6ab7850a90c9e9d0e398959570ee209c21f10e21deedd5e51a84a9c110fefe74

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ab7850a90c9e9d0e398959570ee209c21f10e21deedd5e51a84a9c110fefe74.exe
Size 108KB
Sample240613-3x8etazepl
SHA256 6ab7850a90c9e9d0e398959570ee209c21f10e21deedd5e51a84a9c110fefe74
MD5 a4fe9d48be6e58a3c721047ff1785b7c
SHA1 cd23603fd5ee8a3679ca950268d86e89aa6079cb
SHA512 d5dc5a130727e0fb8d4214e309043ad30c0285d5c5ef037001b42c59bb279f6782cc14270b834ece9955b4f9a8a226bbf6d8be3df0adacd2af6cee9278e81146
SSDEEP 3072:reB2tVCUx0+oNdlUjmOiBn3w8BdTj2h3K:xCUx0+oNdKjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibagcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbocea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmlnbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fckhdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibojncfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiikak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaqcbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfcpncdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmlnbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jiikak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqalmafo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfqjafdq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifmnpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hihicplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iidipnal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmnjhioc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	6ab7850a90c9e9d0e398959570ee209c21f10e21deedd5e51a84a9c110fefe74.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfqjafdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmkbnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofinnkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmgdgjek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpjjod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gifmnpnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmdedo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fflaff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fifdgblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcekkjcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hibljoco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iffmccbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jigollag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoifcnid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpklpkio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpaghf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmclmabe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjjod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fijmbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijhodq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iabgaklg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfdida32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe

Executes dropped EXE 64 IoCs

pid	Process
4976	Eqalmafo.exe
4792	Ecphimfb.exe
3676	Ejjqeg32.exe
4028	Eqciba32.exe
608	Eofinnkf.exe
2520	Efpajh32.exe
1208	Ehonfc32.exe
212	Eoifcnid.exe
1768	Fbgbpihg.exe
1316	Fmmfmbhn.exe
4296	Fbioei32.exe
3720	Ficgacna.exe
1620	Fqkocpod.exe
1204	Fbllkh32.exe
4160	Fifdgblo.exe
3924	Fqmlhpla.exe
1984	Fckhdk32.exe
4812	Fihqmb32.exe
3596	Fmclmabe.exe
2988	Fcnejk32.exe
4968	Fflaff32.exe
1328	Fijmbb32.exe
5064	Fodeolof.exe
2400	Gfnnlffc.exe
1364	Gmhfhp32.exe
404	Gcbnejem.exe
3732	Gfqjafdq.exe
2388	Gmkbnp32.exe
3460	Gqfooodg.exe
5080	Gcekkjcj.exe
4464	Gjocgdkg.exe
3688	Gmmocpjk.exe
3776	Gpklpkio.exe
2808	Gcggpj32.exe
3288	Gfedle32.exe
3972	Gidphq32.exe
4604	Gqkhjn32.exe
1148	Gcidfi32.exe
4588	Gfhqbe32.exe
2040	Gifmnpnl.exe
3160	Gameonno.exe
5016	Hclakimb.exe
2276	Hboagf32.exe
4764	Hihicplj.exe
2432	Hmdedo32.exe
368	Hcnnaikp.exe
2396	Hbanme32.exe
5036	Hjhfnccl.exe
3104	Hmfbjnbp.exe
4180	Hpenfjad.exe
2460	Hbckbepg.exe
3612	Himcoo32.exe
1684	Hpgkkioa.exe
1784	Hbeghene.exe
3556	Hjmoibog.exe
3220	Haggelfd.exe
952	Hcedaheh.exe
748	Hfcpncdk.exe
2392	Hibljoco.exe
4716	Hmmhjm32.exe
3756	Icgqggce.exe
3348	Iffmccbi.exe
2740	Iidipnal.exe
520	Ipnalhii.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Ohcepmcb.dll	Eofinnkf.exe
File created	C:\Windows\SysWOW64\Ceaklo32.dll	Hjmoibog.exe
File opened for modification	C:\Windows\SysWOW64\Ijdeiaio.exe	Ibmmhdhm.exe
File opened for modification	C:\Windows\SysWOW64\Fmmfmbhn.exe	Fbgbpihg.exe
File opened for modification	C:\Windows\SysWOW64\Kpjjod32.exe	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Gcekkjcj.exe	Gqfooodg.exe
File created	C:\Windows\SysWOW64\Ncldlbah.dll	Ibccic32.exe
File created	C:\Windows\SysWOW64\Leqcod32.dll	Jfdida32.exe
File created	C:\Windows\SysWOW64\Majopeii.exe	Mjcgohig.exe
File created	C:\Windows\SysWOW64\Opocad32.dll	Hibljoco.exe
File created	C:\Windows\SysWOW64\Imdnklfp.exe	Ijfboafl.exe
File created	C:\Windows\SysWOW64\Jmkdlkph.exe	Jfaloa32.exe
File opened for modification	C:\Windows\SysWOW64\Ibmmhdhm.exe	Ipnalhii.exe
File created	C:\Windows\SysWOW64\Nnjbke32.exe	Nceonl32.exe
File opened for modification	C:\Windows\SysWOW64\Gmkbnp32.exe	Gfqjafdq.exe
File opened for modification	C:\Windows\SysWOW64\Hmdedo32.exe	Hihicplj.exe
File created	C:\Windows\SysWOW64\Mbgaem32.dll	Himcoo32.exe
File created	C:\Windows\SysWOW64\Ogdimilg.dll	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Mjqjih32.exe	Lddbqa32.exe
File opened for modification	C:\Windows\SysWOW64\Ibojncfj.exe	Ipqnahgf.exe
File opened for modification	C:\Windows\SysWOW64\Jiikak32.exe	Jbocea32.exe
File created	C:\Windows\SysWOW64\Kdaldd32.exe	Kmgdgjek.exe
File created	C:\Windows\SysWOW64\Lidmdfdo.dll	Lpcmec32.exe
File created	C:\Windows\SysWOW64\Jjcfkp32.dll	Hpgkkioa.exe
File created	C:\Windows\SysWOW64\Fjkiobic.dll	Hmmhjm32.exe
File created	C:\Windows\SysWOW64\Aqnhjk32.dll	Iidipnal.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nnhfee32.exe
File created	C:\Windows\SysWOW64\Bademghm.dll	Ficgacna.exe
File created	C:\Windows\SysWOW64\Jokmgc32.dll	Gmhfhp32.exe
File created	C:\Windows\SysWOW64\Lifenaok.dll	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Lmqgnhmp.exe	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Geegicjl.dll	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Efpajh32.exe	Eofinnkf.exe
File created	C:\Windows\SysWOW64\Ekmihm32.dll	Ijfboafl.exe
File created	C:\Windows\SysWOW64\Kinemkko.exe	Kgphpo32.exe
File created	C:\Windows\SysWOW64\Odhibo32.dll	Gjocgdkg.exe
File created	C:\Windows\SysWOW64\Eplmgmol.dll	Kaqcbi32.exe
File created	C:\Windows\SysWOW64\Jfaloa32.exe	Jaedgjjd.exe
File created	C:\Windows\SysWOW64\Jpaghf32.exe	Jigollag.exe
File created	C:\Windows\SysWOW64\Kmalco32.dll	Nceonl32.exe
File created	C:\Windows\SysWOW64\Enbofg32.dll	Kdopod32.exe
File created	C:\Windows\SysWOW64\Bjikbh32.dll	Fqmlhpla.exe
File opened for modification	C:\Windows\SysWOW64\Gcekkjcj.exe	Gqfooodg.exe
File created	C:\Windows\SysWOW64\Gcggpj32.exe	Gpklpkio.exe
File opened for modification	C:\Windows\SysWOW64\Kdhbec32.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Pbcfgejn.dll	Mjhqjg32.exe
File opened for modification	C:\Windows\SysWOW64\Fbllkh32.exe	Fqkocpod.exe
File opened for modification	C:\Windows\SysWOW64\Hfcpncdk.exe	Hcedaheh.exe
File opened for modification	C:\Windows\SysWOW64\Jbocea32.exe	Jpaghf32.exe
File created	C:\Windows\SysWOW64\Ijfboafl.exe	Ibojncfj.exe
File opened for modification	C:\Windows\SysWOW64\Lmqgnhmp.exe	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Gcbnejem.exe	Gmhfhp32.exe
File created	C:\Windows\SysWOW64\Mkbchk32.exe	Mgghhlhq.exe
File opened for modification	C:\Windows\SysWOW64\Ficgacna.exe	Fbioei32.exe
File opened for modification	C:\Windows\SysWOW64\Fqkocpod.exe	Ficgacna.exe
File created	C:\Windows\SysWOW64\Jpckhigh.dll	Gfnnlffc.exe
File created	C:\Windows\SysWOW64\Gfnnlffc.exe	Fodeolof.exe
File created	C:\Windows\SysWOW64\Kmgdgjek.exe	Kkihknfg.exe
File created	C:\Windows\SysWOW64\Gddfpk32.dll	Fqkocpod.exe
File created	C:\Windows\SysWOW64\Gbledndp.dll	Iinlemia.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Mcbahlip.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Nbhkac32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5128	6060	WerFault.exe	230

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekfnlmai.dll"	Fmclmabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjkiobic.dll"	Hmmhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgkghl32.dll"	Gameonno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibccic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmkdlkph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feambf32.dll"	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldooifgl.dll"	Hcnnaikp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjcfkp32.dll"	Hpgkkioa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgengpmj.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fijmbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hboagf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akihmf32.dll"	Kpjjod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcbnejem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiphogop.dll"	Iabgaklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mciobn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdehlgh.dll"	Gmmocpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akanejnd.dll"	Kknafn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcekkjcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqjfoc32.dll"	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihaoimoh.dll"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmbkmemo.dll"	Ipnalhii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipqnahgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Impoan32.dll"	Imgkql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hboagf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjhfnccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iabgaklg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbcfgejn.dll"	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eoifcnid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibgnfha.dll"	Fmmfmbhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphlemjl.dll"	Gcggpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmpolji.dll"	Hcedaheh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gameonno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmgdgjek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipnalhii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfdida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kckbqpnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcggpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdkhlo32.dll"	Gifmnpnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmobp32.dll"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcglnp32.dll"	Fijmbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fodeolof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjmoibog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ficgacna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jiikak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbocea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Nkncdifl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 4976	2976	6ab7850a90c9e9d0e398959570ee209c21f10e21deedd5e51a84a9c110fefe74.exe	81
PID 2976 wrote to memory of 4976	2976	6ab7850a90c9e9d0e398959570ee209c21f10e21deedd5e51a84a9c110fefe74.exe	81
PID 2976 wrote to memory of 4976	2976	6ab7850a90c9e9d0e398959570ee209c21f10e21deedd5e51a84a9c110fefe74.exe	81
PID 4976 wrote to memory of 4792	4976	Eqalmafo.exe	82
PID 4976 wrote to memory of 4792	4976	Eqalmafo.exe	82
PID 4976 wrote to memory of 4792	4976	Eqalmafo.exe	82
PID 4792 wrote to memory of 3676	4792	Ecphimfb.exe	83
PID 4792 wrote to memory of 3676	4792	Ecphimfb.exe	83
PID 4792 wrote to memory of 3676	4792	Ecphimfb.exe	83
PID 3676 wrote to memory of 4028	3676	Ejjqeg32.exe	84
PID 3676 wrote to memory of 4028	3676	Ejjqeg32.exe	84
PID 3676 wrote to memory of 4028	3676	Ejjqeg32.exe	84
PID 4028 wrote to memory of 608	4028	Eqciba32.exe	85
PID 4028 wrote to memory of 608	4028	Eqciba32.exe	85
PID 4028 wrote to memory of 608	4028	Eqciba32.exe	85
PID 608 wrote to memory of 2520	608	Eofinnkf.exe	86
PID 608 wrote to memory of 2520	608	Eofinnkf.exe	86
PID 608 wrote to memory of 2520	608	Eofinnkf.exe	86
PID 2520 wrote to memory of 1208	2520	Efpajh32.exe	87
PID 2520 wrote to memory of 1208	2520	Efpajh32.exe	87
PID 2520 wrote to memory of 1208	2520	Efpajh32.exe	87
PID 1208 wrote to memory of 212	1208	Ehonfc32.exe	88
PID 1208 wrote to memory of 212	1208	Ehonfc32.exe	88
PID 1208 wrote to memory of 212	1208	Ehonfc32.exe	88
PID 212 wrote to memory of 1768	212	Eoifcnid.exe	90
PID 212 wrote to memory of 1768	212	Eoifcnid.exe	90
PID 212 wrote to memory of 1768	212	Eoifcnid.exe	90
PID 1768 wrote to memory of 1316	1768	Fbgbpihg.exe	91
PID 1768 wrote to memory of 1316	1768	Fbgbpihg.exe	91
PID 1768 wrote to memory of 1316	1768	Fbgbpihg.exe	91
PID 1316 wrote to memory of 4296	1316	Fmmfmbhn.exe	92
PID 1316 wrote to memory of 4296	1316	Fmmfmbhn.exe	92
PID 1316 wrote to memory of 4296	1316	Fmmfmbhn.exe	92
PID 4296 wrote to memory of 3720	4296	Fbioei32.exe	93
PID 4296 wrote to memory of 3720	4296	Fbioei32.exe	93
PID 4296 wrote to memory of 3720	4296	Fbioei32.exe	93
PID 3720 wrote to memory of 1620	3720	Ficgacna.exe	94
PID 3720 wrote to memory of 1620	3720	Ficgacna.exe	94
PID 3720 wrote to memory of 1620	3720	Ficgacna.exe	94
PID 1620 wrote to memory of 1204	1620	Fqkocpod.exe	95
PID 1620 wrote to memory of 1204	1620	Fqkocpod.exe	95
PID 1620 wrote to memory of 1204	1620	Fqkocpod.exe	95
PID 1204 wrote to memory of 4160	1204	Fbllkh32.exe	96
PID 1204 wrote to memory of 4160	1204	Fbllkh32.exe	96
PID 1204 wrote to memory of 4160	1204	Fbllkh32.exe	96
PID 4160 wrote to memory of 3924	4160	Fifdgblo.exe	97
PID 4160 wrote to memory of 3924	4160	Fifdgblo.exe	97
PID 4160 wrote to memory of 3924	4160	Fifdgblo.exe	97
PID 3924 wrote to memory of 1984	3924	Fqmlhpla.exe	98
PID 3924 wrote to memory of 1984	3924	Fqmlhpla.exe	98
PID 3924 wrote to memory of 1984	3924	Fqmlhpla.exe	98
PID 1984 wrote to memory of 4812	1984	Fckhdk32.exe	100
PID 1984 wrote to memory of 4812	1984	Fckhdk32.exe	100
PID 1984 wrote to memory of 4812	1984	Fckhdk32.exe	100
PID 4812 wrote to memory of 3596	4812	Fihqmb32.exe	101
PID 4812 wrote to memory of 3596	4812	Fihqmb32.exe	101
PID 4812 wrote to memory of 3596	4812	Fihqmb32.exe	101
PID 3596 wrote to memory of 2988	3596	Fmclmabe.exe	102
PID 3596 wrote to memory of 2988	3596	Fmclmabe.exe	102
PID 3596 wrote to memory of 2988	3596	Fmclmabe.exe	102
PID 2988 wrote to memory of 4968	2988	Fcnejk32.exe	104
PID 2988 wrote to memory of 4968	2988	Fcnejk32.exe	104
PID 2988 wrote to memory of 4968	2988	Fcnejk32.exe	104
PID 4968 wrote to memory of 1328	4968	Fflaff32.exe	105

C:\Users\Admin\AppData\Local\Temp\6ab7850a90c9e9d0e398959570ee209c21f10e21deedd5e51a84a9c110fefe74.exe
"C:\Users\Admin\AppData\Local\Temp\6ab7850a90c9e9d0e398959570ee209c21f10e21deedd5e51a84a9c110fefe74.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\Eqalmafo.exe
  C:\Windows\system32\Eqalmafo.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\Ecphimfb.exe
    C:\Windows\system32\Ecphimfb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\SysWOW64\Ejjqeg32.exe
      C:\Windows\system32\Ejjqeg32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3676
    - - C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4028
      - C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:608
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2400
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3732
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2388
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3460
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5080
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3688
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2808
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        36⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        37⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        38⤵
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        39⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        40⤵
        Executes dropped EXE
        
        PID:4588
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2040
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3160
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        43⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4764
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:368
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        48⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        50⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        51⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        52⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3612
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        55⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3556
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        57⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:952
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2392
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        62⤵
        Executes dropped EXE
        
        PID:3756
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2740
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:520
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        66⤵
        Drops file in System32 directory
        
        PID:2852
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        67⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        68⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3852
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        72⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2868
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4608
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        75⤵
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1660
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        78⤵
        Drops file in System32 directory
        
        PID:2380
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        79⤵
        Drops file in System32 directory
        
        PID:3628
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        80⤵
        Drops file in System32 directory
        
        PID:3164
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        81⤵
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        83⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2444
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        85⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        86⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        87⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:700
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2112
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2812
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1532
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        93⤵
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        94⤵
        Drops file in System32 directory
        
        PID:4088
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        96⤵
        Modifies registry class
        
        PID:1140
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        98⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        99⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        104⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        107⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5656
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5700
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        111⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        114⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        115⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        116⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        118⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        119⤵
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6124
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        121⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        124⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        126⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        127⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        128⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        130⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        131⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        132⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        133⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6088
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        136⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        137⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        138⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        139⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        140⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        141⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        143⤵
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        146⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        147⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 400
        148⤵
        Program crash
        
        PID:5128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6060 -ip 6060
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ecphimfb.exe

Path C:\Windows\SysWOW64\Ecphimfb.exe
Size 108KB
SHA256 9715f66d15dca85ba33ad8f1e889fb54d947ef032f6e0a467005fcd4b2e40942
MD5 49ef868cec538aa10f0c342c84fb1998
SHA1 211804bad759a5c5e3c8001f507b5203b27d2903
SHA512 107ec7946837f9db0842c40e0d331db3525fae383e333e501e4aab6b0725c5c8dff0522423d05c15ad89f053a2fbc69af32a58d892a255b87ced543a18bbe248
SSDEEP 1536:fl1DI8FltAn6PM2jjhTNsl3AMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:frsitRxZk3CUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Efpajh32.exe

Path C:\Windows\SysWOW64\Efpajh32.exe
Size 108KB
SHA256 fb73617cab9e5bb30662f7989cc277ccb3982d5ddf9dfee943e7e983fcd6331f
MD5 b8ca93e1c1923391d0fbc11f457967a8
SHA1 d726930a95c25adf79ff17dc04cc0798eff5a51d
SHA512 26804f293d7431942a14e40fad233171dd7e73b6133214b80d0cd07cbf31f42ddc810bc0f0f11e7b2ffd9f1271b52c7f3a6ffd7205eab4c6ce07f2723ec4ba22
SSDEEP 3072:vZrJws144444444444444FrNeUjmOiBn3w8BdTj2h3K:vUs144444444444444RNLjVu3w8BdTj/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ehonfc32.exe

Path C:\Windows\SysWOW64\Ehonfc32.exe
Size 108KB
SHA256 aafca9f38b25e2830822ebc96f862240b34e5f1c7adcd4ac1e5e1caa2fe03608
MD5 2d6870f58c2283d637aa02cc41328e60
SHA1 2abdc087c63eeab82ea55269ccf3eaccce1edfd1
SHA512 b7261772dd9cbefee86d781a36fa16e7021a6b43317d7f6bfafa5b73c4c6c42c74d80176c83a1e45e9d4dd828f4d2e4398383370c49edebb8a369b5a08324137
SSDEEP 3072:JoaK0DpRSw1wQIA6uKd1UjmOiBn3w8BdTj2h3K:m0D3SYl/6uKdajVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ejjqeg32.exe

Path C:\Windows\SysWOW64\Ejjqeg32.exe
Size 108KB
SHA256 809657c2107755b555cbd5e94e09b0dfee2177499d128712369ce93d5f92fec9
MD5 b54f893b4847da80315ce904228d74e9
SHA1 5f0fde220269f3508335a53ca2d4664c35f79fff
SHA512 0cb3cc7c334f5e15802d01dcfc117110de3d1d6708e6fdb5676c86c3380832b03da034cd5fd9ba9b5848fc53f04bdae1f1dcce5801c4b28ba74c2ca165df4f0a
SSDEEP 3072:LTM5vIQJoaej78o7mRUjmOiBn3w8BdTj2h3K:8ONfj7jmOjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eofinnkf.exe

Path C:\Windows\SysWOW64\Eofinnkf.exe
Size 108KB
SHA256 5f5886126c8da267cedb04867dc37ec92ec5d8a3acd8f8a2477f017df7720643
MD5 639a89cac1e654e5da1f19579b02ad75
SHA1 7d063e98aa26c973455b53aeb6319d8fc1a77847
SHA512 b330463f0bc1f913c54451c41d6f39133bb6d9eea9e6795fc1607ba4c2e7c43aa342ad23ac49b55edc41abd3bfefaaa8edca6c2a6662bdb13f524189a70323b6
SSDEEP 1536:J6SUc67c4eMKDJQIb/77DapcMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:BXxMKVuwUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eoifcnid.exe

Path C:\Windows\SysWOW64\Eoifcnid.exe
Size 108KB
SHA256 34b730f6db0e32e359e932658a935e0b37dac9c82662e72ce9f7742663d36503
MD5 b04e61d39d1067204a443816d8ca84c1
SHA1 a5eb5426d214f1a1fce8dd694c59e5aed46cbf2d
SHA512 007a4a01b67350d4727f9282588b53d64b8b0b0c351ed7ea3dc0f1c16bd6b1b9df796e22f94143101847d23c71d51691dee01939314644f8743fd92af882ce7c
SSDEEP 3072:qDxBrNcYhMBPaeiNd/UjmOiBn3w8BdTj2h3K:KNcYhMziH8jVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eqalmafo.exe

Path C:\Windows\SysWOW64\Eqalmafo.exe
Size 108KB
SHA256 8caa945b12495e588f9fc237d5ab3e0ebd3faa09e10555b4b7fb3a35ae8746c7
MD5 d567d969e34608771a6c0ce6850c92c0
SHA1 1aa626637be9ca69107097ef0805e49047ca08ce
SHA512 fa1047651ed2964a9be02544b8490be9131869c6479e48ae1afaa2e5a09420e329b7fb377df538506fae1143c9dc72dde8633e97ffefb3d6be0e3316c61bd6d7
SSDEEP 1536:eV4g0CpnY6QmoHXEfrJN2VMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:WCCW6OotcdUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eqciba32.exe

Path C:\Windows\SysWOW64\Eqciba32.exe
Size 108KB
SHA256 cd733f8e45ffd21f856aadeadb5663340680d4adbf194f0ea61bfbd3d374e931
MD5 b10cf5776057450d022e5c577cddcdfa
SHA1 ea5815905561789f78ade617abbfc02f4991a8ee
SHA512 77cd554b461befce1986ed6cb4cde212187e7c5eca09f3cb8da99e1b378160d31f2a01c791be5b25c71ae9ea16839e40656c55ea3908436dabdf5fc721775a5b
SSDEEP 1536:XzhD685htGgAm/8KYCipMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:XzIQ71/8BC2UjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbgbpihg.exe

Path C:\Windows\SysWOW64\Fbgbpihg.exe
Size 108KB
SHA256 bf51b6a00c96c96b128bbd1640543e3cb24efc4475ffdb9c7b6acb2f80d010e3
MD5 298c77f109ebab501f105996b02c58c0
SHA1 a0558e8b0484a4597c9b38cb1ef1e5c81c10a9d2
SHA512 4308ae61196e14a3396e100f40927747c747839e8a0496b14e11a21e736f440d7c4226a62971b355d496bce3db9ba49135e91958744fb1bc789a05ecd9df1ca2
SSDEEP 1536:WRh5pSp7TOC/hL69MwB+rjm8NiIqhn3HQ8BawTj2wQ3K:kwhhLOUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbioei32.exe

Path C:\Windows\SysWOW64\Fbioei32.exe
Size 108KB
SHA256 ddf97855efa7e011e389359c3a13d26a3942b6044da7ad2fe7741542be2a11d3
MD5 56725b1f23cfe40a90171f40fb56b3e4
SHA1 d8ee0a58589e55691ac906810a912b4116d24818
SHA512 7313829be1ffc2f176cab54739bb904e857f26505942861349f4546ed9b42ca9eb56d9323c5b10f6bcfbf7468581ac5d5c63b173a28c7a158d3248f9b914b991
SSDEEP 3072:OW8ujCaxKtKZHv5kstUjmOiBn3w8BdTj2h3K:OFHvk5dCjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbllkh32.exe

Path C:\Windows\SysWOW64\Fbllkh32.exe
Size 108KB
SHA256 1d56683b83d2b781ec02033c860f8b22e9f01cf34ce806dd873b20911ff012d8
MD5 0b31d8146c6ee8a2e9f3626a7f09ccd3
SHA1 0a0a52ecbed484c14d3d859e6a70b2379f788d59
SHA512 9cbc1f29be9f8f839656b01d70b717f2dfb9757ce108783ae2bbc9ddae5ad6aafbfb501d64715b3476b06add80c9ea1b34c91c09fd54b30948410f95229d95fd
SSDEEP 3072:yqLrRIEVmmpar17UjmOiBn3w8BdTj2h3K:xrDpQQjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fckhdk32.exe

Path C:\Windows\SysWOW64\Fckhdk32.exe
Size 108KB
SHA256 79e80ce409acb72014e0761efa86a1d547344c2d575c7712a4d9afc4870510da
MD5 d954528fd8fbb8bea861f5a94ff208b0
SHA1 ae95c7fa8ef26dd06d34b729d85fbe30428b5ea7
SHA512 a44cca9b080507ce61f1ec56f4280e7b2d3dbf071ee4c30c9a11d006e0b0cfe97391793102557bab9951d6a402485e9f0168a6fccc4abdc8849ef4db358359fc
SSDEEP 1536:vW8AD6GmQ54PpQuS6BvuvMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:sGpNVJurUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fcnejk32.exe

Path C:\Windows\SysWOW64\Fcnejk32.exe
Size 108KB
SHA256 4a2c373796d0dbcde40e223e933e7fdd0d50c7d1d6f2cb8b3b86c4c6f2c21e28
MD5 e7eab70801d667fbb78c497f513fcddf
SHA1 4da52fc55410402580edd18e66b2959fc89d97d6
SHA512 224c2d5449f878508ec9e123b76f7c4a67af60b2e73f5fe560f1f892f0cb436ee9de350eb123d83af6649845833237c1cf69b889cedbbe80b4d67b44e3454ed5
SSDEEP 1536:EUxjsStlVP4V59UjsX+PMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:EUtDHjcAUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fflaff32.exe

Path C:\Windows\SysWOW64\Fflaff32.exe
Size 108KB
SHA256 eb49c974355bbedffbf79c90f68b98c14846bc024a0b81fa1030c0301b1e4c45
MD5 ea61bdd4e558973032d9031c135e8e53
SHA1 ae214873508159ba4e74938df4627819fd81b726
SHA512 79a425eb1ef98cb9acce5c5650522ea7788b7a6d130924fe9471224c790f9e58aca80a22261c035bedd2dcff7c0b14f7191f60996f8bb55943582560a3804a2c
SSDEEP 3072:dXrJ1e0Babm+++++++++++++++++++++++++++++++++u++L++++++++V+++j++4:dbJQWabm+++++++++++++++++++++++G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ficgacna.exe

Path C:\Windows\SysWOW64\Ficgacna.exe
Size 108KB
SHA256 d274c6013a9751494db5cf69abefd8e80c9fec39b56b88b301a50cc0d76dcbbe
MD5 bcc79b0e122fd5b19f5d9a07bba0aab6
SHA1 759e2a9639ffeef8cc72b7c0dbed595a583c029e
SHA512 578e7904ee43806d414ea855b9a753479d9e2be0580b2cb82aefe78bbc903a285d7c2a1646304fbe9a6c19f9dfe527eb74d84092a8f808be29c3756b0f892114
SSDEEP 1536:tbNY5FDOTdv5rpwwncdf7XCihC+MwB+rjm8NiIqhn3HQ8BawTj2wQ3K:txaG47XNCcUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fifdgblo.exe

Path C:\Windows\SysWOW64\Fifdgblo.exe
Size 108KB
SHA256 68b567decb95efeae037205e5b581211e5b72b8868e8a7e1fad480f490dd1ef2
MD5 df8e56424369449884fbf81179a06b1e
SHA1 c1fd544723b38fdd4982e9bd7acbef743497de4a
SHA512 92b4fb3a3a63de9c7a1984643acf9d625285a164ab137b2c5d7752d5e9761a50c42a5ee77a0c3d29be83be922c0affe2ae2604008cd93085aa31516b596b8cf8
SSDEEP 1536:Y6Z7DboSetaGd35rHtptl1lvMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:t9DEtL5rn1lrUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fihqmb32.exe

Path C:\Windows\SysWOW64\Fihqmb32.exe
Size 108KB
SHA256 fd1b4ddafaa144fee47c062bf0122b2bd5810d0a8325a26c049a0ed3fd914629
MD5 30b0e99c5d26f63d84f6a1ddbeecc79c
SHA1 5025367d778b3d4e26e33eb5e552b9300da7e134
SHA512 78b4293030810c147b733e40f7100f939b02445a9beb20adf8cbc81eb1c98a442e947c762c8d30e19802b5d8ad5e44cb15824ca311d61720a984cb4f855d7d94
SSDEEP 1536:aaKXx1TBFI60+3OvRu1iJX3HUMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:gDXI60+epJHHGUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fijmbb32.exe

Path C:\Windows\SysWOW64\Fijmbb32.exe
Size 108KB
SHA256 bddbba1793befa18f999e37a3e60a56e97dbd780d7a02e0283a22e1fd7f0a31d
MD5 58094faa854f716200878b45d974de8e
SHA1 5df01faf28d9bc9b7b00bfde149faa48d7509560
SHA512 3f7a0c32d52f93887e5c866259dce33f4bb4dde2a0eeb92b981772c880e9e29bcd5097bd0080359c0954002096ad59c309f64504f24ff3926d3050f92fd3711d
SSDEEP 1536:5sNySxTx2fHmkytuSBHjkJxFoMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:iNzd2fmkyt9DykUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmclmabe.exe

Path C:\Windows\SysWOW64\Fmclmabe.exe
Size 108KB
SHA256 6a38d88cbc709ab520058454f4dd0e136afd56993a3608ae99c72da54efda4f0
MD5 a05198cb1fcf0b6b3c589238f9895e80
SHA1 4c179bbe8d625fb3346d2aecee49ee2a5d4ab612
SHA512 ccb30aaac393b534490fe152c574ecf9787d7e919a313f215887e11a801f0437f9e0f76c2734154ac26b7f22e47a9a94f1ed12018df5ed98c60c3e84a98f3b95
SSDEEP 3072:1hEfwFKEWtR/zQ1jUjmOiBn3w8BdTj2h3K:/mwFKrtdQ1IjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmmfmbhn.exe

Path C:\Windows\SysWOW64\Fmmfmbhn.exe
Size 108KB
SHA256 06390d00b07d3312f247e0bdc51939896c9305757b2ee5b5bc7bb0699a727b3e
MD5 d00f29a59bd81ff9ffe496111359f779
SHA1 27066967219f69ba1c9c791fc6c55954d3a99d6b
SHA512 885945329b488f31876781816ce8e0f32382f9fa4b9372856b92258b4fac3ef7f6a6e1052553366fea712873aa765d5fb1be18fbe9d509ff0542c73ade03a97b
SSDEEP 3072:dBhLMwR4E1AsLffQUjmOiBn3w8BdTj2h3K:1GE1fffdjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fodeolof.exe

Path C:\Windows\SysWOW64\Fodeolof.exe
Size 108KB
SHA256 e53da283d2e8f2d4cf0c8c1ffc36fedea75ec07637823671a88b77079e04dd35
MD5 ba6619c24f343a1182b1fa5db4371d65
SHA1 6a1127e58e3d48f59d7730c7efcf7bac18b85990
SHA512 03a7f1a5cd192a6466eecb411204069e65de3f455fe0fb6c81d4f062248ae12266bdc90ef8b6b3aaff9e48b014c9ffc18b2a40f07cd32e2e3bdf009111eadcc7
SSDEEP 3072:Nd1JeiDgX9CNja3oEvtacAoQp+dSyPPUjmOiBn3w8BdTj2h3K:zrbDgX9CNjwxvtacZK+lMjVu3w8BdTj/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqkocpod.exe

Path C:\Windows\SysWOW64\Fqkocpod.exe
Size 108KB
SHA256 41908039413a9d309c9359e63da0096b8380c61d6deb73964310e13ccaf4938b
MD5 eda143dc112d939b768e9b276730dc3c
SHA1 3494ec4ca9da58a8f508e3b1fe52bdd200679402
SHA512 fc1848864c152288186113a40242bcc44174a4367ccc9686a71c08eb6cd4eb81089658c67b07b4a1768fee1bedaac36d4638f998d09dd7af8d6d4243a79bf1f8
SSDEEP 1536:DpoHiiboe49QKafBAHA/I+hGQ0QMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:DYDrPeEeSUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqmlhpla.exe

Path C:\Windows\SysWOW64\Fqmlhpla.exe
Size 108KB
SHA256 d7246f23ce0950c2bf47e2b0a7f54ec511b9fda48bc96dc36a074989f06972e1
MD5 0427d65f4d442c62b29af5855ac03448
SHA1 706b0b053fafd6b3d1265d852576fea6a8d277e9
SHA512 fe0a5fec53cacdac252a3deb3762faa948c03baad04ba591ad12c3167f2cb4c95659687278eb7b6e7aa0d48a3c2311824ea1bbd835cc628bca5e8517f930709f
SSDEEP 3072:klgRc/j77Kd6loiw8WUjmOiBn3w8BdTj2h3K:kln7NZw8TjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcbnejem.exe

Path C:\Windows\SysWOW64\Gcbnejem.exe
Size 108KB
SHA256 c7697d856528eb28b25ce690f8301b44f99929e6165179209aadfb02453e24c4
MD5 6dbb7096c31052af4e8a31a7a2e5efd2
SHA1 17871637a7aa61dad87fb7f5cd199680c8512cfd
SHA512 8436aa7023dda32b4fcbc3495be4301c2f68d06a160776bdb50c2709ebc2ac71589e614ff6ddbf81b098d1365fd00a38c717998a1b6a6c0183de2dc45a74861a
SSDEEP 1536:hT9QG/eoUKpfS6rfU6UsOZ/GcMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:hTy8q+SwnyZ/GeUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcekkjcj.exe

Path C:\Windows\SysWOW64\Gcekkjcj.exe
Size 108KB
SHA256 ee716051de4c4e8fbf1ddc08d359c025f4ed95303d984c117aafffc0a4a7afac
MD5 ac74e51e9e356c946cf6cc40d35cd000
SHA1 c00670e2ef789e62646b880b95e1e6be850bd5b2
SHA512 8d479665967d62096d86ec516014214181b37870ebd1837feb5b0ae2805f78b54e18ca1a3f40717aea0ae182badde3264b881830707e244ceee049ab09ca1dc7
SSDEEP 1536:2OVkd/lZ8Vk+wp1MwB+rjm8NiIqhn3HQ8BawTj2wQ3K:2OVkd/lZ8Vk/9UjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfnnlffc.exe

Path C:\Windows\SysWOW64\Gfnnlffc.exe
Size 108KB
SHA256 10dd180416ae17054e71a9545b6cbc27e4317f1c77bf5ec745dd56dd3983524f
MD5 2da9c1b8e2612ca754810e0bfd181e16
SHA1 6f554344c074fb227892f72238a1325dc433fc68
SHA512 d2c8f37f329c090eb600e35d78157b49ef50fe9d7d7424b17a9c8f84129fd181442a5f85a656c8b085d707c1bc6fcf2bc204783cfb61a874e8c8161b4695d303
SSDEEP 1536:M8aHm8GktlkrhP7+/gV+eRsBMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:+HmbrFK/ggeRs5UjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfqjafdq.exe

Path C:\Windows\SysWOW64\Gfqjafdq.exe
Size 108KB
SHA256 6de229470b2db67a7019378816174b23deb78d42d95c3aa5932472105521a96b
MD5 b44c8c8de2e610150026b4f16fcd2c0c
SHA1 47e0006b377b4bfdae3772efe0f2306ac767eaef
SHA512 8e78ceb84f1e3bab75be909e6064169a4e89e860e4ebde07b5703b3791f0e177b7bb226ec2d309903fc7bccd736c3610da56fc2a73ce0f22e346c7603ef84d7a
SSDEEP 3072:Z3/34OPaSLcUIlM7uceC6UjmOiBn3w8BdTj2h3K:Z3/ay7uceCvjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gjocgdkg.exe

Path C:\Windows\SysWOW64\Gjocgdkg.exe
Size 108KB
SHA256 a82723d8d0cb611013ec8844bccf8de2d744973af34e8e1a6d48589f6e08b500
MD5 551a4c93e13093e266086d907d2f59db
SHA1 e77eaec21562f16164f86e3d6103f4e1113826a0
SHA512 230f7db1a63c31b5310d818d85e07a84de2d6cd22e452b9dd84942132d5951e5cb4d9f2f8fd6d1b3d81132bb03235493a0d070d6017e57791e1518a28eabf389
SSDEEP 1536:fMKWBoKG8UmHwhSdMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:fMKX8uS1UjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmhfhp32.exe

Path C:\Windows\SysWOW64\Gmhfhp32.exe
Size 108KB
SHA256 6d3d67596e7c20b3f7cc4e605e63d5c53698c7c58ffa14f1a18b3196ce57a19f
MD5 2ee34c587c695fcbdcbf28fc36cb0d07
SHA1 a0258d448c46d9554e46f7710f0fe45655a8be18
SHA512 5f040eaebb4668db2f0cdad7306ef18b20d6ddf62f22baaed961eb36fab2612666283c95a134088b40b79dab86b041b028fd6aaf1ef231161d694616e82a9ad7
SSDEEP 3072:aZSstDnZb2UDcXcywUjmOiBn3w8BdTj2h3K:a1Zb2ojy9jVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmkbnp32.exe

Path C:\Windows\SysWOW64\Gmkbnp32.exe
Size 108KB
SHA256 3b0dd985f16beeadc8c4d35b81312b82c48192744375b449dd8a3ff9742ee9df
MD5 429cd96e756c646b5716d303d1bf4ca4
SHA1 da0201fa731be05b396c6d515fc3b9b8b08c7a33
SHA512 fea840e14562bfa71475e661767c453bd7fa993192a40dfbf018e570ad7ad1e0b630a79cb7ff24c385ead18e1da3619cdfd030299450581971459cef2398c15a
SSDEEP 3072:FRYJjuJz7YCtOmUUjmOiBn3w8BdTj2h3K:FR2mNZjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmmocpjk.exe

Path C:\Windows\SysWOW64\Gmmocpjk.exe
Size 108KB
SHA256 c9bdf74bcf61ef606654e221e88f7314d753760d273ddd7613cf0470a078cb17
MD5 56fecc0aa4975f8cd8dd1037f80a07fe
SHA1 53050bd6cc8363656af67470a7eb6bcb5a3ce23a
SHA512 7bfe957ecba95385cf79d876e7f9b5813f52daf2107c955c8c58ec14b5d8b2d1816596584e66d032eea5fe9b8d26499b0a49e975a9946161e1348f17050ec84e
SSDEEP 1536:Zy6j9H8Es0U13/NQtGIqiKHMkhhMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:Zy65HUFrBhZUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqfooodg.exe

Path C:\Windows\SysWOW64\Gqfooodg.exe
Size 108KB
SHA256 86e5d99dfc9986355b0c8ca53a0244bcc77663b74e4a2c1a58afbaafd77d457a
MD5 9419804f224d586d8d665692e17eed69
SHA1 d07419fd7b0b924ec08171a09f2222cf4539de8d
SHA512 f855353fe9bbea1bc2388287347b61b8751533e08bb6d822eb9cbf8d994b1320575392f8f2ff62365cd9f7dc4bfbad057ae3974d7a749fc7419b987d337d2bc5
SSDEEP 3072:IbKq8hdpGOptLIzo+AlUjmOiBn3w8BdTj2h3K:IbKqGLMAKjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kckbqpnj.exe

Path C:\Windows\SysWOW64\Kckbqpnj.exe
Size 108KB
SHA256 918ae08512eb47ede08b4db6e86b517ec1c52f72efc5ef44511ef294a2cfb159
MD5 36c0bdc2bb59f6b34366d2440b6fca9b
SHA1 993fd74cbaa3ea7e03e1ea4c78ff16fea2025248
SHA512 5d00fc0f784280297fbe85bec5d5fe33daa316575b7313e237621a4cd0421428582bd7b1f9618f9f091fb8d3e6391ae5d69d9d361275dd6c724f2aadb33c3617
SSDEEP 1536:/X7g/eLX7VrAuIirXFpMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:RVrwizFxUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkihknfg.exe

Path C:\Windows\SysWOW64\Kkihknfg.exe
Size 108KB
SHA256 50d7346a8da359631102261b6f73d8d6fc4a3ea304bc24695a2907c8ffa1c2c6
MD5 32cd3ce147f9f2b4f782e0b41a801f0f
SHA1 3acdfc9732c45d3776da25c97a389e7d0dd7e749
SHA512 82761da3a1b57f79c15a83c82561634324642f454cfd8cefec339ae76ca989882aeab9d0dac7a5dfd85e579241c95394f12a1d999b3e3ea9ad7eff29d90465f7
SSDEEP 3072:5Ty1THrI6Lrx81VcbUjmOiBn3w8BdTj2h3K:m06K1VcwjVu3w8BdTj2VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laciofpa.exe

Path C:\Windows\SysWOW64\Laciofpa.exe
Size 108KB
SHA256 d6eef254639b82ddf50619ed934b52ee339f8f29f485c9625e017b499dafe3e2
MD5 70adf065d4c1ef4387070c0330251dbf
SHA1 432de1fb6f828754b0ea6bbd867ac2bb11f45b15
SHA512 2bd5d1f38609f4d750d6bf9cbd32c22ce077ab2ae433db9a83dc1f81114e1f6f9880eebd8bab75731cb116908a38ad2a2b4b295ed275830f86f413c1bdd8109f
SSDEEP 1536:zlXOub5u5bWrPySnPZXbMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:hOub5u5KPySntHUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lddbqa32.exe

Path C:\Windows\SysWOW64\Lddbqa32.exe
Size 108KB
SHA256 5d7c8027b7fb4f2146dd6f89e2ca535dfa1f9e86a16a8c964506407de44caa8b
MD5 f2133ca4fc0e074f85df20dad0102eaa
SHA1 35e0c2525aafba8a1def37ff5a13eb5415a61e4a
SHA512 19e33e4d145cba3968d7932673b5e4a84df9229a675f1b4ec59c82d4428e40a1683b605e250b9a77ac4ab1ac3c570f15e1f6d299f9b862fc593fa5f49f587b54
SSDEEP 1536:tkv7i5GZLbLiry+GK8UJMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:WQG1bLAy+x8URUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lijdhiaa.exe

Path C:\Windows\SysWOW64\Lijdhiaa.exe
Size 108KB
SHA256 731e6938f8082dc22da5cbbd9f2435c3da69826244e3cd0c44016a08a9e22261
MD5 44dfea7335ab74838dbbcb1c69725e28
SHA1 a4853c68ff7f499aecf1f7b8a7462a66892db7c6
SHA512 05b3c410cade71f32b6b00b15adf7fc0a7228cb279c98ce363b04da3d320b550ed09cf3625fd671c7ee0e0d1bfaaa442aa8971dcf6829859df98e2feed38cfeb
SSDEEP 1536:PuHxJ2KFlMb/LgsNn+qY4CMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:PwQKFoLglqRAUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgghhlhq.exe

Path C:\Windows\SysWOW64\Mgghhlhq.exe
Size 108KB
SHA256 e7a6f0e09e12a8dcd59466a118c697f62531eeccba8a67cafb151cc3e5af6e62
MD5 cc0af023b6a252c7e7c66ff050c27b6a
SHA1 c45a81ba045242f3c972295b93db5d138d1014c2
SHA512 ceab81595d9fde11653cb9a719e2583d61e257883f887351afb611ee6ecb409ea530b7dd6942685824d50aefd9856fee55d1c5f96d3284d9b00c341b8726cbac
SSDEEP 1536:3MkspUz8SdwTQq0Pc240vIJ3j+XIYxMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:39sn1QbIJz+3pUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncgkcl32.exe

Path C:\Windows\SysWOW64\Ncgkcl32.exe
Size 108KB
SHA256 42eb7fb3fc025292a50abd690d8f28f4c944cf6b425de6a8be5ab5d9ece0f32f
MD5 7d8d1760bddfaaf53630f02c0e63c51b
SHA1 441cd70dfdcce428cdee4750fa81680153f6a4a0
SHA512 47ec6dd4350738c079fa471f89a70efc082d5f7048689e698b80aa3cf5822b444398b0ed295877436c8a73b43480d2bbd9fb95d6666fcd36ae700e431cfc9302
SSDEEP 1536:Ae3QtxPkpb5Pjej6elI8TMwB+rjm8NiIqhn3HQ8BawTj2wQ3K:Ae3D1VvmPUjmOiBn3w8BdTj2h3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-64-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/368-344-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/404-212-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/520-452-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/608-40-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/608-579-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/700-598-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/748-416-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/952-406-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1148-292-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1204-111-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1208-593-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1208-55-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1316-79-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1328-176-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1364-200-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1620-104-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1660-520-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1684-386-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1768-71-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1784-388-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1984-135-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2040-308-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2260-518-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2276-322-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2380-530-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2388-224-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2392-422-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2396-351-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2400-192-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2432-334-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2444-570-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2460-370-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2492-580-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2520-47-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2520-586-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2584-563-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2740-442-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2808-272-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2852-454-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2868-496-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2976-544-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2976-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2988-160-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2992-587-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3104-362-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3160-314-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3164-538-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3220-400-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3236-545-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3288-278-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3348-439-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3460-237-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3524-512-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3556-394-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3596-152-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3612-376-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3628-532-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3676-567-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3676-23-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3688-260-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3720-96-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3732-216-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3756-434-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3776-262-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3852-478-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3924-130-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3972-284-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4028-32-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4028-572-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4044-470-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4056-573-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4124-490-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4160-120-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4180-369-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4296-87-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4448-552-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4464-248-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4476-460-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4588-298-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4604-286-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4608-506-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4712-476-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4716-424-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4764-332-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4792-16-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4792-558-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4812-144-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4968-172-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4976-12-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4976-551-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5016-316-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5028-485-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5036-356-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5064-184-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5080-240-0x0000000000400000-0x000000000043F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads