06c4d9d1d30d3f87845801de4d69127648ea2d0a6f3f38ac43ed16c164e7e556

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07d84d1dc7523af7fd90c534dcae5374.exe
Size

64KB
MD5

07d84d1dc7523af7fd90c534dcae5374
SHA1

6ac6d73dfb71f30a9313e8298fa605713399d986
SHA256

06c4d9d1d30d3f87845801de4d69127648ea2d0a6f3f38ac43ed16c164e7e556
SHA512

dd62832362a598b622b9bf1a4b2c1a0362c625478a5bfc84cbc43efc16c77faee31cc263b4433cc0a12601b85dc358964336f066260feef02b78a7796aa94179
SSDEEP

768:0DM3I1J56QV695BXPHXCHRGalo2KLvrK/1H54FYYKA2kms8Y/ts/9d2NzYVmfiwG:0oY1vhE5RMRGjoWyYrPFW2iwTbW

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iickkbje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bidqko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbgeqmjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oigllh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ophjiaql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcnjijoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imgicgca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhgkgijg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abcgjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adepji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oofaiokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqkill32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajdbac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmedjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhbmphjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhbmphjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ooqqdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oophlo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oileggkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffqhcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gifkpknp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obqanjdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnpmjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlleaeff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amodep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diqnjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpeiie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdcmkgmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moaogand.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plndcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmcjpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fngcmcfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dphiaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjjahe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eecphp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbphglbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piapkbeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajdbac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnnimak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjnkcekm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajqgidij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Felbnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amikgpcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmphaaln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkaiphj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niklpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmcjpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnipbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piapkbeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcoljagj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omopjcjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qamago32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afappe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhonib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjellmbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjellmbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebdcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Biklho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Babcil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfhfhong.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbognp32.exe

Executes dropped EXE 64 IoCs

pid	Process
4516	Ggqida32.exe
4556	Gafmaj32.exe
5104	Ghpendjj.exe
4792	Gnmnfkia.exe
3040	Ghbbcd32.exe
5000	Hgjljpkm.exe
2792	Hglipp32.exe
352	Iohjlmeg.exe
2316	Idebdcdo.exe
884	Iokgal32.exe
2300	Iickkbje.exe
728	Iomcgl32.exe
1724	Ifgldfio.exe
4024	Ighhln32.exe
3004	Inbqhhfj.exe
5080	Iigdfa32.exe
3248	Indmnh32.exe
3116	Ienekbld.exe
852	Jbdbjf32.exe
2100	Jiokfpph.exe
4092	Jnkcogno.exe
4460	Jeekkafl.exe
656	Jkodhk32.exe
4932	Jbileede.exe
2256	Jicdap32.exe
2128	Jnpmjf32.exe
1984	Jejefqaf.exe
2904	Kppici32.exe
736	Kihnmohm.exe
2744	Kpbfii32.exe
3068	Kflnfcgg.exe
3528	Klifnj32.exe
1576	Kbbokdlk.exe
2652	Kimghn32.exe
4080	Kpgodhkd.exe
2700	Kfqgab32.exe
988	Khbdikip.exe
4436	Knlleepl.exe
2036	Kiaqcnpb.exe
4344	Lbjelc32.exe
4968	Lehaho32.exe
1184	Llbidimc.exe
952	Lfhnaa32.exe
3980	Lifjnm32.exe
5056	Lppbkgcj.exe
3100	Lfjjga32.exe
4008	Lhkgoiqe.exe
4552	Lbqklb32.exe
788	Lhncdi32.exe
5052	Loglacfo.exe
2876	Lfodbqfa.exe
2344	Mimpolee.exe
3960	Mojhgbdl.exe
896	Mfaqhp32.exe
4892	Mhbmphjm.exe
4784	Mpieqeko.exe
1292	Mfcmmp32.exe
376	Mibijk32.exe
460	Mplafeil.exe
644	Mbjnbqhp.exe
3664	Mhgfkg32.exe
3888	Moaogand.exe
1664	Mfhfhong.exe
1688	Mifcejnj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ckidcpjl.exe	Cdolgfbp.exe
File created	C:\Windows\SysWOW64\Aekedq32.dll	Jbdbjf32.exe
File opened for modification	C:\Windows\SysWOW64\Iohejo32.exe	Imgicgca.exe
File opened for modification	C:\Windows\SysWOW64\Oboijgbl.exe	Okgaijaj.exe
File created	C:\Windows\SysWOW64\Cmncbodd.dll	Okjnnj32.exe
File created	C:\Windows\SysWOW64\Cjmhfb32.dll	Obafpg32.exe
File created	C:\Windows\SysWOW64\Jacodldj.dll	Lplfcf32.exe
File opened for modification	C:\Windows\SysWOW64\Dcffnbee.exe	Dphiaffa.exe
File opened for modification	C:\Windows\SysWOW64\Ghbbcd32.exe	Gnmnfkia.exe
File created	C:\Windows\SysWOW64\Deohpe32.dll	Pgdokkfg.exe
File opened for modification	C:\Windows\SysWOW64\Emjgim32.exe	Eecphp32.exe
File opened for modification	C:\Windows\SysWOW64\Fefedmil.exe	Fbgihaji.exe
File created	C:\Windows\SysWOW64\Hoaojp32.exe	Hidgai32.exe
File opened for modification	C:\Windows\SysWOW64\Lhgkgijg.exe	Lfiokmkc.exe
File opened for modification	C:\Windows\SysWOW64\Mhldbh32.exe	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Ndhcfaai.dll	Knlleepl.exe
File opened for modification	C:\Windows\SysWOW64\Amodep32.exe	Ajqgidij.exe
File created	C:\Windows\SysWOW64\Jhkbjd32.dll	Eofgpikj.exe
File created	C:\Windows\SysWOW64\Gbhhqamj.dll	Njgqhicg.exe
File created	C:\Windows\SysWOW64\Lddkje32.dll	Phhhhc32.exe
File created	C:\Windows\SysWOW64\Nliaao32.exe	Nijeec32.exe
File opened for modification	C:\Windows\SysWOW64\Bqkill32.exe	Bidqko32.exe
File opened for modification	C:\Windows\SysWOW64\Gfjkjo32.exe	Gppcmeem.exe
File created	C:\Windows\SysWOW64\Noeocqni.dll	Mibijk32.exe
File opened for modification	C:\Windows\SysWOW64\Pjjahe32.exe	Podmkm32.exe
File created	C:\Windows\SysWOW64\Jjkgopfg.dll	Mpieqeko.exe
File created	C:\Windows\SysWOW64\Ebdcld32.exe	Eofgpikj.exe
File opened for modification	C:\Windows\SysWOW64\Mqjbddpl.exe	Mjpjgj32.exe
File created	C:\Windows\SysWOW64\Ghpkld32.dll	Aiplmq32.exe
File opened for modification	C:\Windows\SysWOW64\Bphqji32.exe	Bmidnm32.exe
File created	C:\Windows\SysWOW64\Flpmagqi.exe	Fefedmil.exe
File created	C:\Windows\SysWOW64\Mpeiie32.exe	Mhoahh32.exe
File created	C:\Windows\SysWOW64\Oiihahme.exe	Oigllh32.exe
File created	C:\Windows\SysWOW64\Fnipbc32.exe	Fmhdkknd.exe
File created	C:\Windows\SysWOW64\Oclknk32.dll	Fefedmil.exe
File created	C:\Windows\SysWOW64\Mhldbh32.exe	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Pbjddh32.exe	Pplhhm32.exe
File created	C:\Windows\SysWOW64\Lgidjfjk.dll	Qbonoghb.exe
File created	C:\Windows\SysWOW64\Hminmc32.dll	Lhkgoiqe.exe
File created	C:\Windows\SysWOW64\Nqomdf32.dll	Mfcmmp32.exe
File opened for modification	C:\Windows\SysWOW64\Fmcjpl32.exe	Felbnn32.exe
File created	C:\Windows\SysWOW64\Khlaie32.dll	Mhldbh32.exe
File opened for modification	C:\Windows\SysWOW64\Bkkhbb32.exe	Bdapehop.exe
File created	C:\Windows\SysWOW64\Iigdfa32.exe	Inbqhhfj.exe
File created	C:\Windows\SysWOW64\Abeiec32.dll	Jbileede.exe
File created	C:\Windows\SysWOW64\Cqjenbhh.dll	Oidofh32.exe
File opened for modification	C:\Windows\SysWOW64\Iepaaico.exe	Ifmqfm32.exe
File created	C:\Windows\SysWOW64\Doodkl32.dll	07d84d1dc7523af7fd90c534dcae5374.exe
File created	C:\Windows\SysWOW64\Llbidimc.exe	Lehaho32.exe
File created	C:\Windows\SysWOW64\Pidcecbj.dll	Pjjahe32.exe
File opened for modification	C:\Windows\SysWOW64\Obqanjdb.exe	Oqoefand.exe
File opened for modification	C:\Windows\SysWOW64\Jkodhk32.exe	Jeekkafl.exe
File opened for modification	C:\Windows\SysWOW64\Oofaiokl.exe	Ohlimd32.exe
File created	C:\Windows\SysWOW64\Lnpckhnk.dll	Nqoloc32.exe
File created	C:\Windows\SysWOW64\Aolece32.dll	Flpmagqi.exe
File created	C:\Windows\SysWOW64\Akmcfjdp.dll	Njedbjej.exe
File opened for modification	C:\Windows\SysWOW64\Lifjnm32.exe	Lfhnaa32.exe
File created	C:\Windows\SysWOW64\Bqkill32.exe	Bidqko32.exe
File created	C:\Windows\SysWOW64\Pjaaenbm.dll	Iomcgl32.exe
File created	C:\Windows\SysWOW64\Kpgodhkd.exe	Kimghn32.exe
File opened for modification	C:\Windows\SysWOW64\Obafpg32.exe	Okjnnj32.exe
File created	C:\Windows\SysWOW64\Caqpkjcl.exe	Cmedjl32.exe
File opened for modification	C:\Windows\SysWOW64\Kpgodhkd.exe	Kimghn32.exe
File created	C:\Windows\SysWOW64\Pogppn32.dll	Moaogand.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6300	4348	WerFault.exe	397

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkodhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfhfhong.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjmhfb32.dll"	Obafpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mbgeqmjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbdbjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjqlnnkp.dll"	Deqcbpld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpphjbnh.dll"	Bphqji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjkgopfg.dll"	Mpieqeko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmfplibd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpgodhkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qjnkcekm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbalopbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hidgai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljhbbae.dll"	Oophlo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjjahe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlkngo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oclknk32.dll"	Fefedmil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddnfmqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjcakafa.dll"	Lhenai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfiokmkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhoped32.dll"	Pmhbqbae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmdblp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhenai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njonjm32.dll"	Affikdfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgdemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhgngp32.dll"	Ienekbld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhgfkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afjeceml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkhnpc32.dll"	Nbgcih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obcceg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cibain32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Loglacfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oimkbaed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gppcmeem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnpckhnk.dll"	Nqoloc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfhmjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amnebo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hminmc32.dll"	Lhkgoiqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlleaeff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibffdoal.dll"	Ophjiaql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gifkpknp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgccelpk.dll"	Mbgeqmjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnihje32.dll"	Bdlfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nohehq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmeffoid.dll"	Nlleaeff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiikaj32.dll"	Neafjdkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pafpga32.dll"	Qmdblp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lefqkm32.dll"	Podmkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fefedmil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbibfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imqpnq32.dll"	Mjpjgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oofaiokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhhqamj.dll"	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mibijk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aopmfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	07d84d1dc7523af7fd90c534dcae5374.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nimbkc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbbffdlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enkdaepb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nognnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iomcgl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4516	4312	07d84d1dc7523af7fd90c534dcae5374.exe	141
PID 4312 wrote to memory of 4516	4312	07d84d1dc7523af7fd90c534dcae5374.exe	141
PID 4312 wrote to memory of 4516	4312	07d84d1dc7523af7fd90c534dcae5374.exe	141
PID 4516 wrote to memory of 4556	4516	Ggqida32.exe	140
PID 4516 wrote to memory of 4556	4516	Ggqida32.exe	140
PID 4516 wrote to memory of 4556	4516	Ggqida32.exe	140
PID 4556 wrote to memory of 5104	4556	Gafmaj32.exe	28
PID 4556 wrote to memory of 5104	4556	Gafmaj32.exe	28
PID 4556 wrote to memory of 5104	4556	Gafmaj32.exe	28
PID 5104 wrote to memory of 4792	5104	Ghpendjj.exe	25
PID 5104 wrote to memory of 4792	5104	Ghpendjj.exe	25
PID 5104 wrote to memory of 4792	5104	Ghpendjj.exe	25
PID 4792 wrote to memory of 3040	4792	Gnmnfkia.exe	27
PID 4792 wrote to memory of 3040	4792	Gnmnfkia.exe	27
PID 4792 wrote to memory of 3040	4792	Gnmnfkia.exe	27
PID 3040 wrote to memory of 5000	3040	Ghbbcd32.exe	26
PID 3040 wrote to memory of 5000	3040	Ghbbcd32.exe	26
PID 3040 wrote to memory of 5000	3040	Ghbbcd32.exe	26
PID 5000 wrote to memory of 2792	5000	Hgjljpkm.exe	29
PID 5000 wrote to memory of 2792	5000	Hgjljpkm.exe	29
PID 5000 wrote to memory of 2792	5000	Hgjljpkm.exe	29
PID 2792 wrote to memory of 352	2792	Hglipp32.exe	139
PID 2792 wrote to memory of 352	2792	Hglipp32.exe	139
PID 2792 wrote to memory of 352	2792	Hglipp32.exe	139
PID 352 wrote to memory of 2316	352	Iohjlmeg.exe	137
PID 352 wrote to memory of 2316	352	Iohjlmeg.exe	137
PID 352 wrote to memory of 2316	352	Iohjlmeg.exe	137
PID 2316 wrote to memory of 884	2316	Idebdcdo.exe	136
PID 2316 wrote to memory of 884	2316	Idebdcdo.exe	136
PID 2316 wrote to memory of 884	2316	Idebdcdo.exe	136
PID 884 wrote to memory of 2300	884	Iokgal32.exe	135
PID 884 wrote to memory of 2300	884	Iokgal32.exe	135
PID 884 wrote to memory of 2300	884	Iokgal32.exe	135
PID 2300 wrote to memory of 728	2300	Iickkbje.exe	134
PID 2300 wrote to memory of 728	2300	Iickkbje.exe	134
PID 2300 wrote to memory of 728	2300	Iickkbje.exe	134
PID 728 wrote to memory of 1724	728	Iomcgl32.exe	30
PID 728 wrote to memory of 1724	728	Iomcgl32.exe	30
PID 728 wrote to memory of 1724	728	Iomcgl32.exe	30
PID 1724 wrote to memory of 4024	1724	Ifgldfio.exe	31
PID 1724 wrote to memory of 4024	1724	Ifgldfio.exe	31
PID 1724 wrote to memory of 4024	1724	Ifgldfio.exe	31
PID 4024 wrote to memory of 3004	4024	Ighhln32.exe	133
PID 4024 wrote to memory of 3004	4024	Ighhln32.exe	133
PID 4024 wrote to memory of 3004	4024	Ighhln32.exe	133
PID 3004 wrote to memory of 5080	3004	Inbqhhfj.exe	132
PID 3004 wrote to memory of 5080	3004	Inbqhhfj.exe	132
PID 3004 wrote to memory of 5080	3004	Inbqhhfj.exe	132
PID 5080 wrote to memory of 3248	5080	Iigdfa32.exe	131
PID 5080 wrote to memory of 3248	5080	Iigdfa32.exe	131
PID 5080 wrote to memory of 3248	5080	Iigdfa32.exe	131
PID 3248 wrote to memory of 3116	3248	Indmnh32.exe	130
PID 3248 wrote to memory of 3116	3248	Indmnh32.exe	130
PID 3248 wrote to memory of 3116	3248	Indmnh32.exe	130
PID 3116 wrote to memory of 852	3116	Ienekbld.exe	129
PID 3116 wrote to memory of 852	3116	Ienekbld.exe	129
PID 3116 wrote to memory of 852	3116	Ienekbld.exe	129
PID 852 wrote to memory of 2100	852	Jbdbjf32.exe	128
PID 852 wrote to memory of 2100	852	Jbdbjf32.exe	128
PID 852 wrote to memory of 2100	852	Jbdbjf32.exe	128
PID 2100 wrote to memory of 4092	2100	Jiokfpph.exe	127
PID 2100 wrote to memory of 4092	2100	Jiokfpph.exe	127
PID 2100 wrote to memory of 4092	2100	Jiokfpph.exe	127
PID 4092 wrote to memory of 4460	4092	Jnkcogno.exe	126

C:\Users\Admin\AppData\Local\Temp\07d84d1dc7523af7fd90c534dcae5374.exe
"C:\Users\Admin\AppData\Local\Temp\07d84d1dc7523af7fd90c534dcae5374.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\Ggqida32.exe
  C:\Windows\system32\Ggqida32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4516

C:\Windows\SysWOW64\Gnmnfkia.exe
C:\Windows\system32\Gnmnfkia.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\Ghbbcd32.exe
  C:\Windows\system32\Ghbbcd32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3040

C:\Windows\SysWOW64\Hgjljpkm.exe
C:\Windows\system32\Hgjljpkm.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\Hglipp32.exe
  C:\Windows\system32\Hglipp32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\Iohjlmeg.exe
    C:\Windows\system32\Iohjlmeg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:352

C:\Windows\SysWOW64\Ghpendjj.exe
C:\Windows\system32\Ghpendjj.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\SysWOW64\Ifgldfio.exe
C:\Windows\system32\Ifgldfio.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\Ighhln32.exe
  C:\Windows\system32\Ighhln32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\Inbqhhfj.exe
    C:\Windows\system32\Inbqhhfj.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3004

C:\Windows\SysWOW64\Kpbfii32.exe
C:\Windows\system32\Kpbfii32.exe
1⤵
- Executes dropped EXE
PID:2744
- C:\Windows\SysWOW64\Kflnfcgg.exe
  C:\Windows\system32\Kflnfcgg.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Windows\SysWOW64\Klifnj32.exe
    C:\Windows\system32\Klifnj32.exe
    3⤵
    - Executes dropped EXE
    PID:3528

C:\Windows\SysWOW64\Kfqgab32.exe
C:\Windows\system32\Kfqgab32.exe
1⤵
- Executes dropped EXE
PID:2700
- C:\Windows\SysWOW64\Khbdikip.exe
  C:\Windows\system32\Khbdikip.exe
  2⤵
  - Executes dropped EXE
  PID:988

C:\Windows\SysWOW64\Knlleepl.exe
C:\Windows\system32\Knlleepl.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4436
- C:\Windows\SysWOW64\Kiaqcnpb.exe
  C:\Windows\system32\Kiaqcnpb.exe
  2⤵
  - Executes dropped EXE
  PID:2036

C:\Windows\SysWOW64\Lehaho32.exe
C:\Windows\system32\Lehaho32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4968
- C:\Windows\SysWOW64\Llbidimc.exe
  C:\Windows\system32\Llbidimc.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- - C:\Windows\SysWOW64\Lfhnaa32.exe
    C:\Windows\system32\Lfhnaa32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:952
  - - C:\Windows\SysWOW64\Lifjnm32.exe
      C:\Windows\system32\Lifjnm32.exe
      4⤵
      Executes dropped EXE
      PID:3980
    - - C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        5⤵
        Executes dropped EXE
        
        PID:5056
      - C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        6⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4008
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        8⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        9⤵
        Executes dropped EXE
        
        PID:788

C:\Windows\SysWOW64\Loglacfo.exe
C:\Windows\system32\Loglacfo.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:5052
- C:\Windows\SysWOW64\Lfodbqfa.exe
  C:\Windows\system32\Lfodbqfa.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- - C:\Windows\SysWOW64\Mimpolee.exe
    C:\Windows\system32\Mimpolee.exe
    3⤵
    - Executes dropped EXE
    PID:2344
  - - C:\Windows\SysWOW64\Mojhgbdl.exe
      C:\Windows\system32\Mojhgbdl.exe
      4⤵
      Executes dropped EXE
      PID:3960
    - - C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        5⤵
        Executes dropped EXE
        
        PID:896

C:\Windows\SysWOW64\Mhbmphjm.exe
C:\Windows\system32\Mhbmphjm.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4892
- C:\Windows\SysWOW64\Mpieqeko.exe
  C:\Windows\system32\Mpieqeko.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:4784

C:\Windows\SysWOW64\Mfcmmp32.exe
C:\Windows\system32\Mfcmmp32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1292
- C:\Windows\SysWOW64\Mibijk32.exe
  C:\Windows\system32\Mibijk32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:376
- - C:\Windows\SysWOW64\Mplafeil.exe
    C:\Windows\system32\Mplafeil.exe
    3⤵
    - Executes dropped EXE
    PID:460
  - - C:\Windows\SysWOW64\Mbjnbqhp.exe
      C:\Windows\system32\Mbjnbqhp.exe
      4⤵
      Executes dropped EXE
      PID:644
    - - C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3664
      - C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3888
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1664

C:\Windows\SysWOW64\Mifcejnj.exe
C:\Windows\system32\Mifcejnj.exe
1⤵
- Executes dropped EXE
PID:1688
- C:\Windows\SysWOW64\Mleoafmn.exe
  C:\Windows\system32\Mleoafmn.exe
  2⤵
  PID:4512
- - C:\Windows\SysWOW64\Mbognp32.exe
    C:\Windows\system32\Mbognp32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:2400
  - - C:\Windows\SysWOW64\Niipjj32.exe
      C:\Windows\system32\Niipjj32.exe
      4⤵
      PID:1896
    - - C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        5⤵
        
        PID:4444

C:\Windows\SysWOW64\Ngmpcn32.exe
C:\Windows\system32\Ngmpcn32.exe
1⤵
PID:936
- C:\Windows\SysWOW64\Niklpj32.exe
  C:\Windows\system32\Niklpj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5164
- - C:\Windows\SysWOW64\Nohehq32.exe
    C:\Windows\system32\Nohehq32.exe
    3⤵
    - Modifies registry class
    PID:5208

C:\Windows\SysWOW64\Nlleaeff.exe
C:\Windows\system32\Nlleaeff.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5292
- C:\Windows\SysWOW64\Ncfmno32.exe
  C:\Windows\system32\Ncfmno32.exe
  2⤵
  PID:5344
- - C:\Windows\SysWOW64\Nookip32.exe
    C:\Windows\system32\Nookip32.exe
    3⤵
    PID:5388
  - - C:\Windows\SysWOW64\Oidofh32.exe
      C:\Windows\system32\Oidofh32.exe
      4⤵
      Drops file in System32 directory
      PID:5460
    - - C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5504
      - C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        6⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        7⤵
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        10⤵
        
        PID:5720

C:\Windows\SysWOW64\Nebmekoi.exe
C:\Windows\system32\Nebmekoi.exe
1⤵
PID:5252

C:\Windows\SysWOW64\Lbjelc32.exe
C:\Windows\system32\Lbjelc32.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\SysWOW64\Ojnblg32.exe
C:\Windows\system32\Ojnblg32.exe
1⤵
PID:5760
- C:\Windows\SysWOW64\Ophjiaql.exe
  C:\Windows\system32\Ophjiaql.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:5800

C:\Windows\SysWOW64\Ploknb32.exe
C:\Windows\system32\Ploknb32.exe
1⤵
PID:5872
- C:\Windows\SysWOW64\Pgdokkfg.exe
  C:\Windows\system32\Pgdokkfg.exe
  2⤵
  - Drops file in System32 directory
  PID:5908

C:\Windows\SysWOW64\Phelcc32.exe
C:\Windows\system32\Phelcc32.exe
1⤵
PID:5944
- C:\Windows\SysWOW64\Pckppl32.exe
  C:\Windows\system32\Pckppl32.exe
  2⤵
  PID:6008
- - C:\Windows\SysWOW64\Phhhhc32.exe
    C:\Windows\system32\Phhhhc32.exe
    3⤵
    - Drops file in System32 directory
    PID:6052

C:\Windows\SysWOW64\Pcmlfl32.exe
C:\Windows\system32\Pcmlfl32.exe
1⤵
PID:6088
- C:\Windows\SysWOW64\Pjgebf32.exe
  C:\Windows\system32\Pjgebf32.exe
  2⤵
  PID:6128
- - C:\Windows\SysWOW64\Podmkm32.exe
    C:\Windows\system32\Podmkm32.exe
    3⤵
    - Drops file in System32 directory
    - Modifies registry class
    PID:1788
  - - C:\Windows\SysWOW64\Pjjahe32.exe
      C:\Windows\system32\Pjjahe32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      Modifies registry class
      PID:5196
    - - C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        5⤵
        
        PID:5280
      - C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        6⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3536
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        8⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        10⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        11⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        14⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        15⤵
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        16⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        17⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        18⤵
        
        PID:3452

C:\Windows\SysWOW64\Ajhniccb.exe
C:\Windows\system32\Ajhniccb.exe
1⤵
PID:1096
- C:\Windows\SysWOW64\Aqaffn32.exe
  C:\Windows\system32\Aqaffn32.exe
  2⤵
  PID:6016
- - C:\Windows\SysWOW64\Bgpgng32.exe
    C:\Windows\system32\Bgpgng32.exe
    3⤵
    PID:6080
  - - C:\Windows\SysWOW64\Biadeoce.exe
      C:\Windows\system32\Biadeoce.exe
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        5⤵
        
        PID:5216
      - C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        8⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        9⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2272
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        11⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        10⤵
        Modifies registry class
        
        PID:824
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6044
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        12⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        13⤵
        
        PID:3976

C:\Windows\SysWOW64\Pgbbek32.exe
C:\Windows\system32\Pgbbek32.exe
1⤵
PID:5836

C:\Windows\SysWOW64\Kpgodhkd.exe
C:\Windows\system32\Kpgodhkd.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:4080

C:\Windows\SysWOW64\Kimghn32.exe
C:\Windows\system32\Kimghn32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2652

C:\Windows\SysWOW64\Kbbokdlk.exe
C:\Windows\system32\Kbbokdlk.exe
1⤵
- Executes dropped EXE
PID:1576

C:\Windows\SysWOW64\Kihnmohm.exe
C:\Windows\system32\Kihnmohm.exe
1⤵
- Executes dropped EXE
PID:736

C:\Windows\SysWOW64\Kppici32.exe
C:\Windows\system32\Kppici32.exe
1⤵
- Executes dropped EXE
PID:2904

C:\Windows\SysWOW64\Jejefqaf.exe
C:\Windows\system32\Jejefqaf.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Windows\SysWOW64\Jnpmjf32.exe
C:\Windows\system32\Jnpmjf32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2128

C:\Windows\SysWOW64\Jicdap32.exe
C:\Windows\system32\Jicdap32.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\SysWOW64\Jbileede.exe
C:\Windows\system32\Jbileede.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4932

C:\Windows\SysWOW64\Jkodhk32.exe
C:\Windows\system32\Jkodhk32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:656

C:\Windows\SysWOW64\Jeekkafl.exe
C:\Windows\system32\Jeekkafl.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4460

C:\Windows\SysWOW64\Jnkcogno.exe
C:\Windows\system32\Jnkcogno.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\Jiokfpph.exe
C:\Windows\system32\Jiokfpph.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\Jbdbjf32.exe
C:\Windows\system32\Jbdbjf32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\Qcnjijoe.exe
  C:\Windows\system32\Qcnjijoe.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:2212
- - C:\Windows\SysWOW64\Qfmfefni.exe
    C:\Windows\system32\Qfmfefni.exe
    3⤵
    PID:3736
  - - C:\Windows\SysWOW64\Amfobp32.exe
      C:\Windows\system32\Amfobp32.exe
      4⤵
      PID:3004
    - - C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        5⤵
        
        PID:4508
      - C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6088
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        7⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5948
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        9⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012

C:\Windows\SysWOW64\Ienekbld.exe
C:\Windows\system32\Ienekbld.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\Indmnh32.exe
C:\Windows\system32\Indmnh32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248

C:\Windows\SysWOW64\Iigdfa32.exe
C:\Windows\system32\Iigdfa32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\Iomcgl32.exe
C:\Windows\system32\Iomcgl32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:728

C:\Windows\SysWOW64\Iickkbje.exe
C:\Windows\system32\Iickkbje.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\SysWOW64\Iokgal32.exe
C:\Windows\system32\Iokgal32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\Idebdcdo.exe
C:\Windows\system32\Idebdcdo.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SysWOW64\Gafmaj32.exe
C:\Windows\system32\Gafmaj32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556

C:\Windows\SysWOW64\Nijeec32.exe
C:\Windows\system32\Nijeec32.exe
1⤵
- Drops file in System32 directory
PID:4524
- C:\Windows\SysWOW64\Nliaao32.exe
  C:\Windows\system32\Nliaao32.exe
  2⤵
  PID:5188
- - C:\Windows\SysWOW64\Nognnj32.exe
    C:\Windows\system32\Nognnj32.exe
    3⤵
    - Modifies registry class
    PID:4836

C:\Windows\SysWOW64\Neafjdkn.exe
C:\Windows\system32\Neafjdkn.exe
1⤵
- Modifies registry class
PID:5364
- C:\Windows\SysWOW64\Nimbkc32.exe
  C:\Windows\system32\Nimbkc32.exe
  2⤵
  - Modifies registry class
  PID:5468

C:\Windows\SysWOW64\Nlkngo32.exe
C:\Windows\system32\Nlkngo32.exe
1⤵
- Modifies registry class
PID:1508
- C:\Windows\SysWOW64\Nojjcj32.exe
  C:\Windows\system32\Nojjcj32.exe
  2⤵
  PID:5576

C:\Windows\SysWOW64\Nahgoe32.exe
C:\Windows\system32\Nahgoe32.exe
1⤵
PID:5744
- C:\Windows\SysWOW64\Nbgcih32.exe
  C:\Windows\system32\Nbgcih32.exe
  2⤵
  - Modifies registry class
  PID:1104
- - C:\Windows\SysWOW64\Nefped32.exe
    C:\Windows\system32\Nefped32.exe
    3⤵
    PID:5248
  - - C:\Windows\SysWOW64\Oondnini.exe
      C:\Windows\system32\Oondnini.exe
      4⤵
      PID:5420
    - - C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        5⤵
        
        PID:2304
      - C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        6⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:60
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        8⤵
        
        PID:2404

C:\Windows\SysWOW64\Oldamm32.exe
C:\Windows\system32\Oldamm32.exe
1⤵
PID:5616
- C:\Windows\SysWOW64\Okgaijaj.exe
  C:\Windows\system32\Okgaijaj.exe
  2⤵
  - Drops file in System32 directory
  PID:2552
- - C:\Windows\SysWOW64\Oboijgbl.exe
    C:\Windows\system32\Oboijgbl.exe
    3⤵
    PID:4348

C:\Windows\SysWOW64\Obafpg32.exe
C:\Windows\system32\Obafpg32.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:6164
- C:\Windows\SysWOW64\Oeoblb32.exe
  C:\Windows\system32\Oeoblb32.exe
  2⤵
  PID:6220
- - C:\Windows\SysWOW64\Ohnohn32.exe
    C:\Windows\system32\Ohnohn32.exe
    3⤵
    PID:6260
  - - C:\Windows\SysWOW64\Oklkdi32.exe
      C:\Windows\system32\Oklkdi32.exe
      4⤵
      PID:6300
    - - C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        5⤵
        Modifies registry class
        
        PID:6344

C:\Windows\SysWOW64\Oimkbaed.exe
C:\Windows\system32\Oimkbaed.exe
1⤵
- Modifies registry class
PID:6388
- C:\Windows\SysWOW64\Pllgnl32.exe
  C:\Windows\system32\Pllgnl32.exe
  2⤵
  PID:6436
- - C:\Windows\SysWOW64\Pojcjh32.exe
    C:\Windows\system32\Pojcjh32.exe
    3⤵
    PID:6480
  - - C:\Windows\SysWOW64\Pedlgbkh.exe
      C:\Windows\system32\Pedlgbkh.exe
      4⤵
      PID:6524
    - - C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6656

C:\Windows\SysWOW64\Okjnnj32.exe
C:\Windows\system32\Okjnnj32.exe
1⤵
- Drops file in System32 directory
PID:5484

C:\Windows\SysWOW64\Dndnpf32.exe
C:\Windows\system32\Dndnpf32.exe
1⤵
PID:6696
- C:\Windows\SysWOW64\Ddnfmqng.exe
  C:\Windows\system32\Ddnfmqng.exe
  2⤵
  - Modifies registry class
  PID:6744

C:\Windows\SysWOW64\Dmennnni.exe
C:\Windows\system32\Dmennnni.exe
1⤵
- Modifies registry class
PID:6792
- C:\Windows\SysWOW64\Dodjjimm.exe
  C:\Windows\system32\Dodjjimm.exe
  2⤵
  PID:6832

C:\Windows\SysWOW64\Dbbffdlq.exe
C:\Windows\system32\Dbbffdlq.exe
1⤵
- Modifies registry class
PID:6876
- C:\Windows\SysWOW64\Deqcbpld.exe
  C:\Windows\system32\Deqcbpld.exe
  2⤵
  - Modifies registry class
  PID:6944
- - C:\Windows\SysWOW64\Eofgpikj.exe
    C:\Windows\system32\Eofgpikj.exe
    3⤵
    - Drops file in System32 directory
    PID:7012
  - - C:\Windows\SysWOW64\Ebdcld32.exe
      C:\Windows\system32\Ebdcld32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:7072

C:\Windows\SysWOW64\Eecphp32.exe
C:\Windows\system32\Eecphp32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:7132
- C:\Windows\SysWOW64\Emjgim32.exe
  C:\Windows\system32\Emjgim32.exe
  2⤵
  PID:3228
- - C:\Windows\SysWOW64\Enkdaepb.exe
    C:\Windows\system32\Enkdaepb.exe
    3⤵
    - Modifies registry class
    PID:6292
  - - C:\Windows\SysWOW64\Ebnfbcbc.exe
      C:\Windows\system32\Ebnfbcbc.exe
      4⤵
      PID:6368

C:\Windows\SysWOW64\Felbnn32.exe
C:\Windows\system32\Felbnn32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6448
- C:\Windows\SysWOW64\Fmcjpl32.exe
  C:\Windows\system32\Fmcjpl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:4432
- - C:\Windows\SysWOW64\Fpbflg32.exe
    C:\Windows\system32\Fpbflg32.exe
    3⤵
    PID:6640

C:\Windows\SysWOW64\Fflohaij.exe
C:\Windows\system32\Fflohaij.exe
1⤵
PID:6716
- C:\Windows\SysWOW64\Fijkdmhn.exe
  C:\Windows\system32\Fijkdmhn.exe
  2⤵
  PID:6780
- - C:\Windows\SysWOW64\Fngcmcfe.exe
    C:\Windows\system32\Fngcmcfe.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:6884
  - - C:\Windows\SysWOW64\Ffnknafg.exe
      C:\Windows\system32\Ffnknafg.exe
      4⤵
      PID:4216
    - - C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        5⤵
        Drops file in System32 directory
        
        PID:7044
      - C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6332
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        8⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        9⤵
        Drops file in System32 directory
        
        PID:1260
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        10⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3364

C:\Windows\SysWOW64\Flpmagqi.exe
C:\Windows\system32\Flpmagqi.exe
1⤵
- Drops file in System32 directory
PID:1672
- C:\Windows\SysWOW64\Fnnjmbpm.exe
  C:\Windows\system32\Fnnjmbpm.exe
  2⤵
  PID:7060
- - C:\Windows\SysWOW64\Gehbjm32.exe
    C:\Windows\system32\Gehbjm32.exe
    3⤵
    PID:6212
  - - C:\Windows\SysWOW64\Glbjggof.exe
      C:\Windows\system32\Glbjggof.exe
      4⤵
      PID:6432
    - - C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6752
      - C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        6⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        7⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        8⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        9⤵
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        10⤵
        Modifies registry class
        
        PID:6608
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        11⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        12⤵
        
        PID:3156

C:\Windows\SysWOW64\Hpiecd32.exe
C:\Windows\system32\Hpiecd32.exe
1⤵
PID:6756
- C:\Windows\SysWOW64\Hfcnpn32.exe
  C:\Windows\system32\Hfcnpn32.exe
  2⤵
  PID:6820
- - C:\Windows\SysWOW64\Hoobdp32.exe
    C:\Windows\system32\Hoobdp32.exe
    3⤵
    PID:1372

C:\Windows\SysWOW64\Hoaojp32.exe
C:\Windows\system32\Hoaojp32.exe
1⤵
PID:7184
- C:\Windows\SysWOW64\Hekgfj32.exe
  C:\Windows\system32\Hekgfj32.exe
  2⤵
  PID:7232

C:\Windows\SysWOW64\Hidgai32.exe
C:\Windows\system32\Hidgai32.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:2064

C:\Windows\SysWOW64\Ifmqfm32.exe
C:\Windows\system32\Ifmqfm32.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:7312
- C:\Windows\SysWOW64\Iepaaico.exe
  C:\Windows\system32\Iepaaico.exe
  2⤵
  PID:7360

C:\Windows\SysWOW64\Imgicgca.exe
C:\Windows\system32\Imgicgca.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:7404
- C:\Windows\SysWOW64\Iohejo32.exe
  C:\Windows\system32\Iohejo32.exe
  2⤵
  PID:7448
- - C:\Windows\SysWOW64\Iebngial.exe
    C:\Windows\system32\Iebngial.exe
    3⤵
    PID:7568
  - - C:\Windows\SysWOW64\Kcoccc32.exe
      C:\Windows\system32\Kcoccc32.exe
      4⤵
      PID:7616
    - - C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        5⤵
        
        PID:7676
      - C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        6⤵
        Modifies registry class
        
        PID:7716
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        7⤵
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        8⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7828
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7876
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        10⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        12⤵
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        13⤵
        Modifies registry class
        
        PID:8044
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        14⤵
        Drops file in System32 directory
        
        PID:8084
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8128
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        17⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        18⤵
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        19⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7260
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        20⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        21⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        22⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:860
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        24⤵
        Drops file in System32 directory
        
        PID:4488
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        25⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1808
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5880
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        27⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        28⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        29⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        30⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        31⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        32⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        33⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        34⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        35⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        36⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        38⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        39⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        41⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4440
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        43⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        44⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        45⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        46⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3960
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        48⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:460
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:492
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        51⤵
        Drops file in System32 directory
        
        PID:3200
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        52⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:884
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        54⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        55⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:472
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        57⤵
        Drops file in System32 directory
        
        PID:4092
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        58⤵
        Modifies registry class
        
        PID:852

C:\Windows\SysWOW64\Hoeieolb.exe
C:\Windows\system32\Hoeieolb.exe
1⤵
PID:7272

C:\Windows\SysWOW64\Aiplmq32.exe
C:\Windows\system32\Aiplmq32.exe
1⤵
- Drops file in System32 directory
PID:7628
- C:\Windows\SysWOW64\Aagdnn32.exe
  C:\Windows\system32\Aagdnn32.exe
  2⤵
  PID:7700

C:\Windows\SysWOW64\Adepji32.exe
C:\Windows\system32\Adepji32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7804
- C:\Windows\SysWOW64\Ajohfcpj.exe
  C:\Windows\system32\Ajohfcpj.exe
  2⤵
  PID:7896
- - C:\Windows\SysWOW64\Amnebo32.exe
    C:\Windows\system32\Amnebo32.exe
    3⤵
    - Modifies registry class
    PID:8024
  - - C:\Windows\SysWOW64\Aplaoj32.exe
      C:\Windows\system32\Aplaoj32.exe
      4⤵
      PID:8092
    - - C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        5⤵
        Modifies registry class
        
        PID:8160
      - C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        6⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        8⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        9⤵
        Modifies registry class
        
        PID:7400

C:\Windows\SysWOW64\Bboffejp.exe
C:\Windows\system32\Bboffejp.exe
1⤵
PID:4920
- C:\Windows\SysWOW64\Biiobo32.exe
  C:\Windows\system32\Biiobo32.exe
  2⤵
  PID:3764

C:\Windows\SysWOW64\Bpcgpihi.exe
C:\Windows\system32\Bpcgpihi.exe
1⤵
PID:5424
- C:\Windows\SysWOW64\Bdocph32.exe
  C:\Windows\system32\Bdocph32.exe
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\Biklho32.exe
    C:\Windows\system32\Biklho32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:4520
  - - C:\Windows\SysWOW64\Babcil32.exe
      C:\Windows\system32\Babcil32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:3252
    - - C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        5⤵
        Drops file in System32 directory
        
        PID:4572
      - C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        6⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        7⤵
        Drops file in System32 directory
        
        PID:1256

C:\Windows\SysWOW64\Bgdemb32.exe
C:\Windows\system32\Bgdemb32.exe
1⤵
- Modifies registry class
PID:5644
- C:\Windows\SysWOW64\Cibain32.exe
  C:\Windows\system32\Cibain32.exe
  2⤵
  - Modifies registry class
  PID:5736
- - C:\Windows\SysWOW64\Cmnnimak.exe
    C:\Windows\system32\Cmnnimak.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:4064

C:\Windows\SysWOW64\Cmedjl32.exe
C:\Windows\system32\Cmedjl32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5488
- C:\Windows\SysWOW64\Caqpkjcl.exe
  C:\Windows\system32\Caqpkjcl.exe
  2⤵
  PID:6276

C:\Windows\SysWOW64\Cdolgfbp.exe
C:\Windows\system32\Cdolgfbp.exe
1⤵
- Drops file in System32 directory
PID:5144
- C:\Windows\SysWOW64\Ckidcpjl.exe
  C:\Windows\system32\Ckidcpjl.exe
  2⤵
  PID:5664
- - C:\Windows\SysWOW64\Cpfmlghd.exe
    C:\Windows\system32\Cpfmlghd.exe
    3⤵
    PID:232
  - - C:\Windows\SysWOW64\Dkkaiphj.exe
      C:\Windows\system32\Dkkaiphj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:5160
    - - C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4548

C:\Windows\SysWOW64\Dcffnbee.exe
C:\Windows\system32\Dcffnbee.exe
1⤵
PID:5128
- C:\Windows\SysWOW64\Diqnjl32.exe
  C:\Windows\system32\Diqnjl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:4348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 404
    3⤵
    - Program crash
    PID:6300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4348 -ip 4348
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agbkmijg.exe

Filesize
15KB

MD5
297384f233f64f873ceb525bf624ed39

SHA1
4cb638c7dd155bf33da290cd4d0e5cee7b783d37

SHA256
c043bc20e498040802936d2a1aced42db67d113cf7c52d76a6d83e4765c66b76

SHA512
f55597b10133fc80e50260b238afc2b0607c0f8bc8699049d72e221f77980fd492a4b5450b7ac9f769664e7c0ae62b03b60ab226ed691da2407c33c3134afada

Download Submit
C:\Windows\SysWOW64\Ajjokd32.exe

Filesize
64KB

MD5
7b0fe3edcb64730828b9a3e2f72dc0aa

SHA1
84a08c00cf0dc62db5c8681b24139421e8591e5c

SHA256
da1a85a68e47cf97e5a216d8aa800b583e74274d7fe4d94d2cdfe7ddc2a15231

SHA512
2f87cb4387fdada1f2381f1beacd98af542bb25e1c89e39d2803e7d3f283ea83c1ec4620832f04a1e168468ac298da53d5f86604a2d5790f1bb6bc0daeec870c

Download Submit
C:\Windows\SysWOW64\Amcmpodi.exe

Filesize
12KB

MD5
b4ea71f41c4aeb9c795bb85b00ba6eec

SHA1
484b8b8983246675c16323c85af2364eb1f30347

SHA256
305b7e7cba860621ec820ea6325edc904a92f128605e401ca040a9353b39765a

SHA512
91b16772cf6d377ff86b7707245399fe601f43c6b0a0ab398e1d6e3ca104a6de14334c86c7406be96d09b682b113609018b12895994d12e48461d9223b87472d

Download Submit
C:\Windows\SysWOW64\Amfobp32.exe

Filesize
64KB

MD5
29bba024f67d7cd9c20d485eec5f75f3

SHA1
3ec947eb70bcfa90850eb076b53e3b04051f6c48

SHA256
a1ae3df8cc1a14d484723a81078f4776bd1b54995ea3919ec590968cb3852c00

SHA512
7056c87e75eb0b2afd101ad2ed0a810c450afa027c0f989cd8294a954b6b02e12bb41e41c4bac598338ffc908e476ac93f3c2834332c042de8ff4433de8c0e69

Download Submit
C:\Windows\SysWOW64\Bdocph32.exe

Filesize
64KB

MD5
ca72f8bf8890090136e3e7fa996f5300

SHA1
5bf60126bbc885e9958f77baf8eede2a96b4dbe8

SHA256
1fe57acae053f5bf58c2e125f4c8b644ad02e41fc08c9dd485942a1efef9eee8

SHA512
8a436431d5b0cdc8e4f4c2d64ece3241b25d9a440c7f77647d7701f9fff2bc12821f8654e24c6a9f389d90e3555789467e55baa901d7221ebd872a7e42248279

Download Submit
C:\Windows\SysWOW64\Bfhadc32.exe

Filesize
12KB

MD5
cca2140bd2bf2da22453814c5ac8fe8b

SHA1
6494183c0831b1a29e42cde2dd3386e27bc7c3ad

SHA256
4ea1963606e8dda01ad6b30d32d8575c6f2e6d238dfaf22da371fa7f48766341

SHA512
63bc4a3ce19da64677f1c83c1a7c6967758ff82e3477e9cb22c9aeb679bc1cc2176cc6073c69259609c6bbb9eab2fb9e509d482e745ea4591a80d58e4263ddd2

Download Submit
C:\Windows\SysWOW64\Biiobo32.exe

Filesize
63KB

MD5
cbcfd1ff2d3e5a212e5340952e02b2a3

SHA1
d54af8c016581f2fc2ca9fc34fca8d8be17bfb2e

SHA256
affc347e979048e0607871574d4cb22af20c8fd9023b87796c8d96e38ea36603

SHA512
4525a89e96149e041dac197ef82f6a24d249645454cdc3162df02a001fb173eb4a16c32b7096a0692f092f84ece4f5818ca48213e10558027929531e8e66de21

Download Submit
C:\Windows\SysWOW64\Bipecnkd.exe

Filesize
64KB

MD5
977cd968ef28af111279ae9bd197335d

SHA1
9fd4f9f68021ef3bd436bb623c480f2bfaf52840

SHA256
6693b9a2588c5ab238985bc6cea5407f664946d8f186a60f2a49cdfcc7119553

SHA512
9d5f26eff581cd8d7602a28a0c1963c6abd5ea95a9bec7dad6d25000d877e7c95ce079c692af76c614700e928c8f0ce2d811fad76cff6f734c8a4e324f1bae71

Download Submit
C:\Windows\SysWOW64\Boklbi32.exe

Filesize
14KB

MD5
160b1ce2afa095079e0d6ad186c4c46e

SHA1
b79c0219096463f2d9776945ffc4ca61fb2ca81e

SHA256
36a04668026385ca8d5b3e4ec69831bdb0db5997d32468ac74ab66b06e7c1efb

SHA512
ff551e7facf7849bc1b6500032e6a8beeb6476ad3ee6b36b25780982d2fedc855037e1ac84d85110f9660624e9d7552e283642ffba2f85482fb092b1652ce148

Download Submit
C:\Windows\SysWOW64\Cmnnimak.exe

Filesize
28KB

MD5
2a4f0b659a1f8f0139790149ea664193

SHA1
2ca9d6739605c2d344218a0d01a595a2761333a3

SHA256
d4141580b2640ccb4589ddb31bd034d81c4b928ff57b7ab16b2f55f3ba7d6873

SHA512
fff4dae989644bd3c51ca38135a5e580a0396fd92d92f761e55921d3eeea0249791324c07ea70a09906e58702493f1482c926e4b4b90dcb2bc00e9f9c97fc9e2

Download Submit
C:\Windows\SysWOW64\Dphiaffa.exe

Filesize
57KB

MD5
f1a26844006b19f568afcad8defcf8be

SHA1
22f4e7bbca9773dc2fdacb0bc39ba25e63f6a716

SHA256
41f1c9c1d2e89baed16a4fa06839814fd41426d9423d2a799fc80e002187f753

SHA512
19fc903755c6d86e5114b062fff7f9be682c34d215093fd053aa70d2f164cc6b9f9754287d74d567a2e123e5ff5155eb4e6ff8a1606703d39ac07f0adc33fc26

Download Submit
C:\Windows\SysWOW64\Gafmaj32.exe

Filesize
64KB

MD5
313bfb3ed07c0c17d4d7d3ad98ff2f8b

SHA1
9fa6cc36faf62ffb4328e0666454971aadd2af34

SHA256
e7c2c1af10e42a2650d730938f5f664780bd57919ffe272923a18b0fd5038ee8

SHA512
5e914e10691b45a3ff2bcbbcbb857a9b5e332a51af005b250ed0e1f2eccd2b406324ddbdac31c2f2a3920e790139bd592e4d773611637cce338a0d0d0a75e355

Download Submit
C:\Windows\SysWOW64\Gehbjm32.exe

Filesize
26KB

MD5
fcc0e37953e84f9a3b4bfe38ab1dd6a8

SHA1
74e167bdc69a08e2c7e4cecfe1a791910fcf5b2e

SHA256
3ace31163aed698402766e09ad703db5178f17f3da870d9dd69d5888f39f71ea

SHA512
f7f15a8847a6549b13926737cfa3d3ca6b78b58539d2b73b4cf66950f4780896697650430ad1e8e277440a8639752a7922a58ea66afa79ba5d6e49282f3dc345

Download Submit
C:\Windows\SysWOW64\Ggqida32.exe

Filesize
64KB

MD5
14f94c90dd36021ea397e28568733ff5

SHA1
b5a7c764a5376c56abcd42ea2b762d644b81bc5b

SHA256
59dcd0b0c5c12a4156b691f48afd6c3e4c2080257619605fc54171835d234621

SHA512
6b328c8b299e3a769eeddc0ba3b4f67a944b4d154d1d986aca76084927b4c4876667c20f609a954e3cd30b70f3d614d686f2ca803b0e17673fe3d2934335b7f6

Download Submit
C:\Windows\SysWOW64\Ghbbcd32.exe

Filesize
22KB

MD5
d031ebe79be7c62f14f1daf61fc16beb

SHA1
ff6cc80bda1b10dd2e662b7a5fc8adb547a8d61e

SHA256
7c46739857baf4e4f9e21bbddafa76bd4c07f6e788f0aaf37209b63d6d055371

SHA512
e31a15dce3f8eeb00dcd4e1bde6f1828f671e3283b0146c5815a2090ceb0db81d50c18c62067289cb88a7a3af1794fab4b56442d49bcc76ff7092a15952fe275

Download Submit
C:\Windows\SysWOW64\Ghbbcd32.exe

Filesize
219B

MD5
e8b770b0677245be0ed22b7c2d4ee9c5

SHA1
2a0d45f47dcc279ac9d69717bcae73f4394c59a1

SHA256
c7ce83cfc29b67fe077a8c5cef9699fe2ecb7a7dbf21dd8a377da5da3a0b8691

SHA512
d042d9489dc4e80b9d24df3b2d7cf761dda5b8b63ddfbe2ebfe8ffcd76bc8880b11a0522cb0bf2d6377541a9f4652f7e3d2ebcb202a4eff3fc2e2ba223e8a37f

Download Submit
C:\Windows\SysWOW64\Ghpendjj.exe

Filesize
33KB

MD5
9e48ebfe0541be60e0f5010bba20e670

SHA1
87d3b68d6888bf304d31c4c99f391299d4edf554

SHA256
223f6faaac232523a2c692e0460abe7dd8736b8a1530a71a1f80f667cc6e1d25

SHA512
4e3c7d7e6fa0ea630f860ff912c743d87ba8f7c5deb2cf4e36edb1702ab08381380c381aac1d0eebfda5a6e778eddef8706a5b944be054a623e88005c06d7662

Download Submit
C:\Windows\SysWOW64\Ghpendjj.exe

Filesize
16KB

MD5
73d8689e556384675f129b35f6cd248f

SHA1
654526ea9654de53236897a100f0b782157fd95b

SHA256
008ab90050931a82cf4ebaa7a25296518558a7b57e9a8b649abe346da4175287

SHA512
ef4f46c061e67bb077f5eea1e8a467a6eaf91bc3a90c56d4104ed60ed258845271f716d5f17f0d52c71e5394a93ba45eef8cbfb4cc9d790913864b4f99da718e

Download Submit
C:\Windows\SysWOW64\Ghpendjj.exe

Filesize
40KB

MD5
d634f5bbc9ac797b9a9612e8ef9f537c

SHA1
b04c6f724420065b0bf4857ceee9c7f262e80a39

SHA256
a620bfc606bb3e9e3a347bea52c1ab4e44881bbc56d923b5d7e1d9931dd6a1da

SHA512
189bb76482936ff4db30ac6a2364280099964166a79f2391182c39bc3ee7a1c1ab08c4629263df32da9d320df23aa7f06b1ca120c067bd6427dbd9e6f976c97e

Download Submit
C:\Windows\SysWOW64\Gnmnfkia.exe

Filesize
11KB

MD5
08e0d7e4f94a154d3724bc6c8fa36dc8

SHA1
10810d9c89cbd5b26936116ff1b647685f8634dc

SHA256
6e7e3e9288f1a2c50fc0e65b5bb5ca16b355a9d4cc0a6195bbe311844e791674

SHA512
fdbb14f67c7a997c04f0e40414c95c4bdb3f1dde241e6161064e807603f28cd765b72bd22616c9ed710b21c0359226ff8cff16a31e3be3fcc063078a355fdb0f

Download Submit
C:\Windows\SysWOW64\Gnmnfkia.exe

Filesize
16KB

MD5
24b1c7608d9f6ed166311fa609b5b613

SHA1
1f8ee94835f9d2fab2ab844bf12d37cb3af50224

SHA256
90fc580122515cbe39115872e37e2b08549cc95e521baa7aa1adb02f8c068295

SHA512
c3e46bf6b2f289bafff0dbf9c01d413e850005352aa4b69cc78373e012a7666056c64c2d52033363a09c1124d3cde5d9624b57a521fcc1ad8c84be7906a673c5

Download Submit
C:\Windows\SysWOW64\Hgjljpkm.exe

Filesize
11KB

MD5
ab33f360f8d237a091f543658b9f5cd5

SHA1
8a2406f1a1ecba2f5f5374bf661969f324920b85

SHA256
eda2a676b9854ed7a7f1e3c8197171fbbad1d2200fc176f66e7277f10e31d281

SHA512
706e34adcec60ce0982ff6a631037d63627517014192ea745827d5de45e41ba64dce48b1fe21ead348f1a75a2f48f97f20d212f470866234339314c53b8ed61a

Download Submit
C:\Windows\SysWOW64\Hgjljpkm.exe

Filesize
13KB

MD5
8b88c1a09f63dcbee1ff3c9ef997d2f0

SHA1
c100011ce0e2b1a419d0a0bb8912fdb02fea9060

SHA256
2323c23189fbf4ba3857c3a5f02208e5d6af3c5c2ed0c8fa0fef9f326b893129

SHA512
06802b3afdcaeaae5975b575e2cdc7f6e12876885edca2ea950a1a089b466c62550303f71994edb2ff5e1bb69f8cd20a4720c34e702e116bdbbc718140634bc6

Download Submit
C:\Windows\SysWOW64\Hglipp32.exe

Filesize
64KB

MD5
27f87672dc68c3f55c49b2f36af8defe

SHA1
5cac37f377b3313092e5fadd61aee8892f55eda8

SHA256
736f3608d69ceab5daf2f42a0308ed3e494eef8923b7f310f70b86181d669ff2

SHA512
bb2b0cc2d67ffbc713ff9d3584c0793dcc9a34391c453be922abc713e067303c1fae751ef93840557f6a4c40a3e41fe954cfd37c296cd28c5b5fd1faa0c30614

Download Submit
C:\Windows\SysWOW64\Idebdcdo.exe

Filesize
64KB

MD5
2c4527cb093d1fb39834ff6ebffbbfc4

SHA1
f3ba975920d93d8905bfd53fcf57128c87384c6d

SHA256
d91232e963fa1e69a9c51ac1ce4efbb32ab91d50f9f86f0e157f30d6f4379e96

SHA512
a6348f6867b84bf0227b06472d1133d798ed5e7da62badc24373daee72a5d7ad95bdca432e52757a9b5d21c1eddc561a88c1be520bb90cc3516f2eaf946757c1

Download Submit
C:\Windows\SysWOW64\Idebdcdo.exe

Filesize
3KB

MD5
f21be7f76ddffb50843de060145ee0a9

SHA1
68e9de68360900aa94b9e3b1a0e8d9dc3ce7f3ee

SHA256
0fd9d063f1a8d229a7d7c83c8efb67f7c1382b521fcf7dd1be7c7b2ebb88ac3e

SHA512
6eeab109054d329141e910b5e31ebebd75e4f837d35b86e80df9f322a9464bf0c24830e3e55fce1a0fa0f1f404daf3b21ec74f866ef6a08342ae10a10a9e6509

Download Submit
C:\Windows\SysWOW64\Ienekbld.exe

Filesize
64KB

MD5
f849f4c5261d8d076987d46ef984edba

SHA1
44f66b4c6d4ebbac6d1c331dd470db332f85de44

SHA256
cc12ee32b2678baf33680baf6305e5596ab3934286e64640fc4191c9ef07cbba

SHA512
66382ead0f8e5c77674567c1a50211b8ef914dbfa36be7862f90a3509d2197040eaaad086b9a14bdf6f518cc5755ee58a2b97a6df4ba9a93cde7fb043c54d22b

Download Submit
C:\Windows\SysWOW64\Ifgldfio.exe

Filesize
64KB

MD5
7c092a47f365c14c67126cbd810d771d

SHA1
8b130d17dba9a1b848bdca56a79025026bb5b22f

SHA256
8ad8361bf4173db7373ee285f8b165e916178b006804c1ed401d850cd44d47e4

SHA512
1aca308b31674d29418cfaae8d1bd11747c52a0b9b72d3c647e20eebf57b4b7047933a026dd3b790393bbb808c42a242cdebec2706e4fb11b847781cacbd3391

Download Submit
C:\Windows\SysWOW64\Iickkbje.exe

Filesize
64KB

MD5
aa1f5d2077eb5fdefadef6eb9d165b01

SHA1
776bc32c2198132602ef6ff4ad6309b0933304b8

SHA256
f74fbc96d8bdf33e1eed538bb23be3079ad180da9a8820283a8d2e15968944ab

SHA512
cd3d9dc8bd48ae4df38ee01dcd644e3ee99b4eda7009241bdd7a2cd509b96329be8efe566a5892e6074edaf0ad2218d2e68d4d7f70e33885620dfb4327ba977d

Download Submit
C:\Windows\SysWOW64\Iigdfa32.exe

Filesize
64KB

MD5
c137c0d9b68916c4c9052b0fa0709eab

SHA1
2537ba6b12d53ecb19911c1e9cb22440df027483

SHA256
ded8b5d5a77d76564b300e483ef0ff982ebfbb4ef0c0cc772e2819df4306bb49

SHA512
b53fb613afec218fb4cbffc16bfbbaa297abfb05805f6f9dbf9132950204755e53643cadf0b50784c69f77ce1b85404cbb933197bda2ffdabb9ce7dec3f39e80

Download Submit
C:\Windows\SysWOW64\Inbqhhfj.exe

Filesize
64KB

MD5
90ca50bf4a1d5cea876ebe2218a352c5

SHA1
5089a22ec402da496b372e87e409d41a487a5590

SHA256
dcbbf94249a39c50cf92dacd166b443df782905791c605da205d94968d2959f7

SHA512
b90a69ea449085214bf99721b2ed13408a88fcfd4d220103aa705065e4f30b3a1c681ba4a5d97bcd18da3882758cac0a4761e0b08c1c3171587938964c563a6d

Download Submit
C:\Windows\SysWOW64\Inbqhhfj.exe

Filesize
64KB

MD5
8d80a88da6cfb6a7c8ca30ac04522b09

SHA1
333e25a07f76c0104a585db887891249617afdb3

SHA256
405150d5648a2c5dc72f897d2312b8227dd1e455c1de6c2d3ac34d57ab22ba9e

SHA512
c0bf1a5d6205b9cd2736e55f67fca6a210505d31f5fb7945cf1e7dccd91a75d472de9a76adf22f5a82533ae8fafa0fdd626b1ffe13c69db9dd1af4c0403b80c9

Download Submit
C:\Windows\SysWOW64\Indmnh32.exe

Filesize
64KB

MD5
2e33f44893a04e777c6b102b68db3447

SHA1
9e7ace7b888ff8ced25ece49c9460f572edd607a

SHA256
c5bf57e1745ed9a764dafceff6d9b71e8ad2adc99268151a54445c718948eb86

SHA512
f039e595d16170e03b3c4fb318a561ef9ed12caf86b2ff49fb31ac25769d7ad1a7bc415e0a9cbc118909df6b3a2b2c5c3a360a8113b0d13c8ed86c5ca24d2c67

Download Submit
C:\Windows\SysWOW64\Iohjlmeg.exe

Filesize
64KB

MD5
4a50896d2c7385c868aa523eaf284d98

SHA1
79815a3165835db59cdec739c4ddff38e85f7137

SHA256
6ec156dde531fe72e811983a13fc5d974b15de28fea15f42fb4f1f71b5507ec3

SHA512
d5653ad996d7b63dd4d192821704c7af12a80ec0d67a635f1333a20cbf580d2dff225ac6a4934df7a5d1ee8f6f99b7bb127abd3cb4cdba9bfee12896f73080ae

Download Submit
C:\Windows\SysWOW64\Iohjlmeg.exe

Filesize
1KB

MD5
50a153d65c96cf048219ca20180775cc

SHA1
c9f8dc4e2351368c115b027b3d3f258b163cdaf6

SHA256
e62143329ce22ee67402a4a7d02d25b67895949ed024ba58e86c32412e59c38d

SHA512
fb9c338959a263da8286cae4985a0519211da9ef0e12354855b633198fc18774e68ef8b4b09f5ed617b6ed65001d38f733aac954fd8298ba6bd5e2cbcff0da0a

Download Submit
C:\Windows\SysWOW64\Iokgal32.exe

Filesize
64KB

MD5
b35a38d5bf8e7d65ea482dcbef57b69e

SHA1
973e736c557e811b911e90194a8be6877266c9ab

SHA256
761bbd7f536c8b9681c0773b0ff26ba7374b5d9931a33b3ad3074a7a01dd39b4

SHA512
b2a52f7d13d8e890983983b32a4be728d5006df49c69d7f188db14d209c17842d55322488fa02650346fce4caa6a16e170c244fd49b85f9f17f412bfd7c6929d

Download Submit
C:\Windows\SysWOW64\Iomcgl32.exe

Filesize
64KB

MD5
e7b41dc27477cb5c4ddba55a43a93743

SHA1
fbef06dd3ff1dd86091ac271a1839745e2529243

SHA256
31b7b09e8cdc63b34c6fa3836443f6ae8e862b3594536332242b6160bb1ca714

SHA512
3181e0e3c6d29d8b75c0e6e1a1f3a675dec3d115453d941a7b699befaa23e22110b76861d8dab1a35d8c9e459f6c161ba69c0c846a344f8a6494029538c29a5a

Download Submit
C:\Windows\SysWOW64\Jbdbjf32.exe

Filesize
64KB

MD5
e2acf2a0a4df1fb66b8d55514881cf95

SHA1
8a47674830a563a1224200a69d3c08576c27f696

SHA256
b609f7bf00fdfe0c9e49e1580254b281a9e30ee650c55753ae2a942098ce6d45

SHA512
21255a9a07f9790e377c6bd89a58781c6f138ea4b432ef7f83e911d3fdc895a948a14e22017b0cbac7a7092c70eccc87432dfb728595cb6b71a3a7f80b97f47f

Download Submit
C:\Windows\SysWOW64\Jbileede.exe

Filesize
64KB

MD5
e6bccc06fd8a304a4586480830185634

SHA1
16f3cd11dc83be3538822d0574a7882798c8f3ff

SHA256
879dd4300ac0507a7661ad24c64f606a7a2c4253baa4a4fd800f276d67c000af

SHA512
9b5ca4a3d993ccecf22a6dfa773475d64d09724cda189cb8966ff2d2794ee0802c55694e0945e1d330eec5d5d3681f11245d133357fc068085a3dde950841281

Download Submit
C:\Windows\SysWOW64\Jeekkafl.exe

Filesize
64KB

MD5
e854abf0339d3376fc55d8c9fff11557

SHA1
ca1d80168ec199a04ae9ae2432a6e9e229232489

SHA256
a77fe49634762e5e17e54e02be5831d5813de36a577479f04f0083c9d6623851

SHA512
cc32fdf5597cadb316e2aa488ca7f1eee831129cd7fdd600fd4e1c9117ea586a4458689b8f5eada0c8fe8e3f047c625dc6abaa0fac8d339fb2402ef78f7a587c

Download Submit
C:\Windows\SysWOW64\Jejefqaf.exe

Filesize
64KB

MD5
176133cd454086c8935a8efafaf1b64c

SHA1
886a379c5e7a782ec94d7d5447889651ff16f4fc

SHA256
b6573c9cc1793cebfda6e988041f5c8f092b54d720f87c79554825afa2c425ca

SHA512
c90ce54b8d850521714f7419c814fae6186f0622dc520a619ded99846bcaa406b2c25853299c7dfbdbcf434ddcb850518bc04a81868190a5b79aed2a7c48cd72

Download Submit
C:\Windows\SysWOW64\Jicdap32.exe

Filesize
47KB

MD5
db1c705148c54a2e0c99acd36f71fdd6

SHA1
1aa3b4eb93228248be2aa58f7f790c052ac6cf3e

SHA256
0fa414ce31e9d52b6649ed0e549d278682f9d4ec28082a18fec7967bc6842b1d

SHA512
79f4e6ae18dba5cb601593e6525958468d7f6f26026a0211c6b4accfbfd437fb62e2107f7b68b9d151f17fc28fc38144640613027f7d3a3e8b5e400dc245141f

Download Submit
C:\Windows\SysWOW64\Jiokfpph.exe

Filesize
64KB

MD5
4965c13e4c8f4796f47219bd59e877dc

SHA1
5167c2fe582948a31664735b7b87a6defcc7de1f

SHA256
525d3c1e6dfb98c9812d124530ee7675a43ca26912cad4459c59f517ae035cfa

SHA512
0715fba8bbc80e178fb4ab39db9476dbc219c5675906af30e3e9f2de64f17e5b622743d76547000c91bcc3064d3c5198d3e171756fbf2c370a155a6ad199741a

Download Submit
C:\Windows\SysWOW64\Jkodhk32.exe

Filesize
64KB

MD5
48774e1e4295d39635cf751bcbe5b7dd

SHA1
57f2645f1f2027301fbd2470aef3df7fe7b9842f

SHA256
1f0dc6dcedaa4bf3c7c483d503dc730ddab0f97d0752e795bd684f0a80748d1d

SHA512
14040c1a62ab2b806e66d594a64951cf51d6819fad4edd658efaab93977cfe540897cf22aad886fea6aab8a0aa7eb3404fa84e5573e37f97371c26ac37033674

Download Submit
C:\Windows\SysWOW64\Jnkcogno.exe

Filesize
64KB

MD5
5da25215abe58437b3ae941df2849620

SHA1
5694d3cd41834d6e36770d3031b939a7213fcea9

SHA256
da9dfee9ad701a14791ccd233ff4f41f1225a979a1c3fa8cadbd1326fdf4d8fb

SHA512
88e6beea7a1fb36ff6baa0e4fade3bccd8bca5fbbf5d57cf78396992e3702208656c9c49be1b9ca2a37fda6003f02ec7f5434920ce0a5f794a88a0e69cb58936

Download Submit
C:\Windows\SysWOW64\Jnpmjf32.exe

Filesize
52KB

MD5
4e39e1d6b7a14c998541b242e2c8a933

SHA1
efa27fb8d8e0accf07a1e2d7c97b606e945623cc

SHA256
d6b6d3e47c48f9a07d157b9ff12933e67bed80d5f6794a795b0e660d527fbf9e

SHA512
2f75192477babe9443379cc1151433d17f43fbe64fb3236a040871fa1cb4ec7604a6fa2e1a5f7f1c8ae9b811ac8780bba6bb8f5f5236cf4204e21974216939ec

Download Submit
C:\Windows\SysWOW64\Jnpmjf32.exe

Filesize
64KB

MD5
d38f1271446ae2582655e55e76cf38fc

SHA1
4f0ea44c0e5f550861c3ed7825e584a88be9dcb0

SHA256
a03b08759ff620441db3e9e2864ef2a0a3830bcfc9c671222821c24ab7684e3c

SHA512
79c1384cd33dee303b7963509b13c04b4610c5f2d26ea61c54e8205f68b78eb79adb72586640786aa2fd2d1423c0d11e4123238931870677093c8e5476ac8240

Download Submit
C:\Windows\SysWOW64\Kbbokdlk.exe

Filesize
64KB

MD5
4dc6cfcadc39250e9168ce3f4afe4d60

SHA1
60ac32bbf672e7983946d1479549bd1cb9318ac2

SHA256
e055f9d006fb0b39bed877ccfc24d026401c79d286810f8cbd032ff50aa0b737

SHA512
8115451cac733624e377c4d42aa48daca26c7cf3edd0f22cde361b8fe8485e6213503c5fd179cdff534bb2fcc9fc5eb59214d937f102ffc6fb35449a8eb9eb05

Download Submit
C:\Windows\SysWOW64\Kflnfcgg.exe

Filesize
31KB

MD5
56e658c15a685f71214bd647b87dd98f

SHA1
92d4a7f5ea366ca16e02c6ea7d26078a0553f35e

SHA256
79bef10ebde387041fe852b30970b245df5c30316e0450411fc3bf2839dbce4d

SHA512
785bce1af2f0c903bf9538f1432957c9060998aadbdc03a73f992c55627562536014d543f98036ee0c8d75a2a93c82f47ba51fe91acc92b9a94e1c99c6cb4d59

Download Submit
C:\Windows\SysWOW64\Kflnfcgg.exe

Filesize
17KB

MD5
16c30eeb3d9bbe5db5db7df884414564

SHA1
46efdcccd6129e204b22fc3d314b38f1011b0e0c

SHA256
db5df33420ed5f00607e0a67d2484e08866096c90d5cf4bed14635107d4546bd

SHA512
71d913718376edc3b3e669041cc10fb3e9d4f9410b3e70bf04eabd207633258433c3e9ff626717959f49480c89cdb5f10d567b5b0a3e835fb4494f8830e74851

Download Submit
C:\Windows\SysWOW64\Kiaqcnpb.exe

Filesize
15KB

MD5
2cbbfd25496ee24dd69c537e07cee738

SHA1
cb59d491ef7eeb7f34d99b770a00dc7d7cb50ee4

SHA256
813a440c02b4ad0037143d0840821fbd8ab1d816509c743c8d871ddbdf27045f

SHA512
a8c77cc49523534432dee2b03fdd9dcef23cb1d3d880768c9d3cdc7898bc1051c00934d390298f868f6801104e6d07871933d7e7a9fa71c072770932a5f14036

Download Submit
C:\Windows\SysWOW64\Kihnmohm.exe

Filesize
64KB

MD5
ef1a3453df80cec7f99a4e93c3e0d9bb

SHA1
3d174d02c596abfbdeb40d069af16e2fad789da2

SHA256
3d3ee1d0c01eae02a09f2248e6c6dc93ba7f5c6d172d4ba1304c49a647d3d9b1

SHA512
e48fffa8e1e3adeeb26bcbe0e34571ef1c38e742d9d03b0c08ef8d0bda52aba407e6894e6231e5d024ae0a76503f4d971ce17ea72a715c62176cda2263d35f29

Download Submit
C:\Windows\SysWOW64\Kpbfii32.exe

Filesize
52KB

MD5
2a679791133ad3dfd823bee814861640

SHA1
03abde3e66329b5b02cccb5aa31d6633459f7217

SHA256
352865201df5b94a548ef43308fad13933b518bb5b538727cf90fbd852107c79

SHA512
6ae769317571265f9163aed312c7cf69e8b27307d0e096020444d4483149ec31ba1de45c5de4f117799e3f6038651c7f20d59c2b37d98dcaffeb66a8fc53b38a

Download Submit
C:\Windows\SysWOW64\Kpbfii32.exe

Filesize
64KB

MD5
38a93bc70ca5c79e077bbd6fdd8f2095

SHA1
d870e44d2230bf32bc8bb027204ca23408fcb1f0

SHA256
cee3d9cdbe90a8d03c4dadc8b13571c06e5ac6cde04c352b551c9bf421ede97e

SHA512
b06cade2e27c1636b3879b9c4ec5b21e17b3383eda5254bb2b390b74813ec708f80f41e11a5500b1bdbf5fcbc00445c21cf082e21329b74e5accd9c8a9594e21

Download Submit
C:\Windows\SysWOW64\Kppici32.exe

Filesize
8KB

MD5
d63d9d4bbfd002ba88671338e2c656a8

SHA1
00c1c662e97250d54540de2edd3d1b7a9ad06c84

SHA256
20ee9acad8aca219f1e8942f198be754465ceda6b6cc71f02f86c868e3c76680

SHA512
774cda9145fae4e1438ed3e18cc7570917af7bd1a6e0d4a44ce8bb1d0f7e494a0b097dfb1ef6a37249032f949e15570ea476560502fc7cb94a38c754eaf8e695

Download Submit
C:\Windows\SysWOW64\Kppici32.exe

Filesize
64KB

MD5
00ec300b0bc7f5fd6b87164b3dbc9563

SHA1
58e3ca66304e9bb359c8ebd0f494004e7bca4dd0

SHA256
a12b8bcc9e744c5a42983695d92bb3caa87c4b394dd5a7f706386f3b891c8d25

SHA512
59d6558667a1c373ce03fbac15cdf3868437ff066bf8e03a6f84f8924915a98e42171e6f37fa41e7fe77804d98934c666e58897bc0c5f259f9433d73490c421f

Download Submit
C:\Windows\SysWOW64\Lfiokmkc.exe

Filesize
64KB

MD5
3cd50a55686b86fbd5490411abf80aeb

SHA1
e5f065cca8ab221c6aafae267fbfa2a9946c1ccf

SHA256
2d4c7c73c4958de72a968c613d762ad56609c2600e34a0383536365fc1df3db7

SHA512
d13442971800dec575d4456189b32822e1afd7bca19ab76df9b2b190e608af384e06c869c217f41d7de98b504cd20f5a52fcfcb2a84c26f052dc602ac56b4546

Download Submit
C:\Windows\SysWOW64\Mhbmphjm.exe

Filesize
32KB

MD5
1aeab4756c0b4a5beaf52fcceee772e3

SHA1
5cc1c31c354fe1c0663c429c886c6a7cd1484e60

SHA256
261c2630aaff09e5afb74d93dd1d8df7d80f031d41954b1419feea144e72a3ba

SHA512
80eba7ee15a4bd6c524ca834fb53a4a65f9e4569c9fa5b27f0d7f84144642cfd314dfa770c8f76df45763799f8aa7650c38e943f40b903141ab0481c09d7f50d

Download Submit
C:\Windows\SysWOW64\Nbgcih32.exe

Filesize
10KB

MD5
635a9afec9e147bfa02d4ae066c8936c

SHA1
4fc11f816e165fb00bd34b05f983d1e7a05aec3a

SHA256
d245e1f9f6df5a6aa3336bf9265fdc367963fb4127c704d1b24a25e6135753d0

SHA512
0c77392d1647cbf5c2313f5632e45d028c46a817671d3ebe64833e708cf98898fa841079b67583fba1874fb402c39d09f8db3a520d4a038f81a7860968443df1

Download Submit
C:\Windows\SysWOW64\Nijeec32.exe

Filesize
14KB

MD5
b112e89bbbf07dcad8d3226b33468b1d

SHA1
e3e635b21041c2bc9f683a74557bce3912a8d535

SHA256
40ca564e0e67b9ed310c11846238b5adb49ad542b98e7c4c1072595da65e73ec

SHA512
138b304b0c363ff1d6c241b60bfd6a0d3a4e9cb6b027c6961e1a7bd714e3c3316d340f9c9484cd2ff6e69dc06cd012f8f7c55ac00152e1ad47f8706af066e949

Download Submit
C:\Windows\SysWOW64\Nqoloc32.exe

Filesize
64KB

MD5
9f23b544d9d3b56eace3c81888a04dd2

SHA1
5ae280ea469a0ab002b78b8dff677b1340cd1ee5

SHA256
7a7620817674fe47b24122837b0fde277df92cea3c85e63a4ccad6b4d37fd678

SHA512
b033b782e81e4e5ea387f3ae1f80f5e53c1c8a7d4588cd9e5150ddc8eceb5b0d91e8d64b2c70289b79f6b9eaa8fff05ccf7df121101fc20a58ff1b75d08ceccb

Download Submit
C:\Windows\SysWOW64\Oboijgbl.exe

Filesize
12KB

MD5
95b4e216c2dff430da4b83e309ff0a15

SHA1
a8e0b4be59a1b6bb69465d211f679102108c13b2

SHA256
96e1a6bc337f9a2c16bde067fbe797b24c15933c322e25dd941b23657d05fd1d

SHA512
c7752b4b7b948c48763ae5ac376b34f1576721aa224f846018984ce125c9d565179614634fd3aa72d00ad8474ad094b5037b20a5aa70fde9c44cec8ee98166f0

Download Submit
C:\Windows\SysWOW64\Oifeab32.exe

Filesize
8KB

MD5
70039013f2374f536d30cae0cc05b7bc

SHA1
1567e21d4a42f04bcab4be267285f674d7d033aa

SHA256
3f91a7ef49e58b136580c2acc341e6c95d3902914910cd6f04611c8c9e571e71

SHA512
4a836ce700e107538e00f5da85792c40ed0024acc8c7618c2cf9f18071cf0c1ca62a03e51e0283c3d1abaea3583ca7d3315224d50f4ccfd5a440288f4ba74080

Download Submit
C:\Windows\SysWOW64\Ojnblg32.exe

Filesize
32KB

MD5
0b03c7aea6709793456ebd176e3077d7

SHA1
7889aa6d4549e5726168ab53910fb8c0d135cc20

SHA256
c022f3de7c550b87010e40f95c200064baabb853a971cdbcf3e0d42223884d2a

SHA512
0b93cde2db591f73a1b26204beaf3f7712cba483c43c6fc569a07074fcc1111f30c2b1be1e42d105c0535e95b3486ddbdec09d8e0fdcbe1edc2907f5509cfc69

Download Submit
C:\Windows\SysWOW64\Pojcjh32.exe

Filesize
1KB

MD5
723edc3755192e741ec3e4bf54b29b42

SHA1
902cfffab5c24e5e793280d65cf6b63911532bc3

SHA256
62856c224047e24708aceccc609b638bfcb0c061f5d051d6be9e8eae16ef6ea3

SHA512
c0874c0ca8eb53ee1aba87c485d94c7d453ea70a594b4ee2ca77b756ff3bc27bc117cad81f576d36c3dfc112edbee014ac6b0e4ecf9b26f458875afa636f90d5

Download Submit
C:\Windows\SysWOW64\Qamago32.exe

Filesize
64KB

MD5
c05331814925bdd61a479a1b8cf658b2

SHA1
2e5deea03bd8f0002dcc3d9d7f1c87c7a9211c3e

SHA256
cb6d6502bab53c5225bfff031ec85dbba6502168753a7400e912ff6da3c2c871

SHA512
16973d9ee97443387bb98f0c88af17c9e81448b6e9f139375192d42fae8862437c3e2a11b77f87c7969c6b68fb4a7bada70338974257620f37c4b5837ea0a50d

Download Submit
memory/352-63-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/352-151-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/656-196-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/656-281-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/728-187-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/728-99-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/736-249-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/736-321-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/852-248-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/852-162-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/884-170-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/884-81-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/988-308-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1576-282-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1724-112-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1984-235-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2036-326-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2100-256-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2100-171-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2128-227-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2256-295-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2256-214-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2300-178-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2300-93-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2316-160-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2316-72-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2652-289-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2700-302-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2744-258-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2792-143-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2792-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2904-314-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2904-240-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3004-130-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3040-125-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3040-39-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3068-267-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3116-153-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3116-239-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3248-230-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3248-147-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3528-275-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4024-204-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4024-116-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4080-296-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4092-180-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4092-266-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4312-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4312-80-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4436-315-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4460-193-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4516-89-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4516-8-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4556-97-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4556-16-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4792-115-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4792-31-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4932-206-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4932-288-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5000-134-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5000-48-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5080-139-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5104-107-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5104-23-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads