exe	Kkihknfg.exe
File created	C:\Windows\SysWOW64\Ihaoimoh.dll	Kgbefoji.exe
File created	C:\Windows\SysWOW64\Kkpnlm32.exe	Kcifkp32.exe
File created	C:\Windows\SysWOW64\Ckegia32.dll	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Nklfoi32.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Mlmpolji.dll	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Hdgpjm32.dll	Ipldfi32.exe
File created	C:\Windows\SysWOW64\Mjlcankg.dll	Jagqlj32.exe
File created	C:\Windows\SysWOW64\Kdaldd32.exe	Kacphh32.exe
File opened for modification	C:\Windows\SysWOW64\Lalcng32.exe	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Hcqjfh32.exe	Hmfbjnbp.exe
File created	C:\Windows\SysWOW64\Ldmlpbbj.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Kpdobeck.dll	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Ipckgh32.exe	Ifjfnb32.exe
File created	C:\Windows\SysWOW64\Jfaloa32.exe	Jdcpcf32.exe
File created	C:\Windows\SysWOW64\Kpjjod32.exe	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Ldaeka32.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Bekppcpp.dll	Haidklda.exe
File created	C:\Windows\SysWOW64\Qngfmkdl.dll	Icjmmg32.exe
File created	C:\Windows\SysWOW64\Jaedgjjd.exe	Ifopiajn.exe
File opened for modification	C:\Windows\SysWOW64\Lcbiao32.exe	Lpcmec32.exe
File created	C:\Windows\SysWOW64\Lppaheqp.dll	Jmbklj32.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Iidipnal.exe	Ibjqcd32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6888	6756	WerFault.exe	263

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbgkfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgcifj32.dll"	Mnapdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fmmfmbhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddhbep32.dll"	Ffekegon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fojjgcdm.dll"	Gfqjafdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gjlfbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihoogdd.dll"	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jaljgidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofdhdf32.dll"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iblilb32.dll"	Fihqmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbjnl32.dll"	Hmfbjnbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecaoggc.dll"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eofinnkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcioj32.dll"	Hclakimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdiihjon.dll"	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eleplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohcepmcb.dll"	Eofinnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fmficqpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdehlgh.dll"	Gmmocpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbamkcqa.dll"	Hmdedo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Goiojk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdaldd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eflhoigi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejnmepn.dll"	Eleplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehlaaddj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iebapp32.dll"	Goiojk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbgkfg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlilmlna.dll"	Imbaemhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gjlfbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diefokle.dll"	Gbldaffp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hcnnaikp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Himcoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbeghene.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jdjfcecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdihi32.dll"	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmfbjnbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jplmmfmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaehlf32.dll"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odhibo32.dll"	Gjocgdkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfljmdjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baefid32.dll"	Lnepih32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4296	2372	386d7b81fa6f30f456d154344e74d900_NEIKI.exe	84
PID 2372 wrote to memory of 4296	2372	386d7b81fa6f30f456d154344e74d900_NEIKI.exe	84
PID 2372 wrote to memory of 4296	2372	386d7b81fa6f30f456d154344e74d900_NEIKI.exe	84
PID 4296 wrote to memory of 4792	4296	Elccfc32.exe	85
PID 4296 wrote to memory of 4792	4296	Elccfc32.exe	85
PID 4296 wrote to memory of 4792	4296	Elccfc32.exe	85
PID 4792 wrote to memory of 4736	4792	Eflhoigi.exe	86
PID 4792 wrote to memory of 4736	4792	Eflhoigi.exe	86
PID 4792 wrote to memory of 4736	4792	Eflhoigi.exe	86
PID 4736 wrote to memory of 4632	4736	Eleplc32.exe	87
PID 4736 wrote to memory of 4632	4736	Eleplc32.exe	87
PID 4736 wrote to memory of 4632	4736	Eleplc32.exe	87
PID 4632 wrote to memory of 4988	4632	Eqalmafo.exe	88
PID 4632 wrote to memory of 4988	4632	Eqalmafo.exe	88
PID 4632 wrote to memory of 4988	4632	Eqalmafo.exe	88
PID 4988 wrote to memory of 4608	4988	Ecphimfb.exe	89
PID 4988 wrote to memory of 4608	4988	Ecphimfb.exe	89
PID 4988 wrote to memory of 4608	4988	Ecphimfb.exe	89
PID 4608 wrote to memory of 5000	4608	Efneehef.exe	90
PID 4608 wrote to memory of 5000	4608	Efneehef.exe	90
PID 4608 wrote to memory of 5000	4608	Efneehef.exe	90
PID 5000 wrote to memory of 2156	5000	Ehlaaddj.exe	91
PID 5000 wrote to memory of 2156	5000	Ehlaaddj.exe	91
PID 5000 wrote to memory of 2156	5000	Ehlaaddj.exe	91
PID 2156 wrote to memory of 1576	2156	Eofinnkf.exe	92
PID 2156 wrote to memory of 1576	2156	Eofinnkf.exe	92
PID 2156 wrote to memory of 1576	2156	Eofinnkf.exe	92
PID 1576 wrote to memory of 4024	1576	Efpajh32.exe	93
PID 1576 wrote to memory of 4024	1576	Efpajh32.exe	93
PID 1576 wrote to memory of 4024	1576	Efpajh32.exe	93
PID 4024 wrote to memory of 4772	4024	Ehonfc32.exe	94
PID 4024 wrote to memory of 4772	4024	Ehonfc32.exe	94
PID 4024 wrote to memory of 4772	4024	Ehonfc32.exe	94
PID 4772 wrote to memory of 408	4772	Ecdbdl32.exe	95
PID 4772 wrote to memory of 408	4772	Ecdbdl32.exe	95
PID 4772 wrote to memory of 408	4772	Ecdbdl32.exe	95
PID 408 wrote to memory of 3296	408	Fjnjqfij.exe	96
PID 408 wrote to memory of 3296	408	Fjnjqfij.exe	96
PID 408 wrote to memory of 3296	408	Fjnjqfij.exe	96
PID 3296 wrote to memory of 3684	3296	Fmmfmbhn.exe	98
PID 3296 wrote to memory of 3684	3296	Fmmfmbhn.exe	98
PID 3296 wrote to memory of 3684	3296	Fmmfmbhn.exe	98
PID 3684 wrote to memory of 2376	3684	Fokbim32.exe	99
PID 3684 wrote to memory of 2376	3684	Fokbim32.exe	99
PID 3684 wrote to memory of 2376	3684	Fokbim32.exe	99
PID 2376 wrote to memory of 4424	2376	Ffekegon.exe	100
PID 2376 wrote to memory of 4424	2376	Ffekegon.exe	100
PID 2376 wrote to memory of 4424	2376	Ffekegon.exe	100
PID 4424 wrote to memory of 5100	4424	Ficgacna.exe	101
PID 4424 wrote to memory of 5100	4424	Ficgacna.exe	101
PID 4424 wrote to memory of 5100	4424	Ficgacna.exe	101
PID 5100 wrote to memory of 1380	5100	Fqkocpod.exe	102
PID 5100 wrote to memory of 1380	5100	Fqkocpod.exe	102
PID 5100 wrote to memory of 1380	5100	Fqkocpod.exe	102
PID 1380 wrote to memory of 4652	1380	Fbllkh32.exe	103
PID 1380 wrote to memory of 4652	1380	Fbllkh32.exe	103
PID 1380 wrote to memory of 4652	1380	Fbllkh32.exe	103
PID 4652 wrote to memory of 8	4652	Fifdgblo.exe	104
PID 4652 wrote to memory of 8	4652	Fifdgblo.exe	104
PID 4652 wrote to memory of 8	4652	Fifdgblo.exe	104
PID 8 wrote to memory of 4532	8	Fqmlhpla.exe	106
PID 8 wrote to memory of 4532	8	Fqmlhpla.exe	106
PID 8 wrote to memory of 4532	8	Fqmlhpla.exe	106
PID 4532 wrote to memory of 3764	4532	Ffjdqg32.exe	107

C:\Users\Admin\AppData\Local\Temp\386d7b81fa6f30f456d154344e74d900_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\386d7b81fa6f30f456d154344e74d900_NEIKI.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\Elccfc32.exe
  C:\Windows\system32\Elccfc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\Eflhoigi.exe
    C:\Windows\system32\Eflhoigi.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\SysWOW64\Eleplc32.exe
      C:\Windows\system32\Eleplc32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4632
      - C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3764
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3060
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2440
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:664
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        30⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        31⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        32⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        33⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3224
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:400
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1584
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        40⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1828
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        43⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2420
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        46⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:512
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        48⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2992
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        52⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2596
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1084
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        55⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        57⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        58⤵
        Executes dropped EXE
        
        PID:1932
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4212
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        62⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1956
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1100
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        66⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        67⤵
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        68⤵
        Drops file in System32 directory
        
        PID:4016
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1800
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        70⤵
        Drops file in System32 directory
        
        PID:2772
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4180
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4912
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        73⤵
        Drops file in System32 directory
        
        PID:4704
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        74⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        76⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        77⤵
        Drops file in System32 directory
        
        PID:1788
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        78⤵
        Drops file in System32 directory
        
        PID:2204
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        79⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:932
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        83⤵
        Drops file in System32 directory
        
        PID:1000
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3888
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        85⤵
        Drops file in System32 directory
        
        PID:2024
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        86⤵
        Drops file in System32 directory
        
        PID:2932
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        87⤵
        Drops file in System32 directory
        
        PID:3680
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        88⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        89⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        90⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        91⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        92⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        93⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        95⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        96⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        101⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        103⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        104⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        106⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        110⤵
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        111⤵
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        112⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        113⤵
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        114⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        116⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        118⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        120⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        123⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        125⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4188
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        126⤵
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        127⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        128⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        129⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        131⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        132⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        133⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        135⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        138⤵
        Drops file in System32 directory
        
        PID:6108
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        139⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        143⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        144⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        146⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        148⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6452
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6540
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        152⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6624
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        154⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        155⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        156⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        157⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        158⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6892
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        160⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        161⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7020
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7060
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        164⤵
        Drops file in System32 directory
        
        PID:7104
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        165⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        166⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        167⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        168⤵
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        169⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        170⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6516
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6564
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        173⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        174⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 412
        175⤵
        Program crash
        
        PID:6888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6756 -ip 6756
1⤵
PID:6836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ecdbdl32.exe

Filesize
72KB

MD5
991b25f3fdec75a5fbe7ce82f8754a74

SHA1
1dc04b7ea8ac60553ac8de7b86f69b9df227f9ed

SHA256
25fa25a5035c9776508ceb857ec236d9b741d914cd1d009b5bbfa727bcad67d8

SHA512
34599c752ad3c657756e6d01ea92d523cffae491f713fe0dc28bdd9cae2f063124166b47017818fbba19877d978f6c6993eaf55b853d33abd4ab65462765703e

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
72KB

MD5
a3a0b311a0e81fa3f7375e9f6f6b7cd4

SHA1
e86e41398f78d1f3cc2040d1404815ea5eb8c691

SHA256
0ecfacbc5a3ec2c19cff8aa7bf3a0565c1ca9a6fa487e24c6ed256f9555ab499

SHA512
108aa50bce24e3dc86f408405e5212e526057da26ba0f2939b8fb913deb98eb57d74b5cc41c52b4ae7aebbe23365ae98ee941a1750e6800a1f7789098d84bd89

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
72KB

MD5
6cd5b0da36c0f905b9a6110d08e199a1

SHA1
f7cdd79302cbefb8a450f36e863f49c4f45fcade

SHA256
6a54fd790b4a139413bc3dc69b7c26e0cbb38edd61f8e4164176b6e6b3435add

SHA512
a4d72cac0fac15dba8d9e27ca137192419c5d3c2e74aa9a4519db1df65bab5662610c435fc29450bb0f2543d59cd47fa85d29c5767d217069e8494b9b7b6a882

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
72KB

MD5
b5a05d11b7d22c4a0116b9024da334a8

SHA1
e43561d7a0daf2fe2d6e042e487cb85693af1904

SHA256
c855543313c9647b1443de5646f0a0d16d626405ad0a3f20139aa1004a21a2b8

SHA512
b65b15e8f33e241778c2d29c55bf048e61fca8d3f08dc60e1d85e92e98e5dd06ea4aa0abc17bf24be3da4ff7f9c066ecc4962be97b5dcd973cb9bf7342ce00cb

Download Submit
C:\Windows\SysWOW64\Efpajh32.exe

Filesize
72KB

MD5
9a4350050941daefc4c8c9022536ad6c

SHA1
a7aa348920430df70c75bd2fe45d2ef57c67f34f

SHA256
02b231141e1115820c5f4abc00342ab6dbde854c62b75953140f3a2413f7dc43

SHA512
f141c917d48653063eaea7a45ef11a68bb0d7ece8b2411ee9133b4bae2aa4b4b0dc65001bb3406a9d4d6c3764af44a9821d91eb34b9bed648da3d11f893ded5b

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
72KB

MD5
c5dfaf9b4ac61cb6b2079b9024ddb5ce

SHA1
3c3bca741b4ce49e949741d71781e93ec46f6735

SHA256
63cbe81bfb787c183fc0295ac09c4ca1e59b3402769bb13c5f0a1a263eef8f7f

SHA512
ef38f149cadd816b33d83fddd8a2c05cba809a6beb85e0fc2e9726d45b0d620a27513063d58e9b9a05ca7df078e2272031ac9cb75dd9f61e1d92dadeda37518d

Download Submit
C:\Windows\SysWOW64\Ehonfc32.exe

Filesize
72KB

MD5
df55ced3c3d4b1843a79b53a634624c0

SHA1
427a6e6bf4dce62349bec9f529f4951fcb2062e9

SHA256
ce44aa5d8521535aad7fa5a12f27c99a1bec44be4dee9e240a56c9c9e40098a8

SHA512
7f35e5d4d6ce119241fc7ccfdf566949af4a07033cc5908adc445fa89a4e646db25cad15c1577cd9fdb3302c51a47f452dc03aa64e31f0947e0b8fe0677c7dc7

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
72KB

MD5
be62a7363190fd25b3bedcb2f29039ca

SHA1
8ddf3999de6273d06ae476546e08fffaae58f28c

SHA256
aab81a0094b301d382b17cf4c7343d16de2e4518978c690de30235e247de6c40

SHA512
fbec0528458b3e2d80c2371a225c976d825f4afc957233f126042f8cba4340ca0918fbc86c3dac8240814baecd120ea252c3f841d828d6d909b52d6fecff0940

Download Submit
C:\Windows\SysWOW64\Eleplc32.exe

Filesize
72KB

MD5
4915c3a5f335ba652ef7983d78c2ac56

SHA1
9a433707e40e2119f6fe294e1b19635b5ccc5696

SHA256
61e87a988c522d7f86a0590d42cb494a0c2e0826f20026f134b5f7615a6abdf0

SHA512
524e6a6054145e39cfb47e1f835566bb83311e45f4acd84606ebc307bf00db8010bb48fcdfb50a23672c590cf90b8830f96f971f53708b63d9037a7fa104220e

Download Submit
C:\Windows\SysWOW64\Eofinnkf.exe

Filesize
72KB

MD5
f79e9c1f03c20cf5fdccec6e41689a22

SHA1
d72bf7319325fae063373c9bf4124009e1db88ab

SHA256
c7bff5ee3add20ee93e1d52ec02495b99cc7758d361ea34f121946dfbfea7e69

SHA512
4d7ba753fe3830b04b92330bcc9ebc7a084d44ae49e7a5286060954a3cfef959b3e2d3d481f2737403727101276ebe235d4fb71d757bd26f5be6db501c64c403

Download Submit
C:\Windows\SysWOW64\Eqalmafo.exe

Filesize
72KB

MD5
4d7b7b4b5f41d9abd227fc94205364cd

SHA1
c711c08cc143e2b12a9c54239b70089e6ee93d91

SHA256
dd657a7a8fc762946dd4d102e9c9ce7a3e92598ce86bb9ff17104e7aa15f0873

SHA512
e2152fa584072d0a430705b39fe26d8ee9bff2fa60f8caa8a3ece7f9eac89e1eb895bd01658411a69b5679b94bba01a03e7e15c2b5c8c8cd52960a79bb5f7ba6

Download Submit
C:\Windows\SysWOW64\Fbllkh32.exe

Filesize
72KB

MD5
29549a90cc88c2f8803ae8d3cc2faf12

SHA1
15e82ecfed3f55a48e4ed60b8fcf9d412af35e45

SHA256
268bea5d9af002444a87b85a0a3c01aedc83fc821cddd4631787229851c21a40

SHA512
df1ab039099c8e4f33d1c5c4b8d8a98d5e559dbc13d90789c0d7390b828e0e364a6e14398b49a246965158629691a5dc739336475e8c88978a8a52d786d354f6

Download Submit
C:\Windows\SysWOW64\Fbqefhpm.exe

Filesize
72KB

MD5
a2a81cbd03e48ebf89cc16476f86d0c8

SHA1
d1503832770e3c8e4bc5ae78f94f15121f57e05b

SHA256
aeac5d6088ad9b0fac9b97767328e7be0b44402e74ef12de202c1d27966cc2ae

SHA512
7a2626bb965da22a351fbe46c8d500c1680e0a746d165cd0d9bb6d13f20a50b95740f5127062d243914da5ec5a5c48b7c871391047a9cff8d4f2276d844f9238

Download Submit
C:\Windows\SysWOW64\Ffekegon.exe

Filesize
72KB

MD5
4e04959a12eb4ee5d8acf359b29b13bd

SHA1
138a95b63a37b91bbafbbf3c89291211069e04c2

SHA256
d2a1a9b760f34cd8273598a035332e0a994b037cbb89f1d90b613ae6098482be

SHA512
c17bad3920ffbe9f51286bd000af6ba5bffca14c522a0f2fd2e88bcb95ba1a69bfeb172f9ff768ec8305fec312ecb26d3e49b90e4671d0f77bf3bd56e80b8611

Download Submit
C:\Windows\SysWOW64\Ffjdqg32.exe

Filesize
72KB

MD5
7b11019cde3e400a6052521468f8e418

SHA1
57f70cca3658201e7e4e4008b6c0b37daa09a8a5

SHA256
30ab5bb4ba0c8656745a9b900c7d36db21578ae05c03b31dff36383c72edd826

SHA512
67b34dc698e41819d030197f7198d8ed15a51bfb48a01a3f8c1c2cf4b63f43346b94975cae8f43e666cd6f24be1a148533d9a605aaf26827e5b21b0e471bd16a

Download Submit
C:\Windows\SysWOW64\Ficgacna.exe

Filesize
72KB

MD5
346098e28e07dc6ae014bc3a4a10c36b

SHA1
1b2066cece7497d6e90dcdd5d14cb5aef4976506

SHA256
21d749a04fa707926fdee0f376dcc86b6cda5083dbc31f88022348ee14451ece

SHA512
70667774f81083e4e0fcb70f66b99a1c5c08cf16c4f09f850208f263e7d8fd5ba3534226ceca05c7a0e8975fc96d0e6399fd9f80c33be6764cf053e8e3541ac8

Download Submit
C:\Windows\SysWOW64\Fifdgblo.exe

Filesize
72KB

MD5
dd2ea4e462303c0644f2bc91484b0f97

SHA1
5f59a1c6ad7363e6bba18b8bf8d912cab503a80e

SHA256
dd28e4b6241c7af12c19bf5b69fc699a2e8692126d7d2ee769d8860f81a4c2f4

SHA512
bbb575bf7673f1ead1095238725f25f142bc9c4f41f4cf1b0bc7d3802edbf082a50a416e2600861f2e3cb426ac452b566582e9e9b9e0bc318e8f39279ef63285

Download Submit
C:\Windows\SysWOW64\Fihpfl32.dll

Filesize
7KB

MD5
21169561acb6bb20a89bbe154d3ffd61

SHA1
a8ec91b9d0e0e90037e7c8af239c0d14987a8a03

SHA256
64f956c3bd2809ef005994efcf511a8e90f81baee21548f6c4dad71b40962af3

SHA512
f3c778500704d790c46944d091cf124fdade3e3b0fe74bad2367f3735992acce3c3b94c8e50279decd105a77802c37cee607d5ca45ce4cba5ad8a2df3e64d805

Download Submit
C:\Windows\SysWOW64\Fihqmb32.exe

Filesize
72KB

MD5
41a02b4de989431805c0debbb285f18a

SHA1
8c710406219b8a77328022294983b544961aabca

SHA256
4b31835bc740ff364acc45286b67664b5857afd6a0a6d5777209764e637e6da9

SHA512
8831fb997deca33dcaa6de5b2f63e3b6cbf0f7b2471d5de6ea787f015ca5096a48d293af098aa7ac2a55bf57ba80ee4a39e6f601389a0bbdd41dad1e7d627d3b

Download Submit
C:\Windows\SysWOW64\Fjhmgeao.exe

Filesize
72KB

MD5
b6cc15f192798d38474f85b3aa69272a

SHA1
a9ae796bf87423209738d9c7ae84d7b8e13bebd0

SHA256
d6c09f0f822048ea0d515133cb117c69563cd33888fdd4e20abf6834bdc8d540

SHA512
6aff38b01cc2c6835a41f24cb038015c719594393185801ee28dd565837689e091cf7e925814b6d8b6603a242a367baa225d575f9c9558628d1f72904060f60f

Download Submit
C:\Windows\SysWOW64\Fjnjqfij.exe

Filesize
72KB

MD5
17afacb1aeb6dbc915c8ab8e2b767fca

SHA1
3322c386fa3105daf1bd680af024931e30ab5315

SHA256
af9c3cf71dd68bee6e0511f933e7b279567dc465a3addb5834e9e4793439ea13

SHA512
df60a90168a03e8f19b5f0973f992872d67ee4dc7a4519fec373cc83e53d15f86e2a3f88b80f5ca113f5b90ca209d0ddfa1eff6b0735f4f4ec00351eeb465fb5

Download Submit
C:\Windows\SysWOW64\Fmficqpc.exe

Filesize
72KB

MD5
0cbfc447a898e0f76a08812cf46545bb

SHA1
147eca464e9f0bc38611720330e02eec6a715481

SHA256
6f2b0de64b2d559349c7dac36a04a851df717db56e390792e6420994d94a4574

SHA512
634de5d846fc1dccf465640949c5d3df15cc0d18fe75b708b063e46856f7f06fa46f1d837438be50253cf693dbf24672872974b317064e14da9033edca0e9d05

Download Submit
C:\Windows\SysWOW64\Fmmfmbhn.exe

Filesize
72KB

MD5
a513a5d984d1552613e47ad9d96c6429

SHA1
b790a183dd756e599c5b12a706b5db7d02f1a0eb

SHA256
f9f69db7641f590b1fb85b01c1bd4fdf329b6bd8b7dd71411e18ae9cd6e7c2b1

SHA512
55b2cbd1b2c61feba8e5f918f8bfb51bc943ea6e7b207dc50b28627c5d8f8e7df21c3c9dbe377095dcbd2202543e12b675a5fca45a4585ca0f3cbbcb9d0d5063

Download Submit
C:\Windows\SysWOW64\Fobiilai.exe

Filesize
72KB

MD5
e220c411cf9748a06c5464066de884a5

SHA1
062bdc5a0d1bed50b5e091d73e0b75cb88be212b

SHA256
ad57ce549fa96e50ff322446269dd44633a6d927ae12c01bc5059bb8661f2c98

SHA512
ed3a0fe78db432c2cae70cafb89fbd94546fcafd06f1362b17426b0d91d6291bb761db03cb27cc591582a39026aa729d589b33aaa848f4e146727ea3d751ca25

Download Submit
C:\Windows\SysWOW64\Fodeolof.exe

Filesize
72KB

MD5
690ecc74c7aecfaf3104629acad2dfba

SHA1
770cd705d96ad2dda3462e514e77cd2e32bd57c1

SHA256
db9e92b604217e9339d2019b8ed282fea84dc548c0d87bc1f42e0c2998c2c450

SHA512
a158c971c25cff149d78801c3f13fd6579acf9facb52e2b9d293fcbe8fffd913392d6caa3a50ec0243fc21fc8a047f091271f7cbee407487f8d37be71cd76195

Download Submit
C:\Windows\SysWOW64\Fokbim32.exe

Filesize
72KB

MD5
1d91f0554ddf5647bc9915bbc0c476a4

SHA1
91bbaf1a2cd03e5bb48c650dc28c928679621c49

SHA256
796272ba4f40c2c861e823fa3173e165373917c717bc23dbb2449e4bf0ef44ac

SHA512
86bba077de2c72cf22d97f00f1e658dd5a4c6e8b50772d5d071728a5e11d618603d66f8809370f58d915dfc41d46cf7f1ae5226a2be915f4e9136a6f3b9bb51f

Download Submit
C:\Windows\SysWOW64\Fqkocpod.exe

Filesize
72KB

MD5
159ef90e395f3f368eb3a9ffd3e2f8ee

SHA1
e78780a65e0259c7aadd22af2069ed8eb0742cd3

SHA256
19c1fbb43dfbd9066fa2284c45ba8ad439bdf40f2e19fc64b47bc4fd6f32ab6a

SHA512
cc154014dd84f2778deca07eec7dbda77459fa86d5a6bc9a957fb75aa97d4cd6232593c8ba02018e0b7bada417fc142ef077736146496ab78a4207f8150c56a0

Download Submit
C:\Windows\SysWOW64\Fqmlhpla.exe

Filesize
72KB

MD5
bf200398b8a83bd14233c0ee00db8c1e

SHA1
e9c423a74b862de1306e0dbc37cf93f3d2e8bda2

SHA256
df5a91341b1f5f14179547ee21b2a6986822a3b3122f36f98f13630bf8a86bf1

SHA512
9a24a94683c830b83279bc5b304c670f999070ca93956f154bd36a1020b5b7e3733b9298bc2cb918f1c0f55d6185c21f89fb04b804ab1f1eb65486e73cd998b0

Download Submit
C:\Windows\SysWOW64\Gbcakg32.exe

Filesize
72KB

MD5
13df55dac651a9464f2b9ef2bac1d18d

SHA1
0d9d5150d129839a3ba5f5117eb2586990e77241

SHA256
1644907932a200c6660552a9be84eea765eea09dec8f08e2283ca18bec264e19

SHA512
b72a72d2a551f76f4b0e70871e33591594650d47feb238b4df534de619381be15620824e44debb1270965ff929b0c19fef8fb1a558c70d2889c8457f453d90a9

Download Submit
C:\Windows\SysWOW64\Gimjhafg.exe

Filesize
72KB

MD5
71a921060b778dd52c88a48a3e7c0973

SHA1
d507dc6ce8be8989bc4d73c727200929527aadfd

SHA256
878bd3a55246e634af50b2a0b1714970617ddc358d0f045ac46fda686d333fcd

SHA512
c12da8f3f933fe893679efba09104874a3dfe2ed1255be66906f659025b13bf5ad36a4a22423a32b6bfece4715de54049110ce4789147b120313ee9966ca2957

Download Submit
C:\Windows\SysWOW64\Gjjjle32.exe

Filesize
72KB

MD5
9cc232b4e3daee467fb5c904ad1a66f7

SHA1
17a198c797fade4dbb533b608be33ed4f3d3052b

SHA256
77e639d9fe7a16761be99d02a29a4178a7c6baa014757ddf4e9d652ae8a8cbca

SHA512
f462df8436339e6fa54aed3592ccdc5325c5577508e1997458190f9f0100a4d6549d750816d9941d0a140034b96cbc04e85019ab3bd1f7b1334af4264710ce15

Download Submit
C:\Windows\SysWOW64\Gmhfhp32.exe

Filesize
72KB

MD5
0fc756240dab73aeeb3ad05995d483b6

SHA1
b36fc698d43a1d82d6a8cf75ed07731b70929109

SHA256
ee9326a614b28de64c61bea28580270f494c01ec41dd5221ce61004cd6d94b7c

SHA512
78d89b79228b5c0bebe3f8eab4692f98ce3e8182758e4661bd381b7767e74e0ba8402f3d4239b8767d0a7c138dc7cfdd608a78582510a8ee9ab8910d9f130e89

Download Submit
C:\Windows\SysWOW64\Gogbdl32.exe

Filesize
72KB

MD5
baf4192c70401670023150751dcb5549

SHA1
3c3ec91853b54c700a1e44976c120dbaa63337a4

SHA256
30c25dcde271edce065a696b3f065e41e1a5ebc88077f6d72c0ab61c45909d1e

SHA512
cf60d3ee1a09ef298e42f5793f1f380d6b93ab0ea20ec113aba1f0461475825d68408e4b94f660d0f819378a4e845d27037e85ad4910122ef75161940a17e298

Download Submit
C:\Windows\SysWOW64\Idacmfkj.exe

Filesize
72KB

MD5
3021b158faab00f4832c08deb0f10294

SHA1
24792a3153493ac6ca5a4d9f5d6f576934ebf059

SHA256
1a3a735e677c25464119399bb5c4da468650a5f627a5811b988cd5a92f4e98e8

SHA512
ac9c02b6c32c72bcf193f77b02ce59027b6c6141a55602923c2708adff42853f2a8b2dd68ba757959e23dbe71e2f34867bc82ae4fc60db0a1cd22de462fae26e

Download Submit
C:\Windows\SysWOW64\Ipckgh32.exe

Filesize
72KB

MD5
98def54b219ab8621b5a4db6feb8a6da

SHA1
609f40f2408f141a824814cdf3d56059987bea2b

SHA256
b9f214af1b558a6aefec0665a03c6450428780e36a68a6633c4682b41c34307a

SHA512
349ce8434980601f83b0aa413ca16bc7ff73a9aaa588ba7dca6a52184a3805cc38738245d4d1df08d218cd2b54be75c4135e650c26db1827e577e1205dcc6711

Download Submit
C:\Windows\SysWOW64\Jagqlj32.exe

Filesize
72KB

MD5
893163845f8e19d1a6645c2c652e26ef

SHA1
46efd2f7ed3f5cee4fc7e1fb1c242fbd5fc4f7ce

SHA256
a8e7c177e512a19aee770743431c9e52bccaf215ac84681e3a8263f7346e7fac

SHA512
07f0a9dee84298b448c91db203534c870ed5fe47c769409ad6b3fd4cba6c2dac041a47964c360446955c5afd9e7eb49d804fd4e368d4163bc850f463fcb377c3

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
72KB

MD5
84169900a4b98d9fe777fb9ca6efe241

SHA1
d07bb4e812069c97237715a7257af186930bfb0d

SHA256
ccdae54cd30d95c06358b19c807d909885d686a0efbdd8cc7cf072155b9a3a80

SHA512
78cf603a9cd5dca8f92cf5b9f23c2cf7a90f0f5c5b155b2e1a6587bffe8dd48cfe66eb41ab5a402bc076f953b9dd078de4e3f04b882f0954f0bb90e4eb560e43

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
72KB

MD5
4772a0246c07d15b42aafaebf72b6b1f

SHA1
bedb7d11e22debe37391e1685c80e9603d14d4ea

SHA256
2a36e8f60e51b0335f8e08ee7a2bdab66c9d388c71ab7b98c24076836886bd43

SHA512
5c46c091ad3f0a7d02f03ed4c3503c940eda267b29c022aefa34c7441ac69be61f3ea209d5f69ec5b5de46b44a0d5ac6d89d5e8d707871d36882d2715577ed40

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
72KB

MD5
1d2b35436c2596e861086ffc86b3a384

SHA1
372e8fe828d8862bab59b1aad532cbe8ddc6134c

SHA256
b92d759e6557ae8dd10cbd8925680fe03483745405766ba9f7a14c16fdd75b9a

SHA512
c9b85ae368fbaa96a5d6b9b8dcb26d91c1fe529c1a7076f5fa58c1be832cec2c4eec6985531d7e8350ec95b2989f6e39a2562e3c9fed6f8489f285e4c5f1e9cf

Download Submit
C:\Windows\SysWOW64\Ldkojb32.exe

Filesize
72KB

MD5
e3b84528739da134d1571317f7dbe17e

SHA1
9db8ffc0351406f93f71161175e895966f3857f9

SHA256
bc77d5f70d0a69ea09f5217217bef80652aaebf1a3e429863119845730273952

SHA512
5b086b96f50dc101fa066a05323a942f8d9188dae123f4fcc22ec05d1608e4c0e8846a6140d5e941e73cbce07ae13a8e9c92ae5cc4ab03f0902e69dd996ce268

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
72KB

MD5
f48c13eaab7011572cf60b718c3a6c6e

SHA1
6348dd1ebe1bc66cbc250efbf40a7413c36e53c8

SHA256
6d65d60555622c310e9094f8da696e6429ee1356099862bed55f5039b4a0f3eb

SHA512
a0437256b7db98c9324cf9877167d168e931695097b338724a14de67e0c2ebded676580b562cc521a1b0a61eaa11b8ed263fa0a579c5cf3f91361ec371bea972

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
72KB

MD5
4bfc3ce5812c34cd6b6161e105575dee

SHA1
8e95b64d2057bb652b84ee047971ca94e27e53a3

SHA256
ce2010716950325c076f25f7f861add47e0173a4381eab202c92d0525c1af769

SHA512
3680638d2c7bff67799ae0c0051b8877ad30ca6d386d4838eb2baa8ba8a0397f13377c31c6316cc41db02572386a3fa1cdd6b418229ade50d5e5d402fd048df2

Download Submit
C:\Windows\SysWOW64\Mdmegp32.exe

Filesize
72KB

MD5
166be994b4fe82055577fd4aef0f7b42

SHA1
70f35d88af4f799915b4ab642dd89060df9c8ac9

SHA256
3aabdd839e04612511e94d7157ae1e26987ea7c6c9a3dacf00f11094c613f550

SHA512
15a549b98a3ca4e41df494cb4093e076306ad67d80f0b304b0acfef460bc7127dbe9a488bae8799bd1b31d6f1b0c9891fec558c5429516701cf2db11d30845a4

Download Submit
C:\Windows\SysWOW64\Mjqjih32.exe

Filesize
72KB

MD5
43585735e725ceee314043d26890661d

SHA1
2192b0a9781bddcb0aa2a440bfbace41e88fc01d

SHA256
3e4522e1d4482f71a6673c6c675bd382ac4233cb4d3ae08f3837faa5a88f5a68

SHA512
607e3fab41a7b512a7ae1a3677abbcc034f8a20d1a6a9d1b2552dbcd05b167be6b1379a505e80c3bf03648adda36e89f7400f917aa7a54b8a3657d31c341bd4f

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
72KB

MD5
448252b3ae97350bd0185bfa985a0d9e

SHA1
37d28cb6a28a7372170da1acb99c7ea0ab3d4a39

SHA256
f8effc1e6b4abe0c43fe6618ce09f77b8095e9ac20364cb09372bcc986ee42e2

SHA512
dd2fe6a0434ab9978de1d1a5c5aabd4265081cac0de334d66c72d8c322a97569a358f65d59961f560c7a263bc7b69d2f370ab441911e0e61fac4edde290d321e

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
72KB

MD5
2e378f6fd2b073cf39f356faf3250ade

SHA1
d05bf852d035b78e18d130bc00e6ba8af8f92dab

SHA256
361a2e58af196df104152402950e5856118cbebe8c34c70dbc88ae0d61882e35

SHA512
a1564278e878158307a2139a25fc4fd3d4acf4b443d85fcda35850d66651a4179e4267e3a27a362a2ec4d773b3621d0731b8f592f8cce53d59fda739b4459fed

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
72KB

MD5
a72b0ebec5d85161475699ce950e5e42

SHA1
f9fba57e161d54cdfe54c6a4d1493ca4e5c83deb

SHA256
8e120c80fe22575cf67bc2b5ed642dc39a842c0b2cef5a4b65eecbf1c1f54a3d

SHA512
45647c6ed2e40b2adf30f29924415cfa5da20305e2815ef423ad98780f0e2d8addcee631b64e7371c1663cf2926970d49c3d55c902d0ee06814ca0c17da21800

Download Submit
memory/8-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/116-393-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/380-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/400-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/408-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/448-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/512-345-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/544-320-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/548-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/664-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/872-253-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/932-556-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1000-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1084-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1100-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1380-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1576-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1584-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1692-458-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1788-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1800-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1828-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1932-408-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1936-428-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1944-1271-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1956-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2024-575-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-604-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2204-526-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2272-261-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2280-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2372-550-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2372-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2376-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2420-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2440-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2452-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2492-302-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2508-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2772-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2788-237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2888-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2920-229-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2932-578-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2968-279-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2992-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3060-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3224-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3260-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3296-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3616-434-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3628-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3680-584-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3684-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3764-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3776-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3888-569-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3944-503-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4012-374-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4016-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4024-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4180-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4212-416-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4268-596-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4296-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4296-557-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4368-512-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4404-324-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4424-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4432-446-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4480-598-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4544-354-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4576-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4608-594-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4608-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-577-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4652-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4704-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4732-537-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4736-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4772-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4792-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4792-564-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4884-351-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4896-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4912-495-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4952-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4988-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5000-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5000-597-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5012-272-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5060-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5100-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6188-1181-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6848-1196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads