47aef6d71351981008d9a93e7b9e63f45a663c3a93cacfbcb3fdd13274a26e2e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4f5efa9e91df4d88aa36a9173b4e7e0_NEIKI.exe
Size

96KB
MD5

e4f5efa9e91df4d88aa36a9173b4e7e0
SHA1

2b015b481d4b536a092cb93070ecc3ca4b370dd5
SHA256

47aef6d71351981008d9a93e7b9e63f45a663c3a93cacfbcb3fdd13274a26e2e
SHA512

750b83af4345722a6e2025627bdf27edfa01ecf3df235e3f0515eb2ec94f7674720324281291985579f00fe94af023840014a815d1f78e90ad0c2e9283b2571e
SSDEEP

1536:DEwCPVAOwZ4B9fXp0ZhF1cnwP2LV7RZObZUUWaegPYA:Dn0n5N0ZhzGVClUUWae

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcqjfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hccglh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kilhgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fijmbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Impepm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fopldmcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Goiojk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcnnaikp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpgdbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfachc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imgkql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gogbdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjhfnccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjfnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpojcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imbaemhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffbnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbllkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmoliohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haggelfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbllkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmjqmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jibeql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgneampk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqohnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifhiib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jiphkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmmhjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipldfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icjmmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imihfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gimjhafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gogbdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbckbepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ficgacna.exe

Executes dropped EXE 64 IoCs

pid	Process
8	Ffbnph32.exe
2244	Fmmfmbhn.exe
2960	Fokbim32.exe
4740	Ffekegon.exe
4796	Ficgacna.exe
4804	Fqkocpod.exe
2028	Fbllkh32.exe
2580	Fjcclf32.exe
4616	Fmapha32.exe
3960	Fopldmcl.exe
4984	Ffjdqg32.exe
1488	Fqohnp32.exe
2224	Fcnejk32.exe
1392	Fflaff32.exe
2816	Fijmbb32.exe
4940	Fqaeco32.exe
3860	Gbcakg32.exe
3212	Gimjhafg.exe
3368	Gogbdl32.exe
2968	Gbenqg32.exe
4308	Gjlfbd32.exe
2380	Gqfooodg.exe
2372	Goiojk32.exe
2564	Gjocgdkg.exe
3516	Gqikdn32.exe
4520	Gcggpj32.exe
3640	Gfedle32.exe
2172	Gmoliohh.exe
2616	Gqkhjn32.exe
1836	Gcidfi32.exe
4300	Gfhqbe32.exe
3924	Gifmnpnl.exe
3556	Hboagf32.exe
4896	Hihicplj.exe
3208	Hapaemll.exe
3576	Hcnnaikp.exe
3428	Hjhfnccl.exe
4260	Habnjm32.exe
2704	Hcqjfh32.exe
3064	Hbckbepg.exe
4176	Hjjbcbqj.exe
1876	Hadkpm32.exe
2716	Hccglh32.exe
3648	Hfachc32.exe
4504	Hmklen32.exe
4216	Haggelfd.exe
3372	Hcedaheh.exe
3060	Hfcpncdk.exe
2932	Hmmhjm32.exe
1984	Ipldfi32.exe
536	Ibjqcd32.exe
4016	Ijaida32.exe
4444	Impepm32.exe
1396	Ipnalhii.exe
1376	Icjmmg32.exe
4620	Ifhiib32.exe
1228	Imbaemhc.exe
2308	Iannfk32.exe
3068	Icljbg32.exe
724	Ifjfnb32.exe
212	Ijfboafl.exe
4068	Imdnklfp.exe
4924	Iapjlk32.exe
4200	Ibagcc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jdkind32.dll	Jfaloa32.exe
File created	C:\Windows\SysWOW64\Ihaoimoh.dll	Kbfiep32.exe
File opened for modification	C:\Windows\SysWOW64\Laopdgcg.exe	Ldkojb32.exe
File created	C:\Windows\SysWOW64\Ciiqgjgg.dll	Mkepnjng.exe
File opened for modification	C:\Windows\SysWOW64\Mcnhmm32.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Neahbi32.dll	Fmmfmbhn.exe
File created	C:\Windows\SysWOW64\Fqaeco32.exe	Fijmbb32.exe
File created	C:\Windows\SysWOW64\Gmoliohh.exe	Gfedle32.exe
File created	C:\Windows\SysWOW64\Ifopiajn.exe	Ipegmg32.exe
File created	C:\Windows\SysWOW64\Impepm32.exe	Ijaida32.exe
File opened for modification	C:\Windows\SysWOW64\Nkjjij32.exe	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Fqkocpod.exe	Ficgacna.exe
File created	C:\Windows\SysWOW64\Eilljncf.dll	Jpaghf32.exe
File opened for modification	C:\Windows\SysWOW64\Mnocof32.exe	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mcnhmm32.exe
File opened for modification	C:\Windows\SysWOW64\Lpocjdld.exe	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Nqiogp32.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Fmapha32.exe	Fjcclf32.exe
File opened for modification	C:\Windows\SysWOW64\Hapaemll.exe	Hihicplj.exe
File opened for modification	C:\Windows\SysWOW64\Jkdnpo32.exe	Jpojcf32.exe
File created	C:\Windows\SysWOW64\Jangmibi.exe	Jigollag.exe
File opened for modification	C:\Windows\SysWOW64\Jpojcf32.exe	Jfffjqdf.exe
File created	C:\Windows\SysWOW64\Kdhbec32.exe	Kpmfddnf.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Ndghmo32.exe
File opened for modification	C:\Windows\SysWOW64\Fmmfmbhn.exe	Ffbnph32.exe
File created	C:\Windows\SysWOW64\Hmmhjm32.exe	Hfcpncdk.exe
File created	C:\Windows\SysWOW64\Hdgpjm32.dll	Ipldfi32.exe
File created	C:\Windows\SysWOW64\Imihfl32.exe	Ifopiajn.exe
File created	C:\Windows\SysWOW64\Pglanoaq.dll	Ipnalhii.exe
File created	C:\Windows\SysWOW64\Mghpbg32.dll	Kbdmpqcb.exe
File opened for modification	C:\Windows\SysWOW64\Kgdbkohf.exe	Kcifkp32.exe
File opened for modification	C:\Windows\SysWOW64\Kmnjhioc.exe	Kibnhjgj.exe
File opened for modification	C:\Windows\SysWOW64\Hboagf32.exe	Gifmnpnl.exe
File created	C:\Windows\SysWOW64\Ijaida32.exe	Ibjqcd32.exe
File opened for modification	C:\Windows\SysWOW64\Mgekbljc.exe	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Mpolqa32.exe	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Fjcclf32.exe	Fbllkh32.exe
File created	C:\Windows\SysWOW64\Jibpdc32.dll	Ifopiajn.exe
File created	C:\Windows\SysWOW64\Lgneampk.exe	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	Laciofpa.exe
File opened for modification	C:\Windows\SysWOW64\Ficgacna.exe	Ffekegon.exe
File created	C:\Windows\SysWOW64\Ehbccoaj.dll	Hcqjfh32.exe
File created	C:\Windows\SysWOW64\Jpgdbg32.exe	Imihfl32.exe
File created	C:\Windows\SysWOW64\Khehmdgi.dll	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Kilhgk32.exe	Kkihknfg.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mdiklqhm.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Fokbim32.exe	Fmmfmbhn.exe
File opened for modification	C:\Windows\SysWOW64\Fcnejk32.exe	Fqohnp32.exe
File created	C:\Windows\SysWOW64\Hihicplj.exe	Hboagf32.exe
File created	C:\Windows\SysWOW64\Hionfema.dll	Haggelfd.exe
File opened for modification	C:\Windows\SysWOW64\Mnlfigcc.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Pipfna32.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Mglppmnd.dll	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Ekmihm32.dll	Ijfboafl.exe
File opened for modification	C:\Windows\SysWOW64\Lnepih32.exe	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Mkepnjng.exe	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Ffjdqg32.exe	Fopldmcl.exe
File opened for modification	C:\Windows\SysWOW64\Ifopiajn.exe	Ipegmg32.exe
File created	C:\Windows\SysWOW64\Ofdhdf32.dll	Liekmj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6196	7108	WerFault.exe	253

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfhqbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffekegon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqikdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjjbcbqj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Goiojk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imihfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgiacnii.dll"	Jpgdbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkdnpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hofddb32.dll"	Fopldmcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkageheh.dll"	Hadkpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hadkpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglppmnd.dll"	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oedbld32.dll"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcnejk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqfooodg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfaloa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogdimilg.dll"	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fflaff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jagqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghiqbiae.dll"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adijolgl.dll"	Gqkhjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gifmnpnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kaemnhla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fflaff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlcqelac.dll"	Gfedle32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dngdgf32.dll"	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjlfbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hapaemll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imppcc32.dll"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnjdmn32.dll"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fijmbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jangmibi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kncfca32.dll"	Fflaff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmmkpmf.dll"	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gncoccha.dll"	Kmjqmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opocad32.dll"	Hfcpncdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aajjaf32.dll"	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkiqbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phogofep.dll"	Ifjfnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghmfdf32.dll"	Jibeql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpfijcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbajhpfb.dll"	Gmoliohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibjqcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laopdgcg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 8	3560	e4f5efa9e91df4d88aa36a9173b4e7e0_NEIKI.exe	85
PID 3560 wrote to memory of 8	3560	e4f5efa9e91df4d88aa36a9173b4e7e0_NEIKI.exe	85
PID 3560 wrote to memory of 8	3560	e4f5efa9e91df4d88aa36a9173b4e7e0_NEIKI.exe	85
PID 8 wrote to memory of 2244	8	Ffbnph32.exe	86
PID 8 wrote to memory of 2244	8	Ffbnph32.exe	86
PID 8 wrote to memory of 2244	8	Ffbnph32.exe	86
PID 2244 wrote to memory of 2960	2244	Fmmfmbhn.exe	87
PID 2244 wrote to memory of 2960	2244	Fmmfmbhn.exe	87
PID 2244 wrote to memory of 2960	2244	Fmmfmbhn.exe	87
PID 2960 wrote to memory of 4740	2960	Fokbim32.exe	88
PID 2960 wrote to memory of 4740	2960	Fokbim32.exe	88
PID 2960 wrote to memory of 4740	2960	Fokbim32.exe	88
PID 4740 wrote to memory of 4796	4740	Ffekegon.exe	89
PID 4740 wrote to memory of 4796	4740	Ffekegon.exe	89
PID 4740 wrote to memory of 4796	4740	Ffekegon.exe	89
PID 4796 wrote to memory of 4804	4796	Ficgacna.exe	90
PID 4796 wrote to memory of 4804	4796	Ficgacna.exe	90
PID 4796 wrote to memory of 4804	4796	Ficgacna.exe	90
PID 4804 wrote to memory of 2028	4804	Fqkocpod.exe	91
PID 4804 wrote to memory of 2028	4804	Fqkocpod.exe	91
PID 4804 wrote to memory of 2028	4804	Fqkocpod.exe	91
PID 2028 wrote to memory of 2580	2028	Fbllkh32.exe	92
PID 2028 wrote to memory of 2580	2028	Fbllkh32.exe	92
PID 2028 wrote to memory of 2580	2028	Fbllkh32.exe	92
PID 2580 wrote to memory of 4616	2580	Fjcclf32.exe	93
PID 2580 wrote to memory of 4616	2580	Fjcclf32.exe	93
PID 2580 wrote to memory of 4616	2580	Fjcclf32.exe	93
PID 4616 wrote to memory of 3960	4616	Fmapha32.exe	94
PID 4616 wrote to memory of 3960	4616	Fmapha32.exe	94
PID 4616 wrote to memory of 3960	4616	Fmapha32.exe	94
PID 3960 wrote to memory of 4984	3960	Fopldmcl.exe	95
PID 3960 wrote to memory of 4984	3960	Fopldmcl.exe	95
PID 3960 wrote to memory of 4984	3960	Fopldmcl.exe	95
PID 4984 wrote to memory of 1488	4984	Ffjdqg32.exe	96
PID 4984 wrote to memory of 1488	4984	Ffjdqg32.exe	96
PID 4984 wrote to memory of 1488	4984	Ffjdqg32.exe	96
PID 1488 wrote to memory of 2224	1488	Fqohnp32.exe	97
PID 1488 wrote to memory of 2224	1488	Fqohnp32.exe	97
PID 1488 wrote to memory of 2224	1488	Fqohnp32.exe	97
PID 2224 wrote to memory of 1392	2224	Fcnejk32.exe	98
PID 2224 wrote to memory of 1392	2224	Fcnejk32.exe	98
PID 2224 wrote to memory of 1392	2224	Fcnejk32.exe	98
PID 1392 wrote to memory of 2816	1392	Fflaff32.exe	99
PID 1392 wrote to memory of 2816	1392	Fflaff32.exe	99
PID 1392 wrote to memory of 2816	1392	Fflaff32.exe	99
PID 2816 wrote to memory of 4940	2816	Fijmbb32.exe	100
PID 2816 wrote to memory of 4940	2816	Fijmbb32.exe	100
PID 2816 wrote to memory of 4940	2816	Fijmbb32.exe	100
PID 4940 wrote to memory of 3860	4940	Fqaeco32.exe	101
PID 4940 wrote to memory of 3860	4940	Fqaeco32.exe	101
PID 4940 wrote to memory of 3860	4940	Fqaeco32.exe	101
PID 3860 wrote to memory of 3212	3860	Gbcakg32.exe	102
PID 3860 wrote to memory of 3212	3860	Gbcakg32.exe	102
PID 3860 wrote to memory of 3212	3860	Gbcakg32.exe	102
PID 3212 wrote to memory of 3368	3212	Gimjhafg.exe	103
PID 3212 wrote to memory of 3368	3212	Gimjhafg.exe	103
PID 3212 wrote to memory of 3368	3212	Gimjhafg.exe	103
PID 3368 wrote to memory of 2968	3368	Gogbdl32.exe	104
PID 3368 wrote to memory of 2968	3368	Gogbdl32.exe	104
PID 3368 wrote to memory of 2968	3368	Gogbdl32.exe	104
PID 2968 wrote to memory of 4308	2968	Gbenqg32.exe	106
PID 2968 wrote to memory of 4308	2968	Gbenqg32.exe	106
PID 2968 wrote to memory of 4308	2968	Gbenqg32.exe	106
PID 4308 wrote to memory of 2380	4308	Gjlfbd32.exe	107

C:\Users\Admin\AppData\Local\Temp\e4f5efa9e91df4d88aa36a9173b4e7e0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\e4f5efa9e91df4d88aa36a9173b4e7e0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\Ffbnph32.exe
  C:\Windows\system32\Ffbnph32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\Fmmfmbhn.exe
    C:\Windows\system32\Fmmfmbhn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\SysWOW64\Fokbim32.exe
      C:\Windows\system32\Fokbim32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4740
      - C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2380
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2372
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        25⤵
        Executes dropped EXE
        
        PID:2564
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3516
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        27⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2172
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2616
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        31⤵
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3556
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4896
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3208
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        39⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2704
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4176
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1876
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        46⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4216
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        48⤵
        Executes dropped EXE
        
        PID:3372
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3060
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1984
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:536
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4016
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1396
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1376
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1228
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        59⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        60⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:724
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:212
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        63⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        64⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4200
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1428
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3284
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        68⤵
        Drops file in System32 directory
        
        PID:1812
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        69⤵
        Drops file in System32 directory
        
        PID:5068
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2776
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1704
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        75⤵
        Modifies registry class
        
        PID:1816
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1264
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        77⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2700
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        79⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:520
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3408
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        82⤵
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        83⤵
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        84⤵
        Modifies registry class
        
        PID:2116
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        85⤵
        Drops file in System32 directory
        
        PID:4752
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        86⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        87⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        88⤵
        Modifies registry class
        
        PID:1096
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        89⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        92⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        96⤵
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        98⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        99⤵
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        100⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        102⤵
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        105⤵
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        106⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        107⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        108⤵
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        109⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        110⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        111⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        112⤵
        Drops file in System32 directory
        
        PID:1616
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        113⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        115⤵
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5516
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5612
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        120⤵
        Drops file in System32 directory
        
        PID:5716
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        122⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        127⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        128⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        130⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        131⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        135⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        137⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        138⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        139⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        140⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        141⤵
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        143⤵
        Drops file in System32 directory
        
        PID:6216
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        144⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        145⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        147⤵
        Modifies registry class
        
        PID:6388
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        149⤵
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        150⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        151⤵
        Drops file in System32 directory
        
        PID:6568
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        152⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        154⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        155⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        156⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6832
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        159⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        160⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        161⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        162⤵
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        163⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 224
        164⤵
        Program crash
        
        PID:6196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 7108 -ip 7108
1⤵
PID:5756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Fbllkh32.exe

Filesize
96KB

MD5
8230972696e40a9be6f5598583f8faad

SHA1
236ab64631ef2c3de1cf7874535f8b7b87db669c

SHA256
3ba189b73ddcebe083a4aa2e06f72d3ed0c918e8095d49afb743d11ccb946b6f

SHA512
5010b83f2d6ea9144194ef9f4f5e21f3b3317030a121f2692a97f2df9369ce33a2c627c1e3632feed3b1770fb0c0587e97ff488ddc991eea4163e684bb73cb4e

Download Submit
C:\Windows\SysWOW64\Fcnejk32.exe

Filesize
96KB

MD5
6884dde6b4358ad0fdf04533377d77c0

SHA1
26322c7d08f8db75172297a12cd8fbd4aa512057

SHA256
9224df80654203e2efa824af9c4d090c6c9bcf6017d4e16494b2a9377a076d9a

SHA512
83b3c95d37d074c718b20d277c881e5c0dccefe9246e5c532d2cb863e46a9e81fc024910d22c2095311ee5da3f270967c7d233b6e19ba125f3853cebfd2762b6

Download Submit
C:\Windows\SysWOW64\Ffbnph32.exe

Filesize
96KB

MD5
f3bdcbe95c541df6ec5d15039419a9fa

SHA1
ffad16f75e3f10e623d77a53c171a15b64855971

SHA256
549e2fc4d560ad09cd86ef4980e94fcfe982a2c67ee3322fc0ade5dac1bbd67b

SHA512
c94c85eacecdff61064f61efb7107e182b4ea209ccbc52f42d50b8d930a32d1b6e9b5287a9e96729645318d43a28d3096c6e24a0b1767ab7f994d96620b50c4c

Download Submit
C:\Windows\SysWOW64\Ffekegon.exe

Filesize
96KB

MD5
874a203840ed8909c1ab0add9c16646b

SHA1
00e664bebf31370867b7fbabf7ab439a03c58389

SHA256
01c58c6d5ddcc143b94d56e8df61320cdce2846af79517dcd167b80875a90493

SHA512
7df37e38e229bcc3441551d040f7cf714b4ca704f173948555e2774ea321ef7338c0efe2af55daa1f85ef57eb8936598432607b0a96ed83cbe7b241a7426cb21

Download Submit
C:\Windows\SysWOW64\Ffjdqg32.exe

Filesize
96KB

MD5
b7199253093e3f7a25e3f11f18fe2569

SHA1
8bd470369d81d3da98657d37942ca37b339da909

SHA256
b6f9a31ac6918856a5f7e8bf1c1982a810ce3a8d4a912a99781da502ab908b08

SHA512
bcfc520179e5a413914e850369da113aa1a5ffd68fc9aab3b3997c6951ff00e7f7ad69a33bf6918dc62e3e12bbbcbd8efcd7dc33e56e6c6252fe2c8708656c60

Download Submit
C:\Windows\SysWOW64\Fflaff32.exe

Filesize
96KB

MD5
0fc2f5eb07f752907060a8f31564e1c0

SHA1
44fd2d30ccd5139efab64841310ef696d2be4b1d

SHA256
9ab86ee736a686d47bd999f5fb79b17a3e3389c2cd05bd62902bba4264422f64

SHA512
afaac169d162fbf744f3b520e966dfee9d7d9e2fb1dda8869b86259c83a3ba891a577caf05dde6c965646d5433b42c2c9ad6a44d26cb0ff3a736c0c6f7893648

Download Submit
C:\Windows\SysWOW64\Ficgacna.exe

Filesize
96KB

MD5
af26794138507009b89cb7606861dc56

SHA1
c6d8cebe02c81f8f260e6c426326505202ab9797

SHA256
e6071499d206cf18af43d75bdc4b465a019a0c19b2c59ec062160d39cc889f0c

SHA512
07c9a1ec233d60248c0c7f36a79f1432742220741c03f1ca2c6cb38dfd49cd32af945b116d849fb66af9ac5edc181ba396a03046deac499bdf5a6c4804e0f7de

Download Submit
C:\Windows\SysWOW64\Fijmbb32.exe

Filesize
96KB

MD5
83978501aeb1a09ce3b8687aa622389e

SHA1
a1e98509b27521046b03f133b8229e8ef9bec2aa

SHA256
6c759fd4fe9bcb501ac2e7efe25e4992673e352afca4946a358689680cbacf5c

SHA512
a5f6ce86c7b39d010fb448cfa90827a600e3d9c458d919fa38a84c23d859f7664a8f7a8c7cae809c7cdf11ed93417d3c690c9721a3a79b791969103e50ee0e5c

Download Submit
C:\Windows\SysWOW64\Fjcclf32.exe

Filesize
96KB

MD5
98af4cc51bc8bf6acb30f4d939a8eaef

SHA1
31b65276237bea9e8b41360202b76739807c94e4

SHA256
2d35c57d01e6f1e992cd1702753d96378a06312845e587df5a44aa959a2319d1

SHA512
a97c8abfc0e3c26b140d1f80577af4a4c0d83df81a39617dd91f5185bf3f49ea394dc36113068a91ea85a11ff1c193c4933934f2a7744cb3cdd547d3255b4f6d

Download Submit
C:\Windows\SysWOW64\Fmapha32.exe

Filesize
96KB

MD5
1286e8985e5bcd5c8573b0c4f6d2294b

SHA1
4d35c01807bcabf40e1e8dd9e97dc12ea480cbb1

SHA256
1994f3477c3a9e914160986aca302acadb0218a6866d2ecc6759082e8a944661

SHA512
9555bd9ebe76ddd489014185af5c07d63ddbb1ec455c99bc72bdf317a29a0fad985a0a3d93e0f3a46b6129827f5ad740f75681dab118f5825bdebcf89ddfa53b

Download Submit
C:\Windows\SysWOW64\Fmmfmbhn.exe

Filesize
96KB

MD5
c2e3a05ac62754e876c0e99d4aec2f76

SHA1
6c80d19e9f4e9494e240fd57eb51a4c9828c95fc

SHA256
0bbbdc61830868fdb16af6e0a06ee335723ef0fb7abafb3f237007758814baa3

SHA512
66ba845ce0b8f86aa3cf23585d353ee92dd454c11bfaa34273801137f30523a925e26569f7fff1eda9439805ba788c8b857a74c75b921777d8e1ebcc54ac8ab4

Download Submit
C:\Windows\SysWOW64\Fokbim32.exe

Filesize
96KB

MD5
81d7155a89ebefd4258c09ffe1f70b7e

SHA1
74204ad03e6d8f4718cf213a233541a28cc0af28

SHA256
511eb7da92f104342b6b0a0ebfe41ec69f34d1b460fbb3c1af9c7bdb18538b81

SHA512
ed939961a7add2368010e475f38d38752db02b1a0d1e689466642a1d276500ef65f4ad5123f4f05d1360d0e859ef7749a86bd8709a5c8de4f6b472603c0da68b

Download Submit
C:\Windows\SysWOW64\Fopldmcl.exe

Filesize
96KB

MD5
1458b02f76a69ab33575cf3eb0a6e11f

SHA1
6d2db0ef8fe24dec1dfcb10b0079db31512aea8b

SHA256
6b22ed5dae985d0ec65bd5ae401eabe00fe31ef6e84377f2a6186ee27ad60d26

SHA512
b49758c955f92fd2104935e0da1cb470ab0b7b02167dcff8b53603629fd6f7183656bdc733173120feed8982147c4349437dbd732ec61aa4bb639cf3aef8fa93

Download Submit
C:\Windows\SysWOW64\Fqaeco32.exe

Filesize
96KB

MD5
18a31b6148e461f374ace3623245c92b

SHA1
be0abcac099ac7b987ebb05a3db105372d78befc

SHA256
82c3c153acb807cbbb9a9ec712dc9407681cd3881db56860bfe317a66126cf32

SHA512
1fab2abf8b7ea70164dfb69e528a0cabc23f2a135064f4fc6bb5a4917c9e7c3bb17b58d2921063d14eede6cadc049a45b61a76b78fe44facac1170fc6005a121

Download Submit
C:\Windows\SysWOW64\Fqkocpod.exe

Filesize
96KB

MD5
a4e23d561ae3ac6b6f665d19f03ede94

SHA1
02e891f5e86b8a267132de6d2b98da4caa4fed16

SHA256
38265e3a03b14fb2d22f1ff0a434ead03da3deb662c30efceb1ebe21cbb5e573

SHA512
2925123ddce1561270aa4c5ac74e754bb963bc4ca20add6354ac74a51f73e65e9971a735aca967fe492a314fe32b62370d1a98555019dbc2ea785f1e3b2e060a

Download Submit
C:\Windows\SysWOW64\Fqohnp32.exe

Filesize
96KB

MD5
d17f0534fd3e4bc64af658fbd4417272

SHA1
6a2eb0b2fc27c89ddb647b7784ac3b6b807e9834

SHA256
8c73c26e961c081b00843d73b309e8e61e36dad26aa00a758d03e8a29aaa903c

SHA512
55216177ff73bd4ae2ed4b6c4e6d1b8190d5d48024609210cc27d20171b68f5f50fa2b24bb530c7f0a15c6c50ee5bf945ccba18b11033036dca59ffaddc0697d

Download Submit
C:\Windows\SysWOW64\Gbcakg32.exe

Filesize
96KB

MD5
e24c619e051c1bc8249dffe6a6447eec

SHA1
983ecb4bfa5f584e38d762c9001c6309f27b7505

SHA256
071e5924a10e0bdce4ca6867f97e08dc1cc3e40ab120ace39b3b29ac4d1cae4c

SHA512
12ac85db2589e39b6202b0e95518a583ec56329c905001523deb05b90e7537632d3fe3627386418c5530e10a83b9aaa7ca4888cd5d906b2064bd88a16baf28a0

Download Submit
C:\Windows\SysWOW64\Gbenqg32.exe

Filesize
96KB

MD5
80f7394b439e247f62af748b5d5a0ab0

SHA1
4c929fae4d7604ee0717c3eb517afb06bdd433eb

SHA256
6c92c9814b47f1cd6e80c83c105b5782489e369ec3bf6d97a386fadf2fde664c

SHA512
61cf3e0507d43a60460703c514d2ab846d79965ece8f90c0f6d4dd24aea5746fc41c0fe13317b804737a8483700822e1e8543485337512ec949b0b4486a6e181

Download Submit
C:\Windows\SysWOW64\Gcggpj32.exe

Filesize
96KB

MD5
fa0b75d7f3994cedbe0c98efa397e4ed

SHA1
1bc987f1acb81d8e96509b6dbb3ed4c08f8bee9f

SHA256
3734040b16a4b71149f18e78b06214da29860dce43e8dfdbda477eead9e43bb3

SHA512
8c7ea4bc784b9e649aa0c60a20ebb49b1947202c6739f43577db40bea0a1892910df6ebd1c06d7d8bcb605fa850216c4d4ae0d569de939416fee8a5a015af9ee

Download Submit
C:\Windows\SysWOW64\Gcidfi32.exe

Filesize
96KB

MD5
a30ed4266448abfe9a6d55135a9a9f86

SHA1
6b78b12f8db0bb1e002c8dadd971ae06254b87b0

SHA256
c8afab9ba557f60d795506a2883465e424cff486c3a7b00d0fdc2a49438bd5c4

SHA512
b4b80831d8cfaa52dc6253b75e86ec116604e92abe01d481e4b17b46d66c575d6839df2463fb5393eb188e46d365dc559fbe32059c10b0708564b7f1a47cfcae

Download Submit
C:\Windows\SysWOW64\Gfedle32.exe

Filesize
96KB

MD5
cc65927dd2c33a33f1b0e6021e5a3af9

SHA1
fa5d0ea53ac5991d4f7c95907f03acb82238287c

SHA256
f1de7f9efc73c3bff85711ca32fc2bfb9e5b39a94b8d631cd68e25740c89e124

SHA512
b23d372a65787cd650311f5858a403600f98a442d841c3b415370761ffdf3d03d8a24a81c10348f948d4f988de0bc180ccb1543f83dc135cab6a730957fac764

Download Submit
C:\Windows\SysWOW64\Gfhqbe32.exe

Filesize
96KB

MD5
89c130dae8539747cc7669d484c9e2c0

SHA1
5c2c56b9244647276fde67a6199c80eccf3e6ac1

SHA256
18c5aa048e4422da885a631ff6c8f18e457770b0634132237f0e19b66bb546d4

SHA512
55162cc16d51f60092b4881561a6334296ee1ed32514df030d43c57d14dba971237ca5b95f64f1d6f79368dde7f414f80039aa259313ce27a8924faeab81ab4e

Download Submit
C:\Windows\SysWOW64\Gifmnpnl.exe

Filesize
96KB

MD5
f40e180b3a71ad3263094eec84b31dbf

SHA1
71a13bbda39fd204962636a58b7069a190827295

SHA256
6daf8c6910277890a14739ced4d8c07effa0894418b3b9a56d9f26bf3daa1e6d

SHA512
bd899c812ce16c7bcdd0ef1f85ee071c00908d96f6c42e79753f67a510f254182d0d0c96dafad8c25c15028322613a85b915abb5f69e45c11f3eeb651a5384cc

Download Submit
C:\Windows\SysWOW64\Gimjhafg.exe

Filesize
96KB

MD5
d004ae137022127dc127c9f3e1273d5b

SHA1
c289f4cc3e5401a767b61caf4161f21a168bb10a

SHA256
8f6e009bd9896c3e211659a87e5d34cd5b4fd20c0010e768474f02098f75f274

SHA512
a5cd68bb930136a936c51b815f6f23b107649037e9e51a374a82a5da3536f2abe33d2e5e3100518223637896a5070db871320a3979d36b86c70b1c0d54ffbd67

Download Submit
C:\Windows\SysWOW64\Gjlfbd32.exe

Filesize
96KB

MD5
b576da2f9af6ebae39a07d426a667b75

SHA1
257ec8c0a727c4dd94de3d3e69a1d14d3f8410c6

SHA256
39db52b120fa9f13744ee71dfc3b6b7d22df818898c2d23ab35a982dd957b08b

SHA512
cda5a2f04f4a151ca55d298bcd7d1c5c9ac9de21f0e671adc407d5a8a5c9ee328a9506b23e209508ba419d450868e734f6250a0753afc985797e4fd3b78e1772

Download Submit
C:\Windows\SysWOW64\Gjocgdkg.exe

Filesize
96KB

MD5
ac708ba4e9431b012a492940e3692795

SHA1
40f6bd0c767466a6d1987a50f33a86853e93d627

SHA256
4a963b408d351cb111099a6a99fa0bd6cbff08cefe7561c772af4f247a7b6cef

SHA512
bc77e5c8486aa406fe338d5b7160691ef504108b61bccbdcb79d9016393df09f6aeab9de2adac88d132c70d31c84b99bc9e8575c19ce8859430f13259dd25dd8

Download Submit
C:\Windows\SysWOW64\Gmoliohh.exe

Filesize
96KB

MD5
f854718e28db7290f6c98499ebe8444c

SHA1
16087404b93f2dccbe64821aaa350cfb145d9463

SHA256
e613a1d4a9243be0cb481ebcb143ed41d2f1143e03da742c09a6bbf7deb03da1

SHA512
dbf72d254bffaa8f29692e8f01ecb59fc6963967caeb162c0e6ed97b050c420184d8f3a86e5b40044972ee315c67add1fedaceef99cb70b051da95d737f37cfe

Download Submit
C:\Windows\SysWOW64\Gogbdl32.exe

Filesize
96KB

MD5
dd4242c9abfa83a880560523822c071c

SHA1
8b22900db52e66c3a7de85c0df0b3e67a6ffe190

SHA256
165d8cc81626f22f5e87acc72ebee00ef4b88557f825e544f2cf529f58c7ead4

SHA512
beadbf3e515cc4369d8ae625d2c6df553cc529b0f24882f7b1029fc0bb513e07c1baa282447c58cb7fefab3386864f197baa1fe3ac05f18a59232c5986abf813

Download Submit
C:\Windows\SysWOW64\Goiojk32.exe

Filesize
96KB

MD5
9ae1786769eceab6694f71c726085bf7

SHA1
82820dbc9e7f2f679d62631ea54e22d0332b5ec4

SHA256
4419e80281c4d18f34ef5c1f750ee9b0a990b2da377c210ba07a9dd79fe1ff3a

SHA512
4eb0479b19a4432ddaa1f9fde4109da8138d7f0b78634ae7d1c13e4cad01e5680dae1bbe47f9694ba40831f7ee2abe1db8178064773f5e366f63ce5408e77d21

Download Submit
C:\Windows\SysWOW64\Gqfooodg.exe

Filesize
96KB

MD5
94e74563d45f62737bb04b1df7c056f8

SHA1
bf9b09d919c7aaba3d8ce16891e59b8efd6c71d5

SHA256
0d12ff4d1d7ef620c21c53c1e3ab23957a90417e49cb3ab65a7a6f3641642ff4

SHA512
39641003f077494e38216455e2c3512d382d077ea3410abbaa34815df512230de0dd729d33b83fa3bf247795052fae01e479bfdf2837ad84773f5d28f54c5b8f

Download Submit
C:\Windows\SysWOW64\Gqikdn32.exe

Filesize
96KB

MD5
69a0e543b9ae482ede21a96e20ba648d

SHA1
69f2e3433754d5cd63069bc411648574d09d7879

SHA256
bc4f4b482406136fc646f162d2920ced4fe3d0e0e429c3fb2706e1e79d3e9240

SHA512
0b13c6cad5f9c29587c4804dcd01a028488fca095fa4d5ec2c14ba2ed3f73b4feea72bd70f06d297efdbe73d358c39b985bd4bd9b349e95d6c92ac77c0e0e447

Download Submit
C:\Windows\SysWOW64\Gqkhjn32.exe

Filesize
96KB

MD5
0ae63502d2a7b51e6c5fc32c15d66b51

SHA1
5b1eece292a0079842f82bff73eb841788f6b79e

SHA256
9c4bd8857254a1cbf6c2eed116e7beb6dfedbd5eec27ea1f95e85f7922cd813d

SHA512
21b12712345cdd89db165f1497a94de37c7fef0bb30cec5047ed1ccad4a0c125700a4f193c7438d61ff4552db0335a40896f071878a3ed35d2f54166c024679f

Download Submit
C:\Windows\SysWOW64\Ipegmg32.exe

Filesize
96KB

MD5
9622a96a2185a057f85074568bdacd4d

SHA1
a3957d39f12ce6744a0cb0f12e2e45f3fcae88d6

SHA256
bc6480e8b19b81e04f82577283a1cb9527867a5231010b7ba2a6dea72bf79e7f

SHA512
6f039633a500561d42afad9c19d4ae0b5dc850f8eaf90aeac80efd30053b584fc9bf57b475ab2f434a24f4690a0e5efe63200c96a167d8398ced5327aaf59e5b

Download Submit
C:\Windows\SysWOW64\Jfffjqdf.exe

Filesize
96KB

MD5
0fdc767f89a923b7614062633cde3006

SHA1
dbee1330c55a82dd0f9c1f9d237da9a00161fced

SHA256
0a7633fa43dd5970c4d1c740fa24d7e932f78e02618a5e2c15037ffb34025ee1

SHA512
235aeff53dc58b196936d03055989bdf11414a80899a5677816538a31b1da775110569d0bccdd3970a8381bc957e13e7793afe60cefa8d18987115eb0fb3b003

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
96KB

MD5
0f558e178eb2a5527b3b3646ebd4528c

SHA1
849f660598e92b099881aafc27aa25c83ea1b789

SHA256
157cb8c2af82e557753bb7f34e8a83fe43ca5b61a0873262781096b4740cea1b

SHA512
16c70e6b110affb3a89366b5933c630b6b8a786532ec49961e3bf2c532feac6374550dfa122f85368d8b07777d178514941fb85be41d77cb58d503b0b67ccda9

Download Submit
C:\Windows\SysWOW64\Kkkdan32.exe

Filesize
96KB

MD5
a16f2863e240f92bd14482407e60e944

SHA1
a0c5e389d10d8b5091f463cbcf656d6cf1338fc5

SHA256
62554eabec4c4bff08abe2a0d6ff1fcccc34a54ead8195b02b1df7d934f7a772

SHA512
bc30dee920bdf530671688fd36ebf9411565af9da60ea2bc37c0f18df4f94c2d6cb4dfb427bbc35087b5f311a5616a0d33b2091957bf882b40d9fe3f6c1e21fa

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
96KB

MD5
b29d87822040a9dcc78a04950af2f3a6

SHA1
924522d80b1ebfda5084fc9585d1dd633cdc019a

SHA256
07f11ccc64fd85ec2178633c4c881e3b99fc40a4ac545956376d8a173ae17867

SHA512
49f5c82d77deda07c50aded3865506932d7e0adb42d826e122a0bd29b48052920a61a00244749677ea65189d8a3b69cf65dd37940a19efdef8bae64b946029a2

Download Submit
C:\Windows\SysWOW64\Lcgblncm.exe

Filesize
96KB

MD5
97aec2cbfdffede1d0492eb3e12d8dd2

SHA1
93f7df80efbb65a554dfc85e2904e66eb86934ca

SHA256
91138a9428b361544687abba9d09e96cab626f118a21b481bd51d6a32c3c6b04

SHA512
d5e94bbb54454b8826519eb65df62d9050389ebc1d09efcc2ab95c651a218e538d3fdb42a93dae88865cf7c9f4d23b2c70402e9d38d409689f6c96787c88df6b

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
96KB

MD5
9634c1c8b722d4d7d6da810c45890714

SHA1
3dfb8890428c1d0c86dc846e051d4f4291cc601a

SHA256
e6bdaa523cb2a3b2ff334bfa81813951ed544c2bcf61cd424c9ed9dad8cfe6e8

SHA512
c158f5e015a5871986cfad9d6cfd144c6604867d6a182bae58be26a2fbb1171b2c658ee1bb87802adf327cbc82647e5cd125a63ab2e46b39853b7636beb867a5

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
96KB

MD5
f9a7802e9b641a0180487cb352f962fe

SHA1
7c2fcd0d3f902584ca532208e55562c09b89c0d7

SHA256
e7974f6bc9efdc326266b195e05188133c12cf65b25366bb16f084efbdf6bd3d

SHA512
004ef48182045801553fe03806d149271e34b1acae119e39d17c6ec6d200457d7fa499795da974a2e0fd218681e6dc051706f9da17118ba51d700c66db4e5b06

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
96KB

MD5
3ef4babe7ba402914bc5c8ac1561d4a7

SHA1
1dd8ab495e187e111a6ba5bcac5d65cd602aa8b6

SHA256
371f2949c96e003912eba9cc78a6fcc019be2ac958b23f987ed4fbf5516a4175

SHA512
6a9cb0a19f39070440eac6d3b9e66f7f1df4175a37d41c56e6ada503b15cb77f6237c6460ce774d0e26a0cd64357851622192fb761ad50e64afe93d1824d8609

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
96KB

MD5
34aad6ab8da25c39372f5817a484db48

SHA1
e37fde889388a4b98169c2975f40295097af1d00

SHA256
bc559010229a39eb0c49ed049b18a2496259fae1ffdbb7f317e07cd9e6155fda

SHA512
e9a0ad6a93e488d8e85170ff7b8c6d39eb2cad90c281d3d3b9d5dda6354f18759ea27b12b1ccec2c5479d997348a261c48b63a19e1bb7e22e54b6ce7514006f2

Download Submit
C:\Windows\SysWOW64\Njogjfoj.exe

Filesize
96KB

MD5
e92304aec6f5b99ffa25181b78e1b8b1

SHA1
081b52cf3544b746c3b1c10f2012c7e9bf564435

SHA256
e0e654984e217e379ab7e52840e53526124948f06918f6439e758a86703e365d

SHA512
ae0f8d33b753f4bc98fafe6dfc7587e3a7f7af2b8cd16f34b21c2c70923279fb83b5bd0163ca0d4a962cf8526d1233c2ac494f81dd27a5b51c468ea977cb9cab

Download Submit
memory/8-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/212-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/520-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/536-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/724-429-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-598-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1100-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1228-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1264-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1376-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1392-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1428-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1488-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-507-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1812-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1816-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1984-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2028-599-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2028-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2116-569-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2128-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2172-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2244-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2244-567-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2288-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2320-562-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2380-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2564-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2580-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2616-238-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2700-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2704-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2716-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2776-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2932-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2960-571-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2960-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2968-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3060-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3064-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3068-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3284-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3368-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3372-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3408-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3556-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3560-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3560-545-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3560-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3576-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3640-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3648-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3668-526-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3860-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3924-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3956-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3960-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4008-584-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4016-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4068-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4164-586-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4176-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4200-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4216-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4260-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4300-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4308-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4504-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4520-214-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4620-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4740-37-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4740-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4752-576-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-585-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-595-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4896-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4924-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5068-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6300-1139-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads