e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b.exe
Size

1020KB
MD5

3431db3c34b5997398351f6a2b412e30
SHA1

f27e06b38d908b3da100c265b2672667e1e970cd
SHA256

e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b
SHA512

2a432e2f49f0bf3f73c6e98fdb43d9d0c31906ee10cb51e486c710039b329a0aec065963c3c83ddc9ef100d63d07c9d7bac0243a59b50fa98458f3aafb94a6ff
SSDEEP

24576:0eN7dfyvzecrHPh2kkkkK4kXkkkkkkkkhLX3a20R0i:n7dfyvKcrXbazR0i

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcpllo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpdelajl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kinemkko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mglack32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncgkcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffocib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpmokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfhbppbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnocof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfhbppbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laopdgcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kphmie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkqpjidj.exe

Executes dropped EXE 64 IoCs

pid	Process
5036	Jfhbppbc.exe
4408	Kaqcbi32.exe
2924	Kpccnefa.exe
4208	Kkihknfg.exe
1680	Kacphh32.exe
2852	Kbdmpqcb.exe
3496	Kinemkko.exe
4164	Kphmie32.exe
4472	Kbfiep32.exe
1028	Kgbefoji.exe
4116	Kipabjil.exe
4732	Kagichjo.exe
3132	Kdffocib.exe
2296	Kgdbkohf.exe
4024	Kibnhjgj.exe
220	Kajfig32.exe
972	Kgfoan32.exe
1468	Lmqgnhmp.exe
2964	Lalcng32.exe
3944	Ldkojb32.exe
1800	Lgikfn32.exe
840	Liggbi32.exe
780	Laopdgcg.exe
4656	Lcpllo32.exe
532	Lgkhlnbn.exe
1860	Lijdhiaa.exe
3796	Laalifad.exe
4184	Lpcmec32.exe
2696	Lcbiao32.exe
4032	Lkiqbl32.exe
3628	Lilanioo.exe
5008	Laciofpa.exe
4440	Ldaeka32.exe
2384	Lcdegnep.exe
3664	Lklnhlfb.exe
2340	Lnjjdgee.exe
1580	Laefdf32.exe
4504	Lddbqa32.exe
4524	Lgbnmm32.exe
4356	Lknjmkdo.exe
3296	Mnlfigcc.exe
3476	Mpkbebbf.exe
2772	Mciobn32.exe
2596	Mkpgck32.exe
2352	Mnocof32.exe
3176	Mpmokb32.exe
440	Mcklgm32.exe
4676	Mkbchk32.exe
2188	Mjeddggd.exe
3512	Mamleegg.exe
3264	Mdkhapfj.exe
3792	Mgidml32.exe
3672	Mjhqjg32.exe
1576	Maohkd32.exe
2128	Mdmegp32.exe
2016	Mglack32.exe
1988	Mjjmog32.exe
3448	Mnfipekh.exe
1428	Mpdelajl.exe
4664	Mcbahlip.exe
3208	Nkjjij32.exe
3304	Nnhfee32.exe
4512	Nqfbaq32.exe
1684	Nceonl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Jjblifaf.dll	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Kgkocp32.dll	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Mpkbebbf.exe	Mnlfigcc.exe
File opened for modification	C:\Windows\SysWOW64\Nceonl32.exe	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Kgfoan32.exe	Kajfig32.exe
File created	C:\Windows\SysWOW64\Egqcbapl.dll	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Laciofpa.exe	Lilanioo.exe
File created	C:\Windows\SysWOW64\Laefdf32.exe	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Lddbqa32.exe
File created	C:\Windows\SysWOW64\Dbcjkf32.dll	e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b.exe
File opened for modification	C:\Windows\SysWOW64\Lcbiao32.exe	Lpcmec32.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nggqoj32.exe
File opened for modification	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Mjjmog32.exe	Mglack32.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Kacphh32.exe	Kkihknfg.exe
File opened for modification	C:\Windows\SysWOW64\Kagichjo.exe	Kipabjil.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Lmqgnhmp.exe	Kgfoan32.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Ldaeka32.exe	Laciofpa.exe
File created	C:\Windows\SysWOW64\Mnlfigcc.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Efhikhod.dll	Lmqgnhmp.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	Lcpllo32.exe
File created	C:\Windows\SysWOW64\Fcdjjo32.dll	Nqfbaq32.exe
File created	C:\Windows\SysWOW64\Nggqoj32.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Kgdbkohf.exe	Kdffocib.exe
File created	C:\Windows\SysWOW64\Mamleegg.exe	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mamleegg.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Bdiihjon.dll	Kbdmpqcb.exe
File opened for modification	C:\Windows\SysWOW64\Kphmie32.exe	Kinemkko.exe
File opened for modification	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mjjmog32.exe
File created	C:\Windows\SysWOW64\Lalcng32.exe	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Bheenp32.dll	Lcdegnep.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Ipkobd32.dll	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File opened for modification	C:\Windows\SysWOW64\Kdffocib.exe	Kagichjo.exe
File opened for modification	C:\Windows\SysWOW64\Kkihknfg.exe	Kpccnefa.exe
File opened for modification	C:\Windows\SysWOW64\Kbdmpqcb.exe	Kacphh32.exe
File opened for modification	C:\Windows\SysWOW64\Ncgkcl32.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Lifenaok.dll	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Mkbchk32.exe	Mcklgm32.exe
File opened for modification	C:\Windows\SysWOW64\Mjeddggd.exe	Mkbchk32.exe
File created	C:\Windows\SysWOW64\Mgidml32.exe	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mgidml32.exe
File opened for modification	C:\Windows\SysWOW64\Laefdf32.exe	Lnjjdgee.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbebbf.exe	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lijdhiaa.exe
File opened for modification	C:\Windows\SysWOW64\Lilanioo.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mcklgm32.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Nceonl32.exe
File created	C:\Windows\SysWOW64\Kinemkko.exe	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Gcgqhjop.dll	Lgikfn32.exe
File created	C:\Windows\SysWOW64\Jifkeoll.dll	Lalcng32.exe
File created	C:\Windows\SysWOW64\Lklnhlfb.exe	Lcdegnep.exe
File opened for modification	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File opened for modification	C:\Windows\SysWOW64\Kgfoan32.exe	Kajfig32.exe

Program crash 1 IoCs

pid	pid_target	Process
5324	5192	WerFault.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdffocib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdiihjon.dll"	Kbdmpqcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidmdfdo.dll"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mecaoggc.dll"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifenaok.dll"	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjoceo32.dll"	Laopdgcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgikfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbcjkf32.dll"	e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpgeph32.dll"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kagichjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kacphh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbhnnj32.dll"	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebaqkk32.dll"	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipfna32.dll"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nggqoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnlfigcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mglack32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laopdgcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeandl32.dll"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldkojb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 5036	4268	e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b.exe	82
PID 4268 wrote to memory of 5036	4268	e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b.exe	82
PID 4268 wrote to memory of 5036	4268	e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b.exe	82
PID 5036 wrote to memory of 4408	5036	Jfhbppbc.exe	83
PID 5036 wrote to memory of 4408	5036	Jfhbppbc.exe	83
PID 5036 wrote to memory of 4408	5036	Jfhbppbc.exe	83
PID 4408 wrote to memory of 2924	4408	Kaqcbi32.exe	84
PID 4408 wrote to memory of 2924	4408	Kaqcbi32.exe	84
PID 4408 wrote to memory of 2924	4408	Kaqcbi32.exe	84
PID 2924 wrote to memory of 4208	2924	Kpccnefa.exe	85
PID 2924 wrote to memory of 4208	2924	Kpccnefa.exe	85
PID 2924 wrote to memory of 4208	2924	Kpccnefa.exe	85
PID 4208 wrote to memory of 1680	4208	Kkihknfg.exe	86
PID 4208 wrote to memory of 1680	4208	Kkihknfg.exe	86
PID 4208 wrote to memory of 1680	4208	Kkihknfg.exe	86
PID 1680 wrote to memory of 2852	1680	Kacphh32.exe	87
PID 1680 wrote to memory of 2852	1680	Kacphh32.exe	87
PID 1680 wrote to memory of 2852	1680	Kacphh32.exe	87
PID 2852 wrote to memory of 3496	2852	Kbdmpqcb.exe	88
PID 2852 wrote to memory of 3496	2852	Kbdmpqcb.exe	88
PID 2852 wrote to memory of 3496	2852	Kbdmpqcb.exe	88
PID 3496 wrote to memory of 4164	3496	Kinemkko.exe	90
PID 3496 wrote to memory of 4164	3496	Kinemkko.exe	90
PID 3496 wrote to memory of 4164	3496	Kinemkko.exe	90
PID 4164 wrote to memory of 4472	4164	Kphmie32.exe	91
PID 4164 wrote to memory of 4472	4164	Kphmie32.exe	91
PID 4164 wrote to memory of 4472	4164	Kphmie32.exe	91
PID 4472 wrote to memory of 1028	4472	Kbfiep32.exe	92
PID 4472 wrote to memory of 1028	4472	Kbfiep32.exe	92
PID 4472 wrote to memory of 1028	4472	Kbfiep32.exe	92
PID 1028 wrote to memory of 4116	1028	Kgbefoji.exe	93
PID 1028 wrote to memory of 4116	1028	Kgbefoji.exe	93
PID 1028 wrote to memory of 4116	1028	Kgbefoji.exe	93
PID 4116 wrote to memory of 4732	4116	Kipabjil.exe	94
PID 4116 wrote to memory of 4732	4116	Kipabjil.exe	94
PID 4116 wrote to memory of 4732	4116	Kipabjil.exe	94
PID 4732 wrote to memory of 3132	4732	Kagichjo.exe	95
PID 4732 wrote to memory of 3132	4732	Kagichjo.exe	95
PID 4732 wrote to memory of 3132	4732	Kagichjo.exe	95
PID 3132 wrote to memory of 2296	3132	Kdffocib.exe	96
PID 3132 wrote to memory of 2296	3132	Kdffocib.exe	96
PID 3132 wrote to memory of 2296	3132	Kdffocib.exe	96
PID 2296 wrote to memory of 4024	2296	Kgdbkohf.exe	97
PID 2296 wrote to memory of 4024	2296	Kgdbkohf.exe	97
PID 2296 wrote to memory of 4024	2296	Kgdbkohf.exe	97
PID 4024 wrote to memory of 220	4024	Kibnhjgj.exe	98
PID 4024 wrote to memory of 220	4024	Kibnhjgj.exe	98
PID 4024 wrote to memory of 220	4024	Kibnhjgj.exe	98
PID 220 wrote to memory of 972	220	Kajfig32.exe	99
PID 220 wrote to memory of 972	220	Kajfig32.exe	99
PID 220 wrote to memory of 972	220	Kajfig32.exe	99
PID 972 wrote to memory of 1468	972	Kgfoan32.exe	100
PID 972 wrote to memory of 1468	972	Kgfoan32.exe	100
PID 972 wrote to memory of 1468	972	Kgfoan32.exe	100
PID 1468 wrote to memory of 2964	1468	Lmqgnhmp.exe	101
PID 1468 wrote to memory of 2964	1468	Lmqgnhmp.exe	101
PID 1468 wrote to memory of 2964	1468	Lmqgnhmp.exe	101
PID 2964 wrote to memory of 3944	2964	Lalcng32.exe	102
PID 2964 wrote to memory of 3944	2964	Lalcng32.exe	102
PID 2964 wrote to memory of 3944	2964	Lalcng32.exe	102
PID 3944 wrote to memory of 1800	3944	Ldkojb32.exe	103
PID 3944 wrote to memory of 1800	3944	Ldkojb32.exe	103
PID 3944 wrote to memory of 1800	3944	Ldkojb32.exe	103
PID 1800 wrote to memory of 840	1800	Lgikfn32.exe	104

C:\Users\Admin\AppData\Local\Temp\e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b.exe
"C:\Users\Admin\AppData\Local\Temp\e5393a4b3753e6769913bb2ee3fb608ef30676790c1aa7b5636f3fcd6e02f95b.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\Jfhbppbc.exe
  C:\Windows\system32\Jfhbppbc.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\SysWOW64\Kaqcbi32.exe
    C:\Windows\system32\Kaqcbi32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\SysWOW64\Kpccnefa.exe
      C:\Windows\system32\Kpccnefa.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4208
      - C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        23⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:780
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:532
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1860
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3796
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4184
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2696
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3628
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5008
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2384
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        36⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4356
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3296
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3476
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2596
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2352
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:440
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4676
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2188
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3512
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3792
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3672
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1576
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2016
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1988
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3448
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3208
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3304
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4892
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        67⤵
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1376
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3168
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        72⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3812
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3700
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2280
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1612
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4092
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        79⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5192 -s 400
        80⤵
        Program crash
        
        PID:5324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5192 -ip 5192
1⤵
PID:5264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Jfhbppbc.exe

Filesize
1020KB

MD5
e8bf7f4d0534f6adf09102cbe67931f2

SHA1
717afb5e82c1803c67f96a7fe5f1be12bd5c44aa

SHA256
4f7c690ef3ab9015255750e8199362aac9c1cd2fe1bd9b829c9c6473601f9d3d

SHA512
a616166ca0db368eab7f9f2657d87ee8868def3fd4bac3ac62eac7f9859223cb099073bf211e79dd17afbbdab131baafc5fc2f1bcc101e11b68305ff2be3699a

Download Submit
C:\Windows\SysWOW64\Kacphh32.exe

Filesize
1020KB

MD5
ea3ab3e40e5c818f4ad30b5592e91931

SHA1
72eea488d4d4d7433c4308a6952b940478dde28b

SHA256
8dc52bea60899b24f587dbe1344db130e397d9e586735df9a06f9b1ef12235be

SHA512
18d8fd009ecf6d7ac2023266cc876c64e05fffe4df311195e37a4ecdab8aa91c6acfdc58fe4b61da11adc0975102084bf6675018cea1ed176ee4df6d17be7609

Download Submit
C:\Windows\SysWOW64\Kagichjo.exe

Filesize
1020KB

MD5
791871eb381fc96721e15b6021844641

SHA1
8a8db7a880623c8bceb490a0837c74e998ff2944

SHA256
39be18fad06f5a9b1bb33c16f2f715b2435de59f340fb08d5a1cec2bd94c3ae5

SHA512
8875dadc74b94d58653eb7649aca5bc720fa033a636ea198a0122c3b29ba3bb1ba7efd3dec40feccfd8137523aa9f4d7dfdc21f5d578bf8f11a3bd5e17f8ccf1

Download Submit
C:\Windows\SysWOW64\Kajfig32.exe

Filesize
1020KB

MD5
53d7306e30889269d7a46953f74d3cec

SHA1
d674c4486b47c143984bab259674b1544eb8474a

SHA256
c88aa260e8605902c5f9f3bae373ac63b5586b0849b813d36fb014a99006fd26

SHA512
41f5241a5c1d0cd243f7dc87275ff50e4ee4841769cdf023b76892781256c9c722e3f28f6c8467976f1756e29c0c54f59028fdb83fe4d7c5c3c1e8393914d09b

Download Submit
C:\Windows\SysWOW64\Kaqcbi32.exe

Filesize
1020KB

MD5
7a05093162bfd7eeb294204ee2dc0d7a

SHA1
970650aa9df2d6298917e1b4b708734f28db61fd

SHA256
3715c30f31ef8b86841044eaf6bd69ebc75375c158d25853f4f1894e50ae391c

SHA512
f846eb0ed7d03133cccf4a31b4dbcd5b37e61c6d905e561ba570e373f62debb691b502261d0e4c5e7e9f3c6af8be79085f850902192b2ba49ee103eee57848f7

Download Submit
C:\Windows\SysWOW64\Kbdmpqcb.exe

Filesize
1020KB

MD5
d689b9c8178f1631c28417da0a598c15

SHA1
39c57dea9da883fbfc973f4b91ec117f8e433de9

SHA256
6328a01d902b9496506a296bc5363f210636a6c56021e27a0561896185be4af2

SHA512
02912b2fd2d24f02838b1aec469b3d7a44fc569f23619841d2b62f184adf47ef6ee0509fe6f8f776066cf8e6c883af2a584f56a9b3c3ae2592ab360ab7bec25c

Download Submit
C:\Windows\SysWOW64\Kbfiep32.exe

Filesize
1020KB

MD5
8e62b51420e8abf31ae0692eb6aff533

SHA1
800b68578e894684a7ff37df2008fbca9017100b

SHA256
a4e2ce3aa0ac4229305e7c9b2d5416aac1e5f968c0f486934706e751f7c4d670

SHA512
8534327906f00a1fca6e442eb2b6145a6e244eaa703287b70bb3224b1ec3ff56845d308854d99bda5b8e1f3d4535126899194313a700b948b26196624687c87f

Download Submit
C:\Windows\SysWOW64\Kdffocib.exe

Filesize
1020KB

MD5
880e0009cf6025e312568c28f4179ed2

SHA1
cdb9b6b7b6bf0012cb3947f40c1e2f48b92c3641

SHA256
7bfe59d9c70b8bdb90f014f3ab5b649615d7fcd098017ccca190fda534f71fba

SHA512
b3fc87e9547713170568ac8f1f99e2e7ac4540a6830570427ed103ac053638aa48d55baa8584708c986ce959ed8d44e790b33e5aa325289bf78cf6f6e428c10a

Download Submit
C:\Windows\SysWOW64\Kgbefoji.exe

Filesize
1020KB

MD5
d97637f2d7c1ccc975cc045a178ea693

SHA1
8b7f67adeb958bc8c82901f85a86e6452391867c

SHA256
da6e286a05a71e9a0826f5d4a20ca76a532d2855e22e7ffa1608d2212a18178b

SHA512
531a7067374dc4f28d2fca311aa14198b9d294a4e01499a7f86146d4b7ea813bb9ce51caf356f40a3a7886395fd25cda2f5f9299fec894ce192cf341119da048

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
1020KB

MD5
e895425830704b97077063b7521ad9c2

SHA1
ebb09bf2f1cbb7cea686d50bd41d5c9b6d9f600f

SHA256
c52bc44b18fbf4da428421356b687651e490882e85e611904b66953edee5450b

SHA512
68006122f2a624529dbebf16372d208ef8b0c5ae3fab3dd6ec7f39e37fc3b49be64db89b84f7342baa3ca6107af08e8d37ffacf6bfb54cb97cfd25c50eb11126

Download Submit
C:\Windows\SysWOW64\Kgfoan32.exe

Filesize
1020KB

MD5
db2307b1eae6f9c4f44245c01d7b7f74

SHA1
35c02c41c2b264647aa77c3b67e6f69044484c77

SHA256
d069e9133d92e73dcbd05187677308fc63148381f5f3c8b7e0f348b3d789325a

SHA512
47750c5348da686a1ad6bbb66a69e5cf94449c9345b30f82b3e74d0d4cf6bf083c08dd7ffb821984924751b85dff569f09d7df22e5ad5b7cae9f06980b672040

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
1020KB

MD5
abdfb56a423142571f5cf31ffc1a675a

SHA1
b5af766680a45c60baade7e96dd9a97bab7caa08

SHA256
5795b1ea190987f0fd9e4338b3a2eeef3e19e6f995cf1643d23842d9f87757cb

SHA512
01ee320880e7a9a5dddaf438b191e87371692f37ff06d14f9608135f51f4bff29710d18c9af5537897f00f718655bac21907c1b0ad1546b66059891d6c57b2f9

Download Submit
C:\Windows\SysWOW64\Kinemkko.exe

Filesize
1020KB

MD5
13f8694e9088284eedc2b9990d621e9e

SHA1
1b72b0ac17ce972fd04383be0e37d26ff3832b13

SHA256
d0ca77c68d140a40926077301b1d3e7cd06f8a16057b95cd937beb53fbbe18f0

SHA512
1ab31ba7b7ed8d4a954298e70395618353afbfb47638bb099648c6ac54a020a3f186bfce50ce941cb1d7270c999a12cd8cdc0bc6b5a8547f514bfd696c1d42da

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
1020KB

MD5
e6e6bf9b7d8fdfea1a0b8937dfd0721a

SHA1
4ecb47c8f88d84d7985ccf720d9e39ae49c2e4e7

SHA256
a572ba2ab13fec9a3bdfd81fee181fd9de4d818325b2d14445bf8d20df7f5700

SHA512
7a0e2ee95d5e09d85483c02588eeb4eec795e3d98f4c904b2399cdbac8126d4e6696028ed9e4b5acc78a91be3f1b193e082d88f88efe4bb04037d02ed737c1f2

Download Submit
C:\Windows\SysWOW64\Kkihknfg.exe

Filesize
1020KB

MD5
b43783e54784420098894f92bcc83225

SHA1
58b92cee59093274f0c455c18377abb391f385e8

SHA256
ff3141979891a29bed8642c769f9f2dcc7ffab6778bcbf58d2b6e582a85b5e20

SHA512
279505ce41b70b797fc59cd073884173e231fc1b95c47f201594b8ad69b54dc2c8b4600882fddf7c0ebf5d0403539dbc82d1b14a001a67d4de99bf8523dd5b39

Download Submit
C:\Windows\SysWOW64\Kpccnefa.exe

Filesize
1020KB

MD5
20ddabaa8e38e50399dd866afade7823

SHA1
1d1c207a52a2c8fd801c60fa41b9aa7179bc4d68

SHA256
657ba8716c7ba8d6b0b4b6d967afbeab5c1726dbe70dd1eb8adf0aa40c62914d

SHA512
2043061ea9f9fb4ca0b4d9778ac8bd6eb53f68130be80c71c23c10c2efb30fca15b817858af5a07aa741a63aeab24806ede795389dbe2279cf282001b9c68f6e

Download Submit
C:\Windows\SysWOW64\Kphmie32.exe

Filesize
1020KB

MD5
668e75cc9cd5bb39441bd18a5fe7f988

SHA1
039bf1528abf05fb0074de83ed6dae0af650f902

SHA256
3ade6dd7a32448c09d45e8e981c79b3941382753016883c115989744a1cbe1b9

SHA512
ed2dcd9631ba6f77d19d11674860c628bcc4e01ccebd00c2578d6c0ee426f16900aa7db47a4ed8760713a6f513ea84877887995a4f1fda5cf204c79b5a0f6217

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
1020KB

MD5
a824c1d151062a10b0464b37ece2a547

SHA1
820d33f4dfe4b6c9aa127fe13d3eeec67a630b37

SHA256
2c209154580fd53ad043b8178918231ae397da89a694aeae70b5bfc38282991d

SHA512
1b2c64b623eabb71fa62acbd5ad52c5c3a793031596649dcad185906ae16cdd40f4d7f5d16b9bf08b6916d33c23e9eb48207126b36fbb11df8af5eb3bd718a89

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
1020KB

MD5
5a55db41c3913fa96a9607f48de936b0

SHA1
36a8c7ba5eda10c3145875c8a2af74343afec078

SHA256
c582857287e45702f2cbf299c61d1c730b1f47679316b6c3add565621979caad

SHA512
85c11212491ddd0bbc66b2224299b70575d9954e2ac28861f0e97021462ca385f8309119963f64c14cbe0ee7c3ff2ba8f2bfb599b37449544226d10764bec13b

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
1020KB

MD5
fe8c296f62ec2b3e8623a0b60ea5f795

SHA1
16262634e8271ec08a77fa7fb9398b21c815aa5e

SHA256
e800620eed2fc23da3514c5189ab8ded06ada721f7d283ec44197ebb19d7ee16

SHA512
fc99ca6f0aa83adfa68c9e0f8889907a37d59a58db637117b8312bd0d98f6e1f6aa1dd5f38e550859aea64ecafb3eaf26c866513c7a302af012dba0330712a78

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
1020KB

MD5
a575d8bf55e7a8ed5556a61516f6dea2

SHA1
cc65ac273761690fb537588d3aeb20dcaeccf266

SHA256
2bf3f22f7b005606c91aa650e303caa1270036326d964e8b95505dc63636463d

SHA512
0187965f50f99f01fdc731bc23a44714ca9375d657810c790add8e4810bf78bc728c32994146d5e684287290f4e749983586695c5ec5ffe7a3610ca48ab6a769

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
1020KB

MD5
16425dc3bef84bcb8aa0218f3e25f892

SHA1
849acc57fe9bf124dd0b359a6dfbf942c0b48d80

SHA256
7a38c9d49002f0cc435f9927c02a9c05a0515fee40008aaa505e383d798d5023

SHA512
acc26564f78c62b86129ae5c1b6d84ffaa865ebbb6619eed5251a6cd9a1edcc568b1dce70f5e96eee3f791a5322814d812bac0735966284f7cae3bb00b73448d

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
1020KB

MD5
823d152a37e1c73093c1457c15a3c56e

SHA1
48a66c9c69a3e3a638b3ca476890aeb3f95d294c

SHA256
56d86de7e69daa0d7f55084e40515778a26cc048683deeb27f0b999ca6fd5b75

SHA512
e4331d88d4527b84268b226eb04728f3c7e8a5223cadf34d1274a220c9c5f65939d0786ca0c05fe683d6a017bf7d3e8cedf1b9c439468f1efa092921448d9cc0

Download Submit
C:\Windows\SysWOW64\Ldkojb32.exe

Filesize
1020KB

MD5
fb6018ffa2dfccb3d4e0395dc30f7772

SHA1
9e5c283f6b3b00d175355e66d34bcef1f41365a9

SHA256
3a36f4b654f3f483bc42da07313fcfdd4a7977360b27c1e8be6f6f174f762a01

SHA512
245b1ce4bed8a1bdf997c8018b941f29cf5168d40519fa6eaf3597b6f5ba5e69ebff820a99bf468fdd3a8c3b05ae064eb1b3148b772b3c2cfd663bb1293d6f05

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
1020KB

MD5
cc5fd4624b280c8e706bea1c9c94bcae

SHA1
f59828aadd5fabf6a519bd481820518c84ed99a3

SHA256
43a6d1f62596e52f59225287d744c087d8bc82901ecdeb46a6135b288ee5b7ff

SHA512
44ac9080bc692bfa164702ee097f819347d5abca3f404851b236bd1b4f53cbc420878860d591b12b8d9fa8418d66537806fdd26e936a1db75d05201f5077130f

Download Submit
C:\Windows\SysWOW64\Lgkhlnbn.exe

Filesize
1020KB

MD5
f03b1a2fd318ff0505a142340059c1b8

SHA1
bb080a29f3b4a34030107533c082d59605907da5

SHA256
fce50f1c164ce7d89e04186467f56212eb2e490756a3bbf5c4e0450779398bbe

SHA512
bbf26dd5bf570069f98dc88ef46255c422d6dfab772f82e4c685bc75480d3631870792b3e09f666a41e26b140d7edf4d3bd18a83031a590bb44624008cff0351

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
1020KB

MD5
301b55d19f928a22ee87e0f22cad8569

SHA1
32b9619d88971f3027a923b101036f627b1926b8

SHA256
6270e31e352cc24321cf8f855ee73f50f791ee8b9f74ae92f30768053f573964

SHA512
25c995808c35541257b40d083b380b08f4b1c4cba62660b371f2d6709dbc91ac7a11ce1e9bb68d45fd5ada83eaa19410a58011cee1e66f452a465f0c994b6343

Download Submit
C:\Windows\SysWOW64\Lijdhiaa.exe

Filesize
1020KB

MD5
aa95e06d7a2861f67b4e9b1a673494bd

SHA1
bef649a242c06a8cc9e7af86fb06dd5e7f511d59

SHA256
f3a0f06545bf36f1ef26554fdc5d90373da8a41a1c45dac38e8b5df558b9ac08

SHA512
0357a2b60dcf5a03c377b5ca00a4c4d88e8fb0c105f1e3b598c8f8f661c34d55d07d1c6cc930afee80eb574f32778408bb72ee06ef06513dd1ee5ca3172a57db

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
1020KB

MD5
1347f9b580845b1b2a3322365a714bc4

SHA1
54e21e24f4423f86815f66095e928e41aa1512db

SHA256
c65110e1542f3ab003a915e030ef22e94da028a1b1d4edac952a1d0ffb8ca103

SHA512
a77c058530dc298aa3517ae137b9bdff9df6204668aeffc77ddc0f10e175bf3108d761a40c542320bf12ef94d80d4452d67107bb80563e35ecd96866d5201814

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
1020KB

MD5
15f800a52640ee68548a0457396af8bc

SHA1
05ca6317116a0197f38ac845cde1d03653e5c6c8

SHA256
cc9cfd23eb76992fbc26104098d113f54506e95eadc2c87bd7f7f6a4762cf37c

SHA512
a0702686e4c707bd1e068ea816ebcc9746d9069755d8730b620447c94ef795596921b51a98c045295a1f47edac27a1bfaf776ca8126d7a7cc3a65584f2662ce4

Download Submit
C:\Windows\SysWOW64\Lmqgnhmp.exe

Filesize
1020KB

MD5
bad4644c1b529a16e5102a892d3357b2

SHA1
181dd063abbab55071cc0c8a3abea7375537efe9

SHA256
ea2f217b6c37a15f9bc23d28f9fc52707db5b2b8a19f3ddf285eef3fe22b5614

SHA512
3e8b912783d269637d50d555fadbd3b8bc6a21f177b8ba90dbb9c9aad3dc4ba15a86ff89dda15c92a20ba6a58699d744aa05d0a25305704abf3bc3b97a02e43f

Download Submit
C:\Windows\SysWOW64\Lpcmec32.exe

Filesize
1020KB

MD5
d6e2259ae8c50948be1b631178830d1c

SHA1
47459530184bb14735b82a49fac86791fee402b2

SHA256
1fd2bdbc163a944c60f0b7ae30b1fcb7ec2ed587d1be8a48fd9c5d476c1bffa0

SHA512
59395cd8eb053551bbabde7380991f4c1ef9b069f8c65051b132620906a326d1daa8da63a6db7082e644fdbd5202a4f00ee39a952c974b54e94ef292a0b0bbbb

Download Submit
memory/220-524-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/440-493-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/532-515-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/780-517-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/840-518-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/972-523-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1028-530-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1376-473-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1428-481-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1468-522-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1576-486-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1580-503-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1612-465-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1680-45-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-476-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1712-474-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1744-471-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1800-519-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1860-514-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1988-483-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2016-484-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2128-485-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2188-491-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2280-466-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2296-526-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2340-504-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2344-469-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2352-495-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2384-506-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2596-496-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2696-511-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2772-497-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2852-54-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2924-29-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2964-521-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3132-527-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3168-470-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3176-494-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3208-479-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3264-489-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3296-499-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3304-478-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3448-482-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3476-498-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3496-533-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3512-490-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3628-509-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3664-505-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3672-487-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3700-467-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3792-488-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3796-513-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3812-468-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3944-520-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4024-525-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4032-510-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4092-464-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4116-529-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4164-532-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4184-512-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4208-36-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4208-534-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4268-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4268-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4268-537-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4356-500-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4408-535-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4408-16-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4440-507-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4472-531-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4504-502-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4512-477-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4524-501-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4656-516-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4664-480-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4676-492-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4732-528-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4892-475-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5008-508-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5036-536-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5036-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5064-472-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5156-463-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5192-462-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads