01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca.exe
Size 128KB
Sample240613-xybvcaybqa
SHA256 01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca
MD5 28dea5c110f82e058fc3ffe510a92487
SHA1 a741017fec4de1b04acd93809b50797cbd9a1c57
SHA512 36a25288823e3d106f6d9e2a559c65cb9e9f06e9808dd393ac908670d277974ac6a1a97352e72612b5afff4f32f753459637bc5f57c49fdebb87d215ad214a2c
SSDEEP 1536:G2W4ZDP+YE8e82UcmCRX/2NjRfIEcmMbeAfRQDnRfRa9HprmRfRJCLIXG:083UX/QfjcmMbeSeDn5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjcclf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibjqcd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifhiib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imgkql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmmfmbhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fokbim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gcekkjcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhcnke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoocmoao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eoapbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpklpkio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iapjlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fihqmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmioonpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibccic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eqalmafo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hikfip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fhajlc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffekegon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gjocgdkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iakaql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpkbebbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djnaji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ffekegon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jkfkfohj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjhmgeao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iiffen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fihqmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gjjjle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ijaida32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imihfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eflhoigi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gjclbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhdmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiibkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kajfig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpccnefa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kinemkko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fokbim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hclakimb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hpgkkioa.exe

Executes dropped EXE 64 IoCs

pid	Process
3424	Djnaji32.exe
4880	Dphifcoi.exe
1148	Dcfebonm.exe
4376	Dhcnke32.exe
1440	Domfgpca.exe
2032	Dakbckbe.exe
3624	Ehekqe32.exe
4008	Eoocmoao.exe
4088	Ebnoikqb.exe
860	Ehhgfdho.exe
2524	Eoapbo32.exe
468	Eflhoigi.exe
2704	Eqalmafo.exe
3564	Efneehef.exe
3552	Eqciba32.exe
4380	Ebeejijj.exe
3872	Ehonfc32.exe
3980	Eoifcnid.exe
5092	Fbgbpihg.exe
3448	Fhajlc32.exe
4496	Fmmfmbhn.exe
1964	Fokbim32.exe
3012	Ffekegon.exe
3512	Fqkocpod.exe
1972	Fomonm32.exe
3328	Fbllkh32.exe
3360	Fjcclf32.exe
2756	Fmapha32.exe
2880	Fckhdk32.exe
452	Ffjdqg32.exe
3636	Fihqmb32.exe
680	Fobiilai.exe
3216	Fbqefhpm.exe
2428	Fjhmgeao.exe
3408	Fmficqpc.exe
1984	Fodeolof.exe
1680	Gjjjle32.exe
228	Gmhfhp32.exe
3044	Gcbnejem.exe
916	Giofnacd.exe
1444	Gqfooodg.exe
4024	Gcekkjcj.exe
3492	Gjocgdkg.exe
2792	Gpklpkio.exe
2232	Gfedle32.exe
4476	Gidphq32.exe
2596	Gpnhekgl.exe
1092	Gbldaffp.exe
1956	Gjclbc32.exe
3432	Gppekj32.exe
4424	Hclakimb.exe
3352	Hihicplj.exe
1096	Hbanme32.exe
1508	Hikfip32.exe
3736	Hpenfjad.exe
808	Hbckbepg.exe
2960	Hjjbcbqj.exe
5084	Hmioonpn.exe
3740	Hpgkkioa.exe
3768	Hfachc32.exe
4432	Hippdo32.exe
4944	Hpihai32.exe
812	Hbhdmd32.exe
752	Hjolnb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jdemhe32.exe	Jiphkm32.exe
File created	C:\Windows\SysWOW64\Jmbklj32.exe	Jbmfoa32.exe
File created	C:\Windows\SysWOW64\Eeecjqkd.dll	Kdffocib.exe
File opened for modification	C:\Windows\SysWOW64\Fckhdk32.exe	Fmapha32.exe
File created	C:\Windows\SysWOW64\Mngoghpn.dll	Gjclbc32.exe
File created	C:\Windows\SysWOW64\Bdiihjon.dll	Kgphpo32.exe
File opened for modification	C:\Windows\SysWOW64\Kipabjil.exe	Kgbefoji.exe
File created	C:\Windows\SysWOW64\Fokbim32.exe	Fmmfmbhn.exe
File opened for modification	C:\Windows\SysWOW64\Gppekj32.exe	Gjclbc32.exe
File created	C:\Windows\SysWOW64\Oaehlf32.dll	Mdmegp32.exe
File opened for modification	C:\Windows\SysWOW64\Ebnoikqb.exe	Eoocmoao.exe
File opened for modification	C:\Windows\SysWOW64\Lalcng32.exe	Kkbkamnl.exe
File opened for modification	C:\Windows\SysWOW64\Kdaldd32.exe	Kacphh32.exe
File created	C:\Windows\SysWOW64\Cmafhe32.dll	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Fjhmgeao.exe	Fbqefhpm.exe
File opened for modification	C:\Windows\SysWOW64\Gcbnejem.exe	Gmhfhp32.exe
File created	C:\Windows\SysWOW64\Jbocea32.exe	Jpaghf32.exe
File created	C:\Windows\SysWOW64\Kinemkko.exe	Kgphpo32.exe
File opened for modification	C:\Windows\SysWOW64\Majopeii.exe	Mjcgohig.exe
File opened for modification	C:\Windows\SysWOW64\Dphifcoi.exe	Djnaji32.exe
File opened for modification	C:\Windows\SysWOW64\Ffekegon.exe	Fokbim32.exe
File created	C:\Windows\SysWOW64\Lkbhbe32.dll	Hbhdmd32.exe
File opened for modification	C:\Windows\SysWOW64\Ifjfnb32.exe	Ipqnahgf.exe
File created	C:\Windows\SysWOW64\Ebkdha32.dll	Idofhfmm.exe
File created	C:\Windows\SysWOW64\Ogndib32.dll	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Ampkqqjm.dll	Eoapbo32.exe
File created	C:\Windows\SysWOW64\Hjjbcbqj.exe	Hbckbepg.exe
File opened for modification	C:\Windows\SysWOW64\Fbqefhpm.exe	Fobiilai.exe
File opened for modification	C:\Windows\SysWOW64\Ipegmg32.exe	Imgkql32.exe
File created	C:\Windows\SysWOW64\Hdgohg32.dll	Fbqefhpm.exe
File created	C:\Windows\SysWOW64\Chbijmok.dll	Gqfooodg.exe
File opened for modification	C:\Windows\SysWOW64\Kdcijcke.exe	Kinemkko.exe
File opened for modification	C:\Windows\SysWOW64\Ehhgfdho.exe	Ebnoikqb.exe
File created	C:\Windows\SysWOW64\Jdkind32.dll	Jbfpobpb.exe
File created	C:\Windows\SysWOW64\Ifegaglc.dll	Gfedle32.exe
File created	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Mjqjih32.exe	Lcgblncm.exe
File created	C:\Windows\SysWOW64\Hbanme32.exe	Hihicplj.exe
File opened for modification	C:\Windows\SysWOW64\Iiibkn32.exe	Ifjfnb32.exe
File created	C:\Windows\SysWOW64\Dempmq32.dll	Icjmmg32.exe
File created	C:\Windows\SysWOW64\Kpccnefa.exe	Kmegbjgn.exe
File created	C:\Windows\SysWOW64\Dacdmi32.dll	Dphifcoi.exe
File created	C:\Windows\SysWOW64\Ijaida32.exe	Ibjqcd32.exe
File created	C:\Windows\SysWOW64\Ppgjkamf.dll	Ehonfc32.exe
File created	C:\Windows\SysWOW64\Ocaapo32.dll	Fodeolof.exe
File opened for modification	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Mbgaem32.dll	Hmioonpn.exe
File created	C:\Windows\SysWOW64\Lfmige32.dll	01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca.exe
File created	C:\Windows\SysWOW64\Kijjfe32.dll	Hikfip32.exe
File created	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Fckhdk32.exe	Fmapha32.exe
File created	C:\Windows\SysWOW64\Hclakimb.exe	Gppekj32.exe
File opened for modification	C:\Windows\SysWOW64\Jidbflcj.exe	Jdhine32.exe
File created	C:\Windows\SysWOW64\Kdaldd32.exe	Kacphh32.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Knceql32.dll	Djnaji32.exe
File created	C:\Windows\SysWOW64\Ipqnahgf.exe	Iiffen32.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Fokbim32.exe	Fmmfmbhn.exe
File created	C:\Windows\SysWOW64\Lpacnb32.dll	Gidphq32.exe
File opened for modification	C:\Windows\SysWOW64\Gjjjle32.exe	Fodeolof.exe
File created	C:\Windows\SysWOW64\Imihfl32.exe	Ijkljp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5144	5960	WerFault.exe	229

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpkbebbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbckbepg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfachc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gcbnejem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hpenfjad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mglack32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ffjdqg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbbfkb32.dll"	Ehekqe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblgaie.dll"	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jdhine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kinemkko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogdimilg.dll"	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfmona32.dll"	Dakbckbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmhfhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ibjqcd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gddfpk32.dll"	Fomonm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fihqmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Domfgpca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eoifcnid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gjocgdkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnckcnhb.dll"	Kacphh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbhdmd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlilmlna.dll"	Iiffen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejif32.dll"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpfijcfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ebeejijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gppekj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fomonm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ipqnahgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hikfip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebboiqi.dll"	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iakaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plilol32.dll"	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odegmceb.dll"	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dcfebonm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Giofnacd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gfedle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gjclbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdihi32.dll"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chkede32.dll"	Eoocmoao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inomojol.dll"	Eqciba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpckhigh.dll"	Gjjjle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hifqbnpb.dll"	Gcbnejem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppgjkamf.dll"	Ehonfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocaapo32.dll"	Fodeolof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Ncihikcg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3424	4436	01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca.exe	81
PID 4436 wrote to memory of 3424	4436	01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca.exe	81
PID 4436 wrote to memory of 3424	4436	01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca.exe	81
PID 3424 wrote to memory of 4880	3424	Djnaji32.exe	82
PID 3424 wrote to memory of 4880	3424	Djnaji32.exe	82
PID 3424 wrote to memory of 4880	3424	Djnaji32.exe	82
PID 4880 wrote to memory of 1148	4880	Dphifcoi.exe	83
PID 4880 wrote to memory of 1148	4880	Dphifcoi.exe	83
PID 4880 wrote to memory of 1148	4880	Dphifcoi.exe	83
PID 1148 wrote to memory of 4376	1148	Dcfebonm.exe	84
PID 1148 wrote to memory of 4376	1148	Dcfebonm.exe	84
PID 1148 wrote to memory of 4376	1148	Dcfebonm.exe	84
PID 4376 wrote to memory of 1440	4376	Dhcnke32.exe	86
PID 4376 wrote to memory of 1440	4376	Dhcnke32.exe	86
PID 4376 wrote to memory of 1440	4376	Dhcnke32.exe	86
PID 1440 wrote to memory of 2032	1440	Domfgpca.exe	87
PID 1440 wrote to memory of 2032	1440	Domfgpca.exe	87
PID 1440 wrote to memory of 2032	1440	Domfgpca.exe	87
PID 2032 wrote to memory of 3624	2032	Dakbckbe.exe	88
PID 2032 wrote to memory of 3624	2032	Dakbckbe.exe	88
PID 2032 wrote to memory of 3624	2032	Dakbckbe.exe	88
PID 3624 wrote to memory of 4008	3624	Ehekqe32.exe	89
PID 3624 wrote to memory of 4008	3624	Ehekqe32.exe	89
PID 3624 wrote to memory of 4008	3624	Ehekqe32.exe	89
PID 4008 wrote to memory of 4088	4008	Eoocmoao.exe	91
PID 4008 wrote to memory of 4088	4008	Eoocmoao.exe	91
PID 4008 wrote to memory of 4088	4008	Eoocmoao.exe	91
PID 4088 wrote to memory of 860	4088	Ebnoikqb.exe	92
PID 4088 wrote to memory of 860	4088	Ebnoikqb.exe	92
PID 4088 wrote to memory of 860	4088	Ebnoikqb.exe	92
PID 860 wrote to memory of 2524	860	Ehhgfdho.exe	93
PID 860 wrote to memory of 2524	860	Ehhgfdho.exe	93
PID 860 wrote to memory of 2524	860	Ehhgfdho.exe	93
PID 2524 wrote to memory of 468	2524	Eoapbo32.exe	94
PID 2524 wrote to memory of 468	2524	Eoapbo32.exe	94
PID 2524 wrote to memory of 468	2524	Eoapbo32.exe	94
PID 468 wrote to memory of 2704	468	Eflhoigi.exe	95
PID 468 wrote to memory of 2704	468	Eflhoigi.exe	95
PID 468 wrote to memory of 2704	468	Eflhoigi.exe	95
PID 2704 wrote to memory of 3564	2704	Eqalmafo.exe	97
PID 2704 wrote to memory of 3564	2704	Eqalmafo.exe	97
PID 2704 wrote to memory of 3564	2704	Eqalmafo.exe	97
PID 3564 wrote to memory of 3552	3564	Efneehef.exe	98
PID 3564 wrote to memory of 3552	3564	Efneehef.exe	98
PID 3564 wrote to memory of 3552	3564	Efneehef.exe	98
PID 3552 wrote to memory of 4380	3552	Eqciba32.exe	99
PID 3552 wrote to memory of 4380	3552	Eqciba32.exe	99
PID 3552 wrote to memory of 4380	3552	Eqciba32.exe	99
PID 4380 wrote to memory of 3872	4380	Ebeejijj.exe	100
PID 4380 wrote to memory of 3872	4380	Ebeejijj.exe	100
PID 4380 wrote to memory of 3872	4380	Ebeejijj.exe	100
PID 3872 wrote to memory of 3980	3872	Ehonfc32.exe	101
PID 3872 wrote to memory of 3980	3872	Ehonfc32.exe	101
PID 3872 wrote to memory of 3980	3872	Ehonfc32.exe	101
PID 3980 wrote to memory of 5092	3980	Eoifcnid.exe	102
PID 3980 wrote to memory of 5092	3980	Eoifcnid.exe	102
PID 3980 wrote to memory of 5092	3980	Eoifcnid.exe	102
PID 5092 wrote to memory of 3448	5092	Fbgbpihg.exe	103
PID 5092 wrote to memory of 3448	5092	Fbgbpihg.exe	103
PID 5092 wrote to memory of 3448	5092	Fbgbpihg.exe	103
PID 3448 wrote to memory of 4496	3448	Fhajlc32.exe	104
PID 3448 wrote to memory of 4496	3448	Fhajlc32.exe	104
PID 3448 wrote to memory of 4496	3448	Fhajlc32.exe	104
PID 4496 wrote to memory of 1964	4496	Fmmfmbhn.exe	105

C:\Users\Admin\AppData\Local\Temp\01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca.exe
"C:\Users\Admin\AppData\Local\Temp\01b2860e56049649a3731e8de0ac88f39719dfa32c91f5490e8754a44d8893ca.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\Djnaji32.exe
  C:\Windows\system32\Djnaji32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\Dphifcoi.exe
    C:\Windows\system32\Dphifcoi.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\SysWOW64\Dcfebonm.exe
      C:\Windows\system32\Dcfebonm.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4376
      - C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Dakbckbe.exe
        
        C:\Windows\system32\Dakbckbe.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Eoocmoao.exe
        
        C:\Windows\system32\Eoocmoao.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:860
        
        C:\Windows\SysWOW64\Eoapbo32.exe
        
        C:\Windows\system32\Eoapbo32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1964
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        25⤵
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1972
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        27⤵
        Executes dropped EXE
        
        PID:3328
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2756
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        30⤵
        Executes dropped EXE
        
        PID:2880
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:452
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3636
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:680
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3216
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2428
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        36⤵
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3044
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:916
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1444
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4024
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3492
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        48⤵
        Executes dropped EXE
        
        PID:2596
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3432
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3352
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        54⤵
        Executes dropped EXE
        
        PID:1096
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:808
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        58⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5084
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3768
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        62⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        63⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:752
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        66⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1600
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4652
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        70⤵
        Drops file in System32 directory
        
        PID:1224
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4600
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        74⤵
        Drops file in System32 directory
        
        PID:4492
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1412
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3048
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        77⤵
        Drops file in System32 directory
        
        PID:4644
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        78⤵
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4636
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        80⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2212
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        82⤵
        Drops file in System32 directory
        
        PID:3172
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4152
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1460
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        85⤵
        Drops file in System32 directory
        
        PID:1896
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4268
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1712
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        89⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        90⤵
        Drops file in System32 directory
        
        PID:1848
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        91⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        92⤵
        Drops file in System32 directory
        
        PID:396
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        93⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:564
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        95⤵
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3752
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        97⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        100⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        101⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        104⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        106⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        107⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        108⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        110⤵
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        111⤵
        Drops file in System32 directory
        
        PID:5768
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        112⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        113⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        116⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        117⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        118⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        119⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        120⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        121⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        122⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        123⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        128⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        129⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        131⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        132⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        135⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        136⤵
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        137⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        138⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        139⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1512
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        144⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        145⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        147⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 412
        148⤵
        Program crash
        
        PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5960 -ip 5960
1⤵
PID:6140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dakbckbe.exe

Path C:\Windows\SysWOW64\Dakbckbe.exe
Size 128KB
SHA256 c00fd8672334181d9d7c7b1d8d5de71e25b510a7f7a5bc5f50b8fec8935b4b68
MD5 b5a96558ab8a2cbd3683f4628ca74705
SHA1 0a33f424ec19605ce3b199896d4c7826525b19d9
SHA512 7608a4a552fd444367e2965be6d5f2adc339442f55705ec2680d92a1f1fdb93215534eafeeb7df60a583aeb0f6f67d6081ce66300003b336509facc9e5d5e419
SSDEEP 3072:s1RiAR2Zc/DthKSxn0SOPGcgeQeDN5wkpHxG:s1RiARMc/DXKBSOPqersCA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dbppbgjd.dll

Path C:\Windows\SysWOW64\Dbppbgjd.dll
Size 7KB
SHA256 1b82576b1797460e83a52eaff40a1ef0e7f741888f95dee4dece4758a0168cba
MD5 11dedd65b6daacd454c54c061738554f
SHA1 babfe8d7ded1b3fbbade9808e8b8dbd60e0012ca
SHA512 6be12a96c36c092f3197dc0e7576536ea2f7ab9e343face8b97279727de181b4f54cd715b3823a93e8a4064cb416e767a8f987eaea5b73a1f189641a918c52b1
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPpd3cX5aXW:wUaJf/aFbP0OC2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dcfebonm.exe

Path C:\Windows\SysWOW64\Dcfebonm.exe
Size 128KB
SHA256 9d0be04f9dcb2c013eea8ba618a7042ea910e48e0da78125b1702f9da33c6ce9
MD5 ac45b83610759b704d2da38b3e3c2665
SHA1 db80e25e117818b149f0fa7ad47a232080ddbb6d
SHA512 bd55e59acf8aeb71819378aff7fa79d37ec56628c67d16681110f54d37ce4682282d4e7d1de79f7fa54481ab35b60473b803c33f81714cea2d89fca916c452be
SSDEEP 3072:YAV59d6LeuZ0FKe9bzJkoeDaL5wkpHxG:YM9gSuZ0FKT9CA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhcnke32.exe

Path C:\Windows\SysWOW64\Dhcnke32.exe
Size 128KB
SHA256 517e427218b2f9111cdb78bd7a18e9c9435e523c238718153463526dd26beba0
MD5 df773b473f478fb2c559ee7c356803e0
SHA1 02b2e912e3e28ac080e37df1c21f08470eb10507
SHA512 4b942b2e837baf79fc37480e8f67e10561d35c621297374152646a0897b77ff86a3ebc2a7217d8411052cc977b7d407e4015d6024a04785700b2f5ab0d6a8050
SSDEEP 1536:fnSMGpJsl2bxaVOLU0Y67cSTJuekWiXSLeVRQDNRfRa9HprmRfRJCLIXG:f6sSgV2HnxtiXUeVeDN5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Djnaji32.exe

Path C:\Windows\SysWOW64\Djnaji32.exe
Size 128KB
SHA256 f45fe093f782cee46fb21c517b0470b35ca7495241e35a9913fbe49300069841
MD5 a632694df7e4db94ceee8c5ac7070493
SHA1 54a7bbcfccd6049fe8c93096b7dc256b5807ed93
SHA512 d4596b6c7bbbdeca59d09474271265ee71397743503bf671291dc168c625555f8e4f2a3db997137748dafd5cbd7f27f805794a9bcca5bad7de5bf135e14bfe5d
SSDEEP 1536:eJXA6rJxp+Jae7GCRmhvpqvO+aCrjfVWRQDO5RfRa9HprmRfRJCLIXG:4A6rjfzdVKfVWeDY5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Domfgpca.exe

Path C:\Windows\SysWOW64\Domfgpca.exe
Size 128KB
SHA256 c50ea97b46ea8248283d9176416cc8bf1d0ef8aae49884c7b456affd57899c34
MD5 7c5478617e86510a175e077036ad41d7
SHA1 561deffa9ef9f8325b13aa4d7c4fa9dfedd83352
SHA512 d3ce12f3a869991e5898f9f5650ecd16b86ccdb7ee0d5446f383d46a2537695f768a21c256c98ccd312b4d58704f7049e3fa6d045be25ff20277f2f17f527120
SSDEEP 3072:h3z0rF9oG2TKCktiSg0l7YDFreDn5wkpHxG:hAf2ht5g7YAyCA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dphifcoi.exe

Path C:\Windows\SysWOW64\Dphifcoi.exe
Size 128KB
SHA256 572e4961945ccc311cb2c7fef378603a520ef3808563302a5d0402d631af49be
MD5 11090e4c6a8fca328a39a735118fd78a
SHA1 e4395d5f9c848ef1b2a6f4a6b31691c81ceb2fd3
SHA512 2bb2ea9946cf63e1a726fa27a95b53a303f89783ef4477c95e3e34708f7594212ad49d4ba13e7c61f3d26ba22acb028ce00f9d8e6d8152cfd72c975e5054beee
SSDEEP 3072:7PCIRnG0cIMAfCeG8xJait/eDD5wkpHxG:mIRXc1AfvxpWWCA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ebeejijj.exe

Path C:\Windows\SysWOW64\Ebeejijj.exe
Size 128KB
SHA256 bdede33c9127009093e199f762ffe480e49705e2700ee3a041e4c57bf1eddb74
MD5 81ee865660c6ff1eac7f7e2e70b45c7c
SHA1 dbc168acfa95209281281abcbddabadbaa12a1d4
SHA512 1e7b33acd70d1512d64e531bc38537ad86fc526622003c43bc9b7ec8b236600b7c3923c10b5af23f509e2a56200695a3b34b6acd9303dbdfbe869f40700c7a2b
SSDEEP 1536:5UxCvjpM+vVK/JkYPfEf6t2K9FX+MVGRQDqRfRa9HprmRfRJCLIXG:CxCvjp5vqCYPOOr90MVGeDq5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ebnoikqb.exe

Path C:\Windows\SysWOW64\Ebnoikqb.exe
Size 128KB
SHA256 5a356a3c840dd26736144c36a3cdff14e68d8b3b02850bdecef71f09a5350c59
MD5 a11b27309403ef41ad618b9294920b1c
SHA1 c4b4418678f56ad1a00ade63f8d0cb65dc660516
SHA512 4bbab922c9804c41e0192c8811c71c99b2ef28c44f43e1aa400d41245483dbad10abb4f0e9ca85bba11fd287f63078f7eed4f2c9709316a92ee02a7dd5be22af
SSDEEP 1536:95wVZgUnTFIRfzy5nt4GrbCO3n70XAwC9+ynyRQDERfRa9HprmRfRJCLIXG:4VZbZObl0bTPwCMeDE5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eflhoigi.exe

Path C:\Windows\SysWOW64\Eflhoigi.exe
Size 128KB
SHA256 b90d226bb88349f79d618084528ac585413c41fb7dd39b6ffb35c832d197dfb1
MD5 917b7b564fa618434325e0a6ce4feaf8
SHA1 6387662197c29ac4f1018875ace1811382cd538e
SHA512 5b8d73b18a4be425e3fcaf09b7f9b4187dda15dcbf3022ce4a1972495c49a04d85eb2ebb4f32ae17a85868e601f69e93ee757ebcb26919f5ccdbfbe6a47dff22
SSDEEP 1536:zSny48S13PfFFdZvoGEhUipIB8J/ou/oLqnRsdMBRQDoRfRa9HprmRfRJCLIXG:z8wCF9vWreqJ/qqnRsdMBeDo5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Efneehef.exe

Path C:\Windows\SysWOW64\Efneehef.exe
Size 128KB
SHA256 adf0620951efcb09dcb629c6dbef47c016431803d7977fcd75672318ba36fbe8
MD5 c01e0a50738d17c919b409e42a1754e1
SHA1 e9efaf1ed3cf41fbb03ca7769aba730278b9194d
SHA512 0142607922272f723369a45c395f57b796ae96eaa5878a3568fcb3ba4934209f0bae9be8d1774896bcfa1f39ea692b79e2e38605d0ab7a6d4cd8d78d686489bd
SSDEEP 1536:YLUmx5B9MEnKWCYy5dCJxdzJRmLbLVKC2tsA6PhFRQDxRfRa9HprmRfRJCLIXG:izfMSxCY9ddU+GeDx5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ehekqe32.exe

Path C:\Windows\SysWOW64\Ehekqe32.exe
Size 128KB
SHA256 cf65710970e7aedcd76fb1cfb15d9226c7c20e7450e43938388158ed34cc5550
MD5 ac14dc6d32829ed4d91c505e36ee4f04
SHA1 eead60e32b2912d8be7e590ba120177c4cf8d6c2
SHA512 455f081f5b025f8800906c0ddf3e952b4b31a2cedaae54dacf54fae24e1daaf84b1f88a9c0545c938b9545f18200067bf8a93ba68b56aa8d85af2c180b363aaa
SSDEEP 3072:ATVQu2xoeg6Pa548Kxl8+4ZeDh5wkpHxG:E16U48Kxq+4sICA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ehhgfdho.exe

Path C:\Windows\SysWOW64\Ehhgfdho.exe
Size 128KB
SHA256 67d4610432dad2fb13ea515721abb91bfbae0f14be853b8b28313f42e82b63c9
MD5 1e486d102acf10333a3c70d5cd3e5301
SHA1 706a507178a18ce97c972da59091c389714cd24c
SHA512 d6c5bf70a20c77296e1eb10901a4571a813e43422fd297a14a294fb2fc62081533397d45cae5a6eabc2ee64c08da652c37d55ac3279fe8a3bc481da65b262907
SSDEEP 1536:dJhj4JIM0XscVa3PiNuwH5hUBTJfsRQDURfRa9HprmRfRJCLIXG:/ou6iNDeDU5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ehonfc32.exe

Path C:\Windows\SysWOW64\Ehonfc32.exe
Size 128KB
SHA256 48c3cbea06cf81c7b20b1036ac59164833370394ba99b5e224f3543037c3918b
MD5 14f8bebcb2f2e7742baa98b47a88659a
SHA1 b931d22dde1616fb831acba33824100bf76096da
SHA512 a037b43ecb995ac35a46e5c3643e98c723276da5bc49e9e61d5671fba369494dfa1a0f8d8e55ebfde5e2a34be955b458435d0a9b741d6c4e5569cccb3e88b012
SSDEEP 1536:9FoLGZXE9GFZCuFeRQKXHiAm0DbY8eb35ZiaXftRQDSARfRa9HprmRfRJCLIXG:94SXbZC4elu0I8eniaVeDSA5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eoapbo32.exe

Path C:\Windows\SysWOW64\Eoapbo32.exe
Size 128KB
SHA256 f4a608a44bbf12b67e360d4ac7a8c9fa5e19e615717c6e276f262fb2ea7478e7
MD5 5312844d43d7852f7bec9f772ddbeb33
SHA1 a835f998817e19f294298910f2713d35fda9dbef
SHA512 6b5e8bc6c9a418b125110bdd3286e38e0d909008b4ee5655d1e5be14392d26caf6537c6b52b492ec1116a231d233c3f21e4e37c4d2610aca00601c64e29fd763
SSDEEP 1536:pe28Np2CVna1cEWaa2w9SUsImTzGC5XHwIgRQDJRfRa9HprmRfRJCLIXG:pr8TRVaXXPlQ/eDJ5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eoifcnid.exe

Path C:\Windows\SysWOW64\Eoifcnid.exe
Size 128KB
SHA256 c04969393534817c861cd05527092db7d095f612f4aba23a85781a0337db893a
MD5 39674d69f485826386bf234b7597d1bb
SHA1 94b3316f552da0bb9239f8ba494517bfcb8fe8fe
SHA512 65b679db88e1d76b5897ac1e4da6e922c70d6f49aa762f63144c8f1c69f4b125c35171364f0b3dadc4f93dadf0dbe620f9abb1d2664912083af59b8abce52550
SSDEEP 1536:RDOkREgEmzs5Xq9GKetyLSCjDypVtQV67RQDhRfRa9HprmRfRJCLIXG:QkRdW9KetyLBvypVtn7eDh5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eoocmoao.exe

Path C:\Windows\SysWOW64\Eoocmoao.exe
Size 128KB
SHA256 71ad142547b3beea5237ab04e80f400e96aa76ec7925cdfdf7457d771ef806e4
MD5 eba488342c86edd7b28d061de2cf78ce
SHA1 f1100d2b9c2d34f471f876c94bffd52fd7869ee3
SHA512 c398b7d909abc3cbac326d10ae6dfb275b70a688dc8211c11f4afe0c673146a527312cbcb2fe090a0925180e64055b557996e240e084eb7c59aacd83a3194959
SSDEEP 1536:MDihNt514/pTgesD4ey80mecG7kRQDiRfRa9HprmRfRJCLIXG:MDifD14hMesDfMmeT7keDi5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eqalmafo.exe

Path C:\Windows\SysWOW64\Eqalmafo.exe
Size 128KB
SHA256 d99c3d519e0329579ad7de1e89267c5a9b1b94e47524540bc18e5d2bceb90c9a
MD5 0ff1752017b08de7e82c89d80bd92041
SHA1 3faf567f96176534d53b2fe7acd8ae5b0d0ec3be
SHA512 e03e87df3278d28e906b831c914ed1faa3513a4a6a065de0042b1e2dbddb94fb1db6872bfc1a76cfdc0c505eca2f4ba5c0a4345688d2a8d79f381154e8e1b6e7
SSDEEP 1536:C1NEqC+Hz1kZNdGoler6i44xhdNStcEPuqcO6WgRQD1RfRa9HprmRfRJCLIXG:aqT+pkZDTQr6p4RoyEseD15wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eqciba32.exe

Path C:\Windows\SysWOW64\Eqciba32.exe
Size 128KB
SHA256 2f25ef2f17c2e221bf3a2f314ad7c3140d605784dc74edd480af61704ccd09f0
MD5 260180876af3ac9c4dc7e993f9d48a5d
SHA1 e0b24a075d2426dd1182cbefcd95a484ec1ed4d2
SHA512 bddf8f54d4e045b29697d2ca530fb75bb6bd0931117d702efae9b884d1308678ae206a730b67a1cbafe882b2f976c995f514a05f66e6599d4a8919d1dd70e464
SSDEEP 1536:7cR1O2oYH6zX5d6PpjPx8f/ac7SQajKdmRQD+DRfRa9HprmRfRJCLIXG:7k6Tnwtm97KwmeDq5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbgbpihg.exe

Path C:\Windows\SysWOW64\Fbgbpihg.exe
Size 128KB
SHA256 1c1248753e0b3fba81c0045707052a9b2df38969ae2bbebb347acf846e092138
MD5 066a7334bea1e00a50b340300d3bef5d
SHA1 3ee588a9fc0e6b4b98a0a3015d05dac7189bbea1
SHA512 08b7462323538ea18be163d610ec51718eee87df0392551b112a1754f077b897d6096a71d03aded318db3b0a36884f6087c73e80082c266007edb3f0ee32ddde
SSDEEP 1536:U21QpuTUSeXg/v4TQ5nrZwWExyphFKsKK1vorx4mRQD2qRfRa9HprmRfRJCLIXG:31QiNeXu7FZ9qW1oSmeDj5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbllkh32.exe

Path C:\Windows\SysWOW64\Fbllkh32.exe
Size 128KB
SHA256 24463f8692acaef58850a3d5990d2c447473f3390ad44b4e2973cdf50a887b27
MD5 c3204c7ba3fd7ada4ef8c4d047ecdd6b
SHA1 b0525d4dd96c85d5d4da8682df2a7b5550f7eb6c
SHA512 8e1d362707c802759a563db10b5576d81b8439d8ae340e02b61504e662d606745358213b3d3e82b90a12d1517d12554f8ea23e4f63f610ab56220f4348ab790f
SSDEEP 1536:dnOPzqtBZfIBRtlroaRYBXveBjiw3zRQDqRfRa9HprmRfRJCLIXG:dOPzifIztlroG2sbzeDq5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fckhdk32.exe

Path C:\Windows\SysWOW64\Fckhdk32.exe
Size 128KB
SHA256 017ecd2c24066903f9d54d8a2b305e6aa19390f25066b6b0182384680931af38
MD5 2d0e941c367eeecea197b0f5b8d30400
SHA1 b8345e77b15283514ff3c3eb2f08dd697d96854d
SHA512 65d6e5cc0251072d6b3f6ec57868f3efe13b819f17e36bd55ef522b4206e3f95bd81bc5de82ab8d7d0a73f980432a86eb4d055c0865b74a7b75ab5d1d113743e
SSDEEP 1536:2cJqvrC4leIv2h4vayHTYMrw2osh5JdORQDIRfRa9HprmRfRJCLIXG:BJcshTVMrw2zh5JdOeDI5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffekegon.exe

Path C:\Windows\SysWOW64\Ffekegon.exe
Size 128KB
SHA256 9d4da9bc9fb0af5b1e4b1a4c9be6eca06a8c8e3471bb584ca3bc6ba76ee403f9
MD5 40450043f472f15539ef56b2d86feece
SHA1 5f53eb45e671f99b159a84ebddc238cf233d122d
SHA512 3e7a701cbc67f2505f7202c09be95f05c3275010be045986e8f4e114c83e226a582c3b218498e28b25cc70485f595c23e3ac0c2e465938ae61b64fd9d5af8c1a
SSDEEP 1536:UpdDLUL8XS0O4M4AuICTslRQDvRfRa9HprmRfRJCLIXG:UvL5XS0CuICEeDv5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffjdqg32.exe

Path C:\Windows\SysWOW64\Ffjdqg32.exe
Size 128KB
SHA256 8b03a81e09001fc528d9dab1a9f372e2e4bfd680fcaf67020d70b143d4d4a58b
MD5 c99f9c691cfdf8a24fe8144e77e1bd1e
SHA1 7a893ff44422d3a713d56320f67d91ae15ddea70
SHA512 07c599a458e0f24970a16c4a3f0b142525192d1ada8b92e34c28c54eef3ee2fe38225aa09b48264d066223755813f80d66f781c72e74c0cd2e677ed1358aced8
SSDEEP 3072:GJI2RIOxbNvTTKHJsh0FJZ4AeDY5wkpHxG:QI2K8bxTmmh0HZc7CA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fhajlc32.exe

Path C:\Windows\SysWOW64\Fhajlc32.exe
Size 128KB
SHA256 9710c705c0f37072f44ad562372c3071a24d5fd25e8e1f1d5c6d936e83f49bd8
MD5 9243e2bc57750f914111d89f06bda759
SHA1 915ff36f0bc197fa33bff10db0209dbd0975866f
SHA512 7161682b69de52aa47da861da46fdb1cb7b9a2f2579b9dace74d7edf6c8f48fcdda2244454b253dd65cc88d39884686e01c7c9fa814c20559201014bd62336b9
SSDEEP 1536:M0VBoGcuF5+PEINpgnq4NurteWvOSD9GKTsRZiqEvRQDqRfRa9HprmRfRJCLIXG:MmnTC/7qSDsa2IeDq5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fihqmb32.exe

Path C:\Windows\SysWOW64\Fihqmb32.exe
Size 128KB
SHA256 2783675374fe67e7ab4dff7369aa00af3b143b469de85283e71c84b18f29bfae
MD5 3d10703c5414f408b4d26f0773fb8507
SHA1 4407053b173045f0abc0800cf8705701b27db335
SHA512 c2dd5e1122223fd9a6b69cad4ba734847b714035349b456f778900586b7d29973186662bf78783ae3a24251ac9c688de5c000266f6236e183e5818308d530bd2
SSDEEP 3072:f4lkt5ZONznu4/6n0amDJ0eDq5wkpHxG:wiPO5nuO6n0a6JCA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjcclf32.exe

Path C:\Windows\SysWOW64\Fjcclf32.exe
Size 128KB
SHA256 9c7448d9cc397c5fa02bf207d7bad2103c8001520f4b04dce08ce964ad639dcb
MD5 4483a8dcee10f84efc39e790106cfb58
SHA1 5530ba9cf2d67a25434a210b90b4b9d7b780e0e2
SHA512 930d6fdc67cf440b76fb96b2c8892ee532645f0001ad9af38fe423d7d2af45ea75897cb30334c3f60b0f91d378b4fdaf8ac05a084dbc5a31fa4af70a5312b848
SSDEEP 1536:krlScuy2CAXTSY9V1ON0CJi3URQDa1RfRa9HprmRfRJCLIXG:krgRnWY9zHEeDM5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmapha32.exe

Path C:\Windows\SysWOW64\Fmapha32.exe
Size 128KB
SHA256 638b277d7ece9e4472505a1086839754dae0b45a6b34e5244fa319f9fd419db3
MD5 6e218592f6b44339675452eb919c8f09
SHA1 23a58dc9911e9f0978d7c6d9403b339f2379a9fe
SHA512 55c6ecb8b91f1b9d3fd2b355d292ae8765458a8bf799d25050bbe7d20a09cd6795073339f85eed1c00c523570643954eb7cc8eefd3fe138dcac0ebbaf535150d
SSDEEP 3072:XfI74lUZd/q3hl/G1d+RdeDuE5wkpHxG:U4mZalqdfgCA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmmfmbhn.exe

Path C:\Windows\SysWOW64\Fmmfmbhn.exe
Size 128KB
SHA256 99b9377da1f69bcda1ae8fc7f62672eefc25a80d2f359e6f724c10bef8660c32
MD5 5c72de53ded29df21c8ebff5adb840b5
SHA1 64705c3abed13df1a512b9988ab409281475bd6c
SHA512 d619f095664daf5e111149362436542096c7c03f231ebf0859046c293daf0dafe26cdc9887297cb90333104531c023189b4da1979c0ff767ee17bd4e47d55bdd
SSDEEP 3072:BCTdQitv68X5ztCvWCfa9flvgXSeDF5wkpHxG:BCJQA6QCvRftXpkCA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fobiilai.exe

Path C:\Windows\SysWOW64\Fobiilai.exe
Size 128KB
SHA256 5f191e9a6db71a8de3bd59a2ea25d141e37c1ed04b9fb7258ef4ea549a35dfbe
MD5 9d759550b80ebe6ac8e5ecf2327b2dd9
SHA1 4253189722abacb73ba4bcf5b3700150ff3d6419
SHA512 d747ce504a18264f7f9a28103a17ae5ed52cda6fe07cbcdaee8b7b4763a20253bc995e127dcf1547c5bcc1f5e3ad2f92576023a9fb357c14cdb374133184980e
SSDEEP 1536:zgSb2OMY7PtdQR+s5ijuKHsYZSVzSi5Me2S4tCRQDGRfRa9HprmRfRJCLIXG:LyOMHtYCKHsYZG5ICeDG5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fodeolof.exe

Path C:\Windows\SysWOW64\Fodeolof.exe
Size 128KB
SHA256 2f4c4b6a21de4e00f7fd15977931a8ca6f1ef292392158414f9dc88ddf5e1c01
MD5 ef9be64bca05473bdd7b5909b8ee4aa5
SHA1 92bdfb9170ed3812b01e0733b9ab02a22133975b
SHA512 067fc17b27c462d18dd7afb0509826f780d91ce0fa0988d9d55272866353cc5a0225981f0ea21933d17e69dcc0dd561c79b37cc4e1475c24e63e55bd6aae2bda
SSDEEP 1536:CvAnyimG6F4rRqLJ8ZA+wW3MsExLaYIS4nRQDWRfRa9HprmRfRJCLIXG:znyirtQoAW3UKeDW5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fokbim32.exe

Path C:\Windows\SysWOW64\Fokbim32.exe
Size 128KB
SHA256 1911831867cf1b202fd6d6bc8a326508d8349bd46f3ded23d96bf3f488720dbb
MD5 dced11995f5a54d5c06992abc0de0824
SHA1 bd7a2b5eea85c4a2a4ac3595afc3e3d41ec8a312
SHA512 54cc6d4d570025299ca0b56891fba9475ddaba48ba4b3fecacf9b9b9fe504dc7cdcd20a0e344279ed0459617379566c162a0d049bb157a9cd7a9e46462cbee3b
SSDEEP 3072:r4bDHD2OooI6oV6yJDdwsteDU5wkpHxG:EXjQxDGRnCA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fomonm32.exe

Path C:\Windows\SysWOW64\Fomonm32.exe
Size 128KB
SHA256 a879b5e0cf6827c238ba40aae03a6321e793bab4e7e2ddfea5b2494794dd9861
MD5 3c5be8b47183f72fba38418c39bdd831
SHA1 353b8f57241954773d26ec061b006d8b183b6225
SHA512 be70b434a11f00655f4c08f0b8c2b90cf58120c74b865c42fdc95eb352ca5f225085407e69d3e97efd3673a8132a0e52a6c5a6619273007af33710d2dd484f9b
SSDEEP 1536:u1whQh7Hsnn9Gf2rK7zXOVQG8r0tBlpY7CkHJxRQDcRfRa9HprmRfRJCLIXG:QwMdamG8YtBlp6HJxeDc5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqkocpod.exe

Path C:\Windows\SysWOW64\Fqkocpod.exe
Size 128KB
SHA256 a610d7aae4c0ff33104db854e281faf249c9f4a585ac77dcde7a3fb4f82695aa
MD5 c3c7d2fd8ee78cb523a5fc875a48416d
SHA1 4bcd50f44b7eeacec99061c51a2749bdda7a8b1c
SHA512 7e3a6a1ecb394a8024fc4a94cda5b1aab7b7b42cf23dc26934143905d2c5d5c65bdcf161eb69ea9749265adcf50c4d3f80f68b473ce547431ee0ec7c87156439
SSDEEP 3072:8C9cVTBwcG6MlfHaUgm4mRiTUqceDW5wkpHxG:EV1wASf6Rm4mRs3XtCA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hbckbepg.exe

Path C:\Windows\SysWOW64\Hbckbepg.exe
Size 128KB
SHA256 6b9fa0dae4c803b37a17cc7c4cfe341142f073da1eb5a4bca47df0748cf33561
MD5 61c69356983ae53d33e79fae2f366f2d
SHA1 84f8ab5c761763f1c48ff046824f371dcae5ed64
SHA512 bc9c982e33c68b8ceaaacc5e9f7cfd824db4a2bfc89df4e56c5dcfe8ad52fc809faff0d29d55ec081dd8110c0a20f41a73b45215a675150339cdfbe52638c887
SSDEEP 1536:hChsN08KRD6wMvATKCzVf/sV2WRQDnRfRa9HprmRfRJCLIXG:hnPKRD6rvAWCzZ4eDn5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hjolnb32.exe

Path C:\Windows\SysWOW64\Hjolnb32.exe
Size 128KB
SHA256 0197acb73fb95bc1bca4f4da651ed68e767971047e397194c917866c202be0fa
MD5 7728bb46d38bc7b54a0e429a9aade472
SHA1 8c63526e96e360a042d0d5ecf6ba4a4667d98d8d
SHA512 18aba6f224b8aa539a7fc037b1ef5a81e5f321e80b09e01e60a51b1b338518ee9082b107c1b6f615987148646f275ad069d73a2e515c31d9a196b5625d4cd104
SSDEEP 3072:9acItqyX1dUQycq0RcXxEX2peDp5wkpHxG:J2qyzq0+XxA28oCA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iiffen32.exe

Path C:\Windows\SysWOW64\Iiffen32.exe
Size 128KB
SHA256 4e7d29271b450c88227b27c6c07e93779f2811e5a1bee6fcf04e43e396bc5032
MD5 c06fc97ce55aaf82e078d0866f221c0e
SHA1 738da87d823591d155aacc039386c55c3499ac78
SHA512 965e6a392c36d09b5490d3db031a20b2f8c889ebd94857596a2470c6e52b105fb463f9d52a70da61e769ce17d679eaca1a6faf62c23921ebc635b53acb5de570
SSDEEP 1536:l9+0UyuvUjJg8XbWaX3jtrB08/snaW3cRQD5DRfRa9HprmRfRJCLIXG:rNUyuT8XbWQt08/xW3ceDh5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jbmfoa32.exe

Path C:\Windows\SysWOW64\Jbmfoa32.exe
Size 128KB
SHA256 12b9dfc2c9ef2217f62882ae16c2354ca0ff442278f9baa1ab0361e7bf97f070
MD5 59cfc91f9b5a446efbbe16eda7fbd73d
SHA1 6d070d7c017b1c3c00c0c071527600ff0c34820e
SHA512 22f310115df93a3a9ae62e802b0e21ecbd0b30b130b1714b1ceb83d33c52eccff109582d3ea6f0fa2dae532dbc4dada55dc952af6f8d30dc7c37c5586ff86d07
SSDEEP 1536:lNkeei2iwReBmLU+zWjEG4H0ZLe7TWSEVHjzf2dmY8MlARQDlRfRa9HprmRfRJCR:l6FRJLRKh+W7foyeDl5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mkbchk32.exe

Path C:\Windows\SysWOW64\Mkbchk32.exe
Size 128KB
SHA256 3794c7035590f434c76492242bb76308134f9dd551d5d3e69aeed6eafffa6761
MD5 667ee1ec660e44438b8081db09f7c70a
SHA1 0e27caadfc58306eced1b191706b7a51f246c434
SHA512 990930cefe9492b322a4eee6dcfc1f5191dd845cdce4fcf6ad1502ee4b7c53b98c529f23f3dd47832c5862eebc04601e68c7e87009f45843e77135019a061fc1
SSDEEP 1536:DbRWxm8BP7DucP/yq7Ezl+hiDrC69y+foUaK2RQDsRRfRa9HprmRfRJCLIXG:DbRHKDdf+D5NoneDO5wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 128KB
SHA256 284338aa4c7edb3a75feb678b902f6b7915da3889e59c82e3cb92288a84a4d37
MD5 2e71cc53af02ea33062821a0d4b71815
SHA1 ce654997320d6ea7311468fbf72f355a1e4a8f96
SHA512 1ad0963037c6ce1c2accb684f9d0289ad71d818c2c0a2c0d6f99e5d577bdd33e9a4d63727c58b96246bc3b643006126f50a78c41e94b63e3effae5766a51c1ad
SSDEEP 1536:w5p5H1XlDCt0y9DoINJGmcO5Rk8tmtW5DHsy95PjRQD6RfRa9HprmRfRJCLIXG:i9cJJGgRk8tmtW5DMyXPjeD65wkpHxG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-292-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/452-245-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/468-95-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/680-256-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/752-448-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/808-404-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/812-442-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/860-79-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/916-304-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1092-352-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1096-382-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1148-23-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1148-565-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1224-482-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1412-508-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1440-44-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1444-314-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1460-566-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1508-388-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1600-466-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1680-286-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1712-593-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1896-573-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1924-494-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1956-358-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1964-175-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1972-201-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1984-280-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2032-585-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2032-48-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2212-550-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2232-338-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2428-268-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2524-88-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2596-346-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2704-104-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2728-586-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2756-228-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2792-328-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2880-235-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2960-406-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3012-183-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3044-298-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3048-519-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3172-556-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3216-262-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3328-212-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3352-376-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3360-216-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3408-274-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3424-551-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3424-7-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3432-368-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3448-160-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3492-322-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3512-196-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3552-120-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3564-111-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3624-592-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3624-55-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3636-248-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3736-394-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3740-418-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3768-428-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3872-135-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3980-150-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4008-599-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4008-64-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4024-316-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4088-71-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4120-496-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4152-559-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4236-454-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4268-579-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4376-31-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4376-572-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4380-128-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4408-530-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4424-370-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4432-430-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4436-544-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4436-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4476-340-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4492-502-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4496-168-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4600-484-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4636-536-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4644-522-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4652-476-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4880-558-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4880-15-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4944-436-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4980-460-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5024-542-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5084-412-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/5092-152-0x0000000000400000-0x0000000000441000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads