f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192.exe
Size 80KB
Sample240612-hr4jfstcqa
SHA256 f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192
MD5 0e3dfc1cf8739c334536acfdc7f4a325
SHA1 372b672fe5595caff16aaffeb378bccd860bfaa2
SHA512 cb990091b664b545c3c7c5363988c1c034109673c30690ae5e79e8150f635bd5e4cee18540ca768a29e5b160b3588b852f94404d03f1262846183abf78a13414
SSDEEP 1536:MWfiKEnvyA/JeM159C1PNWbk2LvS5DUHRbPa9b6i+sIk:MWaBvy4n/Ceb9vS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgpfbjlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnoaaaad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqoefand.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fclhpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipihpkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmphaaln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekngemhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgflcifg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmdgikhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmladm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cacmpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeapcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amikgpcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Babcil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhldbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhjhmhhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nimmifgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edaaccbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjfogbjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abmjqe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfogbjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgpfbjlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpgmhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kakmna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abfdpfaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calfpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmedjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jleijb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekonpckp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calfpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkofga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abmjqe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bphqji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekimjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgflcifg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgnbdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqdpgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlmchoan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmhbqbae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apeknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fclhpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocaebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgnomg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddifgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemooo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgnlkfal.exe

Executes dropped EXE 64 IoCs

pid	Process
4896	Jleijb32.exe
840	Jepjhg32.exe
4352	Jgpfbjlo.exe
2360	Jgbchj32.exe
4484	Kegpifod.exe
1496	Kgflcifg.exe
228	Kncaec32.exe
2924	Kgnbdh32.exe
876	Lgpoihnl.exe
3996	Lgbloglj.exe
1136	Lnoaaaad.exe
1368	Lqojclne.exe
2616	Mqafhl32.exe
4772	Mgnlkfal.exe
1440	Mgphpe32.exe
4748	Mjcngpjh.exe
4768	Nmdgikhi.exe
3184	Nglhld32.exe
1020	Ncchae32.exe
2668	Onmfimga.exe
3632	Oclkgccf.exe
3828	Opclldhj.exe
1792	Ocaebc32.exe
2612	Ppgegd32.exe
3968	Ppjbmc32.exe
4300	Phcgcqab.exe
4004	Pnplfj32.exe
4760	Qhjmdp32.exe
2240	Ahmjjoig.exe
5068	Aoioli32.exe
224	Apmhiq32.exe
3924	Aaldccip.exe
4292	Apaadpng.exe
1560	Baannc32.exe
5012	Bgpcliao.exe
3628	Bddcenpi.exe
4124	Bgelgi32.exe
3100	Cnaaib32.exe
3944	Cgnomg32.exe
4560	Cdbpgl32.exe
4664	Dddllkbf.exe
3980	Ddifgk32.exe
4372	Doagjc32.exe
3120	Eqdpgk32.exe
572	Ebdlangb.exe
5100	Ekonpckp.exe
1612	Ehbnigjj.exe
5040	Enpfan32.exe
4400	Ekcgkb32.exe
3712	Fijdjfdb.exe
312	Fkofga32.exe
2896	Geanfelc.exe
1640	Hlmchoan.exe
2848	Hhdcmp32.exe
4712	Iijfhbhl.exe
3624	Ibcjqgnm.exe
3188	Ipihpkkd.exe
4692	Iehmmb32.exe
4468	Jifecp32.exe
3164	Jpbjfjci.exe
4672	Jeapcq32.exe
4676	Jahqiaeb.exe
1548	Kakmna32.exe
3812	Kidben32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ahfmjddg.dll	Kemooo32.exe
File created	C:\Windows\SysWOW64\Fljhbbae.dll	Ookoaokf.exe
File created	C:\Windows\SysWOW64\Pfgbakef.dll	Pafkgphl.exe
File created	C:\Windows\SysWOW64\Mlmadjhb.dll	Pmmlla32.exe
File created	C:\Windows\SysWOW64\Amikgpcc.exe	Afockelf.exe
File created	C:\Windows\SysWOW64\Amoppdld.dll	Bphqji32.exe
File created	C:\Windows\SysWOW64\Dolqpa32.dll	Lnoaaaad.exe
File created	C:\Windows\SysWOW64\Hjaqmkhl.dll	Jifecp32.exe
File created	C:\Windows\SysWOW64\Pafkgphl.exe	Pmhbqbae.exe
File created	C:\Windows\SysWOW64\Fknofqcc.dll	Pmhbqbae.exe
File created	C:\Windows\SysWOW64\Kgflcifg.exe	Kegpifod.exe
File created	C:\Windows\SysWOW64\Lgpoihnl.exe	Kgnbdh32.exe
File created	C:\Windows\SysWOW64\Lnoaaaad.exe	Lgbloglj.exe
File created	C:\Windows\SysWOW64\Eekgliip.dll	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Akcjcnpe.dll	Ekonpckp.exe
File created	C:\Windows\SysWOW64\Ekcgkb32.exe	Enpfan32.exe
File created	C:\Windows\SysWOW64\Fijdjfdb.exe	Ekcgkb32.exe
File created	C:\Windows\SysWOW64\Gadiippo.dll	Opclldhj.exe
File created	C:\Windows\SysWOW64\Bddcenpi.exe	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Enpfan32.exe	Ehbnigjj.exe
File created	C:\Windows\SysWOW64\Hokomfqg.dll	Iijfhbhl.exe
File created	C:\Windows\SysWOW64\Kemooo32.exe	Kcmfnd32.exe
File created	C:\Windows\SysWOW64\Bmladm32.exe	Bphqji32.exe
File opened for modification	C:\Windows\SysWOW64\Kgnbdh32.exe	Kncaec32.exe
File opened for modification	C:\Windows\SysWOW64\Lnoaaaad.exe	Lgbloglj.exe
File created	C:\Windows\SysWOW64\Mgfhfd32.dll	Kcmfnd32.exe
File opened for modification	C:\Windows\SysWOW64\Mhjhmhhd.exe	Lckboblp.exe
File opened for modification	C:\Windows\SysWOW64\Mjnnbk32.exe	Mjlalkmd.exe
File created	C:\Windows\SysWOW64\Cmedjl32.exe	Calfpk32.exe
File opened for modification	C:\Windows\SysWOW64\Ddifgk32.exe	Dddllkbf.exe
File created	C:\Windows\SysWOW64\Kcmfnd32.exe	Kidben32.exe
File created	C:\Windows\SysWOW64\Jdnoeb32.dll	Apeknk32.exe
File created	C:\Windows\SysWOW64\Dmjmekgn.exe	Cacmpj32.exe
File created	C:\Windows\SysWOW64\Eopjfnlo.dll	Ocaebc32.exe
File created	C:\Windows\SysWOW64\Jpbjfjci.exe	Jifecp32.exe
File created	C:\Windows\SysWOW64\Kakmna32.exe	Jahqiaeb.exe
File opened for modification	C:\Windows\SysWOW64\Kemooo32.exe	Kcmfnd32.exe
File created	C:\Windows\SysWOW64\Bjfogbjb.exe	Abmjqe32.exe
File created	C:\Windows\SysWOW64\Pjcblekh.dll	Dmjmekgn.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Ipaooi32.dll	Ddifgk32.exe
File opened for modification	C:\Windows\SysWOW64\Mhldbh32.exe	Mhjhmhhd.exe
File created	C:\Windows\SysWOW64\Ekngemhd.exe	Edaaccbj.exe
File created	C:\Windows\SysWOW64\Fclhpo32.exe	Ekqckmfb.exe
File opened for modification	C:\Windows\SysWOW64\Fkjfakng.exe	Fgiaemic.exe
File created	C:\Windows\SysWOW64\Obqhpfck.dll	Mgphpe32.exe
File created	C:\Windows\SysWOW64\Kkbfan32.dll	Nglhld32.exe
File created	C:\Windows\SysWOW64\Kjamidgd.dll	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Geanfelc.exe	Fkofga32.exe
File opened for modification	C:\Windows\SysWOW64\Iijfhbhl.exe	Hhdcmp32.exe
File created	C:\Windows\SysWOW64\Oqoefand.exe	Ookoaokf.exe
File created	C:\Windows\SysWOW64\Paenokbf.dll	Apjdikqd.exe
File created	C:\Windows\SysWOW64\Caaimlpo.dll	Abmjqe32.exe
File created	C:\Windows\SysWOW64\Accimdgp.dll	f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192.exe
File created	C:\Windows\SysWOW64\Pbhafkok.dll	Nmdgikhi.exe
File created	C:\Windows\SysWOW64\Jponoqjl.dll	Ppgegd32.exe
File created	C:\Windows\SysWOW64\Qhjmdp32.exe	Pnplfj32.exe
File created	C:\Windows\SysWOW64\Ecpfpo32.dll	Baannc32.exe
File opened for modification	C:\Windows\SysWOW64\Iehmmb32.exe	Ipihpkkd.exe
File created	C:\Windows\SysWOW64\Lfqedp32.dll	Lpgmhg32.exe
File opened for modification	C:\Windows\SysWOW64\Lckboblp.exe	Ledepn32.exe
File opened for modification	C:\Windows\SysWOW64\Ookoaokf.exe	Nqfbpb32.exe
File created	C:\Windows\SysWOW64\Edaaccbj.exe	Ekimjn32.exe
File created	C:\Windows\SysWOW64\Fgiaemic.exe	Fjeplijj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5340	5980	WerFault.exe	207

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgbchj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Difebl32.dll"	Mgnlkfal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ookoaokf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amikgpcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddhomdje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhhfif32.dll"	Jepjhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nflnbh32.dll"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pneclb32.dll"	Fkofga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmhbqbae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amoppdld.dll"	Bphqji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Calfpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmokdgeg.dll"	Kgnbdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imnbiq32.dll"	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebdlangb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gohlkq32.dll"	Pmphaaln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amikgpcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kidben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lckboblp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmhbqbae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichqihli.dll"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clmipm32.dll"	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehbnigjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcanfh32.dll"	Bapgdm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekngemhd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amcpgoem.dll"	Ledepn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edoencdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekqckmfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgpecj32.dll"	Kgflcifg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgjimp32.dll"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjamidgd.dll"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ondhkbee.dll"	Eqdpgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnfgko32.dll"	Kadpdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcggmk32.dll"	Fkjfakng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljhbbae.dll"	Ookoaokf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eclbio32.dll"	Ekqckmfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjaqmkhl.dll"	Jifecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdnoeb32.dll"	Apeknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgiaemic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlmchoan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhdcmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgfhfd32.dll"	Kcmfnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adgmoigj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cacmpj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgflcifg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Minqeaad.dll"	Lgpoihnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppgegd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekonpckp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilnjmilq.dll"	Mjlalkmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqdpgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpgmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqfbpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adgmoigj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iehmmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dognaofl.dll"	Kakmna32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4896	2748	f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192.exe	91
PID 2748 wrote to memory of 4896	2748	f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192.exe	91
PID 2748 wrote to memory of 4896	2748	f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192.exe	91
PID 4896 wrote to memory of 840	4896	Jleijb32.exe	92
PID 4896 wrote to memory of 840	4896	Jleijb32.exe	92
PID 4896 wrote to memory of 840	4896	Jleijb32.exe	92
PID 840 wrote to memory of 4352	840	Jepjhg32.exe	93
PID 840 wrote to memory of 4352	840	Jepjhg32.exe	93
PID 840 wrote to memory of 4352	840	Jepjhg32.exe	93
PID 4352 wrote to memory of 2360	4352	Jgpfbjlo.exe	94
PID 4352 wrote to memory of 2360	4352	Jgpfbjlo.exe	94
PID 4352 wrote to memory of 2360	4352	Jgpfbjlo.exe	94
PID 2360 wrote to memory of 4484	2360	Jgbchj32.exe	95
PID 2360 wrote to memory of 4484	2360	Jgbchj32.exe	95
PID 2360 wrote to memory of 4484	2360	Jgbchj32.exe	95
PID 4484 wrote to memory of 1496	4484	Kegpifod.exe	96
PID 4484 wrote to memory of 1496	4484	Kegpifod.exe	96
PID 4484 wrote to memory of 1496	4484	Kegpifod.exe	96
PID 1496 wrote to memory of 228	1496	Kgflcifg.exe	97
PID 1496 wrote to memory of 228	1496	Kgflcifg.exe	97
PID 1496 wrote to memory of 228	1496	Kgflcifg.exe	97
PID 228 wrote to memory of 2924	228	Kncaec32.exe	98
PID 228 wrote to memory of 2924	228	Kncaec32.exe	98
PID 228 wrote to memory of 2924	228	Kncaec32.exe	98
PID 2924 wrote to memory of 876	2924	Kgnbdh32.exe	99
PID 2924 wrote to memory of 876	2924	Kgnbdh32.exe	99
PID 2924 wrote to memory of 876	2924	Kgnbdh32.exe	99
PID 876 wrote to memory of 3996	876	Lgpoihnl.exe	100
PID 876 wrote to memory of 3996	876	Lgpoihnl.exe	100
PID 876 wrote to memory of 3996	876	Lgpoihnl.exe	100
PID 3996 wrote to memory of 1136	3996	Lgbloglj.exe	101
PID 3996 wrote to memory of 1136	3996	Lgbloglj.exe	101
PID 3996 wrote to memory of 1136	3996	Lgbloglj.exe	101
PID 1136 wrote to memory of 1368	1136	Lnoaaaad.exe	102
PID 1136 wrote to memory of 1368	1136	Lnoaaaad.exe	102
PID 1136 wrote to memory of 1368	1136	Lnoaaaad.exe	102
PID 1368 wrote to memory of 2616	1368	Lqojclne.exe	103
PID 1368 wrote to memory of 2616	1368	Lqojclne.exe	103
PID 1368 wrote to memory of 2616	1368	Lqojclne.exe	103
PID 2616 wrote to memory of 4772	2616	Mqafhl32.exe	104
PID 2616 wrote to memory of 4772	2616	Mqafhl32.exe	104
PID 2616 wrote to memory of 4772	2616	Mqafhl32.exe	104
PID 4772 wrote to memory of 1440	4772	Mgnlkfal.exe	105
PID 4772 wrote to memory of 1440	4772	Mgnlkfal.exe	105
PID 4772 wrote to memory of 1440	4772	Mgnlkfal.exe	105
PID 1440 wrote to memory of 4748	1440	Mgphpe32.exe	106
PID 1440 wrote to memory of 4748	1440	Mgphpe32.exe	106
PID 1440 wrote to memory of 4748	1440	Mgphpe32.exe	106
PID 4748 wrote to memory of 4768	4748	Mjcngpjh.exe	107
PID 4748 wrote to memory of 4768	4748	Mjcngpjh.exe	107
PID 4748 wrote to memory of 4768	4748	Mjcngpjh.exe	107
PID 4768 wrote to memory of 3184	4768	Nmdgikhi.exe	108
PID 4768 wrote to memory of 3184	4768	Nmdgikhi.exe	108
PID 4768 wrote to memory of 3184	4768	Nmdgikhi.exe	108
PID 3184 wrote to memory of 1020	3184	Nglhld32.exe	109
PID 3184 wrote to memory of 1020	3184	Nglhld32.exe	109
PID 3184 wrote to memory of 1020	3184	Nglhld32.exe	109
PID 1020 wrote to memory of 2668	1020	Ncchae32.exe	110
PID 1020 wrote to memory of 2668	1020	Ncchae32.exe	110
PID 1020 wrote to memory of 2668	1020	Ncchae32.exe	110
PID 2668 wrote to memory of 3632	2668	Onmfimga.exe	111
PID 2668 wrote to memory of 3632	2668	Onmfimga.exe	111
PID 2668 wrote to memory of 3632	2668	Onmfimga.exe	111
PID 3632 wrote to memory of 3828	3632	Oclkgccf.exe	112

C:\Users\Admin\AppData\Local\Temp\f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192.exe
"C:\Users\Admin\AppData\Local\Temp\f7a08e94c015959ab8c47a3cf501bda5819770fb6f0e3010a7ca4d8349994192.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\Jleijb32.exe
  C:\Windows\system32\Jleijb32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\Jepjhg32.exe
    C:\Windows\system32\Jepjhg32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\SysWOW64\Jgpfbjlo.exe
      C:\Windows\system32\Jgpfbjlo.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2360
      - C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3828
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1792
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2612
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4004
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        34⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1560
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5012
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3944
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        41⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4664
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3980
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:572
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1612
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4400
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        51⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:312
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2848
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4712
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        57⤵
        Executes dropped EXE
        
        PID:3624
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3188
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4468
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        61⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4676
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3812
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2764
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:904
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        68⤵
        Modifies registry class
        
        PID:2428
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        69⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4932
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2776
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3264
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1044
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        76⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        77⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2348
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1948
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:64
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        84⤵
        Drops file in System32 directory
        
        PID:5168
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        86⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        87⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5344
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        89⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        92⤵
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        93⤵
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        96⤵
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        100⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6016
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        104⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        105⤵
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        106⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Ekimjn32.exe
        
        C:\Windows\system32\Ekimjn32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5596
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        112⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        113⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        114⤵
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        115⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 408
        116⤵
        Program crash
        
        PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5980 -ip 5980
1⤵
PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:5612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aaldccip.exe

Path C:\Windows\SysWOW64\Aaldccip.exe
Size 80KB
SHA256 9a6dd7707c08fce9e85e1b042c7aeeb20cf8c6c6762c7cc24952b98cc628105c
MD5 f15c3826ef52d429d08593af4f344662
SHA1 a546cc5beafdf59d82c82416c48ee385cf1f7d6d
SHA512 77fce6a287330d75945c2dc77d4707c6071089a78c801e0dba21e85b2e3b0a55e74fb28824896a934fa450a0a7de1adc85643f91aa22794e5429434cf895eff6
SSDEEP 1536:80R7o6mYFSWkVo3XJQ2LJIS5DUHRbPa9b6i+sIk:MjTVQJByS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ahmjjoig.exe

Path C:\Windows\SysWOW64\Ahmjjoig.exe
Size 80KB
SHA256 c79fcea22c4beca0889f09e8a546945f17c60b9456ec11e979f7147c84d90268
MD5 553d3d94335f0e7a13de51a8f384d63b
SHA1 15132bfc133cca1f00e3f48e9a4ac520d293da4b
SHA512 217bad433a06b75c54e07c1d645f97cc48f9d6c2f5d229c7b32c494e2641337faaa50d53ccc74e576e5245e43b80c59a36c6ac4d7cb7b1d5d5faa6a6b07dee35
SSDEEP 1536:3U1B6Nt6GhNaixDdPl3ixha3U0TO2LfS5DUHRbPa9b6i+sIk:3U/6iGhNailpl3ixhaE0TTfS5DSCopsX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aoioli32.exe

Path C:\Windows\SysWOW64\Aoioli32.exe
Size 80KB
SHA256 8244f15f564cf8e0741adc38e8877b9143249febd797f8380dbd8b06bd30c0ce
MD5 64f900ecad353fa7a6cfc185a1b1b849
SHA1 3b2b12d22abcfea6977fa41ad23b1e16286563e6
SHA512 f9b5e5946febd5a228dcb20d68ad4009f3904a7b6790dcae9d623793c843c494e98fbec154eb3cf95bfea986c9d0d1bd23a1a2b4fbc304bde974ed623b73c4f3
SSDEEP 1536:whfK1qSSOkoFd6fiAdcjVuMs8eV86pQjxwmQX2L0S5DUHRbPa9b6i+sIk:w0X66AT8eV86pQjs80S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apmhiq32.exe

Path C:\Windows\SysWOW64\Apmhiq32.exe
Size 80KB
SHA256 17304cef421c5e751dbff151cfaee44e6128784319cd1a91e30779475994bd08
MD5 fc7fe1e828f4d06a515a2f12a55b9c0a
SHA1 c54e7d8ba6cc99bdee46f285f80cd60c306bc22c
SHA512 23fccd0d53ac779fe253f44597512a16803f632fdef44f9d5e50bf1e1328505e746648581db153b082c4dcad9c4f905477dbeb5bba5ef235e1482db382a201b6
SSDEEP 1536:kJ8mAHdN82KM22pO2L6S5DUHRbPa9b6i+sIk:kej22Ke16S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bgpcliao.exe

Path C:\Windows\SysWOW64\Bgpcliao.exe
Size 80KB
SHA256 73b6b4367bf41ab5adaecde152deeec4ad7acb379817a412dd17ae68ae9954b8
MD5 ecb3fbbc89b03d11fcff6923cc5cb63c
SHA1 6bb0e8de7895b51b35ca77ce8c4f0511e6b7e7a3
SHA512 ed790886b5422bf7b91fef975d93e1794718ecabd588107450cb3061c40ed65b19aa077df0c933832c85840eea424888cf8b88fd585de1395ec21aab827a4b01
SSDEEP 1536:a+nJCypu9vevgAjdvk3QiGkGr2LiS5DUHRbPa9b6i+sIk:akJCz93MuiS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnaaib32.exe

Path C:\Windows\SysWOW64\Cnaaib32.exe
Size 80KB
SHA256 bf0a2677b7a6d6a188186c2f89cd685235901d1e9aec14e5a9ffd542e5f5cbd7
MD5 709fdb74a39770068d2e5b810a9f4d8d
SHA1 3eb8372f4da171381161490354d9ab738ba28a60
SHA512 ab234ac03dbb18ed7c4a372966720c5ea87897b652929cc7af49fc25c060e0f204b13c6a251520624272004797a4c749fc11b57729f00f7574916855cbf5c290
SSDEEP 1536:FhWIDLNpLNG/bLXygq/kdy9ccpQ2LTS5DUHRbPa9b6i+sIk:FhWIFpw7g/pBTS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddifgk32.exe

Path C:\Windows\SysWOW64\Ddifgk32.exe
Size 80KB
SHA256 04621b1f2e678c26329b7eb5c1a42796671d74c8017998cd04ca3e9f8abd5219
MD5 2350fc11abb320de96a3bd59e0148974
SHA1 8f020b9610c1aea829f7a6704889a333c7a73106
SHA512 e428c1241a7be29556b2df1904732e60e43faf997dc117b4f30fc1da35cbaa249b0141d760afbb2608f7225fd0e7f2182c829aa082b0e126bb7bcabec31c0a57
SSDEEP 1536:J8FCiWPCuYqYRNUXg602uROmffJNmn2L/S5DUHRbPa9b6i+sIk:J8YbPCNNIq/Rtfxn/S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmjmekgn.exe

Path C:\Windows\SysWOW64\Dmjmekgn.exe
Size 80KB
SHA256 f2f20a2c2473b9563934d464650d1476ce65660f24d9a5f06ff1114387459ba2
MD5 12f658aeba8a6fc94a63d6be787865de
SHA1 2f159a667d5726d0e6dca2b6a9584ada4e94cd9e
SHA512 8a4ec65f196b71cbc43d6820559f2e672be0a9d8bab802d58bec32fc16308177e966e15a98a373abfa82b181adbc49ad86fa452cdb7e592496f174a60ac4788b
SSDEEP 1536:Ycd1nK4aZSukWQJPtiH2LXS5DUHRbPa9b6i+sIk:YcPK5Z7HQJVhXS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Edaaccbj.exe

Path C:\Windows\SysWOW64\Edaaccbj.exe
Size 80KB
SHA256 dca35e18a082b4c08f746ebc13d095ee850b1a166cd7e87a5b49cc231555d001
MD5 4576d87846814caa347839560f524842
SHA1 e42d37b50cbcbda7393e546744b29b9b67931138
SHA512 adee2e658f80e6f898e110e93a2f0a3afc36b9594eb215bfa09898cf306789ed397dca4928e700a3ab66d54cc3dde75c2e4016789d154d6e0c9ed2aae3408a5a
SSDEEP 1536:AW/0IlSc8QIHeeCW+l32zwXimGZZZZZZZr2LjS5DUHRbPa9b6i+sIk:zMe8QzeCW+l3wTsjS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fkjfakng.exe

Path C:\Windows\SysWOW64\Fkjfakng.exe
Size 80KB
SHA256 547affacefcbc7c7046e2ca13cccb2e77bc737ddde0f9168b4b6dadc2ca54db5
MD5 3070de3f7ce075a162685ed36a31f1c7
SHA1 60cee6731662094923a12d031df1c280702b1797
SHA512 b7945cd84b8370665ce3cab9c39468ebaf9f0767f648789dee8bd2c945ea5a79c35fd4ab54398bd9521f3a53efcf67df8edd1c98cc237855551822af0bec0bdd
SSDEEP 1536:QjAYjfUjgHUd9TqHCdpMiBoOXzoApGR2LlS5DUHRbPa9b6i+sIk:Qj/HUd9qwMxOXzoAp1lS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fkofga32.exe

Path C:\Windows\SysWOW64\Fkofga32.exe
Size 80KB
SHA256 027effc6e72cfaffb2941b401a817837901f9f80c7a18a966d37157b2bd0bc68
MD5 e84aaecff0c44cd300052885ca935187
SHA1 51f76ed1fd4677146981624a60a389c2564b948e
SHA512 dd9d50f212dbb1af0a24b331bff63eda3cb1151fb093973812ecd4a0171881db957f9c8c02abde841f637f4d7987ef12e042192772862718a9e4d6a749ef1e71
SSDEEP 1536:ZhHSVkUuMXb7qMR3Wm1C0c2LKS5DUHRbPa9b6i+sIk:ZhQP17HDVKS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibcjqgnm.exe

Path C:\Windows\SysWOW64\Ibcjqgnm.exe
Size 80KB
SHA256 de7c86f4f02fa3ae1072a136d49768e08fcd71bed5a225e7acbdffb9b1c61702
MD5 baf99a515c0bd8472c0bcb1e443fda92
SHA1 f926ee7ba2a6c75a3387534c856eb26a4199e937
SHA512 a18f009107974c3bd7efda22074320322cb1b97ec9b42167690f7273463db0b89a06b1ace930d94496760575321ee08d6b748d6aa89089be19ba26f146df7f57
SSDEEP 1536:Ewf3JEFp4Sxb2/aZkF/z3MT2LiS5DUHRbPa9b6i+sIk:EwRx8b2dhdiS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jepjhg32.exe

Path C:\Windows\SysWOW64\Jepjhg32.exe
Size 80KB
SHA256 98ff5ebaa42787cd89166b4a44ee421df7bde5f229566d2f8289bb1951bfc9de
MD5 4c30352b4fe38c9df6e2919ca91f3ff9
SHA1 4a6f63b216eef284f958385ec3ae2319a92ef7e0
SHA512 d93fa2d0ebb33c9fe09e24584d3fbd3d3d569dae798ac76ac39c1bb665cfbb7ced68017e4ce8b7a76815c7e8531917fe04bd0658af852e15fc0159b3a9254d06
SSDEEP 1536:dBh4epxTqcWPZSsAqPQVMF/oODbYpQt7zs0PV2LXS5DUHRbPa9b6i+sIk:dj7HqJF/tbjt7zbGXS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jgbchj32.exe

Path C:\Windows\SysWOW64\Jgbchj32.exe
Size 80KB
SHA256 83b4e2c1e9d3d816d6631a05447e3296802959f746b4e844834468f8929aa67d
MD5 5b06d04c6531d2948d2ef0cb3860c139
SHA1 3e7e4c95534c4233aaea83bf1d403f42a2ee5838
SHA512 7deb42fbda8da9bf6e9e650986f5ab1688463216b859ff8817128979ee1494984a59af217072d3d77482c1fe2bbfe3f30b6814f9220dc2c5c9969b9fbe2c963d
SSDEEP 1536:IN6XQYJ+VqsEmclY9K8mDcTHmBQ5drMTiV2LUS5DUHRbPa9b6i+sIk:I0ZJerpclY9XTTHV5drMTlUS5DSCopsX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jgpfbjlo.exe

Path C:\Windows\SysWOW64\Jgpfbjlo.exe
Size 80KB
SHA256 1f1a3151dbb4f71ccc5a29380246a1f628856e77f2ef40b1f63cb8c487a1d0d7
MD5 1b64dddc35421caf41b1e04bf77e1b72
SHA1 2fd052375f6809cfae5fe6dbf4e482e5b40b19b0
SHA512 77857872edba3f6582c7fa0ea1eeade2466ba3df097873eedbfd2cf721b6b3bb77a00bca2d9e0b8e962ac49d5c627a52864252b26383d0ce21f391c873e27633
SSDEEP 1536:GiJbl2AHbpkTNxSlCMBhII4gWuNW2LTS5DUHRbPa9b6i+sIk:7dwNknoGrN7TS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jifecp32.exe

Path C:\Windows\SysWOW64\Jifecp32.exe
Size 80KB
SHA256 0195c63bb4210def7914214d58440d2a912f36ef5ef84fb622e7f48b6d10a734
MD5 5832b81d8e724e4c10313983698978aa
SHA1 4453ea4fc32c13ad4b84ef967b1cc8f5eb431922
SHA512 5b89cb165c30f9ceb84ded2e206e452b0a02572236a5332a850c9d995bd6e622608a9d08145874ab4a03715507a34a4ab316d871a6f520a84bf39b451ff94e23
SSDEEP 1536:p9oK2IgU1vua9ycsVeQrSJ2LpS5DUHRbPa9b6i+sIk:paSQHeQrLpS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jleijb32.exe

Path C:\Windows\SysWOW64\Jleijb32.exe
Size 80KB
SHA256 198d586318410d7bc3eaf6d1fb9313be6e8844e8889cf1f199244e069b2aa9d9
MD5 be0a09fcad7a4190d5946e2172ff3cfd
SHA1 29a439ba9d4bf8440b5dad853b54baec500b0a3a
SHA512 b6494e561da0c289cb92b5f469f2d47d6158bfbcf5e6f8c0ded6ef24275cad3e9dd7e9bcd19284da7f123c40a3da587b3d39cc04ec6702023e15a586c0534d53
SSDEEP 1536:gPlRqfBwCtMTVLaS8ii7FyYPIyS2LGS5DUHRbPa9b6i+sIk:8oJtsUSgBxQGGS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kegpifod.exe

Path C:\Windows\SysWOW64\Kegpifod.exe
Size 80KB
SHA256 c17dbb8d28a2d8b24275ad144d168a7f99e2450944578f15b6081fc13f61358d
MD5 8d1cc3bcdd986641ec41e33fd3c1a626
SHA1 3296fefe432856c11537f6560e81111b7bbef43b
SHA512 f0371e4dfa55963d6883ac2511ac18e39f9b84e66742c4358bc411725deb336088ff94bdb302952f91a349f3ddca6356d8d40bd4fa31c98895fd04bbdc451681
SSDEEP 1536:gCgVl2qkKNCqy3xxB/4N6lf3lOB62LVS5DUHRbPa9b6i+sIk:YVQ2CF//4NKsVS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kemooo32.exe

Path C:\Windows\SysWOW64\Kemooo32.exe
Size 80KB
SHA256 03fb63a026b5786b56e3f29bc59ed263e03c2ca48d061183c02afaf1728ed928
MD5 ac5b3f827ee92a4c84d0f4b1d7ab30e0
SHA1 330a24f2b438811505a4d7bc6c109972d8ac9d11
SHA512 3bcaa47376c562dbb6a61954e281cadd57c61371a1b2454fa4ad00af99349b71c42b495e25709f2bf041d3ef09a529aef1a88ea2f8d135991d43747558d6d0b6
SSDEEP 1536:qpBBFW3u4o+zoEP0uX268goSd2LTS5DUHRbPa9b6i+sIk:qpbFt4o+kEsuX268dSuTS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgflcifg.exe

Path C:\Windows\SysWOW64\Kgflcifg.exe
Size 80KB
SHA256 ba47d4fcdba58982258721801afe64de3f3f83efb14bebfad9be9ce4b4438771
MD5 3ed1d8580b501610d11e09ce97f211e7
SHA1 235572fb6c782437584fd0df8243f1d370b00f20
SHA512 2fe95f6924ceaff23729b40783a82f73ee52d639d4ef8bbb4e7ce2bd57dad397dd641a72b9dd5a4ec2b7a67481e0ce73b902c97d9e02e62969c6cbc4515e1fb4
SSDEEP 1536:VH5qj3nRCbIwi5GDuJkIDljG2L2S5DUHRbPa9b6i+sIk:VH5qj3R6Iwi5GtIdr2S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgnbdh32.exe

Path C:\Windows\SysWOW64\Kgnbdh32.exe
Size 80KB
SHA256 2deabd936fb7bc1732ee0c6c40aae7594ddb3771cfe817a77610658d91a4590b
MD5 6c408042858e3835dce5cd1b518fc4e3
SHA1 0706c1a33b15d00fae6ff692f611c0387e5b8c57
SHA512 e3c8ea5c3f66376b898f87729e9ac92f5e0e51636bde39ab8634698a86522153e402e25f2db7b24a654649b6193fcce4376d031a1ffa4bcc705640a67702410b
SSDEEP 1536:UcTwwXb+/nOP30TaC++YeD2L0S5DUHRbPa9b6i+sIk:Mwr+5Tad+dg0S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kncaec32.exe

Path C:\Windows\SysWOW64\Kncaec32.exe
Size 80KB
SHA256 9968377ce09fab6d605dff51a4b643ecbd5872246c8d928c06e20cf3e9d6db8f
MD5 89af3cba079f3281741b228bd680094e
SHA1 37d11e57a6f0b1da34256d811fa9a84c301144d5
SHA512 d7ca4c582373dca043e96d59012720e97eddb9132cc9774c3918fc466fbd966a69d90e9968dd7c9a48354e3699066e0c66437a2907cb95d82726e727351a9798
SSDEEP 1536:J2fnd1jChiC60Juu+mWgCRikCIt2LBS5DUHRbPa9b6i+sIk:Q1jQ60Juu+mWgCikF+BS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgbloglj.exe

Path C:\Windows\SysWOW64\Lgbloglj.exe
Size 80KB
SHA256 82c6110091e9b1f7544cad954149ab5b95025726e007bbe68024f3c16999faf2
MD5 bdeff8cd90980ac8cbfa6ed29f3eefbc
SHA1 59b99c5631d3392aa53120e06aaefa0e2695edb3
SHA512 40080b7c2f29a6d1460397b10afa0787f156380e6be26484b8e96bafd60a9dff95c37d98ddc4a8c52921a33c32409e3f67180d5ebde509b2b6a5ffcd84f4d318
SSDEEP 1536:cZcvFtR27RRKLUdfSivV1O2LOS5DUHRbPa9b6i+sIk:9tRPwge1TOS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgpoihnl.exe

Path C:\Windows\SysWOW64\Lgpoihnl.exe
Size 80KB
SHA256 d0b9dee7aa89f98f80b2a1ec5fd27218d5f66ec34fd1e9406c3901d986ee4787
MD5 e4082aaec52fb79e624dc2df395b3933
SHA1 dedaec25c6124b8cdff1252da9a9fa21c9a9f545
SHA512 2d1c341d993d2886cc058b91de8dce68ae9a0fb006f3aaf7171fee326202e1ed1557e311f6af0ea36d25da0b0ae00018f3d0da6496e2cb722160bdcbac5d9ded
SSDEEP 1536:T9Bk/FhiGsEZZxmknGXbC8JjXMnEVDDV9S2LPoS5DUHRbPa9b6i+sIk:5SC9EZZEkOuxiDVpgS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnoaaaad.exe

Path C:\Windows\SysWOW64\Lnoaaaad.exe
Size 80KB
SHA256 e21e3bf2de36b6474803b63e8dc7822555105a172760a71250180d5566e67d0a
MD5 722dfada56783d1be244927a5ed3ef36
SHA1 212f0797bbfd29e41a1bc98f9462990a6422bdd4
SHA512 bb34d79cb989315ce4a70ec727584170b4dff118b0daf8a28527cfa5bdcb83175495730385b00e1589cffb80685f6b2b23b747f6b33475e3d1d93404e60ca7ef
SSDEEP 1536:LMJpj3eQKtIkO8Gpf0sLTj2LLS5DUHRbPa9b6i+sIk:IWQKWkO5NhLkLS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lqojclne.exe

Path C:\Windows\SysWOW64\Lqojclne.exe
Size 80KB
SHA256 209748529a42dbf7f63c954d3d9667495b57ab0a88d9f5142b620a16adb1e46c
MD5 36b8e4b819593f4eec0a1571033870c1
SHA1 e256287c2edaea56ffea36c1ed2090f158f5f842
SHA512 ab6e7c4996c7488d9abe0775607a712eae9ae0ecf62706c3f81c8975faf273f3b453453957371a98b36d7b54079b7ce7363f8525cf2481d7728a8fa396e54f9b
SSDEEP 1536:9etmMZauCqYqm0qt2LFS5DUHRbPa9b6i+sIk:9+Zepqvq+FS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgnlkfal.exe

Path C:\Windows\SysWOW64\Mgnlkfal.exe
Size 80KB
SHA256 1a5cf476d6d3a0d140ea87bf7fe817e406b33ff4ea3e3e360a78f044cda02e57
MD5 79f9d938ff89dd469262df70312bcc38
SHA1 133a0698da46ce56e06061f65183b478ef880850
SHA512 3df34f464a2119c8bf5c2c4aee4d22f1365bc410b7b29f54866d7da9269dc7317c6adee2f7c4390a46297339313f50a97e1023ca1bfda6785e01342228c0ccec
SSDEEP 1536:XpX0LBUfX74m88TYfL2L/S5DUHRbPa9b6i+sIk:ZX4UfrR88Io/S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgphpe32.exe

Path C:\Windows\SysWOW64\Mgphpe32.exe
Size 80KB
SHA256 db77f137a08c8c627cabe30dd53766c5447ea85a226aa16804f8b4a8e2843a9f
MD5 f24fef4a3b63c7017c39aae8c14931ae
SHA1 c4c02bf5d65a972c4cf98ad1fc1049239e498678
SHA512 0317dbb6b48abefd5de6b0c12d2b53ddd2a5786c02fe04637c489677ce09ecc70ff23c08c9bc3ae6409131137591da817e9a37225208e6a28ba6397b13d12d8e
SSDEEP 1536:NGmGTzdJiGDxbHLdQhV64t4lLGO7n/u1WL8FyFb0IlecWNtrPvG2LvhS5DUHRbP8:NGmGTzPi6BLdogiglVlecWNtjDZS5DSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjcngpjh.exe

Path C:\Windows\SysWOW64\Mjcngpjh.exe
Size 80KB
SHA256 caf491d0856339336efa96c17c912bd728a1c210671b35c19ac1d3242e55c672
MD5 2b48cd3ef8006d5ce0206041c17b5df3
SHA1 9d2602794c90c8bd9ba67ef17f7fff86da2f9bd1
SHA512 d0d61a79d1b591bfc6d1cae29d54f453d8647b36ce0d444d97f8530d8cd451ee264e207b74926bb7239ce0aaf313bb8083906469e1021dfc400886073fe8bd54
SSDEEP 1536:sfUzZ9G+whD3d4Xx6hCN52LKS5DUHRbPa9b6i+sIk:sfU3R63aXx6YNyKS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mqafhl32.exe

Path C:\Windows\SysWOW64\Mqafhl32.exe
Size 80KB
SHA256 221e2062a27b48a39f7a48065e34cb64ca175e661718388e2ea36a8095a4285a
MD5 b588b279997b091810489ff72e7bf1a8
SHA1 63e4917c6e3ec94e7ffcd36c6f758c48f1b81637
SHA512 3fc7784194de7ea6ccb172d0e8b2ba96553a67fac73eaf6fdb26d14695ac63346ba7352cff07902426b77f92cbc6ca60f62a67cb47a9757733912a5733f8f07d
SSDEEP 1536:PzdeYl/F7i18XZSIzniyb0BifD2LGS5DUHRbPa9b6i+sIk:PzdlF7i18XZSIziyb0wIGS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncchae32.exe

Path C:\Windows\SysWOW64\Ncchae32.exe
Size 80KB
SHA256 b33040e872762f2d40c9492f449e4258a7f4540dbb3c8d65770968f471d30e6d
MD5 ba4cfc9c7bbac603e10a428f25ba3e81
SHA1 e2508e7efc348ca449e88891eb0ff3911369c26d
SHA512 f0db87f2ee4127dd91eca7f5f6b3df0e08ab491b1f1a500915d2397f28e7077a99f1066d0a3d50d98f368eab568d853042dfe9f3ff698b69d4956f3391ebb475
SSDEEP 1536:siE/wtq/fp/TVyHNEH98z0vs3/KFFdK03GyT2LiS5DUHRbPa9b6i+sIk:si0vh7VyHNs8QvDxG/iS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nckkfp32.exe

Path C:\Windows\SysWOW64\Nckkfp32.exe
Size 80KB
SHA256 72409e866d9781d56215f6a2f6c0fa9774b2ac7f94b26491d2fc6594bb179358
MD5 d09c0ccfc2f2feda73e635a75a8d0567
SHA1 6640dcd0396b981b2b8f312a92a2ea4d82764748
SHA512 d149c5afbc3f16ab225f8d4560ff1166bd08bb23a1c067d176bf4d5a2980ded48ead95876bed6b82baf7f8986557a909742cae459e8000cb41c6c94fed93d03d
SSDEEP 1536:HExOBMthf1bhyFidOFo6ProfqHi332LbS5DUHRbPa9b6i+sIk:HExOOthfBEFib6eqCsbS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nglhld32.exe

Path C:\Windows\SysWOW64\Nglhld32.exe
Size 80KB
SHA256 9b868d731ca5bcf83b30f0e90b673026faf73a393ea0b92d6cd0a466b427c1a1
MD5 b619c706aacf27d07daec6fd50265701
SHA1 e45e9be36e7a98eb5cd21d72ac527766449d0625
SHA512 82a1d47819af26e09e12bf77d1b9b3448cde419d0c7812fabbfcaa42ede8f900b23fc2c2339d3294662dbe00457183bb7f23e3baccf4182037ab9fcd77eeed85
SSDEEP 1536:gR6kE/PlIhGd7TTLX81usrIUVrywoRJn6yzZzTscbQlF2LbXS5DUHRbPa9b6i+sX:gR63luGpTTLX80ooz5zZzTs27S5DSCoy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nmdgikhi.exe

Path C:\Windows\SysWOW64\Nmdgikhi.exe
Size 80KB
SHA256 15b34b4e0514e7525da4621af08c382a5b3cfadef62526939e57b3bababef97d
MD5 b01d07e96a111b03d60fc99d38bd1447
SHA1 3628fefcf38ee7178c4e407ee8656cc429a3bcb9
SHA512 89d59f63cc83617c9dac71a1052da38709e7adb1cfb66991dc3d01a053745f77277ba43a7f3b8a86cb0b42bc39ba2e26ebcc661d2cbf8d17f7ddb2d627ec671a
SSDEEP 1536:NGTy4wCwlLE2NAHkKzrmPOl0ggk2L9S5DUHRbPa9b6i+sIk:NRhflLE5HkKuPOl0gm9S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ocaebc32.exe

Path C:\Windows\SysWOW64\Ocaebc32.exe
Size 80KB
SHA256 7fd49283ec46ab769009e9d720b7bdb53bc0160a54bbc5b7f1732dd63c28ad99
MD5 d8dc850b8081ec1d47bb892d28366725
SHA1 0d026c90dc5afae894aa4fd9d6119f78f560515c
SHA512 0c4823c556b260d788acd2c147d708ed58600d8ce75b0fff748758f15a616fd05d0e429adbd8d36550b6aae24956ae7c01dfa803ce535465e0a9fea515f203cb
SSDEEP 1536:ivJI3itA7d4t1yCJyh27Nr/82LSS5DUHRbPa9b6i+sIk:iiitAB4PyCAsN5SS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oclkgccf.exe

Path C:\Windows\SysWOW64\Oclkgccf.exe
Size 80KB
SHA256 9194112665df2c935b7cee1b4df21dbf933d175d7a89f962e407574e8d37ff24
MD5 4bf15ef4a56d2bab57ef00308d64d94d
SHA1 33154f23c6dfe7845cc8b674634b89fc5f703104
SHA512 ec401593a9d6cdcd09d7d105738222dbbc6df115309774f0eedf8825586da29f9824e14e98244b75089b4bc8e33daa88cf92bfdd72459761d2abfb779260f1e5
SSDEEP 1536:97qMgtv+yIZJV/TUCOM2LrS5DUHRbPa9b6i+sIk:3A+yibUJFrS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Onmfimga.exe

Path C:\Windows\SysWOW64\Onmfimga.exe
Size 80KB
SHA256 8edc284a84592519a454aeae6835107b118a6435ff641dde5eb2713b53dd361a
MD5 cc01f7046ce7893af553faffbad639f2
SHA1 fb9ddb534368f21db57533dd834679c44ab6dc6d
SHA512 5a7a3cfefeeaf174c6d8247d01ea8eb9f0fc18ffef02add288d43eceff1e7706f14926af3ca4729eef61e4ac2506575ae106c19a727e05bd9d0dda57cfe4c817
SSDEEP 1536:IK8XrE2+bqO1Hg3tz4+3fq4oeOXvCthW5zp2LDiS5DUHRbPa9b6i+sIk:ALkW4+3C4M5OuS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opclldhj.exe

Path C:\Windows\SysWOW64\Opclldhj.exe
Size 80KB
SHA256 525d2951c90ee2f3ec7d929e971ac2f8fb568c77846c58bd3f458c73f83f9063
MD5 1d8a02b6bf1413b0c40fd6720695687b
SHA1 804cd8341f0626c255116b7eda672137c43a8573
SHA512 24da51cafa46b303d2dc4adaf6d48c2755659ed567a84d304b3b841b26ffbe52459bc10c67a326e3f40a634cc2982a99580c1061e7d03eb4a3015ef2df3c1d43
SSDEEP 1536:1OI7cnshw1AMBbhb7n3LVNAr32L/S5DUHRbPa9b6i+sIk:vBw1AchbnSc/S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Phcgcqab.exe

Path C:\Windows\SysWOW64\Phcgcqab.exe
Size 80KB
SHA256 81d96dd1ca423751bf5b3da3ce0b269af5392fe97c883a078b6ec9c37a3c9bb6
MD5 13566e0c2da27ed7870da3e7526e3893
SHA1 b7a8fdf6ce57d4e655accdc3926bf0f58656ad81
SHA512 e32bb0bd0fb3c4b648479188c37503bc8554ca36ae3dbdac65d6d38897f42faf09026d40f24ddce9415f8c265e542cdc66218ca3e3c322231538ffd0cd6c8e76
SSDEEP 1536:oI2yAZpQ9ScYTM/WqhDOT679IYm9/6j6An4aybQ2LsS5DUHRbPa9b6i+sIk:oI2yAXeScSM+qhDOu79IYm9/6OAUbBsk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmmlla32.exe

Path C:\Windows\SysWOW64\Pmmlla32.exe
Size 80KB
SHA256 3f2666efeadb787eed4ff82b7e45b814d10b129ae21bfa98709f4eefe8187530
MD5 df3f2a8029e53f77aaead801bf876842
SHA1 31d0c35d0e9f66128b2b98b1e94c4885d421eaf3
SHA512 2aae00d4632489ce15660e2f61b0b689f3d84a6a8dbf7db4bfbb8c838edc322656baf0bf4c79011143a543a0d1e6a2975cab838572e140cfe2d0a096877a229f
SSDEEP 1536:4TZsmwh5ZQPcDUOd0w314U0wvFpa2LOS5DUHRbPa9b6i+sIk:tT6PcDU0JRznOS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnplfj32.exe

Path C:\Windows\SysWOW64\Pnplfj32.exe
Size 80KB
SHA256 8fe590ec25168971d87fa8d53a6e903259976368e6efb29a2aee06fe88bdd331
MD5 84f6f95e7ae19023f70caff1f58ffbe9
SHA1 56009336eed40e66a08a2fc120dadc441daad57a
SHA512 17939a1e581a9c3b52a1e992a0ca9e863239392101a0fda4239b4e055c7fe6c222d4b2e1c73a3c1f22528eefde38405c64635c94299476918bd6c4d7c33ded09
SSDEEP 1536:Ww8JWWyEYspP7wxyoRvLz2LgS5DUHRbPa9b6i+sIk:387yrspNoR8gS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ppgegd32.exe

Path C:\Windows\SysWOW64\Ppgegd32.exe
Size 80KB
SHA256 91af02750cd7cc5c48d6a1f477c41b8aa537a3bb4f64622ffcde68ce276af52b
MD5 ea1e0915c8c78fb73c2fea0a06a813d8
SHA1 f246277462d54f12ae955b7e8b002b02e46677d8
SHA512 61437bac55280fed845e946dccfa4c7614e27cd44460537e80ac715b6b09f49ee81abffadcf890f83e7256f0ea52b0bc14f1185b8ca89d977251dacd88e221de
SSDEEP 1536:KcJVawFSIvPZtsYfYGxNwVwei6z42L+S5DUHRbPa9b6i+sIk:ewFSqhtsYfYGxNwVwei69+S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ppjbmc32.exe

Path C:\Windows\SysWOW64\Ppjbmc32.exe
Size 80KB
SHA256 e16c104def113d332f8a10fab48c8ef64b508aa550384dbbbf01f75a49cf45ca
MD5 a46c8a18e179a05a54c1569068537ddb
SHA1 e3d9bea56cfd4084fefea4d5ac91df5e196e27c9
SHA512 85b00e2470825de75df8dc75f98c82ee0c0eefbfbf171a32080691a14d4568b65260c3b481cc14754ee7c9f46db5254250e741f822b090a9b77f988115ea3aab
SSDEEP 1536:2fv+EK/KE85ceuNl2LudS5DUHRbPa9b6i+sIk:239KSLoI2S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qhjmdp32.exe

Path C:\Windows\SysWOW64\Qhjmdp32.exe
Size 80KB
SHA256 fcc380cab762138d0fc2c1413c21096cb792ca421e83fa8ec98f834a0630f2ed
MD5 d0622b7c9a100f408490b2895fedf453
SHA1 837226d385997bd4ed27c62813308e8c498c4308
SHA512 4035434f92390441c98da342b29fb8eeac4236bc72bcd56422afb6cbcd5eea9e3e4a81de977b022e03e1400edc8c76a2c4f79fd24cf9089259d45cae339446d7
SSDEEP 1536:Q5ObmdORAkjeZcoVsAcOjPlOKQlksWm1XS1ncZih2LoS5DUHRbPa9b6i+sIk:QobIrkjeZcouijPlOJun76oS5DSCopsX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-553-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/224-248-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/228-56-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/228-594-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/312-371-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/572-335-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/840-559-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/840-16-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/876-73-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/904-461-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1020-152-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1044-503-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1136-88-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1368-96-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1440-120-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1496-49-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1496-587-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1548-443-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1560-269-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1612-347-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1640-383-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1792-184-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1904-521-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1948-540-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2240-233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2348-527-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2360-33-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2360-573-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2428-467-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2612-192-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2616-104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2628-491-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-161-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2748-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/2748-539-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2748-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2764-455-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2776-488-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2848-389-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2896-377-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2924-65-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3100-293-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-329-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3164-425-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3184-145-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3188-407-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3264-497-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3480-550-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3624-401-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-281-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3632-168-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3712-365-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3812-449-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3828-177-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3872-515-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3924-257-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3944-299-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3968-201-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3980-317-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3996-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4004-217-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4124-287-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4292-263-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4300-209-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4352-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4352-566-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4372-323-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4392-473-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4400-359-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4452-533-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4468-419-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-40-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-580-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4560-305-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4564-509-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4664-311-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4672-431-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4676-437-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4692-413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4712-395-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4748-129-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-225-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4768-137-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4772-112-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-552-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-483-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5012-275-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5040-353-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5068-241-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5100-346-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5124-560-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5168-567-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5212-574-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5256-581-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5300-588-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads