gozi | 9b3425df61be39de7abb5fed7e4808ace733549a25d7d1b59ec1c8162da5309d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics.exe
Size

163KB
MD5

115a3bd7014a6d70a51019f4bd569100
SHA1

5cfb1cfb1440994ec023f0ef8fdce89dfe7981c4
SHA256

9b3425df61be39de7abb5fed7e4808ace733549a25d7d1b59ec1c8162da5309d
SHA512

5e4ba5e33f2a2ea8a77cc933bf712319ec388baed80db7867cbed499cbbf1c6cb88229d07e0bfe9aae770ed12ac557bea9df2296c6bedde7a67c1040a78464e2
SSDEEP

1536:P46egiFKZRYoGCWPW3hEaFHYW2lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:0tFYRnGCh5YW2ltOrWKDBr+yJb

Score

10^/10

gozi banker isfb persistence trojan

Malware Config

Extracted

Family

gozi

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbgkfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldmlpbbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffekegon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcbnejem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfcpncdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcalgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcnhmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kacphh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbnhphbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjocgdkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmocba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcfebonm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejjqeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcopbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfjmgdlf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejjqeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iapjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjocgdkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfcpncdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kinemkko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgneampk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoocmoao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eflhoigi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbqefhpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djnaji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpklpkio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffjqdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nklfoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjepaecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhlhjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifopiajn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmkbnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbckbepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfhbppbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emjjgbjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjfnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmpngk32.exe

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Executes dropped EXE 64 IoCs

pid	Process
3000	Dhjkdg32.exe
4932	Dcopbp32.exe
4804	Denlnk32.exe
1400	Dhlhjf32.exe
4232	Dcalgo32.exe
760	Dephckaf.exe
4896	Djlddi32.exe
4700	Dpemacql.exe
3444	Dcdimopp.exe
4336	Djnaji32.exe
432	Dokjbp32.exe
3260	Dcfebonm.exe
1576	Djpnohej.exe
772	Dpjflb32.exe
4772	Dakbckbe.exe
1900	Ejbkehcg.exe
3516	Elagacbk.exe
3676	Eoocmoao.exe
4120	Ebnoikqb.exe
3032	Elccfc32.exe
2724	Ecmlcmhe.exe
4344	Eflhoigi.exe
3080	Eqalmafo.exe
4164	Ecphimfb.exe
3712	Ejjqeg32.exe
4168	Elhmablc.exe
1536	Ebeejijj.exe
4084	Ejlmkgkl.exe
4492	Emjjgbjp.exe
2732	Ecdbdl32.exe
2564	Fmmfmbhn.exe
3248	Fcgoilpj.exe
2988	Ffekegon.exe
4444	Fmocba32.exe
4600	Fomonm32.exe
2936	Fbllkh32.exe
3168	Fifdgblo.exe
3264	Fopldmcl.exe
5084	Fbnhphbp.exe
4452	Fjepaecb.exe
2616	Fmclmabe.exe
5012	Fbqefhpm.exe
3184	Fjhmgeao.exe
896	Fqaeco32.exe
4672	Gbcakg32.exe
3840	Gfnnlffc.exe
1300	Gqdbiofi.exe
5044	Gcbnejem.exe
2092	Gfqjafdq.exe
3848	Gmkbnp32.exe
1396	Goiojk32.exe
4576	Gbgkfg32.exe
4116	Gjocgdkg.exe
3612	Gmmocpjk.exe
2520	Gpklpkio.exe
2120	Gbjhlfhb.exe
428	Gjapmdid.exe
4608	Gmoliohh.exe
1204	Gqkhjn32.exe
3352	Gcidfi32.exe
2656	Gjclbc32.exe
916	Gameonno.exe
2440	Hclakimb.exe
4176	Hfjmgdlf.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eilljncf.dll	Jdmcidam.exe
File opened for modification	C:\Windows\SysWOW64\Kdaldd32.exe	Kacphh32.exe
File created	C:\Windows\SysWOW64\Dhlhjf32.exe	Denlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Gmkbnp32.exe	Gfqjafdq.exe
File created	C:\Windows\SysWOW64\Gjocgdkg.exe	Gbgkfg32.exe
File opened for modification	C:\Windows\SysWOW64\Jpaghf32.exe	Jmbklj32.exe
File opened for modification	C:\Windows\SysWOW64\Kkbkamnl.exe	Kckbqpnj.exe
File opened for modification	C:\Windows\SysWOW64\Laciofpa.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Ibhblqpo.dll	Lknjmkdo.exe
File opened for modification	C:\Windows\SysWOW64\Mciobn32.exe	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Ckfliccm.dll	Ffekegon.exe
File created	C:\Windows\SysWOW64\Pnfmmb32.dll	Gfqjafdq.exe
File created	C:\Windows\SysWOW64\Eeopdi32.dll	Ifjfnb32.exe
File created	C:\Windows\SysWOW64\Mdmegp32.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Nceonl32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Ncgkcl32.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Kaemnhla.exe	Kinemkko.exe
File created	C:\Windows\SysWOW64\Akanejnd.dll	Kknafn32.exe
File created	C:\Windows\SysWOW64\Lkgdml32.exe	Lcpllo32.exe
File created	C:\Windows\SysWOW64\Mcklgm32.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Legdcg32.dll	Njljefql.exe
File created	C:\Windows\SysWOW64\Lpdcae32.dll	Fifdgblo.exe
File opened for modification	C:\Windows\SysWOW64\Imihfl32.exe	Ifopiajn.exe
File created	C:\Windows\SysWOW64\Jpaghf32.exe	Jmbklj32.exe
File created	C:\Windows\SysWOW64\Lifenaok.dll	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Mpmokb32.exe
File opened for modification	C:\Windows\SysWOW64\Djnaji32.exe	Dcdimopp.exe
File opened for modification	C:\Windows\SysWOW64\Hbckbepg.exe	Hmfbjnbp.exe
File opened for modification	C:\Windows\SysWOW64\Kilhgk32.exe	Kgmlkp32.exe
File created	C:\Windows\SysWOW64\Ghmfdf32.dll	Jaimbj32.exe
File created	C:\Windows\SysWOW64\Kkdeek32.dll	Kgmlkp32.exe
File created	C:\Windows\SysWOW64\Nqmhbpba.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Dcalgo32.exe	Dhlhjf32.exe
File created	C:\Windows\SysWOW64\Djpnohej.exe	Dcfebonm.exe
File opened for modification	C:\Windows\SysWOW64\Ibmmhdhm.exe	Ijaida32.exe
File created	C:\Windows\SysWOW64\Jeiooj32.dll	Jpojcf32.exe
File opened for modification	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Efhikhod.dll	Liekmj32.exe
File created	C:\Windows\SysWOW64\Jmbklj32.exe	Jigollag.exe
File created	C:\Windows\SysWOW64\Bgcomh32.dll	Lpcmec32.exe
File opened for modification	C:\Windows\SysWOW64\Dhlhjf32.exe	Denlnk32.exe
File created	C:\Windows\SysWOW64\Dofqcl32.dll	Fmmfmbhn.exe
File created	C:\Windows\SysWOW64\Lpcioj32.dll	Hclakimb.exe
File opened for modification	C:\Windows\SysWOW64\Hccglh32.exe	Hmioonpn.exe
File created	C:\Windows\SysWOW64\Jdhine32.exe	Jaimbj32.exe
File created	C:\Windows\SysWOW64\Feambf32.dll	Jfffjqdf.exe
File created	C:\Windows\SysWOW64\Liggbi32.exe	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Dlddhggk.dll	Nqmhbpba.exe
File opened for modification	C:\Windows\SysWOW64\Djpnohej.exe	Dcfebonm.exe
File created	C:\Windows\SysWOW64\Elccfc32.exe	Ebnoikqb.exe
File created	C:\Windows\SysWOW64\Qgenhgdd.dll	Fqaeco32.exe
File opened for modification	C:\Windows\SysWOW64\Fomonm32.exe	Fmocba32.exe
File created	C:\Windows\SysWOW64\Lnepih32.exe	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Aiagblgj.dll	Dakbckbe.exe
File opened for modification	C:\Windows\SysWOW64\Ipldfi32.exe	Hmmhjm32.exe
File created	C:\Windows\SysWOW64\Leqcod32.dll	Jibeql32.exe
File opened for modification	C:\Windows\SysWOW64\Ijaida32.exe	Ipldfi32.exe
File created	C:\Windows\SysWOW64\Aaqnkb32.dll	Icljbg32.exe
File created	C:\Windows\SysWOW64\Lgneampk.exe	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Mahbje32.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Dokjbp32.exe	Djnaji32.exe
File created	C:\Windows\SysWOW64\Mbfppi32.dll	Fcgoilpj.exe
File created	C:\Windows\SysWOW64\Imihfl32.exe	Ifopiajn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6876	7148	WerFault.exe	285

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elccfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fihpfl32.dll"	Eqalmafo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ejjqeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcidfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhlhjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecdbdl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iapjlk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfofbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jibpdc32.dll"	Ifopiajn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaimbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpemacql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfofbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnjdmn32.dll"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inomojol.dll"	Elhmablc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jokmgc32.dll"	Gqdbiofi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifopiajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gncoccha.dll"	Kinemkko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dakcla32.dll"	Iiibkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nngcpm32.dll"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mahbje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbnhphbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpqnnk32.dll"	Iikopmkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecmlcmhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogedoeae.dll"	Emjjgbjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmocba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jigollag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odegmceb.dll"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibmmhdhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dngdgf32.dll"	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbllkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Goiojk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nilhco32.dll"	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlcqelac.dll"	Gjapmdid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebnoikqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odhibo32.dll"	Gjocgdkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imppcc32.dll"	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oedbld32.dll"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpgdbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpjqhgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibjjh32.dll"	Nceonl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oimhnoch.dll"	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 3000	3552	115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics.exe	82
PID 3552 wrote to memory of 3000	3552	115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics.exe	82
PID 3552 wrote to memory of 3000	3552	115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics.exe	82
PID 3000 wrote to memory of 4932	3000	Dhjkdg32.exe	83
PID 3000 wrote to memory of 4932	3000	Dhjkdg32.exe	83
PID 3000 wrote to memory of 4932	3000	Dhjkdg32.exe	83
PID 4932 wrote to memory of 4804	4932	Dcopbp32.exe	84
PID 4932 wrote to memory of 4804	4932	Dcopbp32.exe	84
PID 4932 wrote to memory of 4804	4932	Dcopbp32.exe	84
PID 4804 wrote to memory of 1400	4804	Denlnk32.exe	85
PID 4804 wrote to memory of 1400	4804	Denlnk32.exe	85
PID 4804 wrote to memory of 1400	4804	Denlnk32.exe	85
PID 1400 wrote to memory of 4232	1400	Dhlhjf32.exe	86
PID 1400 wrote to memory of 4232	1400	Dhlhjf32.exe	86
PID 1400 wrote to memory of 4232	1400	Dhlhjf32.exe	86
PID 4232 wrote to memory of 760	4232	Dcalgo32.exe	87
PID 4232 wrote to memory of 760	4232	Dcalgo32.exe	87
PID 4232 wrote to memory of 760	4232	Dcalgo32.exe	87
PID 760 wrote to memory of 4896	760	Dephckaf.exe	88
PID 760 wrote to memory of 4896	760	Dephckaf.exe	88
PID 760 wrote to memory of 4896	760	Dephckaf.exe	88
PID 4896 wrote to memory of 4700	4896	Djlddi32.exe	89
PID 4896 wrote to memory of 4700	4896	Djlddi32.exe	89
PID 4896 wrote to memory of 4700	4896	Djlddi32.exe	89
PID 4700 wrote to memory of 3444	4700	Dpemacql.exe	90
PID 4700 wrote to memory of 3444	4700	Dpemacql.exe	90
PID 4700 wrote to memory of 3444	4700	Dpemacql.exe	90
PID 3444 wrote to memory of 4336	3444	Dcdimopp.exe	91
PID 3444 wrote to memory of 4336	3444	Dcdimopp.exe	91
PID 3444 wrote to memory of 4336	3444	Dcdimopp.exe	91
PID 4336 wrote to memory of 432	4336	Djnaji32.exe	92
PID 4336 wrote to memory of 432	4336	Djnaji32.exe	92
PID 4336 wrote to memory of 432	4336	Djnaji32.exe	92
PID 432 wrote to memory of 3260	432	Dokjbp32.exe	93
PID 432 wrote to memory of 3260	432	Dokjbp32.exe	93
PID 432 wrote to memory of 3260	432	Dokjbp32.exe	93
PID 3260 wrote to memory of 1576	3260	Dcfebonm.exe	94
PID 3260 wrote to memory of 1576	3260	Dcfebonm.exe	94
PID 3260 wrote to memory of 1576	3260	Dcfebonm.exe	94
PID 1576 wrote to memory of 772	1576	Djpnohej.exe	95
PID 1576 wrote to memory of 772	1576	Djpnohej.exe	95
PID 1576 wrote to memory of 772	1576	Djpnohej.exe	95
PID 772 wrote to memory of 4772	772	Dpjflb32.exe	97
PID 772 wrote to memory of 4772	772	Dpjflb32.exe	97
PID 772 wrote to memory of 4772	772	Dpjflb32.exe	97
PID 4772 wrote to memory of 1900	4772	Dakbckbe.exe	98
PID 4772 wrote to memory of 1900	4772	Dakbckbe.exe	98
PID 4772 wrote to memory of 1900	4772	Dakbckbe.exe	98
PID 1900 wrote to memory of 3516	1900	Ejbkehcg.exe	99
PID 1900 wrote to memory of 3516	1900	Ejbkehcg.exe	99
PID 1900 wrote to memory of 3516	1900	Ejbkehcg.exe	99
PID 3516 wrote to memory of 3676	3516	Elagacbk.exe	100
PID 3516 wrote to memory of 3676	3516	Elagacbk.exe	100
PID 3516 wrote to memory of 3676	3516	Elagacbk.exe	100
PID 3676 wrote to memory of 4120	3676	Eoocmoao.exe	102
PID 3676 wrote to memory of 4120	3676	Eoocmoao.exe	102
PID 3676 wrote to memory of 4120	3676	Eoocmoao.exe	102
PID 4120 wrote to memory of 3032	4120	Ebnoikqb.exe	103
PID 4120 wrote to memory of 3032	4120	Ebnoikqb.exe	103
PID 4120 wrote to memory of 3032	4120	Ebnoikqb.exe	103
PID 3032 wrote to memory of 2724	3032	Elccfc32.exe	104
PID 3032 wrote to memory of 2724	3032	Elccfc32.exe	104
PID 3032 wrote to memory of 2724	3032	Elccfc32.exe	104
PID 2724 wrote to memory of 4344	2724	Ecmlcmhe.exe	105

C:\Users\Admin\AppData\Local\Temp\115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\115a3bd7014a6d70a51019f4bd569100_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\Dhjkdg32.exe
  C:\Windows\system32\Dhjkdg32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\Dcopbp32.exe
    C:\Windows\system32\Dcopbp32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\SysWOW64\Denlnk32.exe
      C:\Windows\system32\Denlnk32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\Windows\SysWOW64\Dhlhjf32.exe
        
        C:\Windows\system32\Dhlhjf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1400
      - C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Dephckaf.exe
        
        C:\Windows\system32\Dephckaf.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Dpemacql.exe
        
        C:\Windows\system32\Dpemacql.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Dcdimopp.exe
        
        C:\Windows\system32\Dcdimopp.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\Djnaji32.exe
        
        C:\Windows\system32\Djnaji32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\Dokjbp32.exe
        
        C:\Windows\system32\Dokjbp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\Dakbckbe.exe
        
        C:\Windows\system32\Dakbckbe.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Elagacbk.exe
        
        C:\Windows\system32\Elagacbk.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\SysWOW64\Eoocmoao.exe
        
        C:\Windows\system32\Eoocmoao.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3080
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        25⤵
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3712
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        28⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        29⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2564
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3248
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2988
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        36⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3168
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        39⤵
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        42⤵
        Executes dropped EXE
        
        PID:2616
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        44⤵
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:896
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        46⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        47⤵
        Executes dropped EXE
        
        PID:3840
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1300
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1396
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        55⤵
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        59⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        60⤵
        Executes dropped EXE
        
        PID:1204
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        62⤵
        Executes dropped EXE
        
        PID:2656
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        63⤵
        Executes dropped EXE
        
        PID:916
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2440
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        66⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        67⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        68⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        69⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        70⤵
        Drops file in System32 directory
        
        PID:3412
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1200
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        72⤵
        Modifies registry class
        
        PID:392
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        73⤵
        Drops file in System32 directory
        
        PID:1884
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        74⤵
        Modifies registry class
        
        PID:2480
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        75⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        76⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        77⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        78⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4300
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        80⤵
        Drops file in System32 directory
        
        PID:3360
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        81⤵
        Drops file in System32 directory
        
        PID:540
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        82⤵
        Drops file in System32 directory
        
        PID:4536
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        83⤵
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        84⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        85⤵
        Drops file in System32 directory
        
        PID:4008
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4968
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        87⤵
        Modifies registry class
        
        PID:1244
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        89⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        90⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        91⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        93⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        94⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        95⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        96⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        97⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        98⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        99⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        102⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        104⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5820
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        107⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5900
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        111⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        112⤵
        Drops file in System32 directory
        
        PID:6064
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6112
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3728
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        117⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        119⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        120⤵
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        121⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        123⤵
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5908
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5972
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        126⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        127⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        128⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        129⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        131⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        132⤵
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        133⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        134⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        135⤵
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5304
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5568
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        140⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        142⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        143⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        145⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        149⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        151⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6272
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        154⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        155⤵
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        156⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        158⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        159⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        160⤵
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        162⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        163⤵
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        165⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6900
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        167⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        169⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        170⤵
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        171⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        173⤵
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        174⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        176⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        177⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        178⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        180⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        181⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        182⤵
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6928
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        184⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        185⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        189⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        191⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        193⤵
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        196⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        197⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 404
        198⤵
        Program crash
        
        PID:6876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 7148 -ip 7148
1⤵
PID:6712

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:6548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dakbckbe.exe

Filesize
163KB

MD5
c183a894536b81971b59599af7c12b3e

SHA1
828b41e63c9b9a39fefa79dba456ab96804605a7

SHA256
ec13c744f0172c3f637c554ac1b9f569346552e8622674d419088cd7f87d3e2c

SHA512
16637a6f7770134a189fbe5af5d271210b6187f6c8ee140d7e01a84bf4d3d58f4228a6ac8279ba8de4d5342ae3ac41b1453022aefb4437e67448f80bb88156b2

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
163KB

MD5
7fab23f59297b2ba25cf216b9b0d2bb9

SHA1
fa76627e974e4939f78d37e6d8aab9aba2a2cd9a

SHA256
80ddac190437379e61a7a3156ac49bba1f5a818b501cefe2df082ad995d39999

SHA512
0b67f9e722e4c4d70798ebcafc29c0194be53e7609cda011b6edb4311c98324860dacc5efed6e3930890805f4ce6161bb5659cf7e2ba2818c00754b4883011f2

Download Submit
C:\Windows\SysWOW64\Dcdimopp.exe

Filesize
163KB

MD5
ec11fa25f60cc17b76f6cc5a65d62124

SHA1
80b26c3164273888fdbc1d073afbab5542cde3b6

SHA256
097f3b548229b64168bb543a0b134281aa425b2dd9fa471e5a38317cf8c87f0c

SHA512
4a689a9d10ba214fa5aa6e7cc400218f4211e5013052c19faf22cda4195b5d0c1aceef8a4d0a69538d1f789b957b3f13f24236b446643be69e0cd300b8d6cbaf

Download Submit
C:\Windows\SysWOW64\Dcfebonm.exe

Filesize
163KB

MD5
4fe94c2e4058189c2ef52743a5429cf7

SHA1
c099b54e5962d31b18a6deff02955f445480bdfe

SHA256
4be8d6a07bc6c7748281a74cc0e44ca48c60598ad05d5ba48ba914a0975eb7ad

SHA512
bc024ba117e4aa3f9035f76c2d4a31ccb7aa645312f27a9fb18b8e20e43098c54c4dbfe7d9712c76b1143b3b7f37409b86585362caff39fd4043a438d4af0a1c

Download Submit
C:\Windows\SysWOW64\Dcopbp32.exe

Filesize
163KB

MD5
2551c083b2eabd5a64b985eccad367be

SHA1
7232b1dba12c51f78feb47cd45e88b77b4803d9c

SHA256
520dd04f5d777787b9ae03b6bcdccdc4621b0e3da34fc43a1a13ae188825ad07

SHA512
19747aa5c6f664619489df4f39c653f9529d4c25a0ce0bd44fe471b91f48973644ff1db943d8c3445f719e2b51bcb0b5efd6b744181448965ee18dfc1907c5c1

Download Submit
C:\Windows\SysWOW64\Denlnk32.exe

Filesize
163KB

MD5
f149366a4f836000c62aa6201e74e103

SHA1
ae677b3d71198614677b8e408e835b3c52f50bc8

SHA256
a8994cec83f10f40e6d11f51a7752a75b1e673797e2a8e7388babe34308efddf

SHA512
b99081a7ccd32ff91036640ca632f021c806d01abb91d0880f83be412da7de64375d1ca2bcca2f8d0f9d5435a37919dca7d6f0f8efc725cb66f7dea3af708916

Download Submit
C:\Windows\SysWOW64\Dephckaf.exe

Filesize
163KB

MD5
feda26c9dd96d5d9d711dc7baddf65b8

SHA1
e24a3150c304a9de37c37a1eb99e0e5926938f0b

SHA256
fadcbb49e0dec40d7e9f31b737a96e9b3d833f9f3a958b0cd3265bc6363bc895

SHA512
a9983f39fbb3eae2fdda00cb64a0ee73b168f8a37b33032ba542bdf88edabe28793157423fa4d2ab67566240a54706461233c12679bbeeaba8652f1ffe10d274

Download Submit
C:\Windows\SysWOW64\Dhjkdg32.exe

Filesize
163KB

MD5
89081db0be2e452944e05bcd3fd3e898

SHA1
09bade65c5f5f616472d0476f3bb7989fe5a79d6

SHA256
ec83d1f097e4f5e2c116e6dea903a30ebd1ec9cf85cabdb506ce72dc3e13a10e

SHA512
f272795d37e76c13665a0671b34b9ada0aad63bae8b483255258eff7be283b3143b1cf89970ef00b50a937967b3f74fee07858b9cefde1d8bc120448d3fffcc5

Download Submit
C:\Windows\SysWOW64\Dhlhjf32.exe

Filesize
163KB

MD5
2bb8ace6c62a199baeaac06fa3220b13

SHA1
4d7d602fe8f30725f135ada073c2869991cdaa89

SHA256
2bc5c16009b0b0d276e4bd7e6add5e103f2b0b3a2be4e582b0207de33546513a

SHA512
909d9db11206f140200215b5e6ad080007f48da46b386526b13cb868b23be34eeac9cce692bc6d3843c69fe10c34b645e0cc97bf8fef284e5108d72afc3b42fb

Download Submit
C:\Windows\SysWOW64\Djlddi32.exe

Filesize
163KB

MD5
79b32440de7a89ccec2a3518c0d6a5eb

SHA1
4e8e8f5917d01291b91cfc40d594748b4de496cd

SHA256
c6a002a466abbca4251e66a1b2853b1a4bfb4ca8f5f08b60339bdba5a3386f1e

SHA512
fa459a79a3e47c32bfc1e41238d38d093f1467889975058731d6a7d96c3d080850a120ada9b1ad57c4b444aab8d1d187113284130288131925352e2f081b8bf8

Download Submit
C:\Windows\SysWOW64\Djnaji32.exe

Filesize
163KB

MD5
cc4ad9966cf3d133726f194f8d0a09d4

SHA1
dc61e13e6b688a614104fbc774dead608352bc08

SHA256
57a5053538500247b576452a24dc6c58f7d504be9823a176d103d76e43834131

SHA512
754f22302191aa90afad84364dc97b0d2de080c98577d8e8d511fec763a4c76c75dab075429e2dba93b88e924619fa10a1d053a72ec04e0476b24e8998911654

Download Submit
C:\Windows\SysWOW64\Djpnohej.exe

Filesize
163KB

MD5
df0354f3cdaa28fa5f25315837ff1217

SHA1
beb6360c5db1992413e9e78c3e89132624974ea6

SHA256
aeca04512b8a0646eb40132d82073560dec538fea459cdbfcb44a22d31a0730d

SHA512
c4934ab5bc877ea0abceb03bd986a9bdfc8281424844a0a8cd5b3f0b8a2b80ae5f345e46153f00c6c88ddc95f273113223dbad87b9a541a39dbfd725e5f58f47

Download Submit
C:\Windows\SysWOW64\Dokjbp32.exe

Filesize
163KB

MD5
16a7e2313b7473c96447f44fa7131b7b

SHA1
67d157fdbcb52699f0c85990b3440afcd45b7cc6

SHA256
bce8e78479f5349046c7613024bac49ce0c541e2e4203e14fe932736d56a69ff

SHA512
4c983495747510423f30ea54b54766dbfa79ecea243309cee08d435566c8568c84666632f36c4635b9535d2e2a56bfa70625d4b17acca1020817f5b1563d37d5

Download Submit
C:\Windows\SysWOW64\Dpemacql.exe

Filesize
163KB

MD5
4edd279bcf03431ef05681c78815c20c

SHA1
3c74b537b2332ab34f3aa7986f8bba0a0a8d2e63

SHA256
929e9420047bc745d799cf4d2135057481ace8feec5898912cdb98e8f3423f0d

SHA512
aed7b3b3a9400eb8a4afbaac948cc6b6a8172703f84867199ffe3c703e7df675bc4949e28463b0e1106da5ed40e05ee46bb9a383889f5130d2df14cfdf1bceff

Download Submit
C:\Windows\SysWOW64\Dpjflb32.exe

Filesize
163KB

MD5
b9d0ee2ebd40c6b133056ca4e161de3b

SHA1
e76e2a6368e930a63d5ef108a9083ed24938ff6f

SHA256
b2be7ad0ad84da5c1584d14e0d694bcd3ff82778d3bdc6d691a8a0e924d4fae4

SHA512
9cc96fd8592ddf0cfde54d2ee857f0c9399e8bc11d62398ea49a1b4f38a32670f4066b7c7a246f9c8a0a802f7076ab597cc95f4ef346f827b6db2ba7b424dafe

Download Submit
C:\Windows\SysWOW64\Ebeejijj.exe

Filesize
163KB

MD5
edb783efda2355549c091ca3127c469f

SHA1
07746b424e21b8674735354abaa000af0ce3f2ab

SHA256
e491d7af9d3ea6eacb7971684b55a9f93a42b3f0d9760f8c1b0da460f6f62b91

SHA512
65a6934ae959e2f80dab9e7131e526c60888e98ea205bceba6305d489118c93fb4ef2ea558645ca1477c5e2d7b24f3a564a22ab2af7457cdd5198d89156a46f9

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
163KB

MD5
65a016b5f91388c9d986015c724369a9

SHA1
cead323581982da95d8fff287f5507491c5863e5

SHA256
895bb90cb5281ed35ddf12f3a75ad20fb70dbf149dfedaa476f4e720e63c5ae5

SHA512
822a2e6d37fb95ef357b48cfb150dc1076523a561e5c2f7df550ea642b6edfba073e13810244b75ed4807ff84e29bf979a0b54207ead3ac7bc3f5ed0a970fb39

Download Submit
C:\Windows\SysWOW64\Ecdbdl32.exe

Filesize
163KB

MD5
035c2bbf6437d724d4efdb2cc1ef0b1b

SHA1
d70e5a08bc758d7343f6559c6f944c6717139233

SHA256
410f1406e782f6d0052f4f7f449cb4b0e5f38c3434e90b0ad67eb4edbec6ebbf

SHA512
975fba7b932d07016cff24b22d45a87106c7015034b42d2010e13357df89bd2c8216d8613be00d85ef225a256b199a4a45bd0ac924b9a3b80f22e0dc4b4dc18e

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
163KB

MD5
911c1f9c7563c7dcd4dace2e2e0e0117

SHA1
857254a14da92a2a259076600e37188fff9c0b5d

SHA256
4fbfbac83744a4a1583ce59318641bcf68c9a2f283189dfb903d512710ffca3f

SHA512
4c30e33240e69104fddc66ad57b83b59c0e0038b9d56418f2a9810f758504855a1da215bccbffd70040f247d254d288164e7d3aa58409d02e8e6fc52b4e80d0c

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
163KB

MD5
3b1480d81336f874cd3d7385db918ddf

SHA1
0b2e814fde2b54e0d68ebd3c61d538fcef4a79e1

SHA256
40be6775e82bcbdd273e6573f2d11608b61132fcd098f99ca4c9f3e264563481

SHA512
41a29c6dc661a71c97359265fb5feb93ee623bd1c8a6daa0efa51a0f19d33d94bd7f11f9f57bbf8f47111140961d010e39937d1a5135d23816b7196de49bf8af

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
163KB

MD5
c49d868128b819bd10127ded5b3ba250

SHA1
a0bd572cf53703d3b0436296cfac6453219efc1a

SHA256
4a42ad10f5e700528c0bfedba5926e37aef6f34589ec411a8b0be3c5b726d6aa

SHA512
ffa5c5b50193be4395078ab6d4e8a28cb482ab6ae8ef355e87c82fd7dbc35703ba8cb0b87433cebfe8161701f00d1bb445b4ff707a2777f6ef8fa56bd85e0ed9

Download Submit
C:\Windows\SysWOW64\Ejbkehcg.exe

Filesize
163KB

MD5
11c241f6a3c5e5e41d4a2a0ccfc06d88

SHA1
933e36e322c7fdcb267ef9c62b4e83eba6342d48

SHA256
b9dfb3bab827cf1a47a852ff579b7c065b6b06e9f446d510400b244bc0c14147

SHA512
d24e17cfe4f33bfa07f5569713fb83bbfba19855067afeef657b534a5ef2747dadd9301d4f62848337027deab07b4eda91aede0dd4ec93093057d1b4991618d8

Download Submit
C:\Windows\SysWOW64\Ejjqeg32.exe

Filesize
163KB

MD5
0ce29d3497ae8a668b9b0ce0a7581b43

SHA1
b75092eb7b6af643e8e4e406c5c278d58bd94f6d

SHA256
6c0d1f28037c2d4638362e814fe0421782114f5461ca988ff83bcf53983934ea

SHA512
24eb5cecc41e63a1298132aa36bdaef6f4241a9b9129ea89bab5842dfa3f19399ba043e6ae8055ea7e8a822e5e1f8e495b6dccbe2d2e93a4ab6db2aeb7f7a01e

Download Submit
C:\Windows\SysWOW64\Ejlmkgkl.exe

Filesize
163KB

MD5
40dca0b404664540439b15427767a6a7

SHA1
130efcda95da32d624355023f4f2ba3e896dc8aa

SHA256
3e88392d869d7e8434f7039fadb74da38643dd5496962968d3e3c2c0f0c61342

SHA512
0d2e867b4f2088db83ff157bf7ef13da0f567e7cd2daa5addd35c45ee57010d627ac1445ae4af8da8ee20c9f907ed6b7193e4d7770e144398d191deac096d5e1

Download Submit
C:\Windows\SysWOW64\Elagacbk.exe

Filesize
163KB

MD5
14d977853d5c4e6d130e1add8ad36e76

SHA1
474184a816b45f58ad63c40ac75a3e1c255271d4

SHA256
19cf157c644abf0b9357616d5d2de4efff900c4edd18794b6fa307e2a13f2e86

SHA512
6b5cbaf830da00b55f3e8cd78dddfb7c4329698b65af739946f56bf74f4eb81b295a6fde02d0d822980b7f59d85046fabb66b8c69e3be7f78986dfbac9d28883

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
163KB

MD5
a26afd799e32137c02805458898c639f

SHA1
a0da168c3227d8048e4d86d43af1cdfadfc9b241

SHA256
76c5f0ca03e20d59c5c93dc66840bc4b7aaebeb790ef74e856c77439a7305730

SHA512
18b79dabd7d194b4b0b2d6f632373d33970344a2b0cf129aa2e3e587db233549d49f8f344ab25665601d45264c148205d48034c139087dffb4b4b33aafd9102c

Download Submit
C:\Windows\SysWOW64\Elhmablc.exe

Filesize
163KB

MD5
0416b59296a688f0f1306a8b45fc7814

SHA1
80e51a244fc9dd29177a8f131c72a964351af9c1

SHA256
f2dc4261aeeb00a525873f6df2f9634ce6e19a6fb3dbf3c957dbb92b81961702

SHA512
ddd0c44dc987a17913965bc8a86fd7d0a6417d9168b05134f8c261be330039b488ca995c469dafa16f667fc1333c1c48dfaf6f6bd9c40c4cf914824d0e716804

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
163KB

MD5
f36599ae299e2d3862968a5ae5a3fd1c

SHA1
bab762930ed01c3cd14d31127fb9fdd582013a4c

SHA256
0a9bfd6f37dd702c1cd142cc80ea005dcd4d9697f4394967f91c2f946cda4028

SHA512
dc290a40b3a64dc84cbd0e153f007f2f4c2379da3f0b0bd9a2b9bd9e536ce5fe771dfe31b9fa68d1f21ba4d6bc68d372d77b2f3b32fbba3cf98d4454a1377b95

Download Submit
C:\Windows\SysWOW64\Eoocmoao.exe

Filesize
163KB

MD5
a43d824ecf6fdeabd0caac6cea0db288

SHA1
6c6bf1f88bef5277a649087df15371a9cede9fc2

SHA256
052b5ecdbc9e915a36e88a5970e20818d44c7751c50772cbdcbcc1d6b75953bb

SHA512
9c9a8311a291ed5972f933e8f0ac21aaf21dda5947626ec37e9db38e56ced31216f53b06c880780a2e187b269728e3456cbb6012ba898a7c593d79ac939b678a

Download Submit
C:\Windows\SysWOW64\Eqalmafo.exe

Filesize
163KB

MD5
042fab0dcd55ec6e6f179f299e7bf279

SHA1
b97d11ad79c7e8870ec69fb27e340bb324f23999

SHA256
9d257b8e184113cf7244cb9e64bfa8a9b4a9d2e617e43941f00435c12ca12675

SHA512
04ab2b81fd9f8794f0d35c920dcb379e7202383e0d22eb5d36e092e314c65fd34d5ba5a71b94af16a08b40f4e59fb863a14aebbcd7a9b35648fb96f2d3bb35c0

Download Submit
C:\Windows\SysWOW64\Fcgoilpj.exe

Filesize
163KB

MD5
ab81d24749f5f7e5df44b1ba97c200bd

SHA1
e83f54ab2544c1443239139c2951467af08784d3

SHA256
8825272b46573b6f57deabcf4082f24ea58f03f1e6d3f90bef8ac87e0afd8068

SHA512
64dc050aa7f39f23c744a2beb2459b60e01c9f327f15f2291fba7cfc3d79097daa48491fb90b40220298b6b81de7260009012fce9b7f88c16ddc5e1949788897

Download Submit
C:\Windows\SysWOW64\Fmmfmbhn.exe

Filesize
163KB

MD5
100b4973fbf4bd1559642e549b9fd540

SHA1
f135a097edbefcc4c40d6426e947cebb77deaba1

SHA256
dde74dfa496be21aa54c773b4ca59b44b59b4cd38f5885270d3e1c14102308a5

SHA512
f5c21c958c8ec4da0df4af83e558cf4db03eb021f068f5d0fd761e5ddc19e9ce9e32c6b62a46ee34a4cf7b816ea2a059575a0df2661d2519ecce7bcfe849d875

Download Submit
C:\Windows\SysWOW64\Gameonno.exe

Filesize
163KB

MD5
3b7da9032e61c94298b2e96f88a3d8bf

SHA1
485b53cc3ba7f98bdd55dab3482c0d0809b0e796

SHA256
b04fa4e2fa4f144a5d4d18eae80c73810e181fdcfb616f29c93d5d042ec197d6

SHA512
1f00b90e8b6d462909435d00e55f7269114145e599dce382a0afbc0f83a9cc8ad0e0e3ddbc47dd1ec9461009a375d1f2d5f405c95f18255a5cbb6d91732f70a0

Download Submit
C:\Windows\SysWOW64\Jkfkfohj.exe

Filesize
163KB

MD5
d6ea729ff2e03d506032c8acad41ef98

SHA1
aa6eef17058ab26611737db1ae4bb3dc981dc744

SHA256
515960cfadc36abed031c8e799ea9da9d7cedae2a0c48fdb0d55f49a49270a59

SHA512
fb97a0e1442e4fb04e270e999c7b42f4afe6b8b51e29195cef7e6f06859a5bed04866c2dda658aff8261fd8f0cedf7ba8ae795bb7fa34b099253e822a4df1107

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
163KB

MD5
178faa1b21ca5e5de8d06fc481141965

SHA1
33c0241d2f0079c043b60523ca125d9b1d03cb84

SHA256
51f9f6102daafd8c04766bf17525fd23bd04c26ada874a584a829a018cb763fd

SHA512
02c618b646ac1cc22c0f7db06955b6eacea8940ea8b771ecea04b5cc94bf7ddab26542ffc6bbbc6dc05469f02b7784b15bbdc7d6fd68007ffc683ff2b112cf4c

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
163KB

MD5
c7b8818d55ced123604f713aea6604d2

SHA1
7b1469071f09aa27639cd58513132fb857c1c69c

SHA256
100476b56a3f78198c19f055372671b4e0c7100903c4e3f7b3e13825214e84fb

SHA512
2ea0e14be12e8066d1a931e2636d99dc98958dcf4323fd7d9a7e35ac074838b4cfc99121f02e3aba0933a72ba7ee1dac03f577d53c52ae1ffaac04f49f9a781c

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
163KB

MD5
5c0a18ceff899c83f48d8c94f198b634

SHA1
09e5ffc3d91c2be704409d944a63923f5707d002

SHA256
4be1ad091757d1ba7271213e3ed4c32f5bc71bfadc872bbdaa08e213c7fe2917

SHA512
ebfe3782717a3393325d29f514b83e1e003829166acf25b09bd7d16e51520bbefa6a048b924a2604299fca0d1cdd3375fac02e9263955ecd6f10598a18d6ab7d

Download Submit
C:\Windows\SysWOW64\Nkqpjidj.exe

Filesize
163KB

MD5
484d6744be71c8af115cbb9609ecf69a

SHA1
a827839752decf359db4152f2059629acd646dd8

SHA256
d9cb31dae01abd9eb63b6dc66550e48b248781ddad0569bcce665640c6919585

SHA512
f3547e39802f09738d98887b12ef36ab3228b35936af3222e9b423e449a475e14c12837cc2805d64e1953ce3b85ffef90db6baeaa3a56ef84b8a56ae6c7a8859

Download Submit
memory/432-609-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/432-92-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/540-532-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/760-582-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/760-54-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/772-629-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/772-112-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/772-1607-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/828-504-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/896-331-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1200-480-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1204-417-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1244-574-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1300-343-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1400-573-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1400-31-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1536-216-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1536-1581-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1576-622-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1576-104-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1708-469-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1884-486-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1900-128-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1900-642-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1980-584-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2092-355-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2092-1536-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2120-1523-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2120-396-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2332-503-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2440-440-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2480-492-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2520-390-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2564-252-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2612-453-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2656-425-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2724-168-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2732-240-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2936-280-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2988-262-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3000-538-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3000-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3032-160-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3080-184-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3168-286-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3184-324-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3248-256-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3260-96-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3260-615-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3352-419-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3360-531-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3444-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3444-601-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3516-648-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3516-136-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3552-5-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/3552-545-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3552-4-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3612-384-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3676-144-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3676-654-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3712-200-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3840-341-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3848-361-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4008-1467-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4008-557-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4084-224-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4116-382-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4120-152-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4164-191-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4168-207-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4176-442-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4232-576-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4232-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4300-520-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4336-603-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4336-79-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4344-176-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4444-268-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4452-303-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4492-236-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4536-541-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4576-372-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4600-274-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4608-412-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4700-64-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4700-590-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4772-636-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4772-120-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4804-563-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4804-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4896-583-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4896-55-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4932-556-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5012-318-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5044-353-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5084-302-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5132-591-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5304-1361-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5308-616-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5352-1447-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5352-623-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5396-630-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5536-1350-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5612-1434-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5768-1388-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5988-1366-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6424-1325-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6620-1281-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads