bb3f92d0f1c91176bacb831309d399ed8812d554b43c3b08afca681726fba955

Analysis

max time kernel
95s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb3f92d0f1c91176bacb831309d399ed8812d554b43c3b08afca681726fba955.exe
Size 128KB
Sample240614-dv62jatbpg
SHA256 bb3f92d0f1c91176bacb831309d399ed8812d554b43c3b08afca681726fba955
MD5 b5461bee931c124563f3f7a8b1a24644
SHA1 5e29132b72314c825a4098d831cbb328cfdf2483
SHA512 d4d27a783ec72c0e4935fe92394304600868e624b21b39f4f8a13f3b7059d84d4b37799b8d22ba3a532c54b031945a634774630024285895afcf9c5f74a8160c
SSDEEP 1536:4EX9XZM9G14wbXxfkJLRQLUEh44mjD9r823FmUI3kV3oBKi:LK9C4wbhfkNeLUEdmjRrz3TIUV4BKi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjepaecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fbllkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hihicplj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iffmccbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fobiilai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jfaloa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfcgge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haggelfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jaimbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jagqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jangmibi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iinlemia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmapha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jiphkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fqaeco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gqdbiofi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jplmmfmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpccnefa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcbnejem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdjfcecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbioei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ficgacna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gcbnejem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hjmoibog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Haggelfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iffmccbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifopiajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfqjafdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iabgaklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmlnbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqkocpod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbqefhpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ficgacna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fmapha32.exe

UPX dump on OEP (original entry point) 39 IoCs

resource	yara_rule
behavioral2/files/0x000d00000002337e-7.dat	UPX
behavioral2/files/0x0007000000023421-15.dat	UPX
behavioral2/files/0x0007000000023423-22.dat	UPX
behavioral2/files/0x0007000000023425-31.dat	UPX
behavioral2/files/0x0007000000023427-38.dat	UPX
behavioral2/files/0x0007000000023429-46.dat	UPX
behavioral2/files/0x000700000002342b-54.dat	UPX
behavioral2/files/0x000700000002342d-62.dat	UPX
behavioral2/files/0x000700000002342f-70.dat	UPX
behavioral2/files/0x0007000000023431-78.dat	UPX
behavioral2/files/0x0007000000023433-86.dat	UPX
behavioral2/files/0x0007000000023435-94.dat	UPX
behavioral2/files/0x0007000000023437-102.dat	UPX
behavioral2/files/0x0007000000023439-110.dat	UPX
behavioral2/files/0x000700000002343b-118.dat	UPX
behavioral2/files/0x000700000002343d-121.dat	UPX
behavioral2/files/0x000700000002343f-135.dat	UPX
behavioral2/files/0x0007000000023441-141.dat	UPX
behavioral2/files/0x0007000000023443-150.dat	UPX
behavioral2/files/0x0007000000023445-158.dat	UPX
behavioral2/files/0x0007000000023447-166.dat	UPX
behavioral2/files/0x0007000000023449-174.dat	UPX
behavioral2/files/0x000700000002344b-182.dat	UPX
behavioral2/files/0x000700000002344d-190.dat	UPX
behavioral2/files/0x000800000002341e-198.dat	UPX
behavioral2/files/0x0007000000023450-206.dat	UPX
behavioral2/files/0x0007000000023452-214.dat	UPX
behavioral2/files/0x0007000000023454-222.dat	UPX
behavioral2/files/0x0007000000023458-230.dat	UPX
behavioral2/files/0x000700000002345a-237.dat	UPX
behavioral2/files/0x000700000002345c-246.dat	UPX
behavioral2/files/0x000700000002345e-254.dat	UPX
behavioral2/files/0x0007000000023466-275.dat	UPX
behavioral2/files/0x000800000002346a-287.dat	UPX
behavioral2/files/0x00070000000234a1-491.dat	UPX
behavioral2/files/0x00070000000234a7-509.dat	UPX
behavioral2/files/0x00070000000234e0-694.dat	UPX
behavioral2/files/0x0007000000023512-858.dat	UPX
behavioral2/files/0x000700000002352b-955.dat	UPX

Executes dropped EXE 64 IoCs

pid	Process
4288	Fbioei32.exe
3876	Ficgacna.exe
4660	Fqkocpod.exe
3992	Fomonm32.exe
2240	Fbllkh32.exe
1540	Fjcclf32.exe
2556	Fmapha32.exe
5060	Fckhdk32.exe
1312	Fjepaecb.exe
3952	Fobiilai.exe
3224	Fbqefhpm.exe
1244	Fjhmgeao.exe
4540	Fqaeco32.exe
4804	Gcpapkgp.exe
1440	Gfnnlffc.exe
4840	Gqdbiofi.exe
5112	Gcbnejem.exe
1680	Gfqjafdq.exe
3288	Gqfooodg.exe
860	Gfcgge32.exe
4628	Gmmocpjk.exe
2444	Gpklpkio.exe
4520	Gidphq32.exe
3716	Gqkhjn32.exe
224	Gbldaffp.exe
1612	Gmaioo32.exe
856	Hboagf32.exe
3164	Hihicplj.exe
2624	Hmfbjnbp.exe
4328	Hcqjfh32.exe
3932	Hjmoibog.exe
3136	Haggelfd.exe
4988	Hcedaheh.exe
5028	Hmmhjm32.exe
4844	Haidklda.exe
2532	Iffmccbi.exe
2860	Iidipnal.exe
396	Ipnalhii.exe
1840	Ibmmhdhm.exe
3332	Imbaemhc.exe
1048	Ipqnahgf.exe
2232	Ifjfnb32.exe
1448	Iiibkn32.exe
3396	Idofhfmm.exe
5072	Ifmcdblq.exe
728	Iikopmkd.exe
4916	Iabgaklg.exe
1808	Idacmfkj.exe
2436	Ifopiajn.exe
1904	Iinlemia.exe
1836	Jaedgjjd.exe
2404	Jdcpcf32.exe
2256	Jfaloa32.exe
696	Jiphkm32.exe
2480	Jagqlj32.exe
4880	Jdemhe32.exe
2856	Jfdida32.exe
1956	Jibeql32.exe
980	Jaimbj32.exe
4336	Jplmmfmi.exe
4476	Jbkjjblm.exe
404	Jfffjqdf.exe
3616	Jidbflcj.exe
4380	Jaljgidl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gcbnejem.exe	Gqdbiofi.exe
File opened for modification	C:\Windows\SysWOW64\Iikopmkd.exe	Ifmcdblq.exe
File opened for modification	C:\Windows\SysWOW64\Jdemhe32.exe	Jagqlj32.exe
File opened for modification	C:\Windows\SysWOW64\Fqaeco32.exe	Fjhmgeao.exe
File created	C:\Windows\SysWOW64\Hmmhjm32.exe	Hcedaheh.exe
File opened for modification	C:\Windows\SysWOW64\Jfffjqdf.exe	Jbkjjblm.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lcgblncm.exe
File created	C:\Windows\SysWOW64\Mjeddggd.exe	Mgghhlhq.exe
File opened for modification	C:\Windows\SysWOW64\Gpklpkio.exe	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Jbkjjblm.exe	Jplmmfmi.exe
File opened for modification	C:\Windows\SysWOW64\Jaljgidl.exe	Jidbflcj.exe
File created	C:\Windows\SysWOW64\Mpkbebbf.exe	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Lnohlokp.dll	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Lihoogdd.dll	Ifmcdblq.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File opened for modification	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File opened for modification	C:\Windows\SysWOW64\Hcedaheh.exe	Haggelfd.exe
File opened for modification	C:\Windows\SysWOW64\Jidbflcj.exe	Jfffjqdf.exe
File opened for modification	C:\Windows\SysWOW64\Kacphh32.exe	Kmgdgjek.exe
File opened for modification	C:\Windows\SysWOW64\Lkgdml32.exe	Lcpllo32.exe
File opened for modification	C:\Windows\SysWOW64\Mjeddggd.exe	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Jokmgc32.dll	Gqdbiofi.exe
File created	C:\Windows\SysWOW64\Lcpllo32.exe	Lpappc32.exe
File opened for modification	C:\Windows\SysWOW64\Majopeii.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Hndnbj32.dll	Fqkocpod.exe
File created	C:\Windows\SysWOW64\Hcedaheh.exe	Haggelfd.exe
File created	C:\Windows\SysWOW64\Qknpkqim.dll	Jbmfoa32.exe
File opened for modification	C:\Windows\SysWOW64\Kbdmpqcb.exe	Kacphh32.exe
File created	C:\Windows\SysWOW64\Kknafn32.exe	Kbfiep32.exe
File created	C:\Windows\SysWOW64\Ddhbep32.dll	Fbioei32.exe
File created	C:\Windows\SysWOW64\Oddfqf32.dll	Gfqjafdq.exe
File created	C:\Windows\SysWOW64\Kpccnefa.exe	Kmegbjgn.exe
File created	C:\Windows\SysWOW64\Kdffocib.exe	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Laciofpa.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Lcdegnep.exe	Laciofpa.exe
File created	C:\Windows\SysWOW64\Kmgdgjek.exe	Kbapjafe.exe
File opened for modification	C:\Windows\SysWOW64\Kajfig32.exe	Kibnhjgj.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Lpcmec32.exe	Lnepih32.exe
File created	C:\Windows\SysWOW64\Jkfkfohj.exe	Jdmcidam.exe
File created	C:\Windows\SysWOW64\Fckhdk32.exe	Fmapha32.exe
File opened for modification	C:\Windows\SysWOW64\Jibeql32.exe	Jfdida32.exe
File created	C:\Windows\SysWOW64\Maohkd32.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Kbfiep32.exe	Kphmie32.exe
File created	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Lkgdml32.exe	Lcpllo32.exe
File created	C:\Windows\SysWOW64\Gcbnejem.exe	Gqdbiofi.exe
File opened for modification	C:\Windows\SysWOW64\Hihicplj.exe	Hboagf32.exe
File created	C:\Windows\SysWOW64\Pkbjnl32.dll	Hmfbjnbp.exe
File opened for modification	C:\Windows\SysWOW64\Iiibkn32.exe	Ifjfnb32.exe
File created	C:\Windows\SysWOW64\Gbledndp.dll	Iinlemia.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File opened for modification	C:\Windows\SysWOW64\Jbmfoa32.exe	Jdjfcecp.exe
File created	C:\Windows\SysWOW64\Nngcpm32.dll	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Nnhfee32.exe
File opened for modification	C:\Windows\SysWOW64\Gcpapkgp.exe	Fqaeco32.exe
File created	C:\Windows\SysWOW64\Gidphq32.exe	Gpklpkio.exe
File opened for modification	C:\Windows\SysWOW64\Gidphq32.exe	Gpklpkio.exe
File created	C:\Windows\SysWOW64\Gpkqnp32.dll	Gqkhjn32.exe
File opened for modification	C:\Windows\SysWOW64\Jdjfcecp.exe	Jaljgidl.exe
File opened for modification	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5572	6020	WerFault.exe	227

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iabgaklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaehlf32.dll"	Mdmegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejif32.dll"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jifkeoll.dll"	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnngob32.dll"	Lcgblncm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hndnbj32.dll"	Fqkocpod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iikopmkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jaljgidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceaklo32.dll"	Hjmoibog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jfaloa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hihicplj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmmocpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jaimbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjblifaf.dll"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibgnfha.dll"	bb3f92d0f1c91176bacb831309d399ed8812d554b43c3b08afca681726fba955.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fomonm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kbfiep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddhbep32.dll"	Fbioei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jdemhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jibeql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjeebd32.dll"	Fqaeco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gqkhjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jagqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gedmgfjd.dll"	Fckhdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdgohg32.dll"	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ipnalhii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkeang32.dll"	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjlcankg.dll"	Jagqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hakfehok.dll"	Fjhmgeao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gfqjafdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jaljgidl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnepih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fbioei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ficgacna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hjmoibog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kajfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oddfqf32.dll"	Gfqjafdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lkiqbl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4288	4292	bb3f92d0f1c91176bacb831309d399ed8812d554b43c3b08afca681726fba955.exe	81
PID 4292 wrote to memory of 4288	4292	bb3f92d0f1c91176bacb831309d399ed8812d554b43c3b08afca681726fba955.exe	81
PID 4292 wrote to memory of 4288	4292	bb3f92d0f1c91176bacb831309d399ed8812d554b43c3b08afca681726fba955.exe	81
PID 4288 wrote to memory of 3876	4288	Fbioei32.exe	82
PID 4288 wrote to memory of 3876	4288	Fbioei32.exe	82
PID 4288 wrote to memory of 3876	4288	Fbioei32.exe	82
PID 3876 wrote to memory of 4660	3876	Ficgacna.exe	83
PID 3876 wrote to memory of 4660	3876	Ficgacna.exe	83
PID 3876 wrote to memory of 4660	3876	Ficgacna.exe	83
PID 4660 wrote to memory of 3992	4660	Fqkocpod.exe	84
PID 4660 wrote to memory of 3992	4660	Fqkocpod.exe	84
PID 4660 wrote to memory of 3992	4660	Fqkocpod.exe	84
PID 3992 wrote to memory of 2240	3992	Fomonm32.exe	85
PID 3992 wrote to memory of 2240	3992	Fomonm32.exe	85
PID 3992 wrote to memory of 2240	3992	Fomonm32.exe	85
PID 2240 wrote to memory of 1540	2240	Fbllkh32.exe	86
PID 2240 wrote to memory of 1540	2240	Fbllkh32.exe	86
PID 2240 wrote to memory of 1540	2240	Fbllkh32.exe	86
PID 1540 wrote to memory of 2556	1540	Fjcclf32.exe	87
PID 1540 wrote to memory of 2556	1540	Fjcclf32.exe	87
PID 1540 wrote to memory of 2556	1540	Fjcclf32.exe	87
PID 2556 wrote to memory of 5060	2556	Fmapha32.exe	89
PID 2556 wrote to memory of 5060	2556	Fmapha32.exe	89
PID 2556 wrote to memory of 5060	2556	Fmapha32.exe	89
PID 5060 wrote to memory of 1312	5060	Fckhdk32.exe	90
PID 5060 wrote to memory of 1312	5060	Fckhdk32.exe	90
PID 5060 wrote to memory of 1312	5060	Fckhdk32.exe	90
PID 1312 wrote to memory of 3952	1312	Fjepaecb.exe	91
PID 1312 wrote to memory of 3952	1312	Fjepaecb.exe	91
PID 1312 wrote to memory of 3952	1312	Fjepaecb.exe	91
PID 3952 wrote to memory of 3224	3952	Fobiilai.exe	93
PID 3952 wrote to memory of 3224	3952	Fobiilai.exe	93
PID 3952 wrote to memory of 3224	3952	Fobiilai.exe	93
PID 3224 wrote to memory of 1244	3224	Fbqefhpm.exe	94
PID 3224 wrote to memory of 1244	3224	Fbqefhpm.exe	94
PID 3224 wrote to memory of 1244	3224	Fbqefhpm.exe	94
PID 1244 wrote to memory of 4540	1244	Fjhmgeao.exe	95
PID 1244 wrote to memory of 4540	1244	Fjhmgeao.exe	95
PID 1244 wrote to memory of 4540	1244	Fjhmgeao.exe	95
PID 4540 wrote to memory of 4804	4540	Fqaeco32.exe	96
PID 4540 wrote to memory of 4804	4540	Fqaeco32.exe	96
PID 4540 wrote to memory of 4804	4540	Fqaeco32.exe	96
PID 4804 wrote to memory of 1440	4804	Gcpapkgp.exe	97
PID 4804 wrote to memory of 1440	4804	Gcpapkgp.exe	97
PID 4804 wrote to memory of 1440	4804	Gcpapkgp.exe	97
PID 1440 wrote to memory of 4840	1440	Gfnnlffc.exe	98
PID 1440 wrote to memory of 4840	1440	Gfnnlffc.exe	98
PID 1440 wrote to memory of 4840	1440	Gfnnlffc.exe	98
PID 4840 wrote to memory of 5112	4840	Gqdbiofi.exe	100
PID 4840 wrote to memory of 5112	4840	Gqdbiofi.exe	100
PID 4840 wrote to memory of 5112	4840	Gqdbiofi.exe	100
PID 5112 wrote to memory of 1680	5112	Gcbnejem.exe	101
PID 5112 wrote to memory of 1680	5112	Gcbnejem.exe	101
PID 5112 wrote to memory of 1680	5112	Gcbnejem.exe	101
PID 1680 wrote to memory of 3288	1680	Gfqjafdq.exe	102
PID 1680 wrote to memory of 3288	1680	Gfqjafdq.exe	102
PID 1680 wrote to memory of 3288	1680	Gfqjafdq.exe	102
PID 3288 wrote to memory of 860	3288	Gqfooodg.exe	103
PID 3288 wrote to memory of 860	3288	Gqfooodg.exe	103
PID 3288 wrote to memory of 860	3288	Gqfooodg.exe	103
PID 860 wrote to memory of 4628	860	Gfcgge32.exe	104
PID 860 wrote to memory of 4628	860	Gfcgge32.exe	104
PID 860 wrote to memory of 4628	860	Gfcgge32.exe	104
PID 4628 wrote to memory of 2444	4628	Gmmocpjk.exe	105

C:\Users\Admin\AppData\Local\Temp\bb3f92d0f1c91176bacb831309d399ed8812d554b43c3b08afca681726fba955.exe
"C:\Users\Admin\AppData\Local\Temp\bb3f92d0f1c91176bacb831309d399ed8812d554b43c3b08afca681726fba955.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\Fbioei32.exe
  C:\Windows\system32\Fbioei32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\Ficgacna.exe
    C:\Windows\system32\Ficgacna.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\SysWOW64\Fqkocpod.exe
      C:\Windows\system32\Fqkocpod.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4660
    - - C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3992
      - C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:860
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2444
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3716
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        27⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:856
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3164
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2624
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        31⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3136
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4988
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        35⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        36⤵
        Executes dropped EXE
        
        PID:4844
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        38⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:396
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        40⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        41⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        42⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        44⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        45⤵
        Executes dropped EXE
        
        PID:3396
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5072
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:728
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1808
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1904
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        53⤵
        Executes dropped EXE
        
        PID:2404
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2256
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2480
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2856
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:980
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4336
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:404
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3616
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1444
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        67⤵
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        68⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4076
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        70⤵
        Drops file in System32 directory
        
        PID:2724
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        71⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        72⤵
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4920
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4344
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3100
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        76⤵
        Drops file in System32 directory
        
        PID:2768
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        77⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2760
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        79⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4212
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        82⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2500
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1344
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        85⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2244
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2528
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        87⤵
        Modifies registry class
        
        PID:2108
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4300
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1524
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        90⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5236
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        94⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        97⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        98⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        100⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        102⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        105⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5900
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        108⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        111⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        112⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        114⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        115⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        116⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        117⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        118⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        119⤵
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        121⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        122⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        123⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        124⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        125⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        126⤵
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        127⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        128⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        129⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        130⤵
        Drops file in System32 directory
        
        PID:5480
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        131⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5744
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        133⤵
        Drops file in System32 directory
        
        PID:5876
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        136⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        137⤵
        Drops file in System32 directory
        
        PID:5168
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        139⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        140⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5920
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        142⤵
        Drops file in System32 directory
        
        PID:3132
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        143⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 436
        144⤵
        Program crash
        
        PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6020 -ip 6020
1⤵
PID:5444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fbioei32.exe

Path C:\Windows\SysWOW64\Fbioei32.exe
Size 128KB
SHA256 47b66263a17d6c95aa89a910488554c8d8252b975c06269b844797ac9a417079
MD5 dfc03aed176602f771990bfc632529a6
SHA1 a3acd9252fca005af5e8fb57601e82051c105564
SHA512 2cd93df3b08cdd0b44942008cf45d4efa90302e96de12956b6dcb6bce1dd414663f56434a28b9b879dbabd9f148107fbc33db99a3406412bec41310aad9c07c7
SSDEEP 3072:ZDX4vBh9VMuQ7n5lleJUEdmjRrz3TIUV4BKi:ZyD/25lIOEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbllkh32.exe

Path C:\Windows\SysWOW64\Fbllkh32.exe
Size 128KB
SHA256 3d9716aa6aa2f0473ba456de3b9637624b5bf3801ff605306226dab93d4501f8
MD5 e5da2f83aaa30b32f3165c0401acaf26
SHA1 4d35e23043aa6fafcabca735b24c48d2d3b07a3e
SHA512 af0a227cda0f3e71a8e2ed7a209d266e498e39eb6babfa7501ef1fdbfbaa49167b54dac1ea79fa1b77d8c5bf4ec58ff64241aa1d956badec1ff69776effce85e
SSDEEP 3072:uOPzifIztlroG2sbxeLUEdmjRrz3TIUV4BKi:uOPA4EdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fbqefhpm.exe

Path C:\Windows\SysWOW64\Fbqefhpm.exe
Size 128KB
SHA256 80f827d64a5380e5d399e85b6ef433bae7c6ec71091fb205b901aab2c0fe6785
MD5 100d9cd34db7b3f2b3fac261f50f8c29
SHA1 1d5534c7d9af9f9fcca462d7d98121ae98bd07e2
SHA512 17bb5642e5c42468ea6420a6214085b8adb65aeee127cd65d32eea45507f77e955c58c7c4a8d52af118fd0393fcb8d0bf5127efccaf354811a48786f9e1dba64
SSDEEP 3072:RimlWJnXKQskhBtN2SFebUEdmjRrz3TIUV4BKi:RlWAqvNroIEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fckhdk32.exe

Path C:\Windows\SysWOW64\Fckhdk32.exe
Size 128KB
SHA256 89e1930a3e226d20c4d96975ee36c22b31b31a4f7a1fcd8b8ac7f142401ab10c
MD5 6bbff405ff06b80b3b1a65b4c6d70568
SHA1 50294e726a27f51b062a29855b54c38fc10c773a
SHA512 7381c385269d14a867d5412570c01e39a6d02bb55814051e12c7aa1f6393eeb2bf2d3571b5e3ccbe5d4a42b7ccef6492fc63790d25413fbadb53f7fd1e3c64de
SSDEEP 3072:kJcshTVMrw2zh5Jd4eFUEdmjRrz3TIUV4BKi:GhRzY5HaEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ficgacna.exe

Path C:\Windows\SysWOW64\Ficgacna.exe
Size 128KB
SHA256 e5ec39fccb6257feaffdaa495a3884a32f97007bddc0e183a1af36bb011ffe4c
MD5 59ffe357658579f49989bc396857bd8e
SHA1 8432c656b5419a3e4bcdb6f1c1add2cdf62c40ca
SHA512 361004341f46daab5f274a63c1b0b12b2d3c7ed48c225f963b4fa7275c0e68cc23cf5067eebc13e37963fac911dd25e57c7ea18511b885519d0bec12899c794c
SSDEEP 3072:k2RTCEszOjgLadopESle1UEdmjRrz3TIUV4BKi:Xjs0gL5EzKEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjcclf32.exe

Path C:\Windows\SysWOW64\Fjcclf32.exe
Size 128KB
SHA256 55055bd277d6455a3987aba3ac839f7292d8d97dc13500928e59a27c43c55d1f
MD5 e3bff14bb003f0f3345e6e9abfb1f1f2
SHA1 c6bbdbacbdbc7b3d6e626b4a19de22e6d05e2286
SHA512 3357c1cb53eba9c84ae2bfc660bdbafb032acd6f805342370e399dcf906d4f9f018ea6c2b7348e1a65a1dfcb4880b296de9971e9e37b98375bbb192d7f088195
SSDEEP 1536:trlScuy2CAXTSY9V1ON0CJi32RQISUEh44mjD9r823FmUI3kV3oBKi:trgRnWY9zHGe5UEdmjRrz3TIUV4BKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjepaecb.exe

Path C:\Windows\SysWOW64\Fjepaecb.exe
Size 128KB
SHA256 2b3011b50bd55d3d07ad1620623001a0124d81f110de756f4e7c9ddc22e5a61a
MD5 fc2c49d5b330653e0adc5a85dac10f23
SHA1 c5d4c3c4531ef2b44e5dfcb5436294dc4a250238
SHA512 b147daacc2731c7db39aaef522ee9fa2c1960ef3d2c75dba659058cd9e91809409fcdb01801f2b58b0b9fe04fa5a94d27948b44f313647c03143c5dbf41e4bfd
SSDEEP 3072:nuDrbMploQHxbueHUEdmjRrz3TIUV4BKi:nIrIpuQHxbF0EdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fjhmgeao.exe

Path C:\Windows\SysWOW64\Fjhmgeao.exe
Size 128KB
SHA256 5d76d2cecb3780333a8e9374a1886fe71c809980ba4114529e21f63790491cdc
MD5 c1b564924f47422c8b7210c621b2679e
SHA1 696bbb0f3f43ba88d657a329e9326d09b5af1f93
SHA512 361850b4549d7a75766e7c2d1a2b54ea2897031cd20bfc0cbfd3da5f65466a87c3020750a5ed6c22153ea5b71164944f263d68e4a910d81c96cc1fde286269d9
SSDEEP 3072:FWLtH9JcSaDztXX5RWQ68elUEdmjRrz3TIUV4BKi:GtH9TaDPMQS6EdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fmapha32.exe

Path C:\Windows\SysWOW64\Fmapha32.exe
Size 128KB
SHA256 efc76174cd5498c094d42080955073af9495047661bcdbd0623e627ef2ea363c
MD5 39fa0178143e7f34ac309ddb62f6ce44
SHA1 cbc8f618ea94abfad1b29f8a7618cc64470521f7
SHA512 eacb6b478c6715449731a1198953949de47a966c306f7aa0af87057b2151718f6b42b42b084b3836f544a497716c663355291d5f67ff83216b10540f3952ffb1
SSDEEP 3072:OfI74lUZd/q3hl/G1d+RzeUzUEdmjRrz3TIUV4BKi:D4mZalqddPEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fobiilai.exe

Path C:\Windows\SysWOW64\Fobiilai.exe
Size 128KB
SHA256 ca1cc378af6e05d9eec1efde2369259a785eff63e03cb20ba473a591014cfa81
MD5 6b719eb7c1218ab31e798c53934b29e2
SHA1 b3197c718d64ac22f64506a52f0389d83dc62663
SHA512 ed936e7225fd560d0c79a20792cdf85783b2bfa450ddf5ec295591c46eacbd065e2be44d1b45c61ec66e41a6403c9ba54aa053797db92061f0e5cfb122597781
SSDEEP 3072:syOMHtYCKHsYZG5I0ejUEdmjRrz3TIUV4BKi:s+3KHsJagEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fomonm32.exe

Path C:\Windows\SysWOW64\Fomonm32.exe
Size 128KB
SHA256 760050dfdbcd04468942f4ec469d2240e910d86534086aa8eabd2bd6ea30dd1b
MD5 35cef82affb23e9b0299c5e44c0180be
SHA1 be3eeb65626a6074c46026e98b2f57b671d16fa8
SHA512 2093087b67a71ec6c911dc83fa887b2ab501a68ae7dc56678d302aec445bb506e8743c08d530e14beed06ed17672f013f1c136e35d30efc0c572d69293c55312
SSDEEP 3072:NwMdamG8YtBlp6HJ/epUEdmjRrz3TIUV4BKi:bp0ruEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqaeco32.exe

Path C:\Windows\SysWOW64\Fqaeco32.exe
Size 128KB
SHA256 bc040dca15a70b6da3639b2511772136c9168ce17a507a922cde40d0f1d367b1
MD5 695e6cb1c74246865b87dfa0be66bb38
SHA1 e0420dd79c752edf14254939bf2dab800d5e181d
SHA512 051246b56c13bd78ee1ad16b7e3300acf327c271bc86083110c93eceab7cba348a6249cfd8e171376220a3e757989ad5128db2b372d4c1562088944dde6e768d
SSDEEP 1536:GODjdbEQw39s04qgRA5bzgW/RQoHUEh44mjD9r823FmUI3kV3oBKi:LxPmd7e4UEdmjRrz3TIUV4BKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fqkocpod.exe

Path C:\Windows\SysWOW64\Fqkocpod.exe
Size 128KB
SHA256 46d818cb998b01a186dcac34e24098e1f9e8c2e73e7ded42384a3f04f587752f
MD5 779f300a3ac91ce992c198bafa6611e6
SHA1 277dc3a0ef7cb242cb58cea1755c82fa51cf0e1c
SHA512 cc1fbfa748bc292dd6ab19ae3f473231036e94652e7c1e1c63e91539aea62333d2286a7278a6fa6b0501ac668298c43c794e969c3fc514bf34d50cd5ac1fe4a7
SSDEEP 3072:dC9cVTBwcG6MlfHaUgm4mRiTUqeejUEdmjRrz3TIUV4BKi:/V1wASf6Rm4mRs31gEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gbldaffp.exe

Path C:\Windows\SysWOW64\Gbldaffp.exe
Size 128KB
SHA256 ce6126a2a0ae49532eba3d5351fead51c3d1fd0f23b60fff56e11264c5ba65ef
MD5 5d7594034eb45bb1a4f70e0b160a45c5
SHA1 dd1b2beae8a6504d2ab8c7011a19977fb578fe1b
SHA512 d57f41733170490af610a3ada5f9ce034b5ca869d350adce617a46f2a810f0020a61ef2d51cee425167db9038b6b2c2981108900fd54c8d0223ec7cf9de83803
SSDEEP 3072:dRwmZezojeLAoAlQ0jepUEdmjRrz3TIUV4BKi:dRwnzdAlpKuEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcbnejem.exe

Path C:\Windows\SysWOW64\Gcbnejem.exe
Size 128KB
SHA256 a9d4de632e5a3ef8f85dcfab4f3e17cf6109ce345f59b0cb3ab4abfee7bc3fd5
MD5 d3d71321832e8c7328d607f5839bd75f
SHA1 acfcb976b5d2e400c0f57f4786c7eef4a3bb7f54
SHA512 250c0f73e3b28ad4026a97b9e6cddae23fb78eb3c13a66f445b7b3ce0c740b5bc44e0eb65491cc2151e36dbc2ff4bb39bc920e8b692c3656ec86a3b1f86816ce
SSDEEP 3072:jPMYqMyN3acOSCoi9pRdzFJZzueOUEdmjRrz3TIUV4BKi:jLqnNsdZRdEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gcpapkgp.exe

Path C:\Windows\SysWOW64\Gcpapkgp.exe
Size 128KB
SHA256 89e29700f12cb3420cf558928af85b9f27d8da93d0e3ba24552af8e03d8908ac
MD5 834cae18bdb941e12a0c60d4781b5ed6
SHA1 4f44b3de7abc7160b8087751cdb0701ea8ad03c0
SHA512 51eae3ed97e585fa1074e396f6abfe69919ea9cef3ee29081cd5882c759226ea9305bfe868af1afbbcf96ccf8de6f108d51ca3556049f2fc86650aac2a97e0e5
SSDEEP 3072:OluXptircAb3bmCL0eoUEdmjRrz3TIUV4BKi:EuXv1JuHEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gddfpk32.dll

Path C:\Windows\SysWOW64\Gddfpk32.dll
Size 7KB
SHA256 1397a4c05e861839aaa1961d9ae5f5b916fe75b759ba7f64abeeb6df492b2087
MD5 57fea8841fbf51817c9ed5f66b0f23be
SHA1 ba93da17fc61cae8651b4b0fe075827a3ff88450
SHA512 c23a50b14f864b69c15211c3d06b66e96bb584683781b9d8f10849e0815d3872a6e90b431aa862147e301d1d20c87e813af4cd722538ab8bbeca56a4c5388cba
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPad3cX5aXW:wUaJf/aFbP0OR2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfcgge32.exe

Path C:\Windows\SysWOW64\Gfcgge32.exe
Size 128KB
SHA256 3884f85acac3a04581120eb14d84e5c174098f2870048f85b7d6b6758b99a1a1
MD5 51be97a5f253d948a37cf1eaadfd2a1f
SHA1 1d290315ec71890cbb91d4ab3545c83dff373d5c
SHA512 3df9783dd1f2ca5eb356a6e1915915939879c81b21824ec6ca6b2496d13c3448c87dc68cd9ea38b1679ced0aaf4311468a8e4951bc2653e1eefc6c48a17290f3
SSDEEP 1536:EYhuCgw2mbZTlaQwKIeFNxerM1+c5RQbUEh44mjD9r823FmUI3kV3oBKi:l8CgC0QXr95ebUEdmjRrz3TIUV4BKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfnnlffc.exe

Path C:\Windows\SysWOW64\Gfnnlffc.exe
Size 128KB
SHA256 6581703cc99dd114115ff37f968171d99d7d3dcebbf6bd4723730b8df6fe990a
MD5 99b62b79ca63ffdaa6f724b589212c82
SHA1 2a4f055421fe31a6390eaa7dc73ce7d050f46842
SHA512 f41d3146e5d164d47e5c84ee73f17989ff4b3fec52ec84d082389d49e67ae4d9c5b1d161a8ef9fe59ca6c6f897f51bf3aeae1ffa2f7cb1e2c8850d299e57f9c2
SSDEEP 3072:/vYZJeOzaKbYXyw8+xq88esUEdmjRrz3TIUV4BKi:PO+KbYXJ8GbEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gfqjafdq.exe

Path C:\Windows\SysWOW64\Gfqjafdq.exe
Size 128KB
SHA256 875a67acffd529b3603e5ceab09958005f156215d7099ff974e063c6b301a8a2
MD5 a2e037fa89816d50baeee06981af8dbf
SHA1 2836336ddd7830c55d70011a45e3d7ccc2a3ef3c
SHA512 f0f147cd21c78b7c8e54e54febff2a3fb2215fbcf9926a775e87d4867687b69e07c073d6fad86df2fd08c5a084579bc82d0abfab485992f330f140728f67f735
SSDEEP 3072:clXwgFo2wsa7+l+8IKNJzUteyUEdmjRrz3TIUV4BKi:clXwgTc7+l+8VlFREdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gidphq32.exe

Path C:\Windows\SysWOW64\Gidphq32.exe
Size 128KB
SHA256 cbfa4c8328b17a54d84326a247917e5823e3ff19f36779eed4e0bda8a5810a02
MD5 ea5154485af69633988c3946e9172607
SHA1 67ebe1f0369752b427e554f42dd841b5095c923e
SHA512 79f51e2773490d82f4f722d2b60eedefa5b1ba646088c7367b6742e5e3f24dc3baaa304958bfa2dafe3371b5d7e8ac3f3fba57411e8d53f51408137971031864
SSDEEP 3072:nPT9w1eTfpPoI+3MqeAUEdmjRrz3TIUV4BKi:nrucfhoIkMBvEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmaioo32.exe

Path C:\Windows\SysWOW64\Gmaioo32.exe
Size 128KB
SHA256 ed8d6f789c252e77be9f5f0f42a1c283ff518011f225261250b9b9da499c4b50
MD5 891ae879eaf5edf79ed26d737b99c300
SHA1 4b1588a1902b5ef754fbe5b16e9a82854ffbb553
SHA512 ea7051a54a93d818bd3bf5f8112dd59b116c6eae14c9f4c256a84226d3552cd19549da2942e5e6e60e518552015d2bd33ed98fada736f7e4a652a8fd77d0fbaf
SSDEEP 3072:963GKwGC2ohn7glsiZevhUEdmjRrz3TIUV4BKi:6wf2UXis+EdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gmmocpjk.exe

Path C:\Windows\SysWOW64\Gmmocpjk.exe
Size 128KB
SHA256 f87f103970e447acc72bcb6f8ed52aab15db2eb22f7e4bfb688ef128e37450ed
MD5 6b42ea1436ed10db85892979b80988c2
SHA1 db63d6f50b91045abe75f193715a46daec50201d
SHA512 7374546c94add35e9ac6505969aa0c665fa5d1ded3b0b0608e89ea2cf9d7b6b6037be91170a83759bbea7e1461139d4cb22e6e25baf071496e6d5709affddec7
SSDEEP 3072:Hn/Ls2M5nsyDWleeUEdmjRrz3TIUV4BKi:HDsvfD/tEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpklpkio.exe

Path C:\Windows\SysWOW64\Gpklpkio.exe
Size 128KB
SHA256 893eee5c52fd4d4a017c8844c5d366709df2818a994dcc4992f449d40aef6763
MD5 b1238af274bee6d6ab07f38e78869d1a
SHA1 7d3873e18735d762585901cf23bdbe66d71383cf
SHA512 613b0fcf26ab2a1cb29bd3cd1e5b9f797d0b71f3837fa0f33ffe6d8347576fc51f06aa9bf7769a3a2c657847d84e4830b5fe7380f2f5c0525417743a55c79cf0
SSDEEP 3072:h139+Nlhhc+yD/+eTUEdmjRrz3TIUV4BKi:P9u4x/VQEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqdbiofi.exe

Path C:\Windows\SysWOW64\Gqdbiofi.exe
Size 128KB
SHA256 6caf6f883cfeb9533db3967edef589e03e1bfe974cee0b977d21c4bbf3acb479
MD5 aac9b1389e29c3acae73eb50cf869282
SHA1 abf8bbf9ca6b18299dad6cc5f4f1fe860ffed07c
SHA512 725026864c4c83020d6d4fa8af8276c7024237bf91bf9b8433ba0e15e380051a1adfa9aa668d930a67594c8cd9070a3adc763dfedfcb74aa30372f733459d006
SSDEEP 3072:U7im5MSUJ2LvAiCg9tzGe9UEdmjRrz3TIUV4BKi:bmO3J64iCg95diEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqfooodg.exe

Path C:\Windows\SysWOW64\Gqfooodg.exe
Size 128KB
SHA256 b81527fed52633f3b8316a9b7515db1468ebd69921506b0bdc8095ba8365b3b6
MD5 037cfd804769575c504644f4e7d0efd5
SHA1 b4ec5c4fcb8557e5ba9a1093623676bfd858f467
SHA512 ec46af928a4a57edfe80e18ef3c12f4e173e934f104fa8249ce5e53dfac55952fa668888d086a3640a61071a0a581cab4c793426523d693cab7713356b65daf1
SSDEEP 1536:6A8ghfd50hPC5UQ2V/94M6GD6Bh3JFoRQeUEh44mjD9r823FmUI3kV3oBKi:6AP46oD6C6D5KeeUEdmjRrz3TIUV4BKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gqkhjn32.exe

Path C:\Windows\SysWOW64\Gqkhjn32.exe
Size 128KB
SHA256 8f7d0d284c8ac43529faf646bb0d86b8f51deeb6ce9599c41c267581ea0860a2
MD5 cec0252d5bce2210735f537198baa11b
SHA1 68036a50dc89facc4dada823f4962887a8bb4ac5
SHA512 c08818d9ab970709c57ce577350d0db4b0f48790d5f4345da3865cb94e2a83fb094b0ced322cc71af1969435dd92110cded7d2ad2265e70f1fea0f81744615b0
SSDEEP 3072:wI8E9i8m59UqmHLI/jWwmZEXsbttxe8UEdmjRrz3TIUV4BKi:Z8E9i8m59UqmHLeyborEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Haggelfd.exe

Path C:\Windows\SysWOW64\Haggelfd.exe
Size 128KB
SHA256 79231cd626c8236cff843bb5f1663e1fd7f78faf2b6e60d8839bc9308198b10c
MD5 6e695213d7a51d2e31f2af5f13fd220a
SHA1 da37e9fbe596ec8f7c691459b0cee8963e45c508
SHA512 b17e33dfc1b791be26587eba9b8252d4eca998680d91a3ec7c6d9eac651a6b843c231a369fb163437d33ee37b0e9147aec7919548fee2fde4ffaadee452cbd8f
SSDEEP 3072:I0yKahn6YPTSIGzu2kWsV1QWBqm4eTUEdmjRrz3TIUV4BKi:5yI7Da2Bs1zQEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hboagf32.exe

Path C:\Windows\SysWOW64\Hboagf32.exe
Size 128KB
SHA256 1c2b3df641207ebfae002a73c964f0f87b1e25ed70faa2decc24dd3cbc6f32a2
MD5 2007125c8e6cb22c7dfa6b799fde944a
SHA1 de69c8c79e2162b56db19cd01b31f50ed169acde
SHA512 65919ac5ad54bc95a8ecaea2f1acab03b2881e6e4ae814020dbf3e328a48471146189aa17b7087746ac9d97d40f4042369f236cffdb2ee86ee73059e781047b4
SSDEEP 3072:9PROWmcKe+XKF7w5f3YLeKUEdmjRrz3TIUV4BKi:9PROWmcMa63fZEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hcqjfh32.exe

Path C:\Windows\SysWOW64\Hcqjfh32.exe
Size 128KB
SHA256 62c885a06f874b4c950c07232fa4ee52cf2b4199dfcf6c6931f9cac67c1fe0d9
MD5 ad61fa243ef45ee023dabbcc7a65abd2
SHA1 f84e6956d46e02bbfc30ddce3f4268805de73e38
SHA512 b10970f897073e2d2c02249fe1870c7e1ff6989dea443db0ea74bd8bcea50009d45c306f149de7468de6fb2e70b2d808cd4847afd985f2e98df0e70a519ecf35
SSDEEP 3072:uwC93lKfrXWoqvaLvU8seWUEdmjRrz3TIUV4BKi:96sj0vajVEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hihicplj.exe

Path C:\Windows\SysWOW64\Hihicplj.exe
Size 128KB
SHA256 d0f2f5eb022962bbd4a42c4b47705fbd44932361f87693b5d951f9898f09187c
MD5 bc97875f0086f8f52afadea4135063b6
SHA1 381631c4a8da2d185a757cb5f0507d0111c7788d
SHA512 5ba092e511b77f235bde1d9cb6fb9cd5b1922788ff0ad4b6e900a59a56b720514a80fac1b1f6bb3688048e56c89ca579ce30cd54d2eeffcaf4791c28d8a8cbf1
SSDEEP 3072:WQgYo4bikyZVsTXiueKUEdmjRrz3TIUV4BKi:nQ4bikyZVs2FZEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hjmoibog.exe

Path C:\Windows\SysWOW64\Hjmoibog.exe
Size 128KB
SHA256 9caf9730993c9b7585a64b78252c97d906afab9d6b3444765903ec3dd572736f
MD5 ffe55478917f7585141a1de9da7aca29
SHA1 af7bdab3b55c5db78cec287d53d3ce7a1f38e273
SHA512 4dd7025c5f31f37e388b662cbd890cd718a0baed4aa4574c48f7bbf40183307d613ee3911492a1b81f81a5e7b37df7f9e577732f4cb89850b594560114d1ba55
SSDEEP 3072:kVd0AWmoZ/FFylvTlJKGe0dUEdmjRrz3TIUV4BKi:hvZ/DylLmd5EdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hmfbjnbp.exe

Path C:\Windows\SysWOW64\Hmfbjnbp.exe
Size 128KB
SHA256 394cf3c801f5d90cab8d6d98c7aca0025bf51785414fb533fcda791306b87100
MD5 446a5f7493e0db04effda391682e30b1
SHA1 84fd878bd86ebfc4f06e0f48dd55b6a234c71975
SHA512 39f2dc2a3dd71b0492f38783002a6132eec65fb95d0494be629987fc449e372465676d0a01a48434252f1527bff89742f63be9b4cc8c7567e3a7b1e15ab114da
SSDEEP 3072:9E2ymmCHf7cCdjCQHae7UEdmjRrz3TIUV4BKi:98azcC5txoEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iffmccbi.exe

Path C:\Windows\SysWOW64\Iffmccbi.exe
Size 128KB
SHA256 1d8528227e0931803b0dd445f2b0e2c9837b24a4ea18a875c1a88f284ab9b5db
MD5 3cffba8cab34c8a40b84aad98e8eafdb
SHA1 979b60d3fce07d8970a3eed02a01e8ed55797632
SHA512 81d204130aa4f51430b0ba9f417c04e389d680174868381403d7dfccab552dec8bc2dc5d04085d837de143c49b80f549bbfd12c9ebfb81ca57cb53cb2b931398
SSDEEP 3072:EOd0zTgSJyyi9AeKUEdmjRrz3TIUV4BKi:HAdaZEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ipnalhii.exe

Path C:\Windows\SysWOW64\Ipnalhii.exe
Size 128KB
SHA256 ef193763ae9a28f366c2868d440c71b311cb226f953e8899f216fc2cf22ae345
MD5 6f294a8293129aab22393d01ac54f136
SHA1 9334863ea70a90a41ba2202158c09234df754329
SHA512 8d73db36b8f0ac501f6d3888030bf8edf7d221636a93d91b88fb53e48fb388b957e142aaab6b2c3fbbd93fb29a157f9f53df8355add38a670d5af71248d4fd03
SSDEEP 3072:me55koDKFftxfs7tO+zZi6eConzeuUEdmjRrz3TIUV4BKi:8FX0BO+9cC8a9EdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kacphh32.exe

Path C:\Windows\SysWOW64\Kacphh32.exe
Size 128KB
SHA256 25f72c3897e260c120fade7c254a05fdb22b40beaadac48798fa9a92c99030d8
MD5 5d691ab4f1aaf136593b34d6e2fe0379
SHA1 4a89a242e20edba7856e60629570f106da1e5dcd
SHA512 5ebb41f1450913d66b9cf097ba9133438cae03df14675f67f6f366be01773724b53647735884f462655600ccfb05dc382b81801cadc7f04ceeb9fd48645a46e6
SSDEEP 1536:oIhjtkLKFcbGDDZruuxw7jxkwRQNUEh44mjD9r823FmUI3kV3oBKi:XYKCckuw7jqweNUEdmjRrz3TIUV4BKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpccnefa.exe

Path C:\Windows\SysWOW64\Kpccnefa.exe
Size 128KB
SHA256 3ae98a67d8f200165d96058ee729249705c5afe949c0f8070d60d033437ad74a
MD5 93199122730678d3fa102dc8ed8658d3
SHA1 502166b19df0e6dd18de43471ed35dd181fc23b8
SHA512 65f964cf0c8b4abdff60bd4ab18a826d11fd21714703cfa3f6f9c540dfb4e6bf42ac741f90fdd90916eb2656b5db664149264506fb63c402e79cc50be1b8097f
SSDEEP 3072:Rnn1X2o9xKMsdWmb8QY/KmeWUEdmjRrz3TIUV4BKi:Jn1N9sEwH6EVEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laciofpa.exe

Path C:\Windows\SysWOW64\Laciofpa.exe
Size 128KB
SHA256 9481dde8db6680711f0a9348414eba08385aeb709414b6acdb7ee83f2bc7cb64
MD5 cd5202ad05b3b2397383a9a49e63874d
SHA1 dea18a720acd328348579eee5791028b50a67d10
SHA512 bfef8bd411b9fe3375aa699eff2e2279fa3eb2440424fe396c112773ed6775920b2e18088db7f760b19dddf29d447183b194671715115311f257807c29c43646
SSDEEP 3072:xfOp4is60nO9GxgQemUEdmjRrz3TIUV4BKi:xZb2SWlEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcbahlip.exe

Path C:\Windows\SysWOW64\Mcbahlip.exe
Size 128KB
SHA256 d2c2bba20c1f8774851b5b3350139459ec060b0a310afde9af6b65eda37c36cc
MD5 eef4f2d7e0873c3cee3ec8e5afdb234e
SHA1 f5d734d17bc88a9321a63d20ae7a564ea93a69e2
SHA512 270eb8887865f412ab7c5ece42f7969e8db1381e071ad95b7d3767f86bb47c749639a8e83777128fd8916d455652907785d1cd70d686c3c8413dbbeba89df2cf
SSDEEP 3072:jTwxFW41iOOmf9HxkVYpKeMUEdmjRrz3TIUV4BKi:jTwf1iOX9R57EdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncldnkae.exe

Path C:\Windows\SysWOW64\Ncldnkae.exe
Size 128KB
SHA256 c743b38579171f9de584bc165c03a68cc02e388ee2a9ea2d1b5cc2a047320337
MD5 223e6da446a3c1587a72928dc6e1d142
SHA1 626ce0015640bdd6310ea4cc14707d1f99a332ab
SHA512 8c36117319ad591a309a913d02d5e90cf8abe077f32cda63cf30b160129715a0022f8de887936ad14d07fab651b09334b6076f41c9bce8eafbed5d852405ded9
SSDEEP 3072:YOvXpkXut7fWvRRDJejUEdmjRrz3TIUV4BKi:Yi6RggEdGTBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-556-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/224-200-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/396-297-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/404-436-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/540-532-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/696-392-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/728-341-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/856-216-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/860-160-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/980-418-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1048-310-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1136-466-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1244-95-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1312-72-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1312-603-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1344-568-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1440-120-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1444-454-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1448-322-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1524-597-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1540-52-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1612-207-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1628-520-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1680-143-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1808-352-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1836-374-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1840-298-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1904-364-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1956-416-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2028-465-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2108-589-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2232-316-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2240-581-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2240-40-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2244-575-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2256-382-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2404-376-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2436-358-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2444-175-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2480-394-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2500-558-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2528-583-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2532-284-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2556-60-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2624-232-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2724-478-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2760-526-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2768-514-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2856-406-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2860-286-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3100-508-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3136-256-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3164-223-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3224-88-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3288-152-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3332-304-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3396-328-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3616-446-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3684-488-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3716-191-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3876-20-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3932-248-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3952-84-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3992-570-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3992-32-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4076-472-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4204-490-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4212-545-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4288-551-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4288-8-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4292-544-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4292-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4300-594-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4328-239-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4336-428-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4344-502-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4380-450-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4464-538-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4476-430-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4520-184-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4540-104-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4628-168-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4660-28-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4804-112-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4840-128-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4844-274-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4880-400-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4916-350-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4920-496-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4988-262-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5028-272-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5060-596-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5060-64-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5072-338-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5112-142-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5132-604-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5920-973-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5940-998-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads